Edit tour

Windows Analysis Report
563299efce875400a8d9b44b96597c8e-sample (1).zip

Overview

General Information

Sample name:	563299efce875400a8d9b44b96597c8e-sample (1).zip
Analysis ID:	1524026
MD5:	8625e1f9e8548342a4f9f1641a1ae4eb
SHA1:	3b602c272347d14cc91e07bf0dae686d768d7965
SHA256:	11fe7a13ad470ff3c39423f1ebb5b7abff8cf8a656d2ac97c0183d680d07687c
Infos:

Detection

Score:	72
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Submitted sample is a known malware sample

Creates an undocumented autostart registry key

Creates multiple autostart registry keys

Drops PE files with a suspicious file extension

Drops executables to the windows directory (C:\Windows) and starts them

Queries Google from non browser process on port 80

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Uses cmd line tools excessively to alter registry or file data

Writes many files with high entropy

Contains functionality to call native functions

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to check if a debugger is running (OutputDebugString,GetLastError)

Contains functionality to check if a window is minimized (may be used to check if an application is visible)

Contains functionality to create guard pages, often used to hinder reverse engineering and debugging

Contains functionality to dynamically determine API calls

Contains functionality to open a port and listen for incoming connection (possibly a backdoor)

Contains functionality to query CPU information (cpuid)

Contains functionality to query locales information (e.g. system language)

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Creates or modifies windows services

Detected potential crypto function

Drops PE files

Drops PE files to the windows directory (C:\Windows)

Drops files with a non-matching file extension (content does not match file extension)

Extensive use of GetProcAddress (often used to hide API calls)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found dropped PE file which has not been started or loaded

Found evasive API chain (date check)

Found evasive API chain (may stop execution after checking a module file name)

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

Launches processes in debugging mode, may be used to hinder debugging

May infect USB drives

May sleep (evasive loops) to hinder dynamic analysis

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

Potential browser exploit detected (process start blacklist hit)

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries sensitive Operating System Information (via WMI, Win32_ComputerSystem, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sigma detected: Common Autorun Keys Modification

Sigma detected: CurrentVersion Autorun Keys Modification

Sigma detected: Direct Autorun Keys Modification

Sigma detected: Potential Persistence Attempt Via Run Keys Using Reg.EXE

Sigma detected: Suspicious Screensaver Binary File Creation

Sigma detected: Use Short Name Path in Command Line

Sleep loop found (likely to delay execution)

Stores files to the Windows start menu directory

Suricata IDS alerts with low severity for network traffic

Too many similar processes found

Uses Microsoft's Enhanced Cryptographic Provider

Uses code obfuscation techniques (call, push, ret)

Uses reg.exe to modify the Windows registry

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Classification

Process Tree

System is w10x64_ra

rundll32.exe (PID: 6652 cmdline: C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding MD5: EF3179D498793BF4234F708D3BE28633)

1a4e5ccd35a56d84281a143f831563be.exe (PID: 6472 cmdline: "C:\Users\user\Desktop\1a4e5ccd35a56d84281a143f831563be.exe" MD5: 1A4E5CCD35A56D84281A143F831563BE)

1a4e5ccd35a56d84281a143f831563be.exe (PID: 7100 cmdline: "C:\Users\user\Desktop\1a4e5ccd35a56d84281a143f831563be.exe" MD5: 1A4E5CCD35A56D84281A143F831563BE)

setuppicasa39-setup.exe (PID: 6028 cmdline: setuppicasa39-setup.exe MD5: 3DF3D3C125D3BB1A5BD55E88F9E48920)

GPhotos.scr (PID: 5508 cmdline: "C:\Windows\system32\GPhotos.scr" /c /installcheck MD5: 404C6C3C3A59784456DA52660F86C52B)

Picasa3.exe (PID: 3668 cmdline: "C:\Program Files (x86)\Google\Picasa3\Picasa3.exe" /register MD5: 6AD50A491F52B1CBECE23B603037FBDF)

listicka.exe (PID: 4416 cmdline: listicka.exe /S MD5: B29BFD8EE3A426894B4CA3753E5B62A8)

sznsetup-lt.exe (PID: 2412 cmdline: "C:\Users\user\AppData\Roaming\Seznam.cz\sznsetup-lt.exe" -T "C:\Users\user\AppData\Roaming\Seznam.cz" -R "$\install" http://download.seznam.cz/update MD5: 9033DBEE427815F396F63928C3273862)

conhost.exe (PID: 2932 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

sznsetup-lt.exe (PID: 7028 cmdline: "C:\Users\user\AppData\Roaming\Seznam.cz\sznsetup-lt.exe" -T "C:\Users\user\AppData\Roaming\Seznam.cz" -i cz.seznam.software.szninstall MD5: 9033DBEE427815F396F63928C3273862)

conhost.exe (PID: 5744 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

UNZIP.EXE (PID: 6816 cmdline: C:\Users\user\AppData\Local\Temp\~0069FB97.00001B74.sznpkg\unzip.exe -d C:\Users\user\AppData\Local\Temp\~006A18C4.00001B74.sznpkg -o C:\Users\user\AppData\Local\Temp\~0069FB97.00001B74.sznpkg\download\cz.seznam.software.sznsetup-1.2.7-win32.zip MD5: 3FC25896B5B2FB8E20F28FAB8C0E1143)

cmd.exe (PID: 1108 cmdline: cmd /S /C "install.bat C:\Users\user\AppData\Roaming\Seznam.cz" MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

UNZIP.EXE (PID: 5988 cmdline: C:\Users\user\AppData\Local\Temp\~0069FB97.00001B74.sznpkg\unzip.exe -d C:\Users\user\AppData\Local\Temp\~006A1AF6.00001B74.sznpkg -o C:\Users\user\AppData\Local\Temp\~0069FB97.00001B74.sznpkg\download\cz.seznam.software.szninstall-1.1.15-win32.zip MD5: 3FC25896B5B2FB8E20F28FAB8C0E1143)

cmd.exe (PID: 6416 cmdline: cmd /S /C "install.bat C:\Users\user\AppData\Roaming\Seznam.cz" MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

REG.EXE (PID: 2576 cmdline: REG DELETE "HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall\SeznamInstall" /f /va MD5: F0C0D05727A4E1E91F4347C2270500AA)

REG.EXE (PID: 3224 cmdline: REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall\SeznamInstall" /f MD5: F0C0D05727A4E1E91F4347C2270500AA)

REG.EXE (PID: 4796 cmdline: REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall\SeznamInstall" /f /v "InstallLocation" /d C:\Users\user\AppData\Roaming\Seznam.cz MD5: F0C0D05727A4E1E91F4347C2270500AA)

REG.EXE (PID: 2980 cmdline: REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall\SeznamInstall" /f /v "DisplayName" /d "Seznam Software" MD5: F0C0D05727A4E1E91F4347C2270500AA)

REG.EXE (PID: 5428 cmdline: REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall\SeznamInstall" /f /v "DisplayIcon" /d "C:\Users\user\AppData\Roaming\Seznam.cz\szninstall.exe,0" MD5: F0C0D05727A4E1E91F4347C2270500AA)

REG.EXE (PID: 5920 cmdline: REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall\SeznamInstall" /f /v "UninstallString" /d "\"C:\Users\user\AppData\Roaming\Seznam.cz\szninstall.exe\" -X" MD5: F0C0D05727A4E1E91F4347C2270500AA)

REG.EXE (PID: 3688 cmdline: REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall\SeznamInstall" /f /v "ModifyPath" /d "C:\Users\user\AppData\Roaming\Seznam.cz\szninstall.exe" MD5: F0C0D05727A4E1E91F4347C2270500AA)

REG.EXE (PID: 2604 cmdline: REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall\SeznamInstall" /f /v "Publisher" /d "Seznam.cz" MD5: F0C0D05727A4E1E91F4347C2270500AA)

REG.EXE (PID: 4372 cmdline: REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall\SeznamInstall" /f /v "URLInfoAbout" /d "http://software.seznam.cz" MD5: F0C0D05727A4E1E91F4347C2270500AA)

REG.EXE (PID: 4796 cmdline: REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall\SeznamInstall" /f /v "HelpLink" /d "http://napoveda.seznam.cz/cz/software.html" MD5: F0C0D05727A4E1E91F4347C2270500AA)

REG.EXE (PID: 3408 cmdline: REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall\SeznamInstall" /f /v "Comments" /d "Vsechny aplikace spolecnosti Seznam.cz a.s." MD5: F0C0D05727A4E1E91F4347C2270500AA)

REG.EXE (PID: 6044 cmdline: REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall\SeznamInstall" /f /v "NoRepair" /t REG_DWORD /d 1 MD5: F0C0D05727A4E1E91F4347C2270500AA)

REG.EXE (PID: 4112 cmdline: REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall\SeznamInstall" /f /v "NoModify" /t REG_DWORD /d 0 MD5: F0C0D05727A4E1E91F4347C2270500AA)

szninstall.exe (PID: 5736 cmdline: "C:\Users\user\AppData\Roaming\Seznam.cz\szninstall.exe" -s -u -i cz.seznam.software.autoupdate szn-software-listicka MD5: C73E94B86ED9B6BDFF199BB7E8BF9D77)

sznsetup.exe (PID: 3940 cmdline: C:\Users\user\AppData\Roaming\Seznam.cz\sznsetup.exe -V MD5: D0F5D99C74D568EB9909C7582A775DC7)

conhost.exe (PID: 4132 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

sznsetup.exe (PID: 3540 cmdline: C:\Users\user\AppData\Roaming\Seznam.cz\sznsetup.exe -T C:\Users\user\AppData\Roaming\Seznam.cz -i -u cz.seznam.software.autoupdate szn-software-listicka -p MD5: D0F5D99C74D568EB9909C7582A775DC7)

conhost.exe (PID: 5232 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

UNZIP.EXE (PID: 2332 cmdline: C:\Users\user\AppData\Local\Temp\~006A2DE2.00000DD4.sznpkg\unzip.exe -d C:\Users\user\AppData\Local\Temp\~006A81A0.00000DD4.sznpkg -o C:\Users\user\AppData\Roaming\Seznam.cz\install\cz.seznam.software.autoupdate-1.0.8-win32.zip MD5: 3FC25896B5B2FB8E20F28FAB8C0E1143)

conhost.exe (PID: 2084 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cmd.exe (PID: 4956 cmdline: cmd /S /C "install.bat C:\Users\user\AppData\Roaming\Seznam.cz" MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 2188 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

REG.EXE (PID: 7404 cmdline: REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "cz.seznam.software.autoupdate" /d "\"C:\Users\user\AppData\Roaming\Seznam.cz\szninstall.exe\" -c" MD5: F0C0D05727A4E1E91F4347C2270500AA)

UNZIP.EXE (PID: 7348 cmdline: C:\Users\user\AppData\Local\Temp\~006A2DE2.00000DD4.sznpkg\unzip.exe -d C:\Users\user\AppData\Local\Temp\~006A8374.00000DD4.sznpkg -o C:\Users\user\AppData\Roaming\Seznam.cz\install\szn-software-base-1.0.0-win32.zip MD5: 3FC25896B5B2FB8E20F28FAB8C0E1143)

conhost.exe (PID: 7384 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cmd.exe (PID: 7420 cmdline: cmd /S /C "install.bat C:\Users\user\AppData\Roaming\Seznam.cz" MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 7452 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

UNZIP.EXE (PID: 7180 cmdline: C:\Users\user\AppData\Local\Temp\~006A2DE2.00000DD4.sznpkg\unzip.exe -d C:\Users\user\AppData\Local\Temp\~006A848E.00000DD4.sznpkg -o C:\Users\user\AppData\Roaming\Seznam.cz\install\com.microsoft.msdn.msvcr110-11.0.51106.1-win32.zip MD5: 3FC25896B5B2FB8E20F28FAB8C0E1143)

conhost.exe (PID: 6464 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cmd.exe (PID: 932 cmdline: cmd /S /C "install.bat C:\Users\user\AppData\Roaming\Seznam.cz" MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 304 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

CPY.EXE (PID: 4052 cmdline: cpy msvcp110.dll "C:\Users\user\AppData\Roaming\Seznam.cz\bin" MD5: 68F44C9CCFF3A00B357BD2006F536AA1)

CPY.EXE (PID: 7588 cmdline: cpy msvcr110.dll "C:\Users\user\AppData\Roaming\Seznam.cz\bin" MD5: 68F44C9CCFF3A00B357BD2006F536AA1)

UNZIP.EXE (PID: 72 cmdline: C:\Users\user\AppData\Local\Temp\~006A2DE2.00000DD4.sznpkg\unzip.exe -d C:\Users\user\AppData\Local\Temp\~006A8960.00000DD4.sznpkg -o C:\Users\user\AppData\Local\Temp\~006A2DE2.00000DD4.sznpkg\download\cz.seznam.software.lightspeed-1210-12.10.18-win32.zip MD5: 3FC25896B5B2FB8E20F28FAB8C0E1143)

conhost.exe (PID: 4184 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cmd.exe (PID: 6292 cmdline: cmd /S /C "install.bat C:\Users\user\AppData\Roaming\Seznam.cz" MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 3616 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

CPY.EXE (PID: 3908 cmdline: cpy lightspeed.dll "C:\Users\user\AppData\Roaming\Seznam.cz\bin" MD5: 68F44C9CCFF3A00B357BD2006F536AA1)

UNZIP.EXE (PID: 5476 cmdline: C:\Users\user\AppData\Local\Temp\~006A2DE2.00000DD4.sznpkg\unzip.exe -d C:\Users\user\AppData\Local\Temp\~006A8B64.00000DD4.sznpkg -o C:\Users\user\AppData\Local\Temp\~006A2DE2.00000DD4.sznpkg\download\cz.seznam.software.libszndesktop-2.1.35-win32.zip MD5: 3FC25896B5B2FB8E20F28FAB8C0E1143)

conhost.exe (PID: 3916 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cmd.exe (PID: 2136 cmdline: cmd /S /C "install.bat C:\Users\user\AppData\Roaming\Seznam.cz" MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 2080 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

CPY.EXE (PID: 7704 cmdline: cpy "szndesktop.exe" "C:\Users\user\AppData\Roaming\Seznam.cz\bin" MD5: 68F44C9CCFF3A00B357BD2006F536AA1)

CPY.EXE (PID: 7700 cmdline: cpy "szndesktop.conf" "C:\Users\user\AppData\Roaming\Seznam.cz\conf" MD5: 68F44C9CCFF3A00B357BD2006F536AA1)

CPY.EXE (PID: 7772 cmdline: cpy "szndesktop.webpak" "C:\Users\user\AppData\Roaming\Seznam.cz\data" MD5: 68F44C9CCFF3A00B357BD2006F536AA1)

CPY.EXE (PID: 7776 cmdline: cpy "sznpp.exe" "C:\Users\user\AppData\Roaming\Seznam.cz\bin" MD5: 68F44C9CCFF3A00B357BD2006F536AA1)

REG.EXE (PID: 7788 cmdline: reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall\SeznamInstall" /v DisplayVersion /t REG_SZ /d "2.1.35" /f MD5: F0C0D05727A4E1E91F4347C2270500AA)

UNZIP.EXE (PID: 7804 cmdline: C:\Users\user\AppData\Local\Temp\~006A2DE2.00000DD4.sznpkg\unzip.exe -d C:\Users\user\AppData\Local\Temp\~006A9140.00000DD4.sznpkg -o C:\Users\user\AppData\Local\Temp\~006A2DE2.00000DD4.sznpkg\download\cz.seznam.software.szndesktop-2.0.32-win32.zip MD5: 3FC25896B5B2FB8E20F28FAB8C0E1143)

conhost.exe (PID: 7844 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cmd.exe (PID: 7856 cmdline: cmd /S /C "install.bat C:\Users\user\AppData\Roaming\Seznam.cz" MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 7872 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

CPY.EXE (PID: 704 cmdline: cpy "wszndesktop.exe" "C:\Users\user\AppData\Roaming\Seznam.cz\bin" MD5: 68F44C9CCFF3A00B357BD2006F536AA1)

REG.EXE (PID: 6764 cmdline: REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "cz.seznam.software.szndesktop" /d "\"C:\Users\user\AppData\Roaming\Seznam.cz\bin\wszndesktop.exe\" -q" MD5: F0C0D05727A4E1E91F4347C2270500AA)

UNZIP.EXE (PID: 4244 cmdline: C:\Users\user\AppData\Local\Temp\~006A2DE2.00000DD4.sznpkg\unzip.exe -d C:\Users\user\AppData\Local\Temp\~006A93FF.00000DD4.sznpkg -o C:\Users\user\AppData\Local\Temp\~006A2DE2.00000DD4.sznpkg\download\cz.seznam.software.libfoxcub-3.3.8-win32.zip MD5: 3FC25896B5B2FB8E20F28FAB8C0E1143)

conhost.exe (PID: 4020 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cmd.exe (PID: 424 cmdline: cmd /S /C "install.bat C:\Users\user\AppData\Roaming\Seznam.cz" MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 6608 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

CPY.EXE (PID: 2416 cmdline: cpy libfoxcub.dll "C:\Users\user\AppData\Roaming\Seznam.cz\bin" MD5: 68F44C9CCFF3A00B357BD2006F536AA1)

CPY.EXE (PID: 2476 cmdline: cpy libfoxcub-x64.dll "C:\Users\user\AppData\Roaming\Seznam.cz\bin" MD5: 68F44C9CCFF3A00B357BD2006F536AA1)

CPY.EXE (PID: 3852 cmdline: cpy libfoxcub.conf "C:\Users\user\AppData\Roaming\Seznam.cz\conf\szndesktop.d" MD5: 68F44C9CCFF3A00B357BD2006F536AA1)

CPY.EXE (PID: 2960 cmdline: cpy foxcub.conf "C:\Users\user\AppData\Roaming\Seznam.cz\conf\libfoxcub" MD5: 68F44C9CCFF3A00B357BD2006F536AA1)

CPY.EXE (PID: 2816 cmdline: cpy remote.conf "C:\Users\user\AppData\Roaming\Seznam.cz\conf\libfoxcub" MD5: 68F44C9CCFF3A00B357BD2006F536AA1)

CPY.EXE (PID: 3456 cmdline: cpy listickaconfig.webpak "C:\Users\user\AppData\Roaming\Seznam.cz\data" MD5: 68F44C9CCFF3A00B357BD2006F536AA1)

CPY.EXE (PID: 5076 cmdline: cpy listickanastaveni.webpak "C:\Users\user\AppData\Roaming\Seznam.cz\data" MD5: 68F44C9CCFF3A00B357BD2006F536AA1)

CPY.EXE (PID: 1428 cmdline: cpy speeddial.webpak "C:\Users\user\AppData\Roaming\Seznam.cz\data" MD5: 68F44C9CCFF3A00B357BD2006F536AA1)

rundll32.exe (PID: 2084 cmdline: rundll32.exe libfoxcub.dll,UpgradeListicka MD5: 889B99C52A60DD49227C5E485A016679)

REG.EXE (PID: 2876 cmdline: REG QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\szn-software-listicka" /v "UninstallString" MD5: F0C0D05727A4E1E91F4347C2270500AA)

REG.EXE (PID: 6992 cmdline: REG QUERY "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\szn-software-listicka" /v "UninstallString" MD5: F0C0D05727A4E1E91F4347C2270500AA)

REG.EXE (PID: 2188 cmdline: REG DELETE "HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Explorer Bars\{EA837F48-5AD1-443E-AE34-FFE03CBF3099}" /F MD5: F0C0D05727A4E1E91F4347C2270500AA)

sznpp.exe (PID: 7340 cmdline: "C:\Users\user\AppData\Roaming\Seznam.cz\bin\sznpp.exe" -v report-ielisticka-install --status=0 MD5: 62DF7B2F443CBB0284CB7959AD2228C1)

UNZIP.EXE (PID: 7328 cmdline: C:\Users\user\AppData\Local\Temp\~006A2DE2.00000DD4.sznpkg\unzip.exe -d C:\Users\user\AppData\Local\Temp\~006AA61F.00000DD4.sznpkg -o C:\Users\user\AppData\Roaming\Seznam.cz\install\cz.seznam.software.libfoxloader-3.2.7-win32.zip MD5: 3FC25896B5B2FB8E20F28FAB8C0E1143)

conhost.exe (PID: 7324 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cmd.exe (PID: 1864 cmdline: cmd /S /C "install.bat C:\Users\user\AppData\Roaming\Seznam.cz" MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 7460 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

UNZIP.EXE (PID: 4584 cmdline: C:\Users\user\AppData\Local\Temp\~006A2DE2.00000DD4.sznpkg\unzip.exe -d C:\Users\user\AppData\Local\Temp\~006AA7B6.00000DD4.sznpkg -o C:\Users\user\AppData\Local\Temp\~006A2DE2.00000DD4.sznpkg\download\cz.seznam.software.libfoxcub64-3.3.8-win32.zip MD5: 3FC25896B5B2FB8E20F28FAB8C0E1143)

conhost.exe (PID: 3640 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cmd.exe (PID: 6496 cmdline: cmd /S /C "install.bat C:\Users\user\AppData\Roaming\Seznam.cz" MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 5488 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

CPY.EXE (PID: 6484 cmdline: cpy libfoxcub-x64.dll "C:\Users\user\AppData\Roaming\Seznam.cz\bin" MD5: 68F44C9CCFF3A00B357BD2006F536AA1)

CPY.EXE (PID: 5156 cmdline: cpy listicka-x64.exe "C:\Users\user\AppData\Roaming\Seznam.cz\bin" MD5: 68F44C9CCFF3A00B357BD2006F536AA1)

szndesktop.exe (PID: 4888 cmdline: szndesktop.exe default restart MD5: DAC25BB758D6C17C5A8D64CF63702B4E)

szndesktop.exe (PID: 1000 cmdline: szndesktop.exe default restart MD5: DAC25BB758D6C17C5A8D64CF63702B4E)

listicka-x64.exe (PID: 5504 cmdline: "C:\Users\user\AppData\Roaming\Seznam.cz\bin\listicka-x64.exe" MD5: D893A7276D60FD252EAFFE6E91AAC434)

conhost.exe (PID: 5292 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

sznpp.exe (PID: 7156 cmdline: "C:\Users\user\AppData\Roaming\Seznam.cz\bin\sznpp.exe" report-startup MD5: 62DF7B2F443CBB0284CB7959AD2228C1)

UNZIP.EXE (PID: 7584 cmdline: C:\Users\user\AppData\Local\Temp\~006A2DE2.00000DD4.sznpkg\unzip.exe -d C:\Users\user\AppData\Local\Temp\~006AB17A.00000DD4.sznpkg -o C:\Users\user\AppData\Local\Temp\~006A2DE2.00000DD4.sznpkg\download\cz.seznam.software.ielisticka3-3.3.5-win32.zip MD5: 3FC25896B5B2FB8E20F28FAB8C0E1143)

conhost.exe (PID: 7180 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cmd.exe (PID: 6712 cmdline: cmd /S /C "install.bat C:\Users\user\AppData\Roaming\Seznam.cz" MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 4184 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

UNZIP.EXE (PID: 7672 cmdline: C:\Users\user\AppData\Local\Temp\~006A2DE2.00000DD4.sznpkg\unzip.exe -d C:\Users\user\AppData\Local\Temp\~006AB2D1.00000DD4.sznpkg -o C:\Users\user\AppData\Local\Temp\~006A2DE2.00000DD4.sznpkg\download\szn-software-fflisticka-4.0.8-win32.zip MD5: 3FC25896B5B2FB8E20F28FAB8C0E1143)

conhost.exe (PID: 7628 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cmd.exe (PID: 5860 cmdline: cmd /S /C "install.bat C:\Users\user\AppData\Roaming\Seznam.cz" MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 2972 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

sznpp.exe (PID: 6508 cmdline: "C:\Users\user\AppData\Roaming\Seznam.cz\bin\sznpp.exe" install_ff "C:\Users\user\AppData\Roaming\Seznam.cz\data\fflisticka\seznam_doplnek_email-4.4.1-fx.xpi" MD5: 62DF7B2F443CBB0284CB7959AD2228C1)

sznpp.exe (PID: 4692 cmdline: "C:\Users\user\AppData\Roaming\Seznam.cz\bin\sznpp.exe" install_ff "C:\Users\user\AppData\Roaming\Seznam.cz\data\fflisticka\sko-extension@firma.seznam.cz.xpi" MD5: 62DF7B2F443CBB0284CB7959AD2228C1)

sznpp.exe (PID: 7720 cmdline: "C:\Users\user\AppData\Roaming\Seznam.cz\bin\sznpp.exe" install-firefox-nm MD5: 62DF7B2F443CBB0284CB7959AD2228C1)

UNZIP.EXE (PID: 3984 cmdline: C:\Users\user\AppData\Local\Temp\~006A2DE2.00000DD4.sznpkg\unzip.exe -d C:\Users\user\AppData\Local\Temp\~006AC669.00000DD4.sznpkg -o C:\Users\user\AppData\Roaming\Seznam.cz\install\cz.seznam.software.chromelisticka-2.0.4-win32.zip MD5: 3FC25896B5B2FB8E20F28FAB8C0E1143)

conhost.exe (PID: 7692 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cmd.exe (PID: 7744 cmdline: cmd /S /C "install.bat C:\Users\user\AppData\Roaming\Seznam.cz" MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 7776 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

sznpp.exe (PID: 7480 cmdline: "C:\Users\user\AppData\Roaming\Seznam.cz\bin\sznpp.exe" install-chrome all MD5: 62DF7B2F443CBB0284CB7959AD2228C1)

sznpp_64.exe (PID: 7824 cmdline: "C:\Users\user\AppData\Roaming\Seznam.cz\bin\sznpp.exe" install-chrome all MD5: B601F631582DD8D062C306CEB3B7500B)

sznpp.exe (PID: 6776 cmdline: "C:\Users\user\AppData\Roaming\Seznam.cz\bin\sznpp.exe" install-chrome-nm MD5: 62DF7B2F443CBB0284CB7959AD2228C1)

UNZIP.EXE (PID: 6544 cmdline: C:\Users\user\AppData\Local\Temp\~006A2DE2.00000DD4.sznpkg\unzip.exe -d C:\Users\user\AppData\Local\Temp\~006AD463.00000DD4.sznpkg -o C:\Users\user\AppData\Roaming\Seznam.cz\install\com.microsoft.msdn.msvcr100-10.0.40219.325-win32.zip MD5: 3FC25896B5B2FB8E20F28FAB8C0E1143)

conhost.exe (PID: 1060 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cmd.exe (PID: 384 cmdline: cmd /S /C "install.bat C:\Users\user\AppData\Roaming\Seznam.cz" MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 7864 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

CPY.EXE (PID: 1408 cmdline: cpy msvcp100.dll "C:\Users\user\AppData\Roaming\Seznam.cz\bin" MD5: 68F44C9CCFF3A00B357BD2006F536AA1)

CPY.EXE (PID: 6040 cmdline: cpy msvcr100.dll "C:\Users\user\AppData\Roaming\Seznam.cz\bin" MD5: 68F44C9CCFF3A00B357BD2006F536AA1)

UNZIP.EXE (PID: 6152 cmdline: C:\Users\user\AppData\Local\Temp\~006A2DE2.00000DD4.sznpkg\unzip.exe -d C:\Users\user\AppData\Local\Temp\~006AD780.00000DD4.sznpkg -o C:\Users\user\AppData\Roaming\Seznam.cz\install\cz.seznam.software.pp-1.0.2-win32.zip MD5: 3FC25896B5B2FB8E20F28FAB8C0E1143)

conhost.exe (PID: 3176 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cmd.exe (PID: 3852 cmdline: cmd /S /C "install.bat C:\Users\user\AppData\Roaming\Seznam.cz" MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 3320 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

CPY.EXE (PID: 552 cmdline: cpy unlockInstance.dll "C:\Users\user\AppData\Roaming\Seznam.cz\bin" MD5: 68F44C9CCFF3A00B357BD2006F536AA1)

CPY.EXE (PID: 3132 cmdline: cpy unlockInstance.conf "C:\Users\user\AppData\Roaming\Seznam.cz\conf\szndesktop.d" MD5: 68F44C9CCFF3A00B357BD2006F536AA1)

szndesktop.exe (PID: 2092 cmdline: szndesktop.exe default restart MD5: DAC25BB758D6C17C5A8D64CF63702B4E)

szndesktop.exe (PID: 3068 cmdline: szndesktop.exe default restart MD5: DAC25BB758D6C17C5A8D64CF63702B4E)

UNZIP.EXE (PID: 7408 cmdline: C:\Users\user\AppData\Local\Temp\~006A2DE2.00000DD4.sznpkg\unzip.exe -d C:\Users\user\AppData\Local\Temp\~006AE03A.00000DD4.sznpkg -o C:\Users\user\AppData\Roaming\Seznam.cz\install\szn-software-listicka-3.0.0-win32.zip MD5: 3FC25896B5B2FB8E20F28FAB8C0E1143)

conhost.exe (PID: 7340 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cmd.exe (PID: 1944 cmdline: cmd /S /C "install.bat C:\Users\user\AppData\Roaming\Seznam.cz" MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 7332 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

sznsetup.exe (PID: 3720 cmdline: "C:\Users\user\AppData\Roaming\Seznam.cz\sznsetup.exe" -A 49764 cd "C:\Users\user\AppData\Roaming\Seznam.cz" MD5: D0F5D99C74D568EB9909C7582A775DC7)

sznsetup.exe (PID: 612 cmdline: "C:\Users\user\AppData\Roaming\Seznam.cz\sznsetup.exe" -A 49764 "C:\Users\user\AppData\Local\Temp\~006AE03A.00000DD4.sznpkg\install.bat" ADMINPHASE . "C:\Program Files (x86)\Seznam.cz\distribution" MD5: D0F5D99C74D568EB9909C7582A775DC7)

REG.EXE (PID: 7780 cmdline: REG ADD "HKEY_CURRENT_USER\SOFTWARE\Seznam.cz\distribution" /f /v "listicka" /t REG_DWORD /d 1 MD5: F0C0D05727A4E1E91F4347C2270500AA)

cmd.exe (PID: 7764 cmdline: cmd /S /C "C:\Users\user\AppData\Roaming\Seznam.cz\uninstall\cz_seznam_software_libszndesktop_2_1_35.reconfigure.bat C:\Users\user\AppData\Roaming\Seznam.cz" MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 7876 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

szndesktop.exe (PID: 7776 cmdline: "C:\Users\user\AppData\Roaming\Seznam.cz\bin\szndesktop.exe" default restart MD5: DAC25BB758D6C17C5A8D64CF63702B4E)

szndesktop.exe (PID: 1060 cmdline: "C:\Users\user\AppData\Roaming\Seznam.cz\bin\szndesktop.exe" default restart MD5: DAC25BB758D6C17C5A8D64CF63702B4E)

sznpp.exe (PID: 5344 cmdline: "C:\Users\user\AppData\Roaming\Seznam.cz\bin\sznpp.exe" install-chrome retry MD5: 62DF7B2F443CBB0284CB7959AD2228C1)

conhost.exe (PID: 1416 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

listicka-x64.exe (PID: 5644 cmdline: "C:\Users\user\AppData\Roaming\Seznam.cz\bin\listicka-x64.exe" MD5: D893A7276D60FD252EAFFE6E91AAC434)

conhost.exe (PID: 3300 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

sznpp.exe (PID: 2936 cmdline: "C:\Users\user\AppData\Roaming\Seznam.cz\bin\sznpp.exe" report-startup MD5: 62DF7B2F443CBB0284CB7959AD2228C1)

szninstall.exe (PID: 5908 cmdline: "C:\Users\user\AppData\Roaming\Seznam.cz\szninstall.exe" -S 49764 MD5: C73E94B86ED9B6BDFF199BB7E8BF9D77)

cmd.exe (PID: 5744 cmdline: C:\Windows\system32\cmd.exe /c C:\Users\user\AppData\Local\Temp\~006AE03A.00000DD4.sznpkg\install.bat ADMINPHASE . "C:\Program Files (x86)\Seznam.cz\distribution" MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 2044 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

sznsetup.exe (PID: 4692 cmdline: ".\sznsetup.exe" -T "C:\Program Files (x86)\Seznam.cz\distribution" -R "C:\Program Files (x86)\Seznam.cz\distribution\install" MD5: D0F5D99C74D568EB9909C7582A775DC7)

xcopy.exe (PID: 7720 cmdline: xcopy /S /Y /G /I ".\install\*.*" "C:\Program Files (x86)\Seznam.cz\distribution\install" MD5: 7E9B7CE496D09F70C072930940F9F02C)

REG.EXE (PID: 7820 cmdline: REG ADD "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /f /v "seznam-listicka-distribuce" /d "\"C:\Program Files (x86)\Seznam.cz\distribution\szninstall.exe\" -s -d listicka 1 szn-software-listicka cz.seznam.software.autoupdate" MD5: F0C0D05727A4E1E91F4347C2270500AA)

sznsetup.exe (PID: 2180 cmdline: C:\Users\user\AppData\Roaming\Seznam.cz\sznsetup.exe -V MD5: D0F5D99C74D568EB9909C7582A775DC7)

conhost.exe (PID: 1172 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

Picasa3.exe (PID: 6516 cmdline: "C:\Program Files (x86)\Google\Picasa3\Picasa3.exe" MD5: 6AD50A491F52B1CBECE23B603037FBDF)

PicasaPhotoViewer.exe (PID: 3496 cmdline: /config MD5: 69B20702DEBC005CD1DA0906B4A3C4F5)

iexplore.exe (PID: 3720 cmdline: "C:\Program Files\Internet Explorer\iexplore.exe" -nohome "http://picasa.google.com/support/bin/answer.py?hl=en&answer=93773" MD5: CFE2E6942AC1B72981B3105E22D3224E)

iexplore.exe (PID: 3184 cmdline: "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3720 CREDAT:9474 /prefetch:2 MD5: 6F0F06D6AB125A99E43335427066A4A1)

ie_to_edge_stub.exe (PID: 2188 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\BHO\ie_to_edge_stub.exe" --from-ie-to-edge=3 --ie-frame-hwnd=602e8 MD5: 89CF8972D683795DAB6901BC9456675D)

ssvagent.exe (PID: 3068 cmdline: "C:\PROGRA~2\Java\jre-1.8\bin\ssvagent.exe" -new MD5: F9A898A606E7F5A1CD7CFFA8079253A0)

sznpp.exe (PID: 3196 cmdline: "C:\Users\user\AppData\Roaming\Seznam.cz\bin\sznpp.exe" install-chrome retry MD5: 62DF7B2F443CBB0284CB7959AD2228C1)

conhost.exe (PID: 3920 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

sznpp_64.exe (PID: 2272 cmdline: "C:\Users\user\AppData\Roaming\Seznam.cz\bin\sznpp.exe" install-chrome retry MD5: B601F631582DD8D062C306CEB3B7500B)

chrome.exe (PID: 7384 cmdline: chrome.exe --no-default-browser-check --new-window about:blank MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 7328 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2216 --field-trial-handle=1932,i,14273124409084968856,4101485093560783332,262144 /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 3828 cmdline: chrome.exe --no-default-browser-check --new-window about:blank MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

listicka-x64.exe (PID: 1940 cmdline: "C:\Users\user\AppData\Roaming\Seznam.cz\bin\listicka-x64.exe" MD5: D893A7276D60FD252EAFFE6E91AAC434)

conhost.exe (PID: 6164 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

sznpp.exe (PID: 5768 cmdline: "C:\Users\user\AppData\Roaming\Seznam.cz\bin\sznpp.exe" report-startup MD5: 62DF7B2F443CBB0284CB7959AD2228C1)

ie_to_edge_stub.exe (PID: 2280 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\BHO\ie_to_edge_stub.exe" --from-ie-to-edge=3 --ie-frame-hwnd=602e8 MD5: 89CF8972D683795DAB6901BC9456675D)

msedge.exe (PID: 2064 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --from-ie-to-edge=3 --ie-frame-hwnd=602e8 MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 4912 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2244 --field-trial-handle=2004,i,1639013666010223883,15040558206664522354,262144 /prefetch:3 MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 2756 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=1724 --field-trial-handle=2004,i,1639013666010223883,15040558206664522354,262144 /prefetch:8 MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 6524 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=6596 --field-trial-handle=2004,i,1639013666010223883,15040558206664522354,262144 /prefetch:8 MD5: 69222B8101B0601CC6663F8381E7E00F)

cookie_exporter.exe (PID: 3648 cmdline: cookie_exporter.exe --cookie-json=1188 MD5: 3DD7152D6D33725EA5958D7DE2586B97)

msedge.exe (PID: 6532 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-GB --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --mojo-platform-channel-handle=3720 --field-trial-handle=2004,i,1639013666010223883,15040558206664522354,262144 /prefetch:8 MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 8112 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-GB --service-sandbox-type=audio --mojo-platform-channel-handle=4984 --field-trial-handle=2004,i,1639013666010223883,15040558206664522354,262144 /prefetch:8 MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 456 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-GB --service-sandbox-type=search_indexer --message-loop-type-ui --mojo-platform-channel-handle=6084 --field-trial-handle=2004,i,1639013666010223883,15040558206664522354,262144 /prefetch:8 MD5: 69222B8101B0601CC6663F8381E7E00F)

ssvagent.exe (PID: 3652 cmdline: "C:\PROGRA~2\Java\jre-1.8\bin\ssvagent.exe" -new MD5: F9A898A606E7F5A1CD7CFFA8079253A0)

iexplore.exe (PID: 7244 cmdline: "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3720 CREDAT:202066 /prefetch:2 MD5: 6F0F06D6AB125A99E43335427066A4A1)

cleanup

Sigma Signatures

System Summary

Sigma detected: Common Autorun Keys Modification

Source: Registry Key set

Author: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split), wagga (name): Data: Details: , EventID: 13, EventType: SetValue, Image: C:\Windows\SysWOW64\GPhotos.scr, ProcessId: 5508, TargetObject: HKEY_USERS.DEFAULT\Control Panel\Desktop\SCRNSAVE.EXE

Sigma detected: CurrentVersion Autorun Keys Modification

Source: Registry Key set

Author: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: "C:\Users\user\AppData\Roaming\Seznam.cz\szninstall.exe" -c, EventID: 13, EventType: SetValue, Image: C:\Users\user\AppData\Local\Temp\~006A2DE2.00000DD4.sznpkg\REG.EXE, ProcessId: 7404, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\cz.seznam.software.autoupdate

Sigma detected: Direct Autorun Keys Modification

Source: Process started

Author: Victor Sergeev, Daniil Yugoslavskiy, oscd.community: Data: Command: REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "cz.seznam.software.autoupdate" /d "\"C:\Users\user\AppData\Roaming\Seznam.cz\szninstall.exe\" -c", CommandLine: REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "cz.seznam.software.autoupdate" /d "\"C:\Users\user\AppData\Roaming\Seznam.cz\szninstall.exe\" -c", CommandLine|base64offset|contains: DA, Image: C:\Users\user\AppData\Local\Temp\~006A2DE2.00000DD4.sznpkg\REG.EXE, NewProcessName: C:\Users\user\AppData\Local\Temp\~006A2DE2.00000DD4.sznpkg\REG.EXE, OriginalFileName: C:\Users\user\AppData\Local\Temp\~006A2DE2.00000DD4.sznpkg\REG.EXE, ParentCommandLine: cmd /S /C "install.bat C:\Users\user\AppData\Roaming\Seznam.cz", ParentImage: C:\Windows\SysWOW64\cmd.exe, ParentProcessId: 4956, ParentProcessName: cmd.exe, ProcessCommandLine: REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "cz.seznam.software.autoupdate" /d "\"C:\Users\user\AppData\Roaming\Seznam.cz\szninstall.exe\" -c", ProcessId: 7404, ProcessName: REG.EXE

Sigma detected: Potential Persistence Attempt Via Run Keys Using Reg.EXE

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "cz.seznam.software.autoupdate" /d "\"C:\Users\user\AppData\Roaming\Seznam.cz\szninstall.exe\" -c", CommandLine: REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "cz.seznam.software.autoupdate" /d "\"C:\Users\user\AppData\Roaming\Seznam.cz\szninstall.exe\" -c", CommandLine|base64offset|contains: DA, Image: C:\Users\user\AppData\Local\Temp\~006A2DE2.00000DD4.sznpkg\REG.EXE, NewProcessName: C:\Users\user\AppData\Local\Temp\~006A2DE2.00000DD4.sznpkg\REG.EXE, OriginalFileName: C:\Users\user\AppData\Local\Temp\~006A2DE2.00000DD4.sznpkg\REG.EXE, ParentCommandLine: cmd /S /C "install.bat C:\Users\user\AppData\Roaming\Seznam.cz", ParentImage: C:\Windows\SysWOW64\cmd.exe, ParentProcessId: 4956, ParentProcessName: cmd.exe, ProcessCommandLine: REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "cz.seznam.software.autoupdate" /d "\"C:\Users\user\AppData\Roaming\Seznam.cz\szninstall.exe\" -c", ProcessId: 7404, ProcessName: REG.EXE

Sigma detected: Suspicious Screensaver Binary File Creation

Source: File created

Author: frack113: Data: EventID: 11, Image: C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe, ProcessId: 6028, TargetFilename: C:\Windows\SysWOW64\GPhotos.scr

Sigma detected: Use Short Name Path in Command Line

Source: Process started

Author: frack113, Nasreddine Bencherchali: Data: Command: "C:\PROGRA~2\Java\jre-1.8\bin\ssvagent.exe" -new, CommandLine: "C:\PROGRA~2\Java\jre-1.8\bin\ssvagent.exe" -new, CommandLine|base64offset|contains: w, Image: C:\Program Files (x86)\Java\jre-1.8\bin\ssvagent.exe, NewProcessName: C:\Program Files (x86)\Java\jre-1.8\bin\ssvagent.exe, OriginalFileName: C:\Program Files (x86)\Java\jre-1.8\bin\ssvagent.exe, ParentCommandLine: "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3720 CREDAT:9474 /prefetch:2, ParentImage: C:\Program Files (x86)\Internet Explorer\iexplore.exe, ParentProcessId: 3184, ParentProcessName: iexplore.exe, ProcessCommandLine: "C:\PROGRA~2\Java\jre-1.8\bin\ssvagent.exe" -new, ProcessId: 3068, ProcessName: ssvagent.exe

Sigma detected: Modification of IE Registry Settings

Source: Registry Key set

Author: frack113: Data: Details: 1, EventID: 13, EventType: SetValue, Image: C:\Program Files\Internet Explorer\iexplore.exe, ProcessId: 3720, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\SecuritySafe

Suricata Signatures

ETPRO MALWARE Common Downloader Header Pattern H

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-02T12:16:22.113361+0200	2803305	3	Unknown Traffic	192.168.2.16	49707	77.75.76.70	80	TCP
2024-10-02T12:16:23.980004+0200	2803305	3	Unknown Traffic	192.168.2.16	49707	77.75.76.70	80	TCP
2024-10-02T12:16:26.673684+0200	2803305	3	Unknown Traffic	192.168.2.16	49707	77.75.76.70	80	TCP
2024-10-02T12:16:35.593694+0200	2803305	3	Unknown Traffic	192.168.2.16	49765	77.75.76.70	80	TCP
2024-10-02T12:16:37.099132+0200	2803305	3	Unknown Traffic	192.168.2.16	49765	77.75.76.70	80	TCP
2024-10-02T12:16:38.974886+0200	2803305	3	Unknown Traffic	192.168.2.16	49765	77.75.76.70	80	TCP
2024-10-02T12:16:41.372917+0200	2803305	3	Unknown Traffic	192.168.2.16	49765	77.75.76.70	80	TCP
2024-10-02T12:16:43.050976+0200	2803305	3	Unknown Traffic	192.168.2.16	49765	77.75.76.70	80	TCP
2024-10-02T12:16:46.292462+0200	2803305	3	Unknown Traffic	192.168.2.16	49765	77.75.76.70	80	TCP
2024-10-02T12:16:48.599342+0200	2803305	3	Unknown Traffic	192.168.2.16	49765	77.75.76.70	80	TCP
2024-10-02T12:16:49.917865+0200	2803305	3	Unknown Traffic	192.168.2.16	49765	77.75.76.70	80	TCP
2024-10-02T12:17:04.630823+0200	2803305	3	Unknown Traffic	192.168.2.16	49960	77.75.78.30	443	TCP
2024-10-02T12:17:08.501285+0200	2803305	3	Unknown Traffic	192.168.2.16	49966	77.75.78.30	443	TCP
2024-10-02T12:17:10.907798+0200	2803305	3	Unknown Traffic	192.168.2.16	49969	77.75.78.30	443	TCP
2024-10-02T12:17:12.823071+0200	2803305	3	Unknown Traffic	192.168.2.16	49972	77.75.78.30	443	TCP
2024-10-02T12:17:21.078549+0200	2803305	3	Unknown Traffic	192.168.2.16	49981	77.75.78.30	443	TCP
2024-10-02T12:17:27.273153+0200	2803305	3	Unknown Traffic	192.168.2.16	49996	77.75.78.30	443	TCP

ETPRO MALWARE Common Downloader Header Pattern UH

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-02T12:16:36.357307+0200	2803274	2	Potentially Bad Traffic	192.168.2.16	49775	172.217.23.110	443	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

Source: C:\Program Files (x86)\Google\Picasa3\Picasa3.exe	Code function: 20_2_04819970 CryptAcquireContextA,CryptAcquireContextA,GetLastError,CryptAcquireContextA,CryptCreateHash,CryptHashData,CryptDeriveKey,CryptEncrypt,CryptEncrypt,_strncpy,CryptEncrypt,CryptReleaseContext,InterlockedIncrement,	20_2_04819970
Source: C:\Program Files (x86)\Google\Picasa3\Picasa3.exe	Code function: 20_2_04819BA0 CryptAcquireContextA,CryptAcquireContextA,GetLastError,CryptAcquireContextA,CryptCreateHash,CryptHashData,CryptDeriveKey,CryptDecrypt,CryptReleaseContext,	20_2_04819BA0
Source: C:\Program Files (x86)\Google\Picasa3\Picasa3.exe	Code function: 20_2_047E7BC0 CryptEncrypt,InterlockedIncrement,	20_2_047E7BC0

Source: https://support.google.com/picasa/answer/6383491?hl=en&visit_id=638634609885905976-1351747924&rd=3

HTTP Parser: No favicon

Source: C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe

Window detected: I AgreeCancelNullsoft Install System v3.0b1 Nullsoft Install System v3.0b1License AgreementPlease review the license terms before installing Picasa 3By using Picasa 3 you agree to the Google Terms of Service and Privacy Policy.Terms of ServicePrivacy Policy

Source: C:\Users\user\AppData\Local\Temp\~0069FB97.00001B74.sznpkg\REG.EXE

Registry value created: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\SeznamInstall

Source: C:\Users\user\AppData\Roaming\Seznam.cz\szninstall.exe	File created: C:\Users\user\AppData\Roaming\Seznam.cz\install.log.5868.log
Source: C:\Users\user\AppData\Roaming\Seznam.cz\szninstall.exe	File created: C:\Users\user\AppData\Roaming\Seznam.cz\install.log
Source: C:\Windows\SysWOW64\cmd.exe	File created: C:\Users\user\AppData\Roaming\Seznam.cz\install_packages.log

Source: C:\Users\user\AppData\Roaming\Seznam.cz\sznsetup.exe

File opened: C:\Users\user\AppData\Local\Temp\~006AD463.00000DD4.sznpkg\msvcr100.dll

Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.16:49702 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.16:49704 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 77.75.76.70:443 -> 192.168.2.16:49708 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.217.23.110:443 -> 192.168.2.16:49716 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.217.23.110:443 -> 192.168.2.16:49715 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.65:443 -> 192.168.2.16:49736 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.65:443 -> 192.168.2.16:49737 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.185.174:443 -> 192.168.2.16:49755 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.185.174:443 -> 192.168.2.16:49754 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.217.23.110:443 -> 192.168.2.16:49772 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.217.23.110:443 -> 192.168.2.16:49773 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.217.23.110:443 -> 192.168.2.16:49775 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 77.75.76.70:443 -> 192.168.2.16:49776 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.190.159.64:443 -> 192.168.2.16:49926 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 77.75.78.30:443 -> 192.168.2.16:49960 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 77.75.78.30:443 -> 192.168.2.16:49966 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 77.75.78.30:443 -> 192.168.2.16:49969 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 77.75.78.30:443 -> 192.168.2.16:49972 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 77.75.78.30:443 -> 192.168.2.16:49981 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 77.75.78.30:443 -> 192.168.2.16:49996 version: TLS 1.2

Source:	Binary string: C:\Users\ondrej.novak\Documents\Visual Studio 2008\Projects\software-trunk\SeznamInstall\bin\debug\sznsetup-lt.pdbPV source: sznsetup-lt.exe, 00000017.00000000.1729394687.000000000052B000.00000002.00000001.01000000.0000001F.sdmp
Source:	Binary string: C:\Repository\listicka\ielisticka_new\bin-Release\pdb\listicka-x64.pdb source: UNZIP.EXE, 00000081.00000002.2178378406.0000000000428000.00000040.00000001.01000000.00000026.sdmp, CPY.EXE, 00000086.00000002.2185910879.000000000075A000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \plugins\CDVDR\*.pdb source: setuppicasa39-setup.exe, 00000010.00000003.1659418312.000000000067F000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \plugins\expwebsites\*.pdb source: setuppicasa39-setup.exe, 00000010.00000003.1659418312.000000000067F000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: p:\d\a\wpyh4-vm-6.hot\recipes\840394494\base\googleclient\picasa39-stable\build\Picasa3.pdb source: Picasa3.exe, 00000012.00000000.1603749985.0000000000C6A000.00000002.00000001.01000000.00000012.sdmp
Source:	Binary string: C:\playground\repos\listicka\sznpp\bin\symbols\Release_x86\sznpp_dll.pdb source: UNZIP.EXE, 0000005D.00000002.2105385323.0000000000428000.00000040.00000001.01000000.00000026.sdmp, CPY.EXE, 00000064.00000002.2115643669.0000000000ECA000.00000004.00000020.00020000.00000000.sdmp, sznpp.exe, 0000007C.00000000.2152804918.0000000000BFB000.00000002.00000001.01000000.0000002C.sdmp
Source:	Binary string: msvcp110.i386.pdb source: szndesktop.exe, szndesktop.exe, 00000087.00000002.2193190667.000000006C0E1000.00000020.00000001.01000000.0000002E.sdmp
Source:	Binary string: C:\Users\ondrej.novak\Documents\Visual Studio 2008\Projects\software-trunk\SeznamInstall\bin\debug\sznsetup.pdb source: sznsetup.exe, 00000039.00000000.1850844929.0000000000F0C000.00000002.00000001.01000000.00000023.sdmp
Source:	Binary string: msvcr110.i386.pdb source: UNZIP.EXE, 00000052.00000002.2089014833.0000000000428000.00000040.00000001.01000000.00000026.sdmp, CPY.EXE, 00000057.00000002.2096863979.0000000000B3A000.00000004.00000020.00020000.00000000.sdmp, szndesktop.exe, szndesktop.exe, 00000087.00000002.2195197650.000000006C221000.00000020.00000001.01000000.0000002B.sdmp
Source:	Binary string: C:\playground\repos\listicka\sznpp\bin\symbols\Release_x64\sznpp_64.pdb source: sznpp.exe, 0000007C.00000000.2152804918.0000000000B52000.00000002.00000001.01000000.0000002C.sdmp
Source:	Binary string: PhotoViewer.pdbGCTL source: PicasaPhotoViewer.exe, 00000015.00000003.1748748621.0000000003DBE000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\playground\repos\listicka\sznpp\bin\symbols\Release_x86\sznpp.pdb source: sznpp.exe, 0000007C.00000000.2152425887.0000000000B0C000.00000002.00000001.01000000.0000002C.sdmp
Source:	Binary string: C:\playground\repos\listicka\sznpp\bin\symbols\Release_x86\sznpp.pdb- source: sznpp.exe, 0000007C.00000000.2152425887.0000000000B0C000.00000002.00000001.01000000.0000002C.sdmp
Source:	Binary string: p:\d\a\wpyh4-vm-6.hot\recipes\840394494\base\googleclient\picasa39-stable\build\PicasaPhotoViewer.pdb source: setuppicasa39-setup.exe, 00000010.00000002.1664870898.00000000031AA000.00000004.00000020.00020000.00000000.sdmp, PicasaPhotoViewer.exe, 00000015.00000000.1692209976.000000000070D000.00000002.00000001.01000000.00000019.sdmp
Source:	Binary string: p:\d\a\wpyh4-vm-6.hot\recipes\840394494\base\googleclient\picasa39-stable\build\cdautorun\PicasaCD.pdb source: setuppicasa39-setup.exe, 00000010.00000002.1664870898.0000000004419000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: mi_exe_stub.pdb@;AL source: setuppicasa39-setup.exe, 00000010.00000002.1664870898.00000000029F6000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: p:\d\a\wpyh4-vm-6.hot\recipes\840394494\base\googleclient\picasa39-stable\build\plugins\CDVDR\CDVDR.pdb source: setuppicasa39-setup.exe, 00000010.00000002.1664870898.0000000003831000.00000004.00000020.00020000.00000000.sdmp, Picasa3.exe, 00000014.00000002.2497615129.00000000033F3000.00000002.00000001.01000000.00000015.sdmp
Source:	Binary string: p:\d\a\wpyh4-vm-6.hot\recipes\840394494\base\googleclient\picasa39-stable\build\npPicasa3.pdb source: setuppicasa39-setup.exe, 00000010.00000002.1664870898.0000000002E88000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: d:\Development\googleclient\picasa4\build\plugins\Red.pdb source: setuppicasa39-setup.exe, 00000010.00000002.1664870898.0000000003FAE000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Repository\listicka\ielisticka_new\bin-Release\pdb\szndesktop.pdb source: CPY.EXE, 00000061.00000002.2108099884.0000000000E09000.00000004.00000020.00020000.00000000.sdmp, szndesktop.exe, 00000087.00000000.2188348792.0000000000875000.00000002.00000001.01000000.0000002D.sdmp
Source:	Binary string: p:\d\a\wpyh4-vm-6.hot\recipes\840394494\base\googleclient\picasa39-stable\build\plugins\expwebsites\expwebsites.pdb source: setuppicasa39-setup.exe, 00000010.00000002.1664870898.0000000003DA5000.00000004.00000020.00020000.00000000.sdmp, Picasa3.exe, 00000014.00000002.2533437740.000000000488F000.00000002.00000001.01000000.00000016.sdmp
Source:	Binary string: C:\Users\ondrej.novak\Documents\Visual Studio 2008\Projects\software-trunk\SeznamInstall\bin\debug\sznsetup-lt.pdb source: listicka.exe, 00000016.00000002.2443085483.00000000029E3000.00000004.00000020.00020000.00000000.sdmp, sznsetup-lt.exe, 00000017.00000000.1729394687.000000000052B000.00000002.00000001.01000000.0000001F.sdmp
Source:	Binary string: C:\playground\repos\listicka\sznpp\bin\symbols\Release_x64\sznpp_dll.pdb source: CPY.EXE, 00000064.00000002.2115643669.0000000000ECA000.00000004.00000020.00020000.00000000.sdmp, sznpp.exe, 0000007C.00000000.2152804918.0000000000BFB000.00000002.00000001.01000000.0000002C.sdmp
Source:	Binary string: C:\playground\repos\listicka\sznpp\bin\symbols\Release_x64\sznpp_64.pdb( source: sznpp.exe, 0000007C.00000000.2152804918.0000000000B52000.00000002.00000001.01000000.0000002C.sdmp
Source:	Binary string: p:\d\a\wpyh4-vm-6.hot\recipes\840394494\base\googleclient\picasa39-stable\build\GPhotos.pdb source: setuppicasa39-setup.exe, 00000010.00000002.1664870898.00000000035FF000.00000004.00000020.00020000.00000000.sdmp, GPhotos.scr, 00000011.00000000.1542724484.000000000062E000.00000002.00000001.01000000.0000000F.sdmp
Source:	Binary string: C:\Repository\listicka\ielisticka_new\bin-Release\pdb\szndesktop.pdb44 source: CPY.EXE, 00000061.00000002.2108099884.0000000000E09000.00000004.00000020.00020000.00000000.sdmp, szndesktop.exe, 00000087.00000000.2188348792.0000000000875000.00000002.00000001.01000000.0000002D.sdmp
Source:	Binary string: C:\Repository\listicka-new\ielisticka_new\bin-Release\pdb\lightspeed.pdb source: CPY.EXE, 0000005C.00000002.2102179386.0000000000B00000.00000004.00000020.00020000.00000000.sdmp, szndesktop.exe, 00000087.00000002.2198970614.000000006C384000.00000002.00000001.01000000.0000002A.sdmp
Source:	Binary string: p:\d\a\wpyh4-vm-6.hot\recipes\840394494\base\googleclient\picasa39-stable\build\plugins\ytITivo.pdb source: setuppicasa39-setup.exe, 00000010.00000002.1664870898.0000000003F3F000.00000004.00000020.00020000.00000000.sdmp, Picasa3.exe, 00000014.00000002.2504208079.0000000004079000.00000002.00000001.01000000.00000017.sdmp
Source:	Binary string: C:\Repository\listicka-new\ielisticka_new\bin-Release\pdb\lightspeed.pdbQQ source: CPY.EXE, 0000005C.00000002.2102179386.0000000000B00000.00000004.00000020.00020000.00000000.sdmp, szndesktop.exe, 00000087.00000002.2198970614.000000006C384000.00000002.00000001.01000000.0000002A.sdmp
Source:	Binary string: p:\d\a\wpyh4-vm-6.hot\recipes\840394494\base\googleclient\picasa39-stable\build\cdautorun\PicasaRestore.pdb source: setuppicasa39-setup.exe, 00000010.00000002.1664870898.000000000459F000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Repository\listicka\ielisticka_new\bin-Release\pdb\libfoxloader.pdb source: UNZIP.EXE, 0000007D.00000002.2173171240.000000000042B000.00000040.00000001.01000000.00000026.sdmp, szndesktop.exe, 00000087.00000002.2200176289.000000006C489000.00000002.00000001.01000000.0000002F.sdmp
Source:	Binary string: Rg.pdbH source: listicka.exe, 00000016.00000002.2443085483.00000000029E3000.00000004.00000020.00020000.00000000.sdmp, sznsetup-lt.exe, 00000017.00000000.1730049584.0000000000571000.00000002.00000001.01000000.0000001F.sdmp, REG.EXE, 0000002A.00000000.1818569837.0000000001000000.00000002.00000001.01000000.00000021.sdmp, REG.EXE, 0000002A.00000000.1818621571.0000000001018000.00000080.00000001.01000000.00000021.sdmp, REG.EXE, 0000002A.00000002.1819878005.0000000001000000.00000002.00000001.01000000.00000021.sdmp, sznsetup.exe, 00000039.00000000.1851570101.0000000000F52000.00000002.00000001.01000000.00000023.sdmp
Source:	Binary string: C:\Users\petr.slivon\Documents\Visual Studio 2012\Projects\listicka-trunk\ielisticka_new\bin-Release\pdb\wszndesktop.pdb source: UNZIP.EXE, 00000066.00000002.2120076164.0000000000428000.00000040.00000001.01000000.00000026.sdmp, CPY.EXE, 0000006A.00000002.2122729835.0000000000629000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: msvcp110.i386.pdb0 source: szndesktop.exe, 00000087.00000002.2193190667.000000006C0E1000.00000020.00000001.01000000.0000002E.sdmp
Source:	Binary string: C:\Repository\listicka\ielisticka_new\bin-Release\pdb\listicka-x64.pdbhh source: UNZIP.EXE, 00000081.00000002.2178378406.0000000000428000.00000040.00000001.01000000.00000026.sdmp, CPY.EXE, 00000086.00000002.2185910879.000000000075A000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Repository\listicka\ielisticka_new\bin-Release\pdb\libfoxloader.pdb~{ source: UNZIP.EXE, 0000007D.00000002.2173171240.000000000042B000.00000040.00000001.01000000.00000026.sdmp, szndesktop.exe, 00000087.00000002.2200176289.000000006C489000.00000002.00000001.01000000.0000002F.sdmp
Source:	Binary string: C:\Users\ondrej.novak\Documents\Visual Studio 2008\Projects\software-trunk\SeznamInstall\bin\debug\szninstall.pdb source: szninstall.exe, 00000038.00000000.1847499306.0000000000571000.00000002.00000001.01000000.00000022.sdmp
Source:	Binary string: reg.pdb source: REG.EXE, REG.EXE, 0000002A.00000002.1819912483.0000000001001000.00000040.00000001.01000000.00000021.sdmp
Source:	Binary string: mi_exe_stub.pdb source: setuppicasa39-setup.exe, 00000010.00000002.1664870898.00000000029F6000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: PhotoViewer.pdb source: PicasaPhotoViewer.exe, 00000015.00000003.1748748621.0000000003DBE000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: d:\twbrown-picasa-1\googleclient\picasa4\NSIS_Unicode_v3\Plugins\x86-unicode\NSIS_Picasa_Unicode.pdb source: setuppicasa39-setup.exe, 00000010.00000002.1704699696.0000000004CA3000.00000002.00000001.01000000.0000000C.sdmp
Source:	Binary string: C:\Users\ondrej.novak\Documents\Visual Studio 2008\Projects\software-trunk\SeznamInstall\bin\debug\sznsetup-lt.pdbPP source: listicka.exe, 00000016.00000002.2443085483.00000000029E3000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: p:\d\a\wpyh4-vm-6.hot\recipes\840394494\base\googleclient\picasa39-stable\build\Picasa3i18n.pdb source: Picasa3.exe, 00000014.00000002.2599698862.0000000010008000.00000002.00000001.01000000.00000014.sdmp
Source:	Binary string: C:\Users\ondrej.novak\Documents\Visual Studio 2008\Projects\software-trunk\SeznamInstall\bin\debug\sznsetup.pdb` source: sznsetup.exe, 00000039.00000000.1850844929.0000000000F0C000.00000002.00000001.01000000.00000023.sdmp
Source:	Binary string: p:\d\a\wpyh4-vm-6.hot\recipes\840394494\base\googleclient\picasa39-stable\build\cdautorun\PicasaCD.pdblpW source: setuppicasa39-setup.exe, 00000010.00000002.1664870898.0000000004419000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\ondrej.novak\Documents\Visual Studio 2008\Projects\software-trunk\SeznamInstall\bin\debug\szninstall.pdb0Z source: szninstall.exe, 00000038.00000000.1847499306.0000000000571000.00000002.00000001.01000000.00000022.sdmp

Source: Picasa3.exe, 00000012.00000000.1603749985.0000000000C6A000.00000002.00000001.01000000.00000012.sdmp	Binary or memory string: autorun.inf
Source: Picasa3.exe, 00000012.00000000.1603749985.0000000000C6A000.00000002.00000001.01000000.00000012.sdmp	Binary or memory string: VATAPIytICDVDR::ATAPISCSIytICDVDR::SCSI1394ytICDVDR::1394USBytICDVDR::USBUSB 2.0ytICDVDR::USB2.0Unknown typeytICDVDR::UnknownTypeCD-ROMytICDVDR::CD-ROMCD-RytICDVDR::CD-RCD-RWytICDVDR::CD-RWDVD-ROMytICDVDR::DVD-ROMDVD-RytICDVDR::DVD-RDVD-RWytICDVDR::DVD-RWDVD+RytICDVDR::DVD+RDVD+RWytICDVDR::DVD+RWDVD-RAMytICDVDR::DVD-RAMDVD+R DLytICDVDR::DVD+PR9Not Recordable DiscytICDVDR::MTNotRecRecordable DiscytICDVDR::MTRecIncompatible Recordable DiscytICDVDR::MTNotRecIncomBlank Recordable DiscytICDVDR::MTBlankUnknownytICDVDR::MTUnknownBlank DiscytICDVDR::MF1Data Mode 1 DAO (like the MSVC++ or a typical DOS game)ytICDVDR::MF2vKodak Photo CD - Data multis. Mode 2 TAOytICDVDR::MF3Gold Data Mode 1 - Data multis. Mode 1, closedytICDVDR::MF4Gold Data Mode 2 - Data multis. Mode 2, closedytICDVDR::MF5Data Mode 2 DAO (silver mastered from Corel or Toast gold)ytICDVDR::MF6CDRFS - Fixed packet (from Sony packet writing solution)ytICDVDR::MF7Packet writingytICDVDR::MF8Gold Data Mode 1 - Data multis. Mode 1, openytICDVDR::MF9Gold Data Mode 2 - Data multis. Mode 2, openytICDVDR::MF10Audio DAO Silver, like almost any music disc, or Closed GoldytICDVDR::MF11Audio Gold disc not closed (TAO or SAO)ytICDVDR::MF12First type of Enhanced CD (aborted)ytICDVDR::MF13CD Extra, Blue Book standardytICDVDR::MF14Audio TAO tracks with session not closed, the (HP way)ytICDVDR::MF15First track Data and other audioytICDVDR::MF16Gold TAO (like the ones made with Easy-CD 16 or 32 versions)ytICDVDR::MF17Kodak Portfolio (as the Kodak standard)ytICDVDR::MF18Video CD (as the White Book standard)ytICDVDR::MF19CD-i (as the Green Book standard)ytICDVDR::MF20PlayStation (Sony games)ytICDVDR::MF21ytICDVDR::MF22Recordable DVD-R, closedytICDVDR::MF23Recordable DVD-R, openytICDVDR::MF24DVD-RAM cartridgeytICDVDR::MF25OtherytICDVDR::MFOthershell32.dlloption_imagesizelimitoption_jpegqualityoption_thumbsizeoption_useorigoption_backupoption_createhtmloption_estimateoption_inifileoption_manifestoption_manifestcaptionsoption_manifestfiletimesoption_convertnonjpegoption_preservemoviesoption_noautoruninfoption_isuploadautorun.infd:\cdtemp\temp.isoPicasa CDprimoICDVDRDVDBurnBurnTempCannot create disc due to error when attempting to add folder '%s'.BurnCollection::CantAddFolderCannot create disc due to error when attempting to add item '%s'.BurnCollection::CantAddItemVerifyingContinueil_BurnPanel::InsertNext::1Disc Burningil_BurnPanel::NextDialogTitlecdchooselastcddriveuseddrive%c:\ %s on %sil_CDevChooseDialogWinuploadallinstructionpanelpublish/uploadallactionsrectpublish/uploadalloptionsrectpublish/uploadallstoragerectpublish/replicate_button_grouppublish/backup_gopublish/replicate_gopublish/backup_ejectpublish/presentcd_ejectpublish/uploadallsizepublish/uploadallaccesspublish/uploadallsyncSHCreateQueryCancelAutoPlayMonikerpublish/needed_storagepublish/full_storagepublish/final_storagethis removalil_BurnPanel::removalthis changeil_BurnPanel::changethis uploadil_BurnPanel::uploadCalculating...il_BurnPanel::calculatin
Source: Picasa3.exe, 00000012.00000000.1603749985.0000000000C6A000.00000002.00000001.01000000.00000012.sdmp	Binary or memory string: [autorun]
Source: Picasa3.exe, 00000012.00000000.1603749985.0000000000C6A000.00000002.00000001.01000000.00000012.sdmp	Binary or memory string: \autorun.inf
Source: Picasa3.exe, 00000012.00000000.1603749985.0000000000C6A000.00000002.00000001.01000000.00000012.sdmp	Binary or memory string: option_copysrctotempdestnone[autorun]
Source: Picasa3.exe, 00000012.00000000.1603749985.0000000000C6A000.00000002.00000001.01000000.00000012.sdmp	Binary or memory string: \autorun.infCDPrep%s%s%s%s%s%s%s%d%s%s%s\%s\%s\%sThreadDestroyDirectory %sburndialogIUIManagerIFileDatabaseAlignedImageCollectionPreferences\Plugins\plugins/upload/

Source: C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe	Code function: 16_2_04C91B90 lstrcpyW,GlobalAlloc,FindFirstFileW,GetLastError,FindNextFileW,FindClose,	16_2_04C91B90
Source: C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe	Code function: 16_2_04C91F30 lstrcpyW,FindFirstFileW,GetLastError,GetFileAttributesW,FindNextFileW,FindClose,	16_2_04C91F30
Source: C:\Program Files (x86)\Google\Picasa3\Picasa3.exe	Code function: 20_2_033BB710 MultiByteToWideChar,MultiByteToWideChar,MultiByteToWideChar,MultiByteToWideChar,_memset,FindFirstFileW,WideCharToMultiByte,WideCharToMultiByte,WideCharToMultiByte,	20_2_033BB710
Source: C:\Program Files (x86)\Google\Picasa3\Picasa3.exe	Code function: 20_2_033F0600 GetVersion,FindFirstFileExA,	20_2_033F0600
Source: C:\Program Files (x86)\Google\Picasa3\Picasa3.exe	Code function: 20_2_033F05C0 GetVersion,FindFirstFileA,	20_2_033F05C0
Source: C:\Program Files (x86)\Google\Picasa3\Picasa3.exe	Code function: 20_2_033BB850 MultiByteToWideChar,MultiByteToWideChar,MultiByteToWideChar,MultiByteToWideChar,_memset,FindFirstFileExW,WideCharToMultiByte,WideCharToMultiByte,WideCharToMultiByte,	20_2_033BB850
Source: C:\Program Files (x86)\Google\Picasa3\Picasa3.exe	Code function: 20_2_040386D0 MultiByteToWideChar,MultiByteToWideChar,MultiByteToWideChar,MultiByteToWideChar,_memset,FindFirstFileW,WideCharToMultiByte,WideCharToMultiByte,WideCharToMultiByte,	20_2_040386D0
Source: C:\Program Files (x86)\Google\Picasa3\Picasa3.exe	Code function: 20_2_04038810 MultiByteToWideChar,MultiByteToWideChar,MultiByteToWideChar,MultiByteToWideChar,_memset,FindFirstFileExW,WideCharToMultiByte,WideCharToMultiByte,WideCharToMultiByte,	20_2_04038810
Source: C:\Program Files (x86)\Google\Picasa3\Picasa3.exe	Code function: 20_2_04076930 GetVersion,FindFirstFileA,	20_2_04076930
Source: C:\Program Files (x86)\Google\Picasa3\Picasa3.exe	Code function: 20_2_04076970 GetVersion,FindFirstFileExA,	20_2_04076970
Source: C:\Program Files (x86)\Google\Picasa3\Picasa3.exe	Code function: 20_2_048336A0 MultiByteToWideChar,MultiByteToWideChar,MultiByteToWideChar,MultiByteToWideChar,_memset,FindFirstFileW,WideCharToMultiByte,WideCharToMultiByte,WideCharToMultiByte,	20_2_048336A0
Source: C:\Program Files (x86)\Google\Picasa3\Picasa3.exe	Code function: 20_2_048337E0 MultiByteToWideChar,MultiByteToWideChar,MultiByteToWideChar,MultiByteToWideChar,_memset,FindFirstFileExW,WideCharToMultiByte,WideCharToMultiByte,WideCharToMultiByte,	20_2_048337E0
Source: C:\Users\user\AppData\Local\Temp\~0069FB97.00001B74.sznpkg\UNZIP.EXE	Code function: 38_2_0041C29C FindFirstFileA,GetDriveTypeA,FileTimeToLocalFileTime,FileTimeToSystemTime,FileTimeToLocalFileTime,FileTimeToSystemTime,FileTimeToLocalFileTime,FileTimeToSystemTime,FindClose,GetLastError,FindClose,	38_2_0041C29C
Source: C:\Users\user\AppData\Local\Temp\~0069FB97.00001B74.sznpkg\UNZIP.EXE	Code function: 38_2_004107A0 FindFirstFileA,	38_2_004107A0
Source: C:\Users\user\AppData\Roaming\Seznam.cz\bin\szndesktop.exe	Code function: 135_2_6C10D6BF ?_Open_dir@sys@tr2@std@@YAPAXPA_WPB_WAAHAAW4file_type@123@@Z,__EH_prolog3_GS,wcslen,FindFirstFileExW,std::tr2::sys::_Read_dir,FindClose,std::tr2::sys::_Strcpy,	135_2_6C10D6BF
Source: C:\Users\user\AppData\Roaming\Seznam.cz\bin\szndesktop.exe	Code function: 135_2_6C29AAA4 _wstat32i64,__doserrno,_errno,_invalid_parameter_noinfo,_wcspbrk,_errno,__doserrno,_errno,__doserrno,towlower,_getdrive,FindFirstFileExW,_wcspbrk,wcslen,GetDriveTypeW,free,___loctotime32_t,free,_wsopen_s,__fstat32i64,_close,FileTimeToLocalFileTime,FileTimeToSystemTime,___loctotime32_t,FileTimeToLocalFileTime,FileTimeToSystemTime,___loctotime32_t,FileTimeToLocalFileTime,FileTimeToSystemTime,___loctotime32_t,FindClose,GetLastError,__dosmaperr,FindClose,GetLastError,__dosmaperr,FindClose,	135_2_6C29AAA4
Source: C:\Users\user\AppData\Roaming\Seznam.cz\bin\szndesktop.exe	Code function: 135_2_6C298B4F _findfirst64i32,_errno,_invalid_parameter_noinfo,FindFirstFileExA,GetLastError,_errno,_errno,_errno,___time64_t_from_ft,___time64_t_from_ft,___time64_t_from_ft,strcpy_s,_invoke_watson,_findnext64i32,_errno,_invalid_parameter_noinfo,FindNextFileA,GetLastError,_errno,_errno,_errno,___time64_t_from_ft,___time64_t_from_ft,___time64_t_from_ft,strcpy_s,_invoke_watson,_findfirst32i64,_errno,_invalid_parameter_noinfo,FindFirstFileExA,GetLastError,_errno,_errno,_errno,___time64_t_from_ft,___time64_t_from_ft,___time64_t_from_ft,strcpy_s,_invoke_watson,_findnext32i64,_errno,_invalid_parameter_noinfo,FindNextFileA,GetLastError,_errno,_errno,_errno,___time64_t_from_ft,___time64_t_from_ft,___time64_t_from_ft,strcpy_s,_invoke_watson,_seterrormode,SetErrorMode,	135_2_6C298B4F
Source: C:\Users\user\AppData\Roaming\Seznam.cz\bin\szndesktop.exe	Code function: 135_2_6C29A625 _wstat64,__doserrno,_errno,_invalid_parameter_noinfo,_wcspbrk,_errno,__doserrno,_errno,__doserrno,towlower,_getdrive,FindFirstFileExW,_wcspbrk,wcslen,GetDriveTypeW,free,free,_wsopen_s,__fstat64,_close,FileTimeToLocalFileTime,FileTimeToSystemTime,FileTimeToLocalFileTime,FileTimeToSystemTime,FileTimeToLocalFileTime,FileTimeToSystemTime,FindClose,GetLastError,__dosmaperr,FindClose,GetLastError,__dosmaperr,FindClose,	135_2_6C29A625
Source: C:\Users\user\AppData\Roaming\Seznam.cz\bin\szndesktop.exe	Code function: 135_2_6C298653 _findfirst32,_errno,_invalid_parameter_noinfo,FindFirstFileExA,GetLastError,_errno,_errno,_errno,___time64_t_from_ft,___time64_t_from_ft,___time64_t_from_ft,strcpy_s,_invoke_watson,_findnext32,_errno,_invalid_parameter_noinfo,FindNextFileA,GetLastError,_errno,_errno,_errno,___time64_t_from_ft,___time64_t_from_ft,___time64_t_from_ft,strcpy_s,_invoke_watson,_findfirst64,_errno,_invalid_parameter_noinfo,FindFirstFileExA,GetLastError,_errno,_errno,_errno,___time64_t_from_ft,___time64_t_from_ft,___time64_t_from_ft,strcpy_s,_invoke_watson,_findnext64,_errno,_invalid_parameter_noinfo,FindNextFileA,GetLastError,_errno,_errno,_errno,___time64_t_from_ft,___time64_t_from_ft,___time64_t_from_ft,strcpy_s,_invoke_watson,	135_2_6C298653
Source: C:\Users\user\AppData\Roaming\Seznam.cz\bin\szndesktop.exe	Code function: 135_2_6C29A1C7 _wstat32,__doserrno,_errno,_invalid_parameter_noinfo,_wcspbrk,_errno,__doserrno,towlower,_getdrive,FindFirstFileExW,_wcspbrk,wcslen,GetDriveTypeW,free,___loctotime32_t,free,_wsopen_s,__fstat32,_close,FileTimeToLocalFileTime,FileTimeToSystemTime,___loctotime32_t,FileTimeToLocalFileTime,FileTimeToSystemTime,___loctotime32_t,FileTimeToLocalFileTime,FileTimeToSystemTime,___loctotime32_t,FindClose,_errno,GetLastError,__dosmaperr,FindClose,GetLastError,__dosmaperr,FindClose,	135_2_6C29A1C7
Source: C:\Users\user\AppData\Roaming\Seznam.cz\bin\szndesktop.exe	Code function: 135_2_6C297921 _malloc_crt,FindClose,FindFirstFileExA,FindNextFileA,FindClose,	135_2_6C297921
Source: C:\Users\user\AppData\Roaming\Seznam.cz\bin\szndesktop.exe	Code function: 135_2_6C297B8B _malloc_crt,FindClose,FindFirstFileExW,FindNextFileW,FindClose,	135_2_6C297B8B
Source: C:\Users\user\AppData\Roaming\Seznam.cz\bin\szndesktop.exe	Code function: 135_2_6C2377AA _wstat64i32,_wcspbrk,towlower,FindFirstFileExW,FileTimeToLocalFileTime,FileTimeToSystemTime,FileTimeToLocalFileTime,FileTimeToSystemTime,FileTimeToLocalFileTime,FileTimeToSystemTime,FindClose,_errno,__doserrno,_getdrive,GetLastError,GetLastError,_wcspbrk,wcslen,__doserrno,_errno,_invalid_parameter_noinfo,GetDriveTypeW,free,free,_wsopen_s,__fstat64i32,_close,_errno,__dosmaperr,FindClose,__dosmaperr,FindClose,	135_2_6C2377AA
Source: C:\Users\user\AppData\Roaming\Seznam.cz\bin\szndesktop.exe	Code function: 135_2_6C299002 _wfindfirst32,_errno,_invalid_parameter_noinfo,FindFirstFileExW,GetLastError,_errno,_errno,_errno,___time64_t_from_ft,___time64_t_from_ft,___time64_t_from_ft,wcscpy_s,_invoke_watson,_wfindnext32,_errno,_invalid_parameter_noinfo,FindNextFileW,GetLastError,_errno,_errno,_errno,___time64_t_from_ft,___time64_t_from_ft,___time64_t_from_ft,wcscpy_s,_invoke_watson,_wfindfirst64,_errno,_invalid_parameter_noinfo,FindFirstFileExW,GetLastError,_errno,_errno,_errno,___time64_t_from_ft,___time64_t_from_ft,___time64_t_from_ft,wcscpy_s,_invoke_watson,_wfindnext64,_errno,_invalid_parameter_noinfo,FindNextFileW,GetLastError,_errno,_errno,_errno,___time64_t_from_ft,___time64_t_from_ft,___time64_t_from_ft,wcscpy_s,_invoke_watson,_wfindfirst64i32,_errno,_invalid_parameter_noinfo,FindFirstFileExW,GetLastError,_errno,_errno,_errno,___time64_t_from_ft,___time64_t_from_ft,___time64_t_from_ft,wcscpy_s,_invoke_watson,_wfindnext64i32,_errno,_invalid_parameter_noinfo,FindNextFileW,GetLastError,_errno,_errno,_errno,___time64_t_from_ft,___time64_t_from_ft,___time64_t_from_ft,wcscpy_s,_invoke_watson,_wfindfirst32i64,_errno,_invalid_parameter_noinfo,FindFirstFileExW,GetLastError,_errno,_errno,_errno,___time64_t_from_ft,___time64_t_from_ft,___time64_t_from_ft,wcscpy_s,_invoke_watson,_wfindnext32i64,_errno,_invalid_parameter_noinfo,FindNextFileW,GetLastError,_errno,_errno,_errno,___time64_t_from_ft,___time64_t_from_ft,___time64_t_from_ft,wcscpy_s,_invoke_watson,_access,_access_s,	135_2_6C299002
Source: C:\Users\user\AppData\Roaming\Seznam.cz\bin\szndesktop.exe	Code function: 135_2_6C35DBA0 FindFirstFileW,#210,FindNextFileW,FindClose,	135_2_6C35DBA0
Source: C:\Users\user\AppData\Roaming\Seznam.cz\bin\szndesktop.exe	Code function: 135_2_6C35EB00 #210,DeleteFileW,GetLastError,_CxxThrowException,#210,MoveFileExW,GetLastError,_CxxThrowException,#210,MoveFileExW,GetLastError,_CxxThrowException,#210,FindFirstFileW,FindClose,CopyFileW,GetLastError,_CxxThrowException,	135_2_6C35EB00

Source: C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe	File opened: C:\Users\user	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe	File opened: C:\Users\user\Desktop\desktop.ini	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe	File opened: C:\Users\user\Documents\desktop.ini	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe	File opened: C:\Users\user\AppData\Local\Temp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe	File opened: C:\Users\user\AppData	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe	File opened: C:\Users\user\AppData\Local	Jump to behavior

Source: C:\Program Files (x86)\Internet Explorer\iexplore.exe

Process created: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\BHO\ie_to_edge_stub.exe

Networking

Queries Google from non browser process on port 80

Source: C:\Windows\SysWOW64\GPhotos.scr

HTTP traffic: GET /gphotos?action=install&hl=en&gl=ch&brand=GGLA&scrid=AD0E3D47-9B39-483F-83C6-9B8C783457F6&v=(null) HTTP/1.1 Accept: */* Accept-Encoding: gzip User-Agent: Google Photos Screensaver 2.0 (gzip) Host: pack.google.com Connection: Keep-Alive

Source: global traffic	HTTP traffic detected: GET /update/packages.inf HTTP/1.1Host: download.seznam.czConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /update/cz.seznam.software.sznsetup-1.2.7-win32.zip HTTP/1.1Host: download.seznam.czConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /update/cz.seznam.software.szninstall-1.1.15-win32.zip HTTP/1.1Host: download.seznam.czConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /update/packages.inf HTTP/1.1Host: download.seznam.czConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /update/cz.seznam.software.lightspeed-1210-12.10.18-win32.zip HTTP/1.1Host: download.seznam.czConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /update/cz.seznam.software.libszndesktop-2.1.35-win32.zip HTTP/1.1Host: download.seznam.czConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /update/cz.seznam.software.szndesktop-2.0.32-win32.zip HTTP/1.1Host: download.seznam.czConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /update/cz.seznam.software.libfoxcub-3.3.8-win32.zip HTTP/1.1Host: download.seznam.czConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /update/cz.seznam.software.libfoxcub64-3.3.8-win32.zip HTTP/1.1Host: download.seznam.czConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /update/cz.seznam.software.ielisticka3-3.3.5-win32.zip HTTP/1.1Host: download.seznam.czConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /update/szn-software-fflisticka-4.0.8-win32.zip HTTP/1.1Host: download.seznam.czConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /hit/?a=event&d=%7B%22application%22%3A%22szndesktop%22%2C%22signedhash%22%3A%220%22%2C%22action%22%3A%22install_ie%22%2C%22status%22%3A0%2C%22osbuild%22%3A19045%2C%22osarch%22%3A9%2C%22iever%22%3A%2211.00.19041.1%20%28WinBuild.160101.0800%29%22%7D&s=partprog&v=2.1.35&r=1218851696&u=http://www.seznam.cz&h=B0B7C794-8699-4634-B6F9-24DA47BBD8EF&lsid=1727870994840&lses=0 HTTP/1.1Host: h.imedia.cz
Source: global traffic	HTTP traffic detected: GET /hit/?a=event&d=%7B%22action%22%3A%22startup%22%2C%22application%22%3A%22szndesktop%22%2C%22signedhash%22%3A%220%22%2C%22chrv%22%3A16%2C%22che%22%3A16%2C%22chs%22%3A16%2C%22ches%22%3A16%2C%22ie%22%3A1%2C%22osbuild%22%3A19045%2C%22osarch%22%3A9%2C%22chver%22%3A%22117.0.5938.132%22%2C%22ffver%22%3A%22118.0.1%22%2C%22iever%22%3A%2211.00.19041.1%20%28WinBuild.160101.0800%29%22%7D&s=partprog&v=2.1.35&r=-442691421&u=http://www.seznam.cz&h=B0B7C794-8699-4634-B6F9-24DA47BBD8EF&lsid=1727870998589&lses=1727870994840 HTTP/1.1Host: h.imedia.cz
Source: global traffic	HTTP traffic detected: GET /hit/?a=event&d=%7B%22application%22%3A%22szndesktop%22%2C%22signedhash%22%3A%220%22%2C%22action%22%3A%22install_ff%22%2C%22status%22%3A0%2C%22osbuild%22%3A19045%2C%22osarch%22%3A9%2C%22ffver%22%3A%22118.0.1%22%7D&s=partprog&v=2.1.35&r=-845759909&u=http://www.seznam.cz&h=B0B7C794-8699-4634-B6F9-24DA47BBD8EF&lsid=1727871000747&lses=1727870998589 HTTP/1.1Host: h.imedia.cz
Source: global traffic	HTTP traffic detected: GET /hit/?a=event&d=%7B%22application%22%3A%22szndesktop%22%2C%22signedhash%22%3A%220%22%2C%22action%22%3A%22install_ff%22%2C%22status%22%3A0%2C%22osbuild%22%3A19045%2C%22osarch%22%3A9%2C%22ffver%22%3A%22118.0.1%22%7D&s=partprog&v=2.1.35&r=-1701293468&u=http://www.seznam.cz&h=B0B7C794-8699-4634-B6F9-24DA47BBD8EF&lsid=1727871002951&lses=1727871000747 HTTP/1.1Host: h.imedia.cz
Source: global traffic	HTTP traffic detected: GET /hit/?a=event&d=%7B%22action%22%3A%22startup%22%2C%22application%22%3A%22szndesktop%22%2C%22signedhash%22%3A%220%22%2C%22chrv%22%3A48%2C%22che%22%3A48%2C%22chs%22%3A16%2C%22ches%22%3A16%2C%22ie%22%3A1%2C%22osbuild%22%3A19045%2C%22osarch%22%3A9%2C%22chver%22%3A%22117.0.5938.132%22%2C%22ffver%22%3A%22118.0.1%22%2C%22iever%22%3A%2211.00.19041.1%20%28WinBuild.160101.0800%29%22%7D&s=partprog&v=2.1.35&r=-1794028113&u=http://www.seznam.cz&h=B0B7C794-8699-4634-B6F9-24DA47BBD8EF&lsid=1727871011238&lses=1727871002951 HTTP/1.1Host: h.imedia.cz
Source: global traffic	HTTP traffic detected: GET /hit/?a=event&d=%7B%22action%22%3A%22startup%22%2C%22application%22%3A%22szndesktop%22%2C%22signedhash%22%3A%220%22%2C%22chrv%22%3A56%2C%22che%22%3A48%2C%22chs%22%3A16%2C%22ches%22%3A16%2C%22ie%22%3A1%2C%22osbuild%22%3A19045%2C%22osarch%22%3A9%2C%22chver%22%3A%22117.0.5938.132%22%2C%22ffver%22%3A%22118.0.1%22%2C%22iever%22%3A%2211.00.19041.1%20%28WinBuild.160101.0800%29%22%7D&s=partprog&v=2.1.35&r=256494956&u=http://www.seznam.cz&h=B0B7C794-8699-4634-B6F9-24DA47BBD8EF&lsid=1727871017325&lses=1727871011238 HTTP/1.1Host: h.imedia.cz
Source: global traffic	HTTP traffic detected: GET /update/packages.inf HTTP/1.1Host: download.seznam.cz
Source: global traffic	HTTP traffic detected: GET /update/cz.seznam.software.sznsetup-1.2.7-win32.zip HTTP/1.1Host: download.seznam.cz
Source: global traffic	HTTP traffic detected: GET /update/cz.seznam.software.szninstall-1.1.15-win32.zip HTTP/1.1Host: download.seznam.cz
Source: global traffic	HTTP traffic detected: GET /update/packages.inf HTTP/1.1Host: download.seznam.cz
Source: global traffic	HTTP traffic detected: GET /update/cz.seznam.software.lightspeed-1210-12.10.18-win32.zip HTTP/1.1Host: download.seznam.cz
Source: global traffic	HTTP traffic detected: GET /update/cz.seznam.software.libszndesktop-2.1.35-win32.zip HTTP/1.1Host: download.seznam.cz
Source: global traffic	HTTP traffic detected: GET /update/cz.seznam.software.szndesktop-2.0.32-win32.zip HTTP/1.1Host: download.seznam.cz
Source: global traffic	HTTP traffic detected: GET /update/cz.seznam.software.libfoxcub-3.3.8-win32.zip HTTP/1.1Host: download.seznam.cz
Source: global traffic	HTTP traffic detected: GET /update/cz.seznam.software.libfoxcub64-3.3.8-win32.zip HTTP/1.1Host: download.seznam.cz
Source: global traffic	HTTP traffic detected: GET /update/cz.seznam.software.ielisticka3-3.3.5-win32.zip HTTP/1.1Host: download.seznam.cz
Source: global traffic	HTTP traffic detected: GET /update/szn-software-fflisticka-4.0.8-win32.zip HTTP/1.1Host: download.seznam.cz

Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.16:49707 -> 77.75.76.70:80
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.16:49765 -> 77.75.76.70:80
Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.16:49775 -> 172.217.23.110:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.16:49969 -> 77.75.78.30:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.16:49972 -> 77.75.78.30:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.16:49966 -> 77.75.78.30:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.16:49960 -> 77.75.78.30:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.16:49981 -> 77.75.78.30:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.16:49996 -> 77.75.78.30:443

Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 23.200.0.9
Source: unknown	TCP traffic detected without corresponding DNS query: 23.200.0.9
Source: unknown	TCP traffic detected without corresponding DNS query: 23.200.0.9
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.40
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.40
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.40
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.40
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.40
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.40

Source: C:\Program Files (x86)\Google\Picasa3\Picasa3.exe

Code function: 20_2_04829380 QueryPerformanceCounter,HttpEndRequestA,InternetSetStatusCallback,GetLastError,InternetReadFile,InternetReadFile,

20_2_04829380

Source: global traffic

HTTP traffic detected: HTTP/1.1 200 OKCross-Origin-Resource-Policy: cross-originContent-Encoding: gzipETag: W/"c0cf1b4023295e310be6a0c4867471a65178b3c614f7cf80069684d27704e64f"Date: Wed, 02 Oct 2024 10:16:27 GMTContent-Type: application/atom+xml; charset=UTF-8Server: blogger-renderdCache-Control: public, must-revalidate, proxy-revalidate, max-age=1Vary: Accept-EncodingExpires: Wed, 02 Oct 2024 10:16:28 GMTX-Content-Type-Options: nosniffX-XSS-Protection: 0Last-Modified: Wed, 28 Aug 2024 14:47:25 GMTContent-Length: 9776X-Frame-Options: SAMEORIGINData Raw: 1f 8b 08 00 00 00 00 00 00 03 ed 7d d9 72 db c8 d2 e6 7d 3f 05 da 27 e2 d8 1d 16 48 2c 04 37 cb 3e 23 c9 4b ab 6d d9 b2 2d b7 ed be e9 00 81 22 09 13 04 60 2c a2 e8 ab 7e 88 b9 99 88 7f 22 fe 98 47 f9 1f a5 9f 64 32 b3 0a 1b 09 6e 12 25 ca 6e 75 d8 6d 89 04 0a 59 59 55 99 5f ae d8 ff cf c5 d8 95 ce 59 18 39 be f7 f8 be 5a 53 ee 4b cc b3 7c db f1 06 8f ef 7f 38 7b 2e b7 ef ff e7 c9 3e 5e 25 47 f1 d4 65 d1 90 b1 58 1a 86 ac ff f8 de 30 8e 83 6e bd 3e 99 4c 6a 3d d7 1f 0c 58 58 b3 fc 71 9d 5f 57 37 63 7f 5c b3 a2 e8 9e 14 4f 03 f6 f8 5e cc 2e e2 3a fe 0e e3 f5 19 b3 25 18 d3 8b 1e df 2f 8c 32 d1 6b 7e 38 a8 6b 8a 62 d4 0f e0 f6 fb fc 9a ae 1f 30 ef 3d 33 43 6b 98 5d 6e 76 e8 59 72 3d 0a 98 55 c7 0b 22 ba 20 8c a2 3a cc a2 9e de 2a 08 cb ee 8b ac 21 1b 9b 51 6d e0 fb 03 97 d1 18 e2 12 7c 6c 3b bd 6d c0 7c 18 a9 44 1c ff 88 08 e4 3f 66 d7 da 19 2b 2a 46 e7 d3 b9 27 ae 8d 87 39 29 41 12 ba 34 5c 34 f5 6c c7 32 63 58 82 3a 5c c0 4c 1b a7 70 ff c9 be 63 3f 89 cd 41 b7 c0 dc 3d b5 d3 e9 d0 07 b2 da 30 9a 46 b3 d3 34 8c 56 bb a9 36 db ba d2 dc af c3 1d fb 49 60 9b 31 b3 9f 68 8a d6 90 95 b6 ac b5 cf 94 56 b7 d1 ea 6a 46 ad d3 69 cb f0 8b a2 ec d7 d3 cb f6 e1 c9 6c e0 87 53 29 66 e1 f8 f1 3d 33 89 7d fe dd bd fa 93 fd d8 89 5d c6 57 f0 3e ae e0 fd 27 67 43 26 9d 02 b9 91 29 e9 d2 3b 20 f6 84 ed d7 e9 b2 27 fb 51 d2 2b de 30 8c c7 2e 4c a3 9e 7e fc 64 df 75 bc 91 14 32 77 d9 7a 70 8e fd 0b f7 c8 7d 31 90 19 04 6e ca 21 dc 57 0f 81 9b f7 f9 2e cc b8 49 24 c9 c8 bd 31 a3 fd 18 05 7e 4c 03 e2 48 51 3d f0 a3 38 aa db ac 6f 26 6e 7c bf 5e a4 25 62 6e 7f 83 47 cd 6e 78 3e 7e c5 7a 2c 7b a6 e9 02 bb 3d e0 f2 fd 02 77 eb c4 b1 b5 27 56 1e 71 98 f4 66 6f 4d 7a c0 7a f8 bc 97 f4 6a 30 b1 d2 8d b0 ce 43 3f 7c b2 ef 99 63 f6 44 2c e8 19 33 c7 fb 75 fa 64 3f 09 9d 27 0b 26 1c 84 7e df 71 59 1d 0e 8c a6 ab ed 96 a1 aa 5a db 68 18 4a 53 d3 61 63 c1 8d fb b0 a8 8e fb c4 f3 43 16 b8 d3 ff 55 b8 79 bf ce bf da 1f d8 5d 67 6c 0e d8 9a db 21 1e 26 e3 9e 07 77 de 97 26 8e 1d 83 24 50 9b 30 5d e6 0c 86 31 ff 39 0a 2d 3e 4e 04 03 Data Ascii: }r}?'H,7>#Km-"`,~"Gd2n%numYYU_Y9ZSK|8{.>^%GeX0n>Lj=XXq_W7c\O^.:%/2k~8kb0=3Ck]nvYr=U" :*!Qm|l;m|D?f+*F'9)A4\4l2cX:\Lpc?A=0F4V6I`1hVjFi

Source: C:\Program Files (x86)\Internet Explorer\iexplore.exe

File created: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Virtualized\C

Source: global traffic	HTTP traffic detected: GET /fs/windows/config.json HTTP/1.1Connection: Keep-AliveAccept: /Accept-Encoding: identityIf-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMTRange: bytes=0-2147483646User-Agent: Microsoft BITS/7.8Host: fs.microsoft.com
Source: global traffic	HTTP traffic detected: GET /update/packages.inf HTTP/1.1Host: download.seznam.czConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /update/cz.seznam.software.sznsetup-1.2.7-win32.zip HTTP/1.1Host: download.seznam.czConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /update/cz.seznam.software.szninstall-1.1.15-win32.zip HTTP/1.1Host: download.seznam.czConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /picasa/answer/93773?hl=en HTTP/1.1Accept: text/html, application/xhtml+xml, image/jxr, /Accept-Language: en-CHUser-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateConnection: Keep-AliveHost: support.google.com
Source: global traffic	HTTP traffic detected: GET /picasa/answer/157000?hl=en&visit_id=638634609885905976-1351747924&rd=1 HTTP/1.1Accept: text/html, application/xhtml+xml, image/jxr, /Accept-Language: en-CHUser-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateConnection: Keep-AliveHost: support.google.com
Source: global traffic	HTTP traffic detected: GET /picasa/answer/156347?hl=en&visit_id=638634609885905976-1351747924&rd=2 HTTP/1.1Accept: text/html, application/xhtml+xml, image/jxr, /Accept-Language: en-CHUser-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateConnection: Keep-AliveHost: support.google.com
Source: global traffic	HTTP traffic detected: GET /picasa/answer/6383491?hl=en&visit_id=638634609885905976-1351747924&rd=3 HTTP/1.1Accept: text/html, application/xhtml+xml, image/jxr, /Accept-Language: en-CHUser-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateConnection: Keep-AliveHost: support.google.com
Source: global traffic	HTTP traffic detected: GET /crx/blobs/AY4GWKDHKllS27BO_e8bCnbax_jg8ytdTG4Uzua5Kte91Msonmjt9Ssh1u4j53F3UYy-997sHknkzKEy9994XId3zBBDiju_YSunzv5QYwyL8XEx9VuF26n3JIgkmCYaLzIAxlKa5UdUDZoPCHdwU63c7rFT0JUxfsWG/GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_82_1_0.crx HTTP/1.1Host: clients2.googleusercontent.comConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /euPTmjj_6KOIZQJEA6eBnNPDVsQh79w_GUOZOjxdi8mCA2a5YlFg95RYLD3X8aJkxB0u=w36-h36 HTTP/1.1Accept: image/png, image/svg+xml, image/jxr, image/;q=0.8, /*;q=0.5Referer: https://support.google.com/picasa/answer/6383491?hl=en&visit_id=638634609885905976-1351747924&rd=3Accept-Language: en-CHUser-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: lh3.googleusercontent.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /_/scs/abc-static/_/js/k=gapi.gapi.en.SpvAvsXfWWo.O/m=gapi_iframes,googleapis_client/rt=j/sv=1/d=1/ed=1/am=AACA/rs=AHpOoo-MoqWi0fF1M09Ccs-6QfulXvxfdg/cb=gapi.loaded_0 HTTP/1.1Accept: application/javascript, /;q=0.8Referer: https://support.google.com/picasa/answer/6383491?hl=en&visit_id=638634609885905976-1351747924&rd=3Accept-Language: en-CHUser-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: apis.google.comConnection: Keep-AliveCookie: NID=517=m-X95JoeCPCfoIHtcSxsmDi2wuwakqGlxl54bZGUpbMC8a-isGAbpG2Na1kJthkxyJutWyJR96BInrx1gm8GqFOkcoEY6cxDpArB931-8AEywgrSdlj_NkfkwtkvrNVCdHigO3n64T5OJjG2D0NbQ4RfOIRTD2zql-Sl_sWD3ScVAutPLTLnrvnwfcdARGW7_nOeLc_Xx6R7hL6-4RWij2UVns3pTxlpxWQcdbV_SDnZauyMgzVrmQ
Source: global traffic	HTTP traffic detected: GET /favicon.ico HTTP/1.1Accept: /UA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: support.google.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /picasa/answer/favicon.ico HTTP/1.1User-Agent: AutoItHost: support.google.com
Source: global traffic	HTTP traffic detected: GET /update/packages.inf HTTP/1.1Host: download.seznam.czConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /assets/domains_config_gz/2.8.76/asset?assetgroup=EntityExtractionDomainsConfig HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveEdge-Asset-Group: EntityExtractionDomainsConfigSec-Mesh-Client-Edge-Version: 117.0.2045.47Sec-Mesh-Client-Edge-Channel: stableSec-Mesh-Client-OS: WindowsSec-Mesh-Client-OS-Version: 10.0.19045Sec-Mesh-Client-Arch: x86_64Sec-Mesh-Client-WebView: 0Sec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_manifest_gz/4.7.107/asset?assetgroup=Shoreline HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveEdge-Asset-Group: ShorelineSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /edge/welcome?form=M10004&mb03=true HTTP/1.1Host: www.microsoft.comConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentsec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"sec-ch-ua-platform-version: "10.0.0"Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /fwlink/?linkid=2195291 HTTP/1.1Host: go.microsoft.comConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"sec-ch-ua-platform-version: "10.0.0"Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /update/cz.seznam.software.lightspeed-1210-12.10.18-win32.zip HTTP/1.1Host: download.seznam.czConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /edge/welcome?form=M10004&mb03=true HTTP/1.1Host: www.microsoft.comConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentsec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"sec-ch-ua-platform-version: "10.0.0"sec-ch-ua-full-version: "117.0.2045.47"sec-ch-ua-arch: "x86"sec-ch-ua-bitness: "64"sec-ch-prefers-color-scheme: lightAccept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /en-gb/edge/welcome?form=M10004&mb03=true HTTP/1.1Host: www.microsoft.comConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentsec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-full-version: "117.0.2045.47"sec-ch-ua-arch: "x86"sec-ch-ua-platform: "Windows"sec-ch-ua-platform-version: "10.0.0"sec-ch-ua-bitness: "64"sec-ch-prefers-color-scheme: lightAccept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /update/cz.seznam.software.libszndesktop-2.1.35-win32.zip HTTP/1.1Host: download.seznam.czConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /shared/edgeweb/css/2e4b955.css HTTP/1.1Host: edgestatic.azureedge.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: text/css,/;q=0.1Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://www.microsoft.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /shared/edgeweb/css/105d560.css HTTP/1.1Host: edgestatic.azureedge.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: text/css,/;q=0.1Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://www.microsoft.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /shared/edgeweb/css/16d7f8e.css HTTP/1.1Host: edgestatic.azureedge.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: text/css,/;q=0.1Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://www.microsoft.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /shared/edgeweb/css/ec09bb6.css HTTP/1.1Host: edgestatic.azureedge.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: text/css,/;q=0.1Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://www.microsoft.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /shared/edgeweb/css/659e497.css HTTP/1.1Host: edgestatic.azureedge.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: text/css,/;q=0.1Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://www.microsoft.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /shared/edgeweb/css/287b8b9.css HTTP/1.1Host: edgestatic.azureedge.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: text/css,/;q=0.1Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://www.microsoft.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /shared/edgeweb/css/859decd.css HTTP/1.1Host: edgestatic.azureedge.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: text/css,/;q=0.1Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://www.microsoft.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /shared/edgeweb/5b15c2a.js HTTP/1.1Host: edgestatic.azureedge.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://www.microsoft.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /shared/edgeweb/24b82ee.js HTTP/1.1Host: edgestatic.azureedge.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://www.microsoft.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /shared/edgeweb/1c2ab9a.js HTTP/1.1Host: edgestatic.azureedge.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://www.microsoft.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /shared/edgeweb/f99a53a.js HTTP/1.1Host: edgestatic.azureedge.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://www.microsoft.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /update/cz.seznam.software.szndesktop-2.0.32-win32.zip HTTP/1.1Host: download.seznam.czConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /shared/edgeweb/6e93679.js HTTP/1.1Host: edgestatic.azureedge.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://www.microsoft.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /shared/edgeweb/76250cb.js HTTP/1.1Host: edgestatic.azureedge.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://www.microsoft.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /shared/edgeweb/9f3b99e.js HTTP/1.1Host: edgestatic.azureedge.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://www.microsoft.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /shared/edgeweb/dd71a23.js HTTP/1.1Host: edgestatic.azureedge.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://www.microsoft.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /shared/edgeweb/03948fb.js HTTP/1.1Host: edgestatic.azureedge.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://www.microsoft.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /update/cz.seznam.software.libfoxcub-3.3.8-win32.zip HTTP/1.1Host: download.seznam.czConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /shared/cms/lrs1c69a1j/logos/5a74283229e24d0ca59fb94ed941c3a0.png HTTP/1.1Host: edgestatic.azureedge.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.microsoft.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /shared/edgeweb/fonts/segoeui-vf-display.5c8aa5a.woff2 HTTP/1.1Host: edgestatic.azureedge.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://www.microsoft.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: fontReferer: https://edgestatic.azureedge.net/shared/edgeweb/css/105d560.cssAccept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /shared/edgeweb/fonts/segoeui-vf-display-semibold.b7bb141.woff2 HTTP/1.1Host: edgestatic.azureedge.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://www.microsoft.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: fontReferer: https://edgestatic.azureedge.net/shared/edgeweb/css/105d560.cssAccept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /shared/edgeweb/img/arrow-left.0af059d.svg HTTP/1.1Host: edgestatic.azureedge.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: /Origin: https://www.microsoft.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://www.microsoft.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /shared/edgeweb/img/arrow-right.96b564d.svg HTTP/1.1Host: edgestatic.azureedge.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: /Origin: https://www.microsoft.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://www.microsoft.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /mscc/lib/v2/wcp-consent.js HTTP/1.1Host: wcpstatic.microsoft.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://www.microsoft.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /shared/cms/lrs1c69a1j/section-images/f1415474cbbc413bbbf3c9fc3fd1b3d0.png HTTP/1.1Host: edgestatic.azureedge.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.microsoft.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /shared/cms/lrs1c69a1j/section-images/1c237bd147234b5b8b5ea2624c7de744.png HTTP/1.1Host: edgestatic.azureedge.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.microsoft.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /shared/edgeweb/img/fluent-qr.44414bd.svg HTTP/1.1Host: edgestatic.azureedge.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: /Origin: https://www.microsoft.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://www.microsoft.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /shared/edgeweb/img/fluent-link.baf5bd6.svg HTTP/1.1Host: edgestatic.azureedge.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: /Origin: https://www.microsoft.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://www.microsoft.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /shared/cms/lrs1c69a1j/section-images/2b2884022b26457e9368c34b176c570c.png HTTP/1.1Host: edgestatic.azureedge.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.microsoft.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /shared/edgeweb/img/fluent-dropdown.8618950.svg HTTP/1.1Host: edgestatic.azureedge.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: /Origin: https://www.microsoft.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://www.microsoft.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /shared/cms/lrs1c69a1j/section-images/a06eb816e83b48758a42ca5dbddb2e67.png HTTP/1.1Host: edgestatic.azureedge.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.microsoft.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /bloomfilterfiles/ExpandedDomainsFilterGlobal.json HTTP/1.1Host: www.bing.comConnection: keep-aliveCookie: ANON=; MUID=;_RwBf=;Sec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /shared/edgeweb/img/win11-explore.553240e.svg HTTP/1.1Host: edgestatic.azureedge.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.microsoft.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /shared/edgeweb/img/win11-start.415d423.svg HTTP/1.1Host: edgestatic.azureedge.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.microsoft.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /shared/edgeweb/img/fluent-check-bold.0ced02b.svg HTTP/1.1Host: edgestatic.azureedge.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: /Origin: https://www.microsoft.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://www.microsoft.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /apppack/edgefre HTTP/1.1Host: apps.microsoft.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: same-siteSec-Fetch-Mode: navigateSec-Fetch-Dest: iframeReferer: https://www.microsoft.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /shared/edgeweb/img/win11-edge.c5cce66.png HTTP/1.1Host: edgestatic.azureedge.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.microsoft.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /shared/cms/lrs1c69a1j/section-images/94713cf7bc7c406d83691315feaf82dd.jpg HTTP/1.1Host: edgestatic.azureedge.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.microsoft.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /shared/edgeweb/img/pinning-browser.b02edf1.svg HTTP/1.1Host: edgestatic.azureedge.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.microsoft.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /shared/edgeweb/img/pinning-arrow.e9317cd.svg HTTP/1.1Host: edgestatic.azureedge.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.microsoft.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /shared/cms/lrs1c69a1j/section-images/89ff15806b9e4b09b2fb21673a1c7094.webp HTTP/1.1Host: edgestatic.azureedge.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.microsoft.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /update/cz.seznam.software.libfoxcub64-3.3.8-win32.zip HTTP/1.1Host: download.seznam.czConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /apppack/edgefre?hl=en-us&gl=US HTTP/1.1Host: apps.microsoft.comConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: same-siteSec-Fetch-Mode: navigateSec-Fetch-Dest: iframesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Referer: https://www.microsoft.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: MSCC=NR
Source: global traffic	HTTP traffic detected: GET /shared/edgeweb/img/max.5b1398e.png HTTP/1.1Host: edgestatic.azureedge.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.microsoft.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /shared/edgeweb/img/pinterest.b958ffd.png HTTP/1.1Host: edgestatic.azureedge.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.microsoft.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /shared/edgeweb/img/amazon.a8a5fd1.png HTTP/1.1Host: edgestatic.azureedge.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.microsoft.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /shared/edgeweb/img/instagram.4cd031e.png HTTP/1.1Host: edgestatic.azureedge.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.microsoft.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /shared/edgeweb/img/facebook.bb606e7.png HTTP/1.1Host: edgestatic.azureedge.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.microsoft.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /npm/@shoelace-style/shoelace@2.12.0/cdn/themes/light.css HTTP/1.1Host: cdn.jsdelivr.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: text/css,/;q=0.1Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://apps.microsoft.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /shared/edgeweb/img/outlook.dcd709d.png HTTP/1.1Host: edgestatic.azureedge.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.microsoft.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /assets/js/index-3c527300.css HTTP/1.1Host: apps.microsoft.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: text/css,/;q=0.1Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://apps.microsoft.com/apppack/edgefre?hl=en-us&gl=USAccept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: MSCC=NR
Source: global traffic	HTTP traffic detected: GET /assets/js/index-36d30887.js HTTP/1.1Host: apps.microsoft.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://apps.microsoft.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://apps.microsoft.com/apppack/edgefre?hl=en-us&gl=USAccept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: MSCC=NR
Source: global traffic	HTTP traffic detected: GET /shared/edgeweb/img/office.b772a89.png HTTP/1.1Host: edgestatic.azureedge.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.microsoft.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /shared/cms/lrs1c69a1j/section-images/935d5e3b261649808ca8fbeb888a5d63.png HTTP/1.1Host: edgestatic.azureedge.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.microsoft.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /shared/cms/lrs1c69a1j/section-images/38c8c879d3854390897db9c4b7f3a682.jpg HTTP/1.1Host: edgestatic.azureedge.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.microsoft.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /shared/cms/lrs1c69a1j/section-images/2068e415cbe2442b82f2fba24ee0c202.png HTTP/1.1Host: edgestatic.azureedge.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.microsoft.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /shared/cms/lrs1c69a1j/section-images/166ba0e92d8b4ad0b18bdf3455bfce5c.jpg HTTP/1.1Host: edgestatic.azureedge.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.microsoft.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /filestreamingservice/files/bdc392b9-6b81-4aaa-b3ee-2fffd9562edb?P1=1728468990&P2=404&P3=2&P4=fYCr80phaT2bw%2b97uzl%2bZm4Y9sWhLMBhIRsYhHez6bNE%2fFFZZ4zgZrSJ7EBeaEm2%2fZHS5qyeUFkGOOxDRvW5Gw%3d%3d HTTP/1.1Host: msedgeextensions.sf.tlu.dl.delivery.mp.microsoft.comConnection: keep-aliveMS-CV: xxx6Kkdk1ksoy08AVfOlJeSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /clarity.js HTTP/1.1Host: apps.microsoft.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://apps.microsoft.com/apppack/edgefre?hl=en-us&gl=USAccept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: MSCC=NR
Source: global traffic	HTTP traffic detected: GET /shared/cms/lrs1c69a1j/section-images/cea0e14e0ec44c1a9e8b92a6715ef1c1.png HTTP/1.1Host: edgestatic.azureedge.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.microsoft.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /update/cz.seznam.software.ielisticka3-3.3.5-win32.zip HTTP/1.1Host: download.seznam.czConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /assets/js/index-70a46923.js HTTP/1.1Host: apps.microsoft.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://apps.microsoft.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://apps.microsoft.com/assets/js/index-36d30887.jsAccept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: MSCC=NR
Source: global traffic	HTTP traffic detected: GET /louserzed-strings/en-gb/strings.json?v=bd1e6f1fd0 HTTP/1.1Host: apps.microsoft.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://apps.microsoft.com/apppack/edgefre?hl=en-us&gl=USAccept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: MSCC=NR
Source: global traffic	HTTP traffic detected: GET /api/settings/flags?gl=US&hl=en-us&sessionId= HTTP/1.1Host: apps.microsoft.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47X-API-Ref: db2c8457ef6ae807db500c0199cc06898be1b23d3cd9b3206a65b7c81f4185f0sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://apps.microsoft.com/apppack/edgefre?hl=en-us&gl=USAccept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: MSCC=NR
Source: global traffic	HTTP traffic detected: GET /api/Products/ZeroStateSearch?gl=US&hl=en-us HTTP/1.1Host: apps.microsoft.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47X-API-Ref: ebe1c0636328a720580a52e74af985ddefbb0609f391016b633be0072e31e7fcsec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://apps.microsoft.com/apppack/edgefre?hl=en-us&gl=USAccept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: MSCC=NR
Source: global traffic	HTTP traffic detected: GET /shared/cms/lrs1c69a1j/section-images/92176a17dafb4a90a9de118656f92fb2.jpg HTTP/1.1Host: edgestatic.azureedge.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.microsoft.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /shared/cms/lrs1c69a1j/section-images/bbd7bff84da242f286f1e64f4f51d171.jpg HTTP/1.1Host: edgestatic.azureedge.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.microsoft.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /shared/cms/lrs1c69a1j/section-images/d369d673d1e74d5eb64a9da00f0a2c2b.jpg HTTP/1.1Host: edgestatic.azureedge.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.microsoft.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /shared/cms/lrs1c69a1j/section-images/fbee95612d3b45979dd58820b1e0df59.jpg HTTP/1.1Host: edgestatic.azureedge.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.microsoft.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /shared/cms/lrs1c69a1j/section-images/e37077f885ed4fa6961e58e8b4c8b10d.jpg HTTP/1.1Host: edgestatic.azureedge.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.microsoft.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /shared/cms/lrs1c69a1j/section-images/173b124fd99446babb8439cf477b38fd.jpg HTTP/1.1Host: edgestatic.azureedge.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.microsoft.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /dmp/up/pixie.js HTTP/1.1Host: acdn.adnxs.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://www.microsoft.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /scripts/c/ms.jsll-3.min.js HTTP/1.1Host: js.monitor.azure.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://www.microsoft.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /shared/cms/lrs1c69a1j/section-images/ea9d7038df454660bfdb39a6de1c22d8.jpg HTTP/1.1Host: edgestatic.azureedge.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.microsoft.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /shared/cms/lrs1c69a1j/section-images/7a62d65e6d6b48d5b5278067c3a78dba.png HTTP/1.1Host: edgestatic.azureedge.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.microsoft.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /en_US/fbevents.js HTTP/1.1Host: connect.facebook.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://www.microsoft.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /assets/js/applicationinsights-web-9ad09b9c.js HTTP/1.1Host: apps.microsoft.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://apps.microsoft.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: scriptAccept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: MSCC=NR; exp-session-id=b6d0ece2-29a7-4143-931c-d621648d7cb8
Source: global traffic	HTTP traffic detected: GET /assets/js/InstrumentHooks-cd565348.js HTTP/1.1Host: apps.microsoft.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://apps.microsoft.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: scriptAccept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: MSCC=NR; exp-session-id=b6d0ece2-29a7-4143-931c-d621648d7cb8
Source: global traffic	HTTP traffic detected: GET /assets/js/applicationinsights-core-js-9783d46c.js HTTP/1.1Host: apps.microsoft.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://apps.microsoft.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: scriptAccept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: MSCC=NR; exp-session-id=b6d0ece2-29a7-4143-931c-d621648d7cb8
Source: global traffic	HTTP traffic detected: GET /shared/cms/lrs1c69a1j/section-videos/3dd826a043744d6cbfe55165a35a8ec8.mp4 HTTP/1.1Host: edgestatic.azureedge.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Accept-Encoding: identity;q=1, ;q=0sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: /*Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: videoReferer: https://www.microsoft.com/Accept-Language: en-GB,en;q=0.9,en-US;q=0.8Range: bytes=0-
Source: global traffic	HTTP traffic detected: GET /assets/js/Index-cbed7ffc.js HTTP/1.1Host: apps.microsoft.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://apps.microsoft.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://apps.microsoft.com/assets/js/index-36d30887.jsAccept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: MSCC=NR; exp-session-id=b6d0ece2-29a7-4143-931c-d621648d7cb8
Source: global traffic	HTTP traffic detected: GET /update/szn-software-fflisticka-4.0.8-win32.zip HTTP/1.1Host: download.seznam.czConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /tag/inyago70pn HTTP/1.1Host: www.clarity.msConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://apps.microsoft.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /tag/edvmnysmkk HTTP/1.1Host: www.clarity.msConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://www.microsoft.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /assets/js/edgefre-0b65e548.js HTTP/1.1Host: apps.microsoft.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://apps.microsoft.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: scriptAccept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: MSCC=NR; exp-session-id=b6d0ece2-29a7-4143-931c-d621648d7cb8
Source: global traffic	HTTP traffic detected: GET /li.lms-analytics/insight.min.js HTTP/1.1Host: snap.licdn.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://www.microsoft.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /pixie/up?pi=e8619ae9-c189-46ef-bfc8-f39e0ac838fd HTTP/1.1Host: ib.adnxs.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: /Origin: https://www.microsoft.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://www.microsoft.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /bat.js HTTP/1.1Host: bat.bing.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: /X-Edge-Shopping-Flag: 1Sec-MS-GEC: FF699648EBF162654E01182ED0BD24EDB1A2721B7E78C7D8756497D88A893629Sec-MS-GEC-Version: 1-117.0.2045.47Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://www.microsoft.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /shared/edgeweb/fonts/segoeui-vf-display-bold.3b9304c.woff2 HTTP/1.1Host: edgestatic.azureedge.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://www.microsoft.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: fontReferer: https://edgestatic.azureedge.net/shared/edgeweb/css/105d560.cssAccept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /assets/js/product-collection-86c4abf3.js HTTP/1.1Host: apps.microsoft.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://apps.microsoft.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: scriptAccept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: MSCC=NR; exp-session-id=b6d0ece2-29a7-4143-931c-d621648d7cb8
Source: global traffic	HTTP traffic detected: GET /assets/js/nav-bar-ed71552c.js HTTP/1.1Host: apps.microsoft.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://apps.microsoft.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: scriptAccept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: MSCC=NR; exp-session-id=b6d0ece2-29a7-4143-931c-d621648d7cb8
Source: global traffic	HTTP traffic detected: GET /s/0.7.47/clarity.js HTTP/1.1Host: www.clarity.msConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://www.microsoft.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: CLID=c6083d87285244068a54b7c1410cd9fd.20241002.20251002
Source: global traffic	HTTP traffic detected: GET /s/0.7.47/clarity-extended.js HTTP/1.1Host: www.clarity.msConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://apps.microsoft.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: CLID=c6083d87285244068a54b7c1410cd9fd.20241002.20251002
Source: global traffic	HTTP traffic detected: GET /shared/cms/lrs1c69a1j/section-videos/3dd826a043744d6cbfe55165a35a8ec8.mp4 HTTP/1.1Host: edgestatic.azureedge.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Accept-Encoding: identity;q=1, ;q=0sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: /*Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: videoReferer: https://www.microsoft.com/Accept-Language: en-GB,en;q=0.9,en-US;q=0.8Range: bytes=2785280-2823167If-Range: W/"2b1400-18c5bb7f0e4"
Source: global traffic	HTTP traffic detected: GET /assets/js/auto-complete-app-search-c8ed58b0.js HTTP/1.1Host: apps.microsoft.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://apps.microsoft.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: scriptAccept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: MSCC=NR; exp-session-id=b6d0ece2-29a7-4143-931c-d621648d7cb8
Source: global traffic	HTTP traffic detected: GET /assets/js/collection-helper-ed90e706.js HTTP/1.1Host: apps.microsoft.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://apps.microsoft.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: scriptAccept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: MSCC=NR; exp-session-id=b6d0ece2-29a7-4143-931c-d621648d7cb8
Source: global traffic	HTTP traffic detected: GET /assets/js/paged-list-777752e9.js HTTP/1.1Host: apps.microsoft.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://apps.microsoft.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: scriptAccept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: MSCC=NR; exp-session-id=b6d0ece2-29a7-4143-931c-d621648d7cb8
Source: global traffic	HTTP traffic detected: GET /pixie?e=LandingPage&pi=e8619ae9-c189-46ef-bfc8-f39e0ac838fd&it=1727864209441&v=0.0.41&u=https%3A%2F%2Fwww.microsoft.com%2Fen-gb%2Fedge%2Fwelcome%3Fform%3DM10004%26mb03%3Dtrue&st=1727864209440&et=1727864210207&if=0&uetmsmid=ead072c6-87b6-4905-8bcf-231e8931644d&asce=0&ascc=0&tcfhl=0&tcfe=0&tcfgdpr=0&tcfc=0 HTTP/1.1Host: ib.adnxs.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.microsoft.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /assets/js/flip-animation-helper-712a32df.js HTTP/1.1Host: apps.microsoft.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://apps.microsoft.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: scriptAccept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: MSCC=NR; exp-session-id=b6d0ece2-29a7-4143-931c-d621648d7cb8
Source: global traffic	HTTP traffic detected: GET /p/action/355008692.js HTTP/1.1Host: bat.bing.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: /X-Edge-Shopping-Flag: 1Sec-MS-GEC: FF699648EBF162654E01182ED0BD24EDB1A2721B7E78C7D8756497D88A893629Sec-MS-GEC-Version: 1-117.0.2045.47Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://www.microsoft.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /collect?v=2&fmt=js&pid=7850&time=1727864210223&li_adsId=c6366846-7f41-4708-9fb6-3269a23fdc13&url=https%3A%2F%2Fwww.microsoft.com%2Fen-gb%2Fedge%2Fwelcome%3Fform%3DM10004%26mb03%3Dtrue HTTP/1.1Host: px.ads.linkedin.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.microsoft.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /assets/js/collection-types-77c388cf.js HTTP/1.1Host: apps.microsoft.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://apps.microsoft.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: scriptAccept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: MSCC=NR; exp-session-id=b6d0ece2-29a7-4143-931c-d621648d7cb8
Source: global traffic	HTTP traffic detected: GET /tr/?id=1770559986549030&ev=PageView&dl=https%3A%2F%2Fwww.microsoft.com%2Fen-gb%2Fedge%2Fwelcome%3Fform%3DM10004%26mb03%3Dtrue&rl=&if=false&ts=1727864210807&sw=1280&sh=1024&v=2.9.170&r=stable&ec=0&o=4126&fbp=fb.1.1727864210794.836094937724409315&cs_est=true&ler=empty&it=1727864210083&coo=false&rqm=GET HTTP/1.1Host: www.facebook.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.microsoft.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /assets/icons/download-psi.svg HTTP/1.1Host: apps.microsoft.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"traceparent: 00-3b21d183801646059abf60aea5313c9b-493e3c1559104b6e-01request-id: \|3b21d183801646059abf60aea5313c9b.493e3c1559104b6esec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://apps.microsoft.com/apppack/edgefre?hl=en-us&gl=USAccept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: MSCC=NR; exp-session-id=b6d0ece2-29a7-4143-931c-d621648d7cb8; ai_user=gPFm7QcR2pV4O/zkZSC6dC\|2024-10-02T10:16:49.985Z; ai_session=KeivHP7d5TFls18euJ+R3i\|1727864209993\|1727864209993; _fbp=fb.1.1727864210794.836094937724409315; _clck=1x4xmda%7C2%7Cfpo%7C0%7C1736; _uetsid=70ac830080a711efa9fc9be06d42c5d1; _uetvid=70acc12080a711efa4bbe5908cfb5aee
Source: global traffic	HTTP traffic detected: GET /action/0?ti=355008692&Ver=2&mid=2f7ef59e-c4f4-48b2-910f-313aa21048be&sid=70ac830080a711efa9fc9be06d42c5d1&vid=70acc12080a711efa4bbe5908cfb5aee&vids=1&msclkid=N&uach=pv%3D10.0.0&pi=918639831&lg=en-GB&sw=1280&sh=1024&sc=24&tl=Welcome%20to%20Microsoft%20Edge&p=https%3A%2F%2Fwww.microsoft.com%2Fen-gb%2Fedge%2Fwelcome%3Fform%3DM10004%26mb03%3Dtrue&r=&lt=11581&evt=pageLoad&sv=1&cdb=AQAQ&rn=989132 HTTP/1.1Host: bat.bing.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8X-Edge-Shopping-Flag: 1Sec-MS-GEC: FF699648EBF162654E01182ED0BD24EDB1A2721B7E78C7D8756497D88A893629Sec-MS-GEC-Version: 1-117.0.2045.47Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.microsoft.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /action/0?ti=355008692&Ver=2&mid=2f7ef59e-c4f4-48b2-910f-313aa21048be&sid=70ac830080a711efa9fc9be06d42c5d1&vid=70acc12080a711efa4bbe5908cfb5aee&vids=0&msclkid=N&ea=Other-Info-Screenwidth-1280&en=Y&p=https%3A%2F%2Fwww.microsoft.com%2Fen-gb%2Fedge%2Fwelcome&sw=1280&sh=1024&sc=24&evt=custom&cdb=AQAQ&rn=692432 HTTP/1.1Host: bat.bing.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8X-Edge-Shopping-Flag: 1Sec-MS-GEC: FF699648EBF162654E01182ED0BD24EDB1A2721B7E78C7D8756497D88A893629Sec-MS-GEC-Version: 1-117.0.2045.47Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.microsoft.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /action/0?ti=355008692&Ver=2&mid=2f7ef59e-c4f4-48b2-910f-313aa21048be&sid=70ac830080a711efa9fc9be06d42c5d1&vid=70acc12080a711efa4bbe5908cfb5aee&vids=0&msclkid=N&ea=Other-Info-Screenheight-1024&en=Y&p=https%3A%2F%2Fwww.microsoft.com%2Fen-gb%2Fedge%2Fwelcome&sw=1280&sh=1024&sc=24&evt=custom&cdb=AQAQ&rn=591063 HTTP/1.1Host: bat.bing.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8X-Edge-Shopping-Flag: 1Sec-MS-GEC: FF699648EBF162654E01182ED0BD24EDB1A2721B7E78C7D8756497D88A893629Sec-MS-GEC-Version: 1-117.0.2045.47Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.microsoft.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /action/0?ti=355008692&Ver=2&mid=2f7ef59e-c4f4-48b2-910f-313aa21048be&sid=70ac830080a711efa9fc9be06d42c5d1&vid=70acc12080a711efa4bbe5908cfb5aee&vids=0&msclkid=N&ea=Other-Info-Pixelratio-1&en=Y&p=https%3A%2F%2Fwww.microsoft.com%2Fen-gb%2Fedge%2Fwelcome&sw=1280&sh=1024&sc=24&evt=custom&cdb=AQAQ&rn=953385 HTTP/1.1Host: bat.bing.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8X-Edge-Shopping-Flag: 1Sec-MS-GEC: FF699648EBF162654E01182ED0BD24EDB1A2721B7E78C7D8756497D88A893629Sec-MS-GEC-Version: 1-117.0.2045.47Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.microsoft.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /action/0?ti=355008692&Ver=2&mid=2f7ef59e-c4f4-48b2-910f-313aa21048be&sid=70ac830080a711efa9fc9be06d42c5d1&vid=70acc12080a711efa4bbe5908cfb5aee&vids=0&msclkid=N&ea=Action-Firstslide-AiIntro&en=Y&p=https%3A%2F%2Fwww.microsoft.com%2Fen-gb%2Fedge%2Fwelcome&sw=1280&sh=1024&sc=24&evt=custom&cdb=AQAQ&rn=399722 HTTP/1.1Host: bat.bing.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8X-Edge-Shopping-Flag: 1Sec-MS-GEC: FF699648EBF162654E01182ED0BD24EDB1A2721B7E78C7D8756497D88A893629Sec-MS-GEC-Version: 1-117.0.2045.47Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.microsoft.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /collect?v=2&fmt=js&pid=7850&time=1727864210223&li_adsId=c6366846-7f41-4708-9fb6-3269a23fdc13&url=https%3A%2F%2Fwww.microsoft.com%2Fen-gb%2Fedge%2Fwelcome%3Fform%3DM10004%26mb03%3Dtrue&cookiesTest=true HTTP/1.1Host: px.ads.linkedin.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.microsoft.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: li_sugr=d35b3f83-bdbb-45a3-85ce-a0229f826989; bcookie="v=2&2516b960-85ad-4191-847f-415a33eda43e"; lidc="b=TGST06:s=T:r=T:a=T:p=T:g=3013:u=1:x=1:i=1727864211:t=1727950611:v=2:sig=AQG_p4RFuAy5RLp45N0Pq_b0ZbnDEu0_"
Source: global traffic	HTTP traffic detected: GET /tag/uet/355008692?insights=1 HTTP/1.1Host: www.clarity.msConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://www.microsoft.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: CLID=c6083d87285244068a54b7c1410cd9fd.20241002.20251002
Source: global traffic	HTTP traffic detected: GET /image/apps.8453.13655054093851568.4a371b72-2ce8-4bdb-9d83-be49894d3fa0.7f3687b9-847d-4f86-bb5c-c73259e2b38e?w=75 HTTP/1.1Host: store-images.s-microsoft.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://apps.microsoft.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /image/apps.56161.9007199266246365.1d5a6a53-3c49-4f80-95d7-78d76b0e05d0.a3e87fea-e03e-4c0a-8f26-9ecef205fa7b?w=75 HTTP/1.1Host: store-images.s-microsoft.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://apps.microsoft.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /image/apps.25776.14473651905739879.c2c2c20a-48ca-4b7a-a0c5-392cddcd557e.dbe766f0-50a3-4270-957c-d06415f86f39?w=75 HTTP/1.1Host: store-images.s-microsoft.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://apps.microsoft.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /service-worker.js HTTP/1.1Host: apps.microsoft.comConnection: keep-aliveCache-Control: max-age=0Accept: /Service-Worker: scriptUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Sec-Fetch-Site: same-originSec-Fetch-Mode: same-originSec-Fetch-Dest: serviceworkerReferer: https://apps.microsoft.com/apppack/edgefre?hl=en-us&gl=USAccept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: MSCC=NR; exp-session-id=b6d0ece2-29a7-4143-931c-d621648d7cb8; ai_user=gPFm7QcR2pV4O/zkZSC6dC\|2024-10-02T10:16:49.985Z; ai_session=KeivHP7d5TFls18euJ+R3i\|1727864209993\|1727864209993; _fbp=fb.1.1727864210794.836094937724409315; _clck=1x4xmda%7C2%7Cfpo%7C0%7C1736
Source: global traffic	HTTP traffic detected: GET /consumers/oauth2/v2.0/authorize?client_id=929d973a-a08f-46a0-80b5-3c690ee1ee5f&scope=User.Read%20offline_access%20openid%20profile&redirect_uri=https%3A%2F%2Fapps.microsoft.com%2F&client-request-id=01924cbb-87e4-7744-aa7b-63aaf0118cbd&response_mode=fragment&response_type=code&x-client-SKU=msal.js.browser&x-client-VER=3.18.0&client_info=1&code_challenge=12wPOc1UDIDnCIHouMCWAbj0MmuWrsUyf6M21SmFz-A&code_challenge_method=S256&prompt=none&nonce=01924cbb-8810-75ee-8ce9-2c4082eafda8&state=eyJpZCI6IjAxOTI0Y2JiLTg3ZTQtNzBkZi1iZDFhLWVlMzFlYzFkOWE0YSIsIm1ldGEiOnsiaW50ZXJhY3Rpb25UeXBlIjoic2lsZW50In19 HTTP/1.1Host: login.microsoftonline.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-Dest: iframeReferer: https://apps.microsoft.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /px/li_sync?redirect=https%3A%2F%2Fpx.ads.linkedin.com%2Fcollect%3Fv%3D2%26fmt%3Djs%26pid%3D7850%26time%3D1727864210223%26li_adsId%3Dc6366846-7f41-4708-9fb6-3269a23fdc13%26url%3Dhttps%253A%252F%252Fwww.microsoft.com%252Fen-gb%252Fedge%252Fwelcome%253Fform%253DM10004%2526mb03%253Dtrue%26cookiesTest%3Dtrue%26liSync%3Dtrue HTTP/1.1Host: www.linkedin.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.microsoft.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: li_sugr=d35b3f83-bdbb-45a3-85ce-a0229f826989; bcookie="v=2&2516b960-85ad-4191-847f-415a33eda43e"; lidc="b=TGST06:s=T:r=T:a=T:p=T:g=3013:u=1:x=1:i=1727864211:t=1727950611:v=2:sig=AQG_p4RFuAy5RLp45N0Pq_b0ZbnDEu0_"; UserMatchHistory=AQIyePVLc9XnZgAAAZJMu4yU2_WgOCBxObdkN0Wk2LpTA7gLTgo39UVR7LkM-ElLklnw9wU5PMNQRQ; AnalyticsSyncHistory=AQKSK2PlgfRT2AAAAZJMu4yUVhKeSnIwUJNjMHTmLuEK0NvpIjlatlsxaB_7NFCL0oKdIIi5nD5QhsrMvCHBIw
Source: global traffic	HTTP traffic detected: GET /assets/js/_commonjsHelpers-39b5b250.js HTTP/1.1Host: apps.microsoft.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://apps.microsoft.com/service-worker.jsAccept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: MSCC=NR; exp-session-id=b6d0ece2-29a7-4143-931c-d621648d7cb8; ai_user=gPFm7QcR2pV4O/zkZSC6dC\|2024-10-02T10:16:49.985Z; ai_session=KeivHP7d5TFls18euJ+R3i\|1727864209993\|1727864209993; _fbp=fb.1.1727864210794.836094937724409315; _clck=1x4xmda%7C2%7Cfpo%7C0%7C1736; _uetsid=70ac830080a711efa9fc9be06d42c5d1; _uetvid=70acc12080a711efa4bbe5908cfb5aee; _clsk=z8aa33%7C1727864211918%7C1%7C0%7Ct.clarity.ms%2Fcollect
Source: global traffic	HTTP traffic detected: GET /collect?v=2&fmt=js&pid=7850&time=1727864210223&li_adsId=c6366846-7f41-4708-9fb6-3269a23fdc13&url=https%3A%2F%2Fwww.microsoft.com%2Fen-gb%2Fedge%2Fwelcome%3Fform%3DM10004%26mb03%3Dtrue&cookiesTest=true&liSync=true HTTP/1.1Host: px.ads.linkedin.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.microsoft.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: li_sugr=d35b3f83-bdbb-45a3-85ce-a0229f826989; bcookie="v=2&2516b960-85ad-4191-847f-415a33eda43e"; lidc="b=TGST06:s=T:r=T:a=T:p=T:g=3013:u=1:x=1:i=1727864211:t=1727950611:v=2:sig=AQG_p4RFuAy5RLp45N0Pq_b0ZbnDEu0_"; UserMatchHistory=AQIyePVLc9XnZgAAAZJMu4yU2_WgOCBxObdkN0Wk2LpTA7gLTgo39UVR7LkM-ElLklnw9wU5PMNQRQ; AnalyticsSyncHistory=AQKSK2PlgfRT2AAAAZJMu4yUVhKeSnIwUJNjMHTmLuEK0NvpIjlatlsxaB_7NFCL0oKdIIi5nD5QhsrMvCHBIw
Source: global traffic	HTTP traffic detected: GET /offline.html HTTP/1.1Host: apps.microsoft.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://apps.microsoft.com/service-worker.jsAccept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: MSCC=NR; exp-session-id=b6d0ece2-29a7-4143-931c-d621648d7cb8; ai_user=gPFm7QcR2pV4O/zkZSC6dC\|2024-10-02T10:16:49.985Z; ai_session=KeivHP7d5TFls18euJ+R3i\|1727864209993\|1727864209993; _fbp=fb.1.1727864210794.836094937724409315; _clck=1x4xmda%7C2%7Cfpo%7C0%7C1736; _uetsid=70ac830080a711efa9fc9be06d42c5d1; _uetvid=70acc12080a711efa4bbe5908cfb5aee; _clsk=z8aa33%7C1727864211918%7C1%7C0%7Ct.clarity.ms%2Fcollect
Source: global traffic	HTTP traffic detected: GET /shared/cms/lrs1c69a1j/section-videos/3dd826a043744d6cbfe55165a35a8ec8.mp4 HTTP/1.1Host: edgestatic.azureedge.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Accept-Encoding: identity;q=1, ;q=0sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: /*Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: videoReferer: https://www.microsoft.com/Accept-Language: en-GB,en;q=0.9,en-US;q=0.8Range: bytes=32768-
Source: global traffic	HTTP traffic detected: GET /assets/js/about-b1ba6593.js HTTP/1.1Host: apps.microsoft.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://apps.microsoft.com/service-worker.jsAccept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: MSCC=NR; exp-session-id=b6d0ece2-29a7-4143-931c-d621648d7cb8; ai_user=gPFm7QcR2pV4O/zkZSC6dC\|2024-10-02T10:16:49.985Z; ai_session=KeivHP7d5TFls18euJ+R3i\|1727864209993\|1727864209993; _fbp=fb.1.1727864210794.836094937724409315; _clck=1x4xmda%7C2%7Cfpo%7C0%7C1736; _uetsid=70ac830080a711efa9fc9be06d42c5d1; _uetvid=70acc12080a711efa4bbe5908cfb5aee; _clsk=z8aa33%7C1727864211918%7C1%7C0%7Ct.clarity.ms%2Fcollect; MC1=GUID=40944b817c6f43219ea5caba422ead52&HASH=4094&LV=202410&V=4&LU=1727864214076; MS0=5d5a28dc628a46d8918acde28b77f98f
Source: global traffic	HTTP traffic detected: GET /oauth20_authorize.srf?client_id=929d973a-a08f-46a0-80b5-3c690ee1ee5f&scope=User.Read+offline_access+openid+profile&redirect_uri=https%3a%2f%2fapps.microsoft.com%2f&response_type=code&state=eyJpZCI6IjAxOTI0Y2JiLTg3ZTQtNzBkZi1iZDFhLWVlMzFlYzFkOWE0YSIsIm1ldGEiOnsiaW50ZXJhY3Rpb25UeXBlIjoic2lsZW50In19&response_mode=fragment&nonce=01924cbb-8810-75ee-8ce9-2c4082eafda8&prompt=none&code_challenge=NzfLDfZZ9pa9p594AEIvEIVcYy8SF9QRmo7u5zhFThU&code_challenge_method=S256&x-client-SKU=msal.js.browser&x-client-Ver=3.18.0&uaid=01924cbb87e47744aa7b63aaf0118cbd&msproxy=1&issuer=mso&tenant=consumers&ui_locales=en-GB&client_info=1&epct=PAQABDgEAAADW6jl31mB3T7ugrWTT8pFewSlPCygvk1lyVk6poWg0cXhJYK5z7bDUkD84hYnFfpGk3Dqr8p-SQwUSFQo5nwp3L68_LzPzWl5zH1OvuQD7NdyuHDbID_p9Jf4HLB5epgLIUALB3rtkYUSQiYgSVPxYXqac_1W8-J_7c4W3yxQ9bEdyMvnVmMGhSZsTYIASrVH9UgXMbgwz3xj-5Qd_uUH7-FDN9pHWVUPGxJLoz3Q_BSAA&jshs=0 HTTP/1.1Host: login.live.comConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-Dest: iframesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Referer: https://apps.microsoft.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /assets/js/additional-info-b4cc1e57.js HTTP/1.1Host: apps.microsoft.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://apps.microsoft.com/service-worker.jsAccept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: MSCC=NR; exp-session-id=b6d0ece2-29a7-4143-931c-d621648d7cb8; ai_user=gPFm7QcR2pV4O/zkZSC6dC\|2024-10-02T10:16:49.985Z; ai_session=KeivHP7d5TFls18euJ+R3i\|1727864209993\|1727864209993; _fbp=fb.1.1727864210794.836094937724409315; _clck=1x4xmda%7C2%7Cfpo%7C0%7C1736; _uetsid=70ac830080a711efa9fc9be06d42c5d1; _uetvid=70acc12080a711efa4bbe5908cfb5aee; _clsk=z8aa33%7C1727864211918%7C1%7C0%7Ct.clarity.ms%2Fcollect; MC1=GUID=40944b817c6f43219ea5caba422ead52&HASH=4094&LV=202410&V=4&LU=1727864214076; MS0=5d5a28dc628a46d8918acde28b77f98f
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: apps.microsoft.comConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-Dest: iframesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Referer: https://apps.microsoft.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: MSCC=NR; exp-session-id=b6d0ece2-29a7-4143-931c-d621648d7cb8; ai_user=gPFm7QcR2pV4O/zkZSC6dC\|2024-10-02T10:16:49.985Z; ai_session=KeivHP7d5TFls18euJ+R3i\|1727864209993\|1727864209993; _fbp=fb.1.1727864210794.836094937724409315; _clck=1x4xmda%7C2%7Cfpo%7C0%7C1736; _uetsid=70ac830080a711efa9fc9be06d42c5d1; _uetvid=70acc12080a711efa4bbe5908cfb5aee; _clsk=z8aa33%7C1727864211918%7C1%7C0%7Ct.clarity.ms%2Fcollect; MC1=GUID=40944b817c6f43219ea5caba422ead52&HASH=4094&LV=202410&V=4&LU=1727864214076; MS0=5d5a28dc628a46d8918acde28b77f98f
Source: global traffic	HTTP traffic detected: GET /assets/js/alert-service-3c7acae3.js HTTP/1.1Host: apps.microsoft.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://apps.microsoft.com/service-worker.jsAccept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: MSCC=NR; exp-session-id=b6d0ece2-29a7-4143-931c-d621648d7cb8; ai_user=gPFm7QcR2pV4O/zkZSC6dC\|2024-10-02T10:16:49.985Z; ai_session=KeivHP7d5TFls18euJ+R3i\|1727864209993\|1727864209993; _fbp=fb.1.1727864210794.836094937724409315; _clck=1x4xmda%7C2%7Cfpo%7C0%7C1736; _uetsid=70ac830080a711efa9fc9be06d42c5d1; _uetvid=70acc12080a711efa4bbe5908cfb5aee; _clsk=z8aa33%7C1727864211918%7C1%7C0%7Ct.clarity.ms%2Fcollect; MC1=GUID=40944b817c6f43219ea5caba422ead52&HASH=4094&LV=202410&V=4&LU=1727864214076; MS0=5d5a28dc628a46d8918acde28b77f98f
Source: global traffic	HTTP traffic detected: GET /?hl=en-gb&gl=US HTTP/1.1Host: apps.microsoft.comConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-Dest: iframesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Referer: https://apps.microsoft.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: MSCC=NR; exp-session-id=b6d0ece2-29a7-4143-931c-d621648d7cb8; ai_user=gPFm7QcR2pV4O/zkZSC6dC\|2024-10-02T10:16:49.985Z; ai_session=KeivHP7d5TFls18euJ+R3i\|1727864209993\|1727864209993; _fbp=fb.1.1727864210794.836094937724409315; _clck=1x4xmda%7C2%7Cfpo%7C0%7C1736; _uetsid=70ac830080a711efa9fc9be06d42c5d1; _uetvid=70acc12080a711efa4bbe5908cfb5aee; _clsk=z8aa33%7C1727864211918%7C1%7C0%7Ct.clarity.ms%2Fcollect; MC1=GUID=40944b817c6f43219ea5caba422ead52&HASH=4094&LV=202410&V=4&LU=1727864214076; MS0=5d5a28dc628a46d8918acde28b77f98f
Source: global traffic	HTTP traffic detected: GET /assets/js/app-badge-dd910ddd.js HTTP/1.1Host: apps.microsoft.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://apps.microsoft.com/service-worker.jsAccept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: MSCC=NR; exp-session-id=b6d0ece2-29a7-4143-931c-d621648d7cb8; ai_user=gPFm7QcR2pV4O/zkZSC6dC\|2024-10-02T10:16:49.985Z; ai_session=KeivHP7d5TFls18euJ+R3i\|1727864209993\|1727864209993; _fbp=fb.1.1727864210794.836094937724409315; _clck=1x4xmda%7C2%7Cfpo%7C0%7C1736; _uetsid=70ac830080a711efa9fc9be06d42c5d1; _uetvid=70acc12080a711efa4bbe5908cfb5aee; _clsk=z8aa33%7C1727864211918%7C1%7C0%7Ct.clarity.ms%2Fcollect; MC1=GUID=40944b817c6f43219ea5caba422ead52&HASH=4094&LV=202410&V=4&LU=1727864214076; MS0=5d5a28dc628a46d8918acde28b77f98f
Source: global traffic	HTTP traffic detected: GET /welcome/static/favicon.png HTTP/1.1Host: edgestatic.azureedge.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.microsoft.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /c.gif HTTP/1.1Host: c.clarity.msConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.microsoft.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /assets/js/apps-565c0e30.js HTTP/1.1Host: apps.microsoft.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://apps.microsoft.com/service-worker.jsAccept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: MSCC=NR; exp-session-id=b6d0ece2-29a7-4143-931c-d621648d7cb8; ai_user=gPFm7QcR2pV4O/zkZSC6dC\|2024-10-02T10:16:49.985Z; ai_session=KeivHP7d5TFls18euJ+R3i\|1727864209993\|1727864209993; _fbp=fb.1.1727864210794.836094937724409315; _clck=1x4xmda%7C2%7Cfpo%7C0%7C1736; _uetsid=70ac830080a711efa9fc9be06d42c5d1; _uetvid=70acc12080a711efa4bbe5908cfb5aee; _clsk=z8aa33%7C1727864211918%7C1%7C0%7Ct.clarity.ms%2Fcollect; MC1=GUID=40944b817c6f43219ea5caba422ead52&HASH=4094&LV=202410&V=4&LU=1727864214076; MS0=5d5a28dc628a46d8918acde28b77f98f
Source: global traffic	HTTP traffic detected: GET /c.gif?ctsa=mr&CtsSyncId=8145D78C597043718658058358F19F5A&RedC=c.clarity.ms&MXFR=29D059AB96C76E5E0C754CA792C7607D HTTP/1.1Host: c.bing.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageSec-MS-GEC: FF699648EBF162654E01182ED0BD24EDB1A2721B7E78C7D8756497D88A893629Sec-MS-GEC-Version: 1-117.0.2045.47Referer: https://www.microsoft.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: MUID=2609E576E1796E461EBDF07AE01B6F4F
Source: global traffic	HTTP traffic detected: GET /assets/js/auth-control-b8e249cd.js HTTP/1.1Host: apps.microsoft.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://apps.microsoft.com/service-worker.jsAccept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: MSCC=NR; exp-session-id=b6d0ece2-29a7-4143-931c-d621648d7cb8; ai_user=gPFm7QcR2pV4O/zkZSC6dC\|2024-10-02T10:16:49.985Z; ai_session=KeivHP7d5TFls18euJ+R3i\|1727864209993\|1727864209993; _fbp=fb.1.1727864210794.836094937724409315; _clck=1x4xmda%7C2%7Cfpo%7C0%7C1736; _uetsid=70ac830080a711efa9fc9be06d42c5d1; _uetvid=70acc12080a711efa4bbe5908cfb5aee; _clsk=z8aa33%7C1727864211918%7C1%7C0%7Ct.clarity.ms%2Fcollect; MC1=GUID=40944b817c6f43219ea5caba422ead52&HASH=4094&LV=202410&V=4&LU=1727864214076; MS0=5d5a28dc628a46d8918acde28b77f98f
Source: global traffic	HTTP traffic detected: GET /c.gif?ctsa=mr&CtsSyncId=8145D78C597043718658058358F19F5A&MUID=2609E576E1796E461EBDF07AE01B6F4F HTTP/1.1Host: c.clarity.msConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.microsoft.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: SM=T; MUID=29D059AB96C76E5E0C754CA792C7607D
Source: global traffic	HTTP traffic detected: GET /assets/js/cms-page-6f3814da.js HTTP/1.1Host: apps.microsoft.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://apps.microsoft.com/service-worker.jsAccept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: MSCC=NR; exp-session-id=b6d0ece2-29a7-4143-931c-d621648d7cb8; ai_user=gPFm7QcR2pV4O/zkZSC6dC\|2024-10-02T10:16:49.985Z; ai_session=KeivHP7d5TFls18euJ+R3i\|1727864209993\|1727864209993; _fbp=fb.1.1727864210794.836094937724409315; _clck=1x4xmda%7C2%7Cfpo%7C0%7C1736; _uetsid=70ac830080a711efa9fc9be06d42c5d1; _uetvid=70acc12080a711efa4bbe5908cfb5aee; _clsk=z8aa33%7C1727864211918%7C1%7C0%7Ct.clarity.ms%2Fcollect; MC1=GUID=40944b817c6f43219ea5caba422ead52&HASH=4094&LV=202410&V=4&LU=1727864214076; MS0=5d5a28dc628a46d8918acde28b77f98f
Source: global traffic	HTTP traffic detected: GET /assets/js/collection-group-9730b6e8.js HTTP/1.1Host: apps.microsoft.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://apps.microsoft.com/service-worker.jsAccept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: MSCC=NR; exp-session-id=b6d0ece2-29a7-4143-931c-d621648d7cb8; ai_user=gPFm7QcR2pV4O/zkZSC6dC\|2024-10-02T10:16:49.985Z; ai_session=KeivHP7d5TFls18euJ+R3i\|1727864209993\|1727864209993; _fbp=fb.1.1727864210794.836094937724409315; _clck=1x4xmda%7C2%7Cfpo%7C0%7C1736; _uetsid=70ac830080a711efa9fc9be06d42c5d1; _uetvid=70acc12080a711efa4bbe5908cfb5aee; _clsk=z8aa33%7C1727864211918%7C1%7C0%7Ct.clarity.ms%2Fcollect; MC1=GUID=40944b817c6f43219ea5caba422ead52&HASH=4094&LV=202410&V=4&LU=1727864214076; MS0=5d5a28dc628a46d8918acde28b77f98f
Source: global traffic	HTTP traffic detected: GET /assets/js/collection-reel-group-3ecad3dd.js HTTP/1.1Host: apps.microsoft.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://apps.microsoft.com/service-worker.jsAccept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: MSCC=NR; exp-session-id=b6d0ece2-29a7-4143-931c-d621648d7cb8; ai_user=gPFm7QcR2pV4O/zkZSC6dC\|2024-10-02T10:16:49.985Z; ai_session=KeivHP7d5TFls18euJ+R3i\|1727864209993\|1727864209993; _fbp=fb.1.1727864210794.836094937724409315; _clck=1x4xmda%7C2%7Cfpo%7C0%7C1736; _uetsid=70ac830080a711efa9fc9be06d42c5d1; _uetvid=70acc12080a711efa4bbe5908cfb5aee; _clsk=z8aa33%7C1727864211918%7C1%7C0%7Ct.clarity.ms%2Fcollect; MC1=GUID=40944b817c6f43219ea5caba422ead52&HASH=4094&LV=202410&V=4&LU=1727864214076; MS0=5d5a28dc628a46d8918acde28b77f98f
Source: global traffic	HTTP traffic detected: GET /assets/js/collections-0ef93cf0.js HTTP/1.1Host: apps.microsoft.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://apps.microsoft.com/service-worker.jsAccept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: MSCC=NR; exp-session-id=b6d0ece2-29a7-4143-931c-d621648d7cb8; ai_user=gPFm7QcR2pV4O/zkZSC6dC\|2024-10-02T10:16:49.985Z; ai_session=KeivHP7d5TFls18euJ+R3i\|1727864209993\|1727864209993; _fbp=fb.1.1727864210794.836094937724409315; _clck=1x4xmda%7C2%7Cfpo%7C0%7C1736; _uetsid=70ac830080a711efa9fc9be06d42c5d1; _uetvid=70acc12080a711efa4bbe5908cfb5aee; _clsk=z8aa33%7C1727864211918%7C1%7C0%7Ct.clarity.ms%2Fcollect; MC1=GUID=40944b817c6f43219ea5caba422ead52&HASH=4094&LV=202410&V=4&LU=1727864214076; MS0=5d5a28dc628a46d8918acde28b77f98f
Source: global traffic	HTTP traffic detected: GET /assets/js/collections-browse-06db3db6.js HTTP/1.1Host: apps.microsoft.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://apps.microsoft.com/service-worker.jsAccept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: MSCC=NR; exp-session-id=b6d0ece2-29a7-4143-931c-d621648d7cb8; ai_user=gPFm7QcR2pV4O/zkZSC6dC\|2024-10-02T10:16:49.985Z; ai_session=KeivHP7d5TFls18euJ+R3i\|1727864209993\|1727864209993; _fbp=fb.1.1727864210794.836094937724409315; _clck=1x4xmda%7C2%7Cfpo%7C0%7C1736; _uetsid=70ac830080a711efa9fc9be06d42c5d1; _uetvid=70acc12080a711efa4bbe5908cfb5aee; _clsk=z8aa33%7C1727864211918%7C1%7C0%7Ct.clarity.ms%2Fcollect; MC1=GUID=40944b817c6f43219ea5caba422ead52&HASH=4094&LV=202410&V=4&LU=1727864214076; MS0=5d5a28dc628a46d8918acde28b77f98f
Source: global traffic	HTTP traffic detected: GET /assets/js/collections-test-fd3115fd.js HTTP/1.1Host: apps.microsoft.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://apps.microsoft.com/service-worker.jsAccept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: MSCC=NR; exp-session-id=b6d0ece2-29a7-4143-931c-d621648d7cb8; ai_user=gPFm7QcR2pV4O/zkZSC6dC\|2024-10-02T10:16:49.985Z; ai_session=KeivHP7d5TFls18euJ+R3i\|1727864209993\|1727864209993; _fbp=fb.1.1727864210794.836094937724409315; _clck=1x4xmda%7C2%7Cfpo%7C0%7C1736; _uetsid=70ac830080a711efa9fc9be06d42c5d1; _uetvid=70acc12080a711efa4bbe5908cfb5aee; _clsk=z8aa33%7C1727864211918%7C1%7C0%7Ct.clarity.ms%2Fcollect; MC1=GUID=40944b817c6f43219ea5caba422ead52&HASH=4094&LV=202410&V=4&LU=1727864214076; MS0=5d5a28dc628a46d8918acde28b77f98f
Source: global traffic	HTTP traffic detected: GET /hit/?a=event&d=%7B%22application%22%3A%22szndesktop%22%2C%22signedhash%22%3A%220%22%2C%22action%22%3A%22install_ie%22%2C%22status%22%3A0%2C%22osbuild%22%3A19045%2C%22osarch%22%3A9%2C%22iever%22%3A%2211.00.19041.1%20%28WinBuild.160101.0800%29%22%7D&s=partprog&v=2.1.35&r=1218851696&u=http://www.seznam.cz&h=B0B7C794-8699-4634-B6F9-24DA47BBD8EF&lsid=1727870994840&lses=0 HTTP/1.1Host: h.imedia.cz
Source: global traffic	HTTP traffic detected: GET /assets/js/color-worker-bb651d13.js HTTP/1.1Host: apps.microsoft.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://apps.microsoft.com/service-worker.jsAccept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: MSCC=NR; exp-session-id=b6d0ece2-29a7-4143-931c-d621648d7cb8; ai_user=gPFm7QcR2pV4O/zkZSC6dC\|2024-10-02T10:16:49.985Z; ai_session=KeivHP7d5TFls18euJ+R3i\|1727864209993\|1727864209993; _fbp=fb.1.1727864210794.836094937724409315; _clck=1x4xmda%7C2%7Cfpo%7C0%7C1736; _uetsid=70ac830080a711efa9fc9be06d42c5d1; _uetvid=70acc12080a711efa4bbe5908cfb5aee; _clsk=z8aa33%7C1727864211918%7C1%7C0%7Ct.clarity.ms%2Fcollect; MC1=GUID=40944b817c6f43219ea5caba422ead52&HASH=4094&LV=202410&V=4&LU=1727864214076; MS0=5d5a28dc628a46d8918acde28b77f98f
Source: global traffic	HTTP traffic detected: GET /assets/js/component-telemetry-ids-fc9d7e15.js HTTP/1.1Host: apps.microsoft.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://apps.microsoft.com/service-worker.jsAccept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: MSCC=NR; exp-session-id=b6d0ece2-29a7-4143-931c-d621648d7cb8; ai_user=gPFm7QcR2pV4O/zkZSC6dC\|2024-10-02T10:16:49.985Z; ai_session=KeivHP7d5TFls18euJ+R3i\|1727864209993\|1727864209993; _fbp=fb.1.1727864210794.836094937724409315; _clck=1x4xmda%7C2%7Cfpo%7C0%7C1736; _uetsid=70ac830080a711efa9fc9be06d42c5d1; _uetvid=70acc12080a711efa4bbe5908cfb5aee; _clsk=z8aa33%7C1727864211918%7C1%7C0%7Ct.clarity.ms%2Fcollect; MC1=GUID=40944b817c6f43219ea5caba422ead52&HASH=4094&LV=202410&V=4&LU=1727864214076; MS0=5d5a28dc628a46d8918acde28b77f98f
Source: global traffic	HTTP traffic detected: GET /assets/js/dash.all.min-f4f61554.js HTTP/1.1Host: apps.microsoft.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://apps.microsoft.com/service-worker.jsAccept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: MSCC=NR; exp-session-id=b6d0ece2-29a7-4143-931c-d621648d7cb8; ai_user=gPFm7QcR2pV4O/zkZSC6dC\|2024-10-02T10:16:49.985Z; ai_session=KeivHP7d5TFls18euJ+R3i\|1727864209993\|1727864209993; _fbp=fb.1.1727864210794.836094937724409315; _clck=1x4xmda%7C2%7Cfpo%7C0%7C1736; _uetsid=70ac830080a711efa9fc9be06d42c5d1; _uetvid=70acc12080a711efa4bbe5908cfb5aee; _clsk=z8aa33%7C1727864211918%7C1%7C0%7Ct.clarity.ms%2Fcollect; MC1=GUID=40944b817c6f43219ea5caba422ead52&HASH=4094&LV=202410&V=4&LU=1727864214076; MS0=5d5a28dc628a46d8918acde28b77f98f
Source: global traffic	HTTP traffic detected: GET /hit/?a=event&d=%7B%22action%22%3A%22startup%22%2C%22application%22%3A%22szndesktop%22%2C%22signedhash%22%3A%220%22%2C%22chrv%22%3A16%2C%22che%22%3A16%2C%22chs%22%3A16%2C%22ches%22%3A16%2C%22ie%22%3A1%2C%22osbuild%22%3A19045%2C%22osarch%22%3A9%2C%22chver%22%3A%22117.0.5938.132%22%2C%22ffver%22%3A%22118.0.1%22%2C%22iever%22%3A%2211.00.19041.1%20%28WinBuild.160101.0800%29%22%7D&s=partprog&v=2.1.35&r=-442691421&u=http://www.seznam.cz&h=B0B7C794-8699-4634-B6F9-24DA47BBD8EF&lsid=1727870998589&lses=1727870994840 HTTP/1.1Host: h.imedia.cz
Source: global traffic	HTTP traffic detected: GET /assets/js/dash.mss.min-9e6d10cc.js HTTP/1.1Host: apps.microsoft.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://apps.microsoft.com/service-worker.jsAccept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: MSCC=NR; exp-session-id=b6d0ece2-29a7-4143-931c-d621648d7cb8; ai_user=gPFm7QcR2pV4O/zkZSC6dC\|2024-10-02T10:16:49.985Z; ai_session=KeivHP7d5TFls18euJ+R3i\|1727864209993\|1727864209993; _fbp=fb.1.1727864210794.836094937724409315; _clck=1x4xmda%7C2%7Cfpo%7C0%7C1736; _uetsid=70ac830080a711efa9fc9be06d42c5d1; _uetvid=70acc12080a711efa4bbe5908cfb5aee; _clsk=z8aa33%7C1727864211918%7C1%7C0%7Ct.clarity.ms%2Fcollect; MC1=GUID=40944b817c6f43219ea5caba422ead52&HASH=4094&LV=202410&V=4&LU=1727864214076; MS0=5d5a28dc628a46d8918acde28b77f98f
Source: global traffic	HTTP traffic detected: GET /assets/js/editorial-aabeb52f.js HTTP/1.1Host: apps.microsoft.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://apps.microsoft.com/service-worker.jsAccept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: MSCC=NR; exp-session-id=b6d0ece2-29a7-4143-931c-d621648d7cb8; ai_user=gPFm7QcR2pV4O/zkZSC6dC\|2024-10-02T10:16:49.985Z; ai_session=KeivHP7d5TFls18euJ+R3i\|1727864209993\|1727864209993; _fbp=fb.1.1727864210794.836094937724409315; _clck=1x4xmda%7C2%7Cfpo%7C0%7C1736; _uetsid=70ac830080a711efa9fc9be06d42c5d1; _uetvid=70acc12080a711efa4bbe5908cfb5aee; _clsk=z8aa33%7C1727864211918%7C1%7C0%7Ct.clarity.ms%2Fcollect; MC1=GUID=40944b817c6f43219ea5caba422ead52&HASH=4094&LV=202410&V=4&LU=1727864214076; MS0=5d5a28dc628a46d8918acde28b77f98f
Source: global traffic	HTTP traffic detected: GET /hit/?a=event&d=%7B%22application%22%3A%22szndesktop%22%2C%22signedhash%22%3A%220%22%2C%22action%22%3A%22install_ff%22%2C%22status%22%3A0%2C%22osbuild%22%3A19045%2C%22osarch%22%3A9%2C%22ffver%22%3A%22118.0.1%22%7D&s=partprog&v=2.1.35&r=-845759909&u=http://www.seznam.cz&h=B0B7C794-8699-4634-B6F9-24DA47BBD8EF&lsid=1727871000747&lses=1727870998589 HTTP/1.1Host: h.imedia.cz
Source: global traffic	HTTP traffic detected: GET /assets/js/error-cba35c53.js HTTP/1.1Host: apps.microsoft.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://apps.microsoft.com/service-worker.jsAccept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: MSCC=NR; exp-session-id=b6d0ece2-29a7-4143-931c-d621648d7cb8; ai_user=gPFm7QcR2pV4O/zkZSC6dC\|2024-10-02T10:16:49.985Z; ai_session=KeivHP7d5TFls18euJ+R3i\|1727864209993\|1727864209993; _fbp=fb.1.1727864210794.836094937724409315; _clck=1x4xmda%7C2%7Cfpo%7C0%7C1736; _uetsid=70ac830080a711efa9fc9be06d42c5d1; _uetvid=70acc12080a711efa4bbe5908cfb5aee; _clsk=z8aa33%7C1727864211918%7C1%7C0%7Ct.clarity.ms%2Fcollect; MC1=GUID=40944b817c6f43219ea5caba422ead52&HASH=4094&LV=202410&V=4&LU=1727864214076; MS0=5d5a28dc628a46d8918acde28b77f98f
Source: global traffic	HTTP traffic detected: GET /assets/js/filter-menu.styles-c22dcbf5.js HTTP/1.1Host: apps.microsoft.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://apps.microsoft.com/service-worker.jsAccept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: MSCC=NR; exp-session-id=b6d0ece2-29a7-4143-931c-d621648d7cb8; ai_user=gPFm7QcR2pV4O/zkZSC6dC\|2024-10-02T10:16:49.985Z; ai_session=KeivHP7d5TFls18euJ+R3i\|1727864209993\|1727864209993; _fbp=fb.1.1727864210794.836094937724409315; _clck=1x4xmda%7C2%7Cfpo%7C0%7C1736; _uetsid=70ac830080a711efa9fc9be06d42c5d1; _uetvid=70acc12080a711efa4bbe5908cfb5aee; _clsk=z8aa33%7C1727864211918%7C1%7C0%7Ct.clarity.ms%2Fcollect; MC1=GUID=40944b817c6f43219ea5caba422ead52&HASH=4094&LV=202410&V=4&LU=1727864214076; MS0=5d5a28dc628a46d8918acde28b77f98f
Source: global traffic	HTTP traffic detected: GET /hit/?a=event&d=%7B%22application%22%3A%22szndesktop%22%2C%22signedhash%22%3A%220%22%2C%22action%22%3A%22install_ff%22%2C%22status%22%3A0%2C%22osbuild%22%3A19045%2C%22osarch%22%3A9%2C%22ffver%22%3A%22118.0.1%22%7D&s=partprog&v=2.1.35&r=-1701293468&u=http://www.seznam.cz&h=B0B7C794-8699-4634-B6F9-24DA47BBD8EF&lsid=1727871002951&lses=1727871000747 HTTP/1.1Host: h.imedia.cz
Source: global traffic	HTTP traffic detected: GET /assets/js/flip-animation-demo-c4c759ed.js HTTP/1.1Host: apps.microsoft.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://apps.microsoft.com/service-worker.jsAccept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: MSCC=NR; exp-session-id=b6d0ece2-29a7-4143-931c-d621648d7cb8; ai_user=gPFm7QcR2pV4O/zkZSC6dC\|2024-10-02T10:16:49.985Z; ai_session=KeivHP7d5TFls18euJ+R3i\|1727864209993\|1727864209993; _fbp=fb.1.1727864210794.836094937724409315; _clck=1x4xmda%7C2%7Cfpo%7C0%7C1736; _uetsid=70ac830080a711efa9fc9be06d42c5d1; _uetvid=70acc12080a711efa4bbe5908cfb5aee; _clsk=z8aa33%7C1727864211918%7C1%7C0%7Ct.clarity.ms%2Fcollect; MC1=GUID=40944b817c6f43219ea5caba422ead52&HASH=4094&LV=202410&V=4&LU=1727864214076; MS0=5d5a28dc628a46d8918acde28b77f98f
Source: global traffic	HTTP traffic detected: GET /assets/js/footer-menu-93708975.js HTTP/1.1Host: apps.microsoft.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://apps.microsoft.com/service-worker.jsAccept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: MSCC=NR; exp-session-id=b6d0ece2-29a7-4143-931c-d621648d7cb8; ai_user=gPFm7QcR2pV4O/zkZSC6dC\|2024-10-02T10:16:49.985Z; ai_session=KeivHP7d5TFls18euJ+R3i\|1727864209993\|1727864209993; _fbp=fb.1.1727864210794.836094937724409315; _clck=1x4xmda%7C2%7Cfpo%7C0%7C1736; _uetsid=70ac830080a711efa9fc9be06d42c5d1; _uetvid=70acc12080a711efa4bbe5908cfb5aee; _clsk=z8aa33%7C1727864211918%7C1%7C0%7Ct.clarity.ms%2Fcollect; MC1=GUID=40944b817c6f43219ea5caba422ead52&HASH=4094&LV=202410&V=4&LU=1727864214076; MS0=5d5a28dc628a46d8918acde28b77f98f
Source: global traffic	HTTP traffic detected: GET /assets/js/gaming-97ae1c62.js HTTP/1.1Host: apps.microsoft.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://apps.microsoft.com/service-worker.jsAccept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: MSCC=NR; exp-session-id=b6d0ece2-29a7-4143-931c-d621648d7cb8; ai_user=gPFm7QcR2pV4O/zkZSC6dC\|2024-10-02T10:16:49.985Z; ai_session=KeivHP7d5TFls18euJ+R3i\|1727864209993\|1727864209993; _fbp=fb.1.1727864210794.836094937724409315; _clck=1x4xmda%7C2%7Cfpo%7C0%7C1736; _uetsid=70ac830080a711efa9fc9be06d42c5d1; _uetvid=70acc12080a711efa4bbe5908cfb5aee; _clsk=z8aa33%7C1727864211918%7C1%7C0%7Ct.clarity.ms%2Fcollect; MC1=GUID=40944b817c6f43219ea5caba422ead52&HASH=4094&LV=202410&V=4&LU=1727864214076; MS0=5d5a28dc628a46d8918acde28b77f98f
Source: global traffic	HTTP traffic detected: GET /assets/js/header-1ef6623c.js HTTP/1.1Host: apps.microsoft.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://apps.microsoft.com/service-worker.jsAccept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: MSCC=NR; exp-session-id=b6d0ece2-29a7-4143-931c-d621648d7cb8; ai_user=gPFm7QcR2pV4O/zkZSC6dC\|2024-10-02T10:16:49.985Z; ai_session=KeivHP7d5TFls18euJ+R3i\|1727864209993\|1727864209993; _fbp=fb.1.1727864210794.836094937724409315; _clck=1x4xmda%7C2%7Cfpo%7C0%7C1736; _uetsid=70ac830080a711efa9fc9be06d42c5d1; _uetvid=70acc12080a711efa4bbe5908cfb5aee; _clsk=z8aa33%7C1727864211918%7C1%7C0%7Ct.clarity.ms%2Fcollect; MC1=GUID=40944b817c6f43219ea5caba422ead52&HASH=4094&LV=202410&V=4&LU=1727864214076; MS0=5d5a28dc628a46d8918acde28b77f98f
Source: global traffic	HTTP traffic detected: GET /assets/js/home-38153ab0.js HTTP/1.1Host: apps.microsoft.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://apps.microsoft.com/service-worker.jsAccept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: MSCC=NR; exp-session-id=b6d0ece2-29a7-4143-931c-d621648d7cb8; ai_user=gPFm7QcR2pV4O/zkZSC6dC\|2024-10-02T10:16:49.985Z; ai_session=KeivHP7d5TFls18euJ+R3i\|1727864209993\|1727864209993; _fbp=fb.1.1727864210794.836094937724409315; _clck=1x4xmda%7C2%7Cfpo%7C0%7C1736; _uetsid=70ac830080a711efa9fc9be06d42c5d1; _uetvid=70acc12080a711efa4bbe5908cfb5aee; _clsk=z8aa33%7C1727864211918%7C1%7C0%7Ct.clarity.ms%2Fcollect; MC1=GUID=40944b817c6f43219ea5caba422ead52&HASH=4094&LV=202410&V=4&LU=1727864214076; MS0=5d5a28dc628a46d8918acde28b77f98f
Source: global traffic	HTTP traffic detected: GET /assets/js/index-d961e0b8.js HTTP/1.1Host: apps.microsoft.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://apps.microsoft.com/service-worker.jsAccept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: MSCC=NR; exp-session-id=b6d0ece2-29a7-4143-931c-d621648d7cb8; ai_user=gPFm7QcR2pV4O/zkZSC6dC\|2024-10-02T10:16:49.985Z; ai_session=KeivHP7d5TFls18euJ+R3i\|1727864209993\|1727864209993; _fbp=fb.1.1727864210794.836094937724409315; _clck=1x4xmda%7C2%7Cfpo%7C0%7C1736; _uetsid=70ac830080a711efa9fc9be06d42c5d1; _uetvid=70acc12080a711efa4bbe5908cfb5aee; _clsk=z8aa33%7C1727864211918%7C1%7C0%7Ct.clarity.ms%2Fcollect; MC1=GUID=40944b817c6f43219ea5caba422ead52&HASH=4094&LV=202410&V=4&LU=1727864214076; MS0=5d5a28dc628a46d8918acde28b77f98f
Source: global traffic	HTTP traffic detected: GET /assets/js/info-card-cf23577c.js HTTP/1.1Host: apps.microsoft.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://apps.microsoft.com/service-worker.jsAccept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: MSCC=NR; exp-session-id=b6d0ece2-29a7-4143-931c-d621648d7cb8; ai_user=gPFm7QcR2pV4O/zkZSC6dC\|2024-10-02T10:16:49.985Z; ai_session=KeivHP7d5TFls18euJ+R3i\|1727864209993\|1727864209993; _fbp=fb.1.1727864210794.836094937724409315; _clck=1x4xmda%7C2%7Cfpo%7C0%7C1736; _uetsid=70ac830080a711efa9fc9be06d42c5d1; _uetvid=70acc12080a711efa4bbe5908cfb5aee; _clsk=z8aa33%7C1727864211918%7C1%7C0%7Ct.clarity.ms%2Fcollect; MC1=GUID=40944b817c6f43219ea5caba422ead52&HASH=4094&LV=202410&V=4&LU=1727864214076; MS0=5d5a28dc628a46d8918acde28b77f98f
Source: global traffic	HTTP traffic detected: GET /assets/js/info-panel-f1f0caf0.js HTTP/1.1Host: apps.microsoft.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://apps.microsoft.com/service-worker.jsAccept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: MSCC=NR; exp-session-id=b6d0ece2-29a7-4143-931c-d621648d7cb8; ai_user=gPFm7QcR2pV4O/zkZSC6dC\|2024-10-02T10:16:49.985Z; ai_session=KeivHP7d5TFls18euJ+R3i\|1727864209993\|1727864209993; _fbp=fb.1.1727864210794.836094937724409315; _clck=1x4xmda%7C2%7Cfpo%7C0%7C1736; _uetsid=70ac830080a711efa9fc9be06d42c5d1; _uetvid=70acc12080a711efa4bbe5908cfb5aee; _clsk=z8aa33%7C1727864211918%7C1%7C0%7Ct.clarity.ms%2Fcollect; MC1=GUID=40944b817c6f43219ea5caba422ead52&HASH=4094&LV=202410&V=4&LU=1727864214076; MS0=5d5a28dc628a46d8918acde28b77f98f
Source: global traffic	HTTP traffic detected: GET /hit/?a=event&d=%7B%22action%22%3A%22startup%22%2C%22application%22%3A%22szndesktop%22%2C%22signedhash%22%3A%220%22%2C%22chrv%22%3A48%2C%22che%22%3A48%2C%22chs%22%3A16%2C%22ches%22%3A16%2C%22ie%22%3A1%2C%22osbuild%22%3A19045%2C%22osarch%22%3A9%2C%22chver%22%3A%22117.0.5938.132%22%2C%22ffver%22%3A%22118.0.1%22%2C%22iever%22%3A%2211.00.19041.1%20%28WinBuild.160101.0800%29%22%7D&s=partprog&v=2.1.35&r=-1794028113&u=http://www.seznam.cz&h=B0B7C794-8699-4634-B6F9-24DA47BBD8EF&lsid=1727871011238&lses=1727871002951 HTTP/1.1Host: h.imedia.cz
Source: global traffic	HTTP traffic detected: GET /assets/js/landscape-poster-collection-2d9bcc1d.js HTTP/1.1Host: apps.microsoft.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://apps.microsoft.com/service-worker.jsAccept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: MSCC=NR; exp-session-id=b6d0ece2-29a7-4143-931c-d621648d7cb8; ai_user=gPFm7QcR2pV4O/zkZSC6dC\|2024-10-02T10:16:49.985Z; ai_session=KeivHP7d5TFls18euJ+R3i\|1727864209993\|1727864209993; _fbp=fb.1.1727864210794.836094937724409315; _clck=1x4xmda%7C2%7Cfpo%7C0%7C1736; _uetsid=70ac830080a711efa9fc9be06d42c5d1; _uetvid=70acc12080a711efa4bbe5908cfb5aee; _clsk=z8aa33%7C1727864211918%7C1%7C0%7Ct.clarity.ms%2Fcollect; MC1=GUID=40944b817c6f43219ea5caba422ead52&HASH=4094&LV=202410&V=4&LU=1727864214076; MS0=5d5a28dc628a46d8918acde28b77f98f
Source: global traffic	HTTP traffic detected: GET /assets/js/language-selector-dialog-b96e2be1.js HTTP/1.1Host: apps.microsoft.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://apps.microsoft.com/service-worker.jsAccept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: MSCC=NR; exp-session-id=b6d0ece2-29a7-4143-931c-d621648d7cb8; ai_user=gPFm7QcR2pV4O/zkZSC6dC\|2024-10-02T10:16:49.985Z; ai_session=KeivHP7d5TFls18euJ+R3i\|1727864209993\|1727864209993; _fbp=fb.1.1727864210794.836094937724409315; _clck=1x4xmda%7C2%7Cfpo%7C0%7C1736; _uetsid=70ac830080a711efa9fc9be06d42c5d1; _uetvid=70acc12080a711efa4bbe5908cfb5aee; _clsk=z8aa33%7C1727864211918%7C1%7C0%7Ct.clarity.ms%2Fcollect; MC1=GUID=40944b817c6f43219ea5caba422ead52&HASH=4094&LV=202410&V=4&LU=1727864214076; MS0=5d5a28dc628a46d8918acde28b77f98f
Source: global traffic	HTTP traffic detected: GET /assets/js/lottie-player.esm-e4b3d620.js HTTP/1.1Host: apps.microsoft.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://apps.microsoft.com/service-worker.jsAccept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: MSCC=NR; exp-session-id=b6d0ece2-29a7-4143-931c-d621648d7cb8; ai_user=gPFm7QcR2pV4O/zkZSC6dC\|2024-10-02T10:16:49.985Z; ai_session=KeivHP7d5TFls18euJ+R3i\|1727864209993\|1727864209993; _fbp=fb.1.1727864210794.836094937724409315; _clck=1x4xmda%7C2%7Cfpo%7C0%7C1736; _uetsid=70ac830080a711efa9fc9be06d42c5d1; _uetvid=70acc12080a711efa4bbe5908cfb5aee; _clsk=z8aa33%7C1727864211918%7C1%7C0%7Ct.clarity.ms%2Fcollect; MC1=GUID=40944b817c6f43219ea5caba422ead52&HASH=4094&LV=202410&V=4&LU=1727864214076; MS0=5d5a28dc628a46d8918acde28b77f98f
Source: global traffic	HTTP traffic detected: GET /assets/js/market-collection-service-133bf42f.js HTTP/1.1Host: apps.microsoft.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://apps.microsoft.com/service-worker.jsAccept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: MSCC=NR; exp-session-id=b6d0ece2-29a7-4143-931c-d621648d7cb8; ai_user=gPFm7QcR2pV4O/zkZSC6dC\|2024-10-02T10:16:49.985Z; ai_session=KeivHP7d5TFls18euJ+R3i\|1727864209993\|1727864209993; _fbp=fb.1.1727864210794.836094937724409315; _clck=1x4xmda%7C2%7Cfpo%7C0%7C1736; _uetsid=70ac830080a711efa9fc9be06d42c5d1; _uetvid=70acc12080a711efa4bbe5908cfb5aee; _clsk=z8aa33%7C1727864211918%7C1%7C0%7Ct.clarity.ms%2Fcollect; MC1=GUID=40944b817c6f43219ea5caba422ead52&HASH=4094&LV=202410&V=4&LU=1727864214076; MS0=5d5a28dc628a46d8918acde28b77f98f
Source: global traffic	HTTP traffic detected: GET /assets/js/movies-724e2e75.js HTTP/1.1Host: apps.microsoft.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://apps.microsoft.com/service-worker.jsAccept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: MSCC=NR; exp-session-id=b6d0ece2-29a7-4143-931c-d621648d7cb8; ai_user=gPFm7QcR2pV4O/zkZSC6dC\|2024-10-02T10:16:49.985Z; ai_session=KeivHP7d5TFls18euJ+R3i\|1727864209993\|1727864209993; _fbp=fb.1.1727864210794.836094937724409315; _clck=1x4xmda%7C2%7Cfpo%7C0%7C1736; _uetsid=70ac830080a711efa9fc9be06d42c5d1; _uetvid=70acc12080a711efa4bbe5908cfb5aee; _clsk=z8aa33%7C1727864211918%7C1%7C0%7Ct.clarity.ms%2Fcollect; MC1=GUID=40944b817c6f43219ea5caba422ead52&HASH=4094&LV=202410&V=4&LU=1727864214076; MS0=5d5a28dc628a46d8918acde28b77f98f
Source: global traffic	HTTP traffic detected: GET /assets/js/not-found-fa055e11.js HTTP/1.1Host: apps.microsoft.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://apps.microsoft.com/service-worker.jsAccept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: MSCC=NR; exp-session-id=b6d0ece2-29a7-4143-931c-d621648d7cb8; ai_user=gPFm7QcR2pV4O/zkZSC6dC\|2024-10-02T10:16:49.985Z; ai_session=KeivHP7d5TFls18euJ+R3i\|1727864209993\|1727864209993; _fbp=fb.1.1727864210794.836094937724409315; _clck=1x4xmda%7C2%7Cfpo%7C0%7C1736; _uetsid=70ac830080a711efa9fc9be06d42c5d1; _uetvid=70acc12080a711efa4bbe5908cfb5aee; _clsk=z8aa33%7C1727864211918%7C1%7C0%7Ct.clarity.ms%2Fcollect; MC1=GUID=40944b817c6f43219ea5caba422ead52&HASH=4094&LV=202410&V=4&LU=1727864214076; MS0=5d5a28dc628a46d8918acde28b77f98f
Source: global traffic	HTTP traffic detected: GET /assets/js/play-board-b1b7ae54.js HTTP/1.1Host: apps.microsoft.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://apps.microsoft.com/service-worker.jsAccept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: MSCC=NR; exp-session-id=b6d0ece2-29a7-4143-931c-d621648d7cb8; ai_user=gPFm7QcR2pV4O/zkZSC6dC\|2024-10-02T10:16:49.985Z; ai_session=KeivHP7d5TFls18euJ+R3i\|1727864209993\|1727864209993; _fbp=fb.1.1727864210794.836094937724409315; _clck=1x4xmda%7C2%7Cfpo%7C0%7C1736; _uetsid=70ac830080a711efa9fc9be06d42c5d1; _uetvid=70acc12080a711efa4bbe5908cfb5aee; _clsk=z8aa33%7C1727864211918%7C1%7C0%7Ct.clarity.ms%2Fcollect; MC1=GUID=40944b817c6f43219ea5caba422ead52&HASH=4094&LV=202410&V=4&LU=1727864214076; MS0=5d5a28dc628a46d8918acde28b77f98f
Source: global traffic	HTTP traffic detected: GET /hit/?a=event&d=%7B%22action%22%3A%22startup%22%2C%22application%22%3A%22szndesktop%22%2C%22signedhash%22%3A%220%22%2C%22chrv%22%3A56%2C%22che%22%3A48%2C%22chs%22%3A16%2C%22ches%22%3A16%2C%22ie%22%3A1%2C%22osbuild%22%3A19045%2C%22osarch%22%3A9%2C%22chver%22%3A%22117.0.5938.132%22%2C%22ffver%22%3A%22118.0.1%22%2C%22iever%22%3A%2211.00.19041.1%20%28WinBuild.160101.0800%29%22%7D&s=partprog&v=2.1.35&r=256494956&u=http://www.seznam.cz&h=B0B7C794-8699-4634-B6F9-24DA47BBD8EF&lsid=1727871017325&lses=1727871011238 HTTP/1.1Host: h.imedia.cz
Source: global traffic	HTTP traffic detected: GET /assets/js/play-board-tester-46874b9b.js HTTP/1.1Host: apps.microsoft.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://apps.microsoft.com/service-worker.jsAccept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: MSCC=NR; exp-session-id=b6d0ece2-29a7-4143-931c-d621648d7cb8; ai_user=gPFm7QcR2pV4O/zkZSC6dC\|2024-10-02T10:16:49.985Z; ai_session=KeivHP7d5TFls18euJ+R3i\|1727864209993\|1727864209993; _fbp=fb.1.1727864210794.836094937724409315; _clck=1x4xmda%7C2%7Cfpo%7C0%7C1736; _uetsid=70ac830080a711efa9fc9be06d42c5d1; _uetvid=70acc12080a711efa4bbe5908cfb5aee; _clsk=z8aa33%7C1727864211918%7C1%7C0%7Ct.clarity.ms%2Fcollect; MC1=GUID=40944b817c6f43219ea5caba422ead52&HASH=4094&LV=202410&V=4&LU=1727864214076; MS0=5d5a28dc628a46d8918acde28b77f98f
Source: global traffic	HTTP traffic detected: GET /assets/js/product-collection-renderer-92dc7aad.js HTTP/1.1Host: apps.microsoft.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://apps.microsoft.com/service-worker.jsAccept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: MSCC=NR; exp-session-id=b6d0ece2-29a7-4143-931c-d621648d7cb8; ai_user=gPFm7QcR2pV4O/zkZSC6dC\|2024-10-02T10:16:49.985Z; ai_session=KeivHP7d5TFls18euJ+R3i\|1727864209993\|1727864209993; _fbp=fb.1.1727864210794.836094937724409315; _clck=1x4xmda%7C2%7Cfpo%7C0%7C1736; _uetsid=70ac830080a711efa9fc9be06d42c5d1; _uetvid=70acc12080a711efa4bbe5908cfb5aee; _clsk=z8aa33%7C1727864211918%7C1%7C0%7Ct.clarity.ms%2Fcollect; MC1=GUID=40944b817c6f43219ea5caba422ead52&HASH=4094&LV=202410&V=4&LU=1727864214076; MS0=5d5a28dc628a46d8918acde28b77f98f
Source: global traffic	HTTP traffic detected: GET /assets/js/product-details-e165fa07.js HTTP/1.1Host: apps.microsoft.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://apps.microsoft.com/service-worker.jsAccept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: MSCC=NR; exp-session-id=b6d0ece2-29a7-4143-931c-d621648d7cb8; ai_user=gPFm7QcR2pV4O/zkZSC6dC\|2024-10-02T10:16:49.985Z; ai_session=KeivHP7d5TFls18euJ+R3i\|1727864209993\|1727864209993; _fbp=fb.1.1727864210794.836094937724409315; _clck=1x4xmda%7C2%7Cfpo%7C0%7C1736; _uetsid=70ac830080a711efa9fc9be06d42c5d1; _uetvid=70acc12080a711efa4bbe5908cfb5aee; _clsk=z8aa33%7C1727864211918%7C1%7C0%7Ct.clarity.ms%2Fcollect; MC1=GUID=40944b817c6f43219ea5caba422ead52&HASH=4094&LV=202410&V=4&LU=1727864214076; MS0=5d5a28dc628a46d8918acde28b77f98f
Source: global traffic	HTTP traffic detected: GET /assets/js/product-review-1e817684.js HTTP/1.1Host: apps.microsoft.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://apps.microsoft.com/service-worker.jsAccept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: MSCC=NR; exp-session-id=b6d0ece2-29a7-4143-931c-d621648d7cb8; ai_user=gPFm7QcR2pV4O/zkZSC6dC\|2024-10-02T10:16:49.985Z; ai_session=KeivHP7d5TFls18euJ+R3i\|1727864209993\|1727864209993; _fbp=fb.1.1727864210794.836094937724409315; _clck=1x4xmda%7C2%7Cfpo%7C0%7C1736; _uetsid=70ac830080a711efa9fc9be06d42c5d1; _uetvid=70acc12080a711efa4bbe5908cfb5aee; _clsk=z8aa33%7C1727864211918%7C1%7C0%7Ct.clarity.ms%2Fcollect; MC1=GUID=40944b817c6f43219ea5caba422ead52&HASH=4094&LV=202410&V=4&LU=1727864214076; MS0=5d5a28dc628a46d8918acde28b77f98f
Source: global traffic	HTTP traffic detected: GET /assets/js/promo-panel-544f890b.js HTTP/1.1Host: apps.microsoft.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://apps.microsoft.com/service-worker.jsAccept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: MSCC=NR; exp-session-id=b6d0ece2-29a7-4143-931c-d621648d7cb8; ai_user=gPFm7QcR2pV4O/zkZSC6dC\|2024-10-02T10:16:49.985Z; ai_session=KeivHP7d5TFls18euJ+R3i\|1727864209993\|1727864209993; _fbp=fb.1.1727864210794.836094937724409315; _clck=1x4xmda%7C2%7Cfpo%7C0%7C1736; _uetsid=70ac830080a711efa9fc9be06d42c5d1; _uetvid=70acc12080a711efa4bbe5908cfb5aee; _clsk=z8aa33%7C1727864211918%7C1%7C0%7Ct.clarity.ms%2Fcollect; MC1=GUID=40944b817c6f43219ea5caba422ead52&HASH=4094&LV=202410&V=4&LU=1727864214076; MS0=5d5a28dc628a46d8918acde28b77f98f
Source: global traffic	HTTP traffic detected: GET /assets/js/ratings-reviews-list-5a17d118.js HTTP/1.1Host: apps.microsoft.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://apps.microsoft.com/service-worker.jsAccept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: MSCC=NR; exp-session-id=b6d0ece2-29a7-4143-931c-d621648d7cb8; ai_user=gPFm7QcR2pV4O/zkZSC6dC\|2024-10-02T10:16:49.985Z; ai_session=KeivHP7d5TFls18euJ+R3i\|1727864209993\|1727864209993; _fbp=fb.1.1727864210794.836094937724409315; _clck=1x4xmda%7C2%7Cfpo%7C0%7C1736; _uetsid=70ac830080a711efa9fc9be06d42c5d1; _uetvid=70acc12080a711efa4bbe5908cfb5aee; _clsk=z8aa33%7C1727864211918%7C1%7C0%7Ct.clarity.ms%2Fcollect; MC1=GUID=40944b817c6f43219ea5caba422ead52&HASH=4094&LV=202410&V=4&LU=1727864214076; MS0=5d5a28dc628a46d8918acde28b77f98f
Source: global traffic	HTTP traffic detected: GET /assets/js/ratings-reviews-summary-abe56846.js HTTP/1.1Host: apps.microsoft.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://apps.microsoft.com/service-worker.jsAccept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: MSCC=NR; exp-session-id=b6d0ece2-29a7-4143-931c-d621648d7cb8; ai_user=gPFm7QcR2pV4O/zkZSC6dC\|2024-10-02T10:16:49.985Z; ai_session=KeivHP7d5TFls18euJ+R3i\|1727864209993\|1727864209993; _fbp=fb.1.1727864210794.836094937724409315; _clck=1x4xmda%7C2%7Cfpo%7C0%7C1736; _uetsid=70ac830080a711efa9fc9be06d42c5d1; _uetvid=70acc12080a711efa4bbe5908cfb5aee; _clsk=z8aa33%7C1727864211918%7C1%7C0%7Ct.clarity.ms%2Fcollect; MC1=GUID=40944b817c6f43219ea5caba422ead52&HASH=4094&LV=202410&V=4&LU=1727864214076; MS0=5d5a28dc628a46d8918acde28b77f98f
Source: global traffic	HTTP traffic detected: GET /assets/js/related-products-76acf8ee.js HTTP/1.1Host: apps.microsoft.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://apps.microsoft.com/service-worker.jsAccept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: MSCC=NR; exp-session-id=b6d0ece2-29a7-4143-931c-d621648d7cb8; ai_user=gPFm7QcR2pV4O/zkZSC6dC\|2024-10-02T10:16:49.985Z; ai_session=KeivHP7d5TFls18euJ+R3i\|1727864209993\|1727864209993; _fbp=fb.1.1727864210794.836094937724409315; _clck=1x4xmda%7C2%7Cfpo%7C0%7C1736; _uetsid=70ac830080a711efa9fc9be06d42c5d1; _uetvid=70acc12080a711efa4bbe5908cfb5aee; _clsk=z8aa33%7C1727864211918%7C1%7C0%7Ct.clarity.ms%2Fcollect; MC1=GUID=40944b817c6f43219ea5caba422ead52&HASH=4094&LV=202410&V=4&LU=1727864214076; MS0=5d5a28dc628a46d8918acde28b77f98f
Source: global traffic	HTTP traffic detected: GET /assets/js/report-dialog-8539c0d0.js HTTP/1.1Host: apps.microsoft.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://apps.microsoft.com/service-worker.jsAccept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: MSCC=NR; exp-session-id=b6d0ece2-29a7-4143-931c-d621648d7cb8; ai_user=gPFm7QcR2pV4O/zkZSC6dC\|2024-10-02T10:16:49.985Z; ai_session=KeivHP7d5TFls18euJ+R3i\|1727864209993\|1727864209993; _fbp=fb.1.1727864210794.836094937724409315; _clck=1x4xmda%7C2%7Cfpo%7C0%7C1736; _uetsid=70ac830080a711efa9fc9be06d42c5d1; _uetvid=70acc12080a711efa4bbe5908cfb5aee; _clsk=z8aa33%7C1727864211918%7C1%7C0%7Ct.clarity.ms%2Fcollect; MC1=GUID=40944b817c6f43219ea5caba422ead52&HASH=4094&LV=202410&V=4&LU=1727864214076; MS0=5d5a28dc628a46d8918acde28b77f98f
Source: global traffic	HTTP traffic detected: GET /assets/js/search-results-9f1dba5f.js HTTP/1.1Host: apps.microsoft.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://apps.microsoft.com/service-worker.jsAccept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: MSCC=NR; exp-session-id=b6d0ece2-29a7-4143-931c-d621648d7cb8; ai_user=gPFm7QcR2pV4O/zkZSC6dC\|2024-10-02T10:16:49.985Z; ai_session=KeivHP7d5TFls18euJ+R3i\|1727864209993\|1727864209993; _fbp=fb.1.1727864210794.836094937724409315; _clck=1x4xmda%7C2%7Cfpo%7C0%7C1736; _uetsid=70ac830080a711efa9fc9be06d42c5d1; _uetvid=70acc12080a711efa4bbe5908cfb5aee; _clsk=z8aa33%7C1727864211918%7C1%7C0%7Ct.clarity.ms%2Fcollect; MC1=GUID=40944b817c6f43219ea5caba422ead52&HASH=4094&LV=202410&V=4&LU=1727864214076; MS0=5d5a28dc628a46d8918acde28b77f98f
Source: global traffic	HTTP traffic detected: GET /assets/js/search-results-publisher-07f4a6c3.js HTTP/1.1Host: apps.microsoft.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://apps.microsoft.com/service-worker.jsAccept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: MSCC=NR; exp-session-id=b6d0ece2-29a7-4143-931c-d621648d7cb8; ai_user=gPFm7QcR2pV4O/zkZSC6dC\|2024-10-02T10:16:49.985Z; ai_session=KeivHP7d5TFls18euJ+R3i\|1727864209993\|1727864209993; _fbp=fb.1.1727864210794.836094937724409315; _clck=1x4xmda%7C2%7Cfpo%7C0%7C1736; _uetsid=70ac830080a711efa9fc9be06d42c5d1; _uetvid=70acc12080a711efa4bbe5908cfb5aee; _clsk=z8aa33%7C1727864211918%7C1%7C0%7Ct.clarity.ms%2Fcollect; MC1=GUID=40944b817c6f43219ea5caba422ead52&HASH=4094&LV=202410&V=4&LU=1727864214076; MS0=5d5a28dc628a46d8918acde28b77f98f
Source: global traffic	HTTP traffic detected: GET /assets/js/spacing.styles-7155d2ad.js HTTP/1.1Host: apps.microsoft.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://apps.microsoft.com/service-worker.jsAccept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: MSCC=NR; exp-session-id=b6d0ece2-29a7-4143-931c-d621648d7cb8; ai_user=gPFm7QcR2pV4O/zkZSC6dC\|2024-10-02T10:16:49.985Z; ai_session=KeivHP7d5TFls18euJ+R3i\|1727864209993\|1727864209993; _fbp=fb.1.1727864210794.836094937724409315; _clck=1x4xmda%7C2%7Cfpo%7C0%7C1736; _uetsid=70ac830080a711efa9fc9be06d42c5d1; _uetvid=70acc12080a711efa4bbe5908cfb5aee; _clsk=z8aa33%7C1727864211918%7C1%7C0%7Ct.clarity.ms%2Fcollect; MC1=GUID=40944b817c6f43219ea5caba422ead52&HASH=4094&LV=202410&V=4&LU=1727864214076; MS0=5d5a28dc628a46d8918acde28b77f98f
Source: global traffic	HTTP traffic detected: GET /assets/js/spotlight-card-d6cf8e19.js HTTP/1.1Host: apps.microsoft.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://apps.microsoft.com/service-worker.jsAccept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: MSCC=NR; exp-session-id=b6d0ece2-29a7-4143-931c-d621648d7cb8; ai_user=gPFm7QcR2pV4O/zkZSC6dC\|2024-10-02T10:16:49.985Z; ai_session=KeivHP7d5TFls18euJ+R3i\|1727864209993\|1727864209993; _fbp=fb.1.1727864210794.836094937724409315; _clck=1x4xmda%7C2%7Cfpo%7C0%7C1736; _uetsid=70ac830080a711efa9fc9be06d42c5d1; _uetvid=70acc12080a711efa4bbe5908cfb5aee; _clsk=z8aa33%7C1727864211918%7C1%7C0%7Ct.clarity.ms%2Fcollect; MC1=GUID=40944b817c6f43219ea5caba422ead52&HASH=4094&LV=202410&V=4&LU=1727864214076; MS0=5d5a28dc628a46d8918acde28b77f98f
Source: global traffic	HTTP traffic detected: GET /assets/js/spotlight-control-43a365a0.js HTTP/1.1Host: apps.microsoft.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://apps.microsoft.com/service-worker.jsAccept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: MSCC=NR; exp-session-id=b6d0ece2-29a7-4143-931c-d621648d7cb8; ai_user=gPFm7QcR2pV4O/zkZSC6dC\|2024-10-02T10:16:49.985Z; ai_session=KeivHP7d5TFls18euJ+R3i\|1727864209993\|1727864209993; _fbp=fb.1.1727864210794.836094937724409315; _clck=1x4xmda%7C2%7Cfpo%7C0%7C1736; _uetsid=70ac830080a711efa9fc9be06d42c5d1; _uetvid=70acc12080a711efa4bbe5908cfb5aee; _clsk=z8aa33%7C1727864211918%7C1%7C0%7Ct.clarity.ms%2Fcollect; MC1=GUID=40944b817c6f43219ea5caba422ead52&HASH=4094&LV=202410&V=4&LU=1727864214076; MS0=5d5a28dc628a46d8918acde28b77f98f
Source: global traffic	HTTP traffic detected: GET /assets/js/subscript-199a50ce.js HTTP/1.1Host: apps.microsoft.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://apps.microsoft.com/service-worker.jsAccept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: MSCC=NR; exp-session-id=b6d0ece2-29a7-4143-931c-d621648d7cb8; ai_user=gPFm7QcR2pV4O/zkZSC6dC\|2024-10-02T10:16:49.985Z; ai_session=KeivHP7d5TFls18euJ+R3i\|1727864209993\|1727864209993; _fbp=fb.1.1727864210794.836094937724409315; _clck=1x4xmda%7C2%7Cfpo%7C0%7C1736; _uetsid=70ac830080a711efa9fc9be06d42c5d1; _uetvid=70acc12080a711efa4bbe5908cfb5aee; _clsk=z8aa33%7C1727864211918%7C1%7C0%7Ct.clarity.ms%2Fcollect; MC1=GUID=40944b817c6f43219ea5caba422ead52&HASH=4094&LV=202410&V=4&LU=1727864214076; MS0=5d5a28dc628a46d8918acde28b77f98f
Source: global traffic	HTTP traffic detected: GET /assets/js/system-requirements-7f350381.js HTTP/1.1Host: apps.microsoft.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://apps.microsoft.com/service-worker.jsAccept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: MSCC=NR; exp-session-id=b6d0ece2-29a7-4143-931c-d621648d7cb8; ai_user=gPFm7QcR2pV4O/zkZSC6dC\|2024-10-02T10:16:49.985Z; ai_session=KeivHP7d5TFls18euJ+R3i\|1727864209993\|1727864209993; _fbp=fb.1.1727864210794.836094937724409315; _clck=1x4xmda%7C2%7Cfpo%7C0%7C1736; _uetsid=70ac830080a711efa9fc9be06d42c5d1; _uetvid=70acc12080a711efa4bbe5908cfb5aee; _clsk=z8aa33%7C1727864211918%7C1%7C0%7Ct.clarity.ms%2Fcollect; MC1=GUID=40944b817c6f43219ea5caba422ead52&HASH=4094&LV=202410&V=4&LU=1727864214076; MS0=5d5a28dc628a46d8918acde28b77f98f
Source: global traffic	HTTP traffic detected: GET /assets/js/tencent-4e399fb0.js HTTP/1.1Host: apps.microsoft.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://apps.microsoft.com/service-worker.jsAccept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: MSCC=NR; exp-session-id=b6d0ece2-29a7-4143-931c-d621648d7cb8; ai_user=gPFm7QcR2pV4O/zkZSC6dC\|2024-10-02T10:16:49.985Z; ai_session=KeivHP7d5TFls18euJ+R3i\|1727864209993\|1727864209993; _fbp=fb.1.1727864210794.836094937724409315; _clck=1x4xmda%7C2%7Cfpo%7C0%7C1736; _uetsid=70ac830080a711efa9fc9be06d42c5d1; _uetvid=70acc12080a711efa4bbe5908cfb5aee; _clsk=z8aa33%7C1727864211918%7C1%7C0%7Ct.clarity.ms%2Fcollect; MC1=GUID=40944b817c6f43219ea5caba422ead52&HASH=4094&LV=202410&V=4&LU=1727864214076; MS0=5d5a28dc628a46d8918acde28b77f98f
Source: global traffic	HTTP traffic detected: GET /assets/js/trending-collection-dc56edd4.js HTTP/1.1Host: apps.microsoft.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://apps.microsoft.com/service-worker.jsAccept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: MSCC=NR; exp-session-id=b6d0ece2-29a7-4143-931c-d621648d7cb8; ai_user=gPFm7QcR2pV4O/zkZSC6dC\|2024-10-02T10:16:49.985Z; ai_session=KeivHP7d5TFls18euJ+R3i\|1727864209993\|1727864209993; _fbp=fb.1.1727864210794.836094937724409315; _clck=1x4xmda%7C2%7Cfpo%7C0%7C1736; _uetsid=70ac830080a711efa9fc9be06d42c5d1; _uetvid=70acc12080a711efa4bbe5908cfb5aee; _clsk=z8aa33%7C1727864211918%7C1%7C0%7Ct.clarity.ms%2Fcollect; MC1=GUID=40944b817c6f43219ea5caba422ead52&HASH=4094&LV=202410&V=4&LU=1727864214076; MS0=5d5a28dc628a46d8918acde28b77f98f
Source: global traffic	HTTP traffic detected: GET /assets/js/video-player-aab5351f.js HTTP/1.1Host: apps.microsoft.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://apps.microsoft.com/service-worker.jsAccept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: MSCC=NR; exp-session-id=b6d0ece2-29a7-4143-931c-d621648d7cb8; ai_user=gPFm7QcR2pV4O/zkZSC6dC\|2024-10-02T10:16:49.985Z; ai_session=KeivHP7d5TFls18euJ+R3i\|1727864209993\|1727864209993; _fbp=fb.1.1727864210794.836094937724409315; _clck=1x4xmda%7C2%7Cfpo%7C0%7C1736; _uetsid=70ac830080a711efa9fc9be06d42c5d1; _uetvid=70acc12080a711efa4bbe5908cfb5aee; _clsk=z8aa33%7C1727864211918%7C1%7C0%7Ct.clarity.ms%2Fcollect; MC1=GUID=40944b817c6f43219ea5caba422ead52&HASH=4094&LV=202410&V=4&LU=1727864214076; MS0=5d5a28dc628a46d8918acde28b77f98f
Source: global traffic	HTTP traffic detected: GET /assets/js/visual-info-panel-112e17cc.js HTTP/1.1Host: apps.microsoft.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://apps.microsoft.com/service-worker.jsAccept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: MSCC=NR; exp-session-id=b6d0ece2-29a7-4143-931c-d621648d7cb8; ai_user=gPFm7QcR2pV4O/zkZSC6dC\|2024-10-02T10:16:49.985Z; ai_session=KeivHP7d5TFls18euJ+R3i\|1727864209993\|1727864209993; _fbp=fb.1.1727864210794.836094937724409315; _clck=1x4xmda%7C2%7Cfpo%7C0%7C1736; _uetsid=70ac830080a711efa9fc9be06d42c5d1; _uetvid=70acc12080a711efa4bbe5908cfb5aee; _clsk=z8aa33%7C1727864211918%7C1%7C0%7Ct.clarity.ms%2Fcollect; MC1=GUID=40944b817c6f43219ea5caba422ead52&HASH=4094&LV=202410&V=4&LU=1727864214076; MS0=5d5a28dc628a46d8918acde28b77f98f
Source: global traffic	HTTP traffic detected: GET /assets/js/wide-info-card-9b21aa9e.js HTTP/1.1Host: apps.microsoft.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://apps.microsoft.com/service-worker.jsAccept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: MSCC=NR; exp-session-id=b6d0ece2-29a7-4143-931c-d621648d7cb8; ai_user=gPFm7QcR2pV4O/zkZSC6dC\|2024-10-02T10:16:49.985Z; ai_session=KeivHP7d5TFls18euJ+R3i\|1727864209993\|1727864209993; _fbp=fb.1.1727864210794.836094937724409315; _clck=1x4xmda%7C2%7Cfpo%7C0%7C1736; _uetsid=70ac830080a711efa9fc9be06d42c5d1; _uetvid=70acc12080a711efa4bbe5908cfb5aee; _clsk=z8aa33%7C1727864211918%7C1%7C0%7Ct.clarity.ms%2Fcollect; MC1=GUID=40944b817c6f43219ea5caba422ead52&HASH=4094&LV=202410&V=4&LU=1727864214076; MS0=5d5a28dc628a46d8918acde28b77f98f
Source: global traffic	HTTP traffic detected: GET /baidu_verify_codeva-7XwzFsIV37.html HTTP/1.1Host: apps.microsoft.comConnection: keep-alivePragma: no-cacheCache-Control: no-cacheUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://apps.microsoft.com/service-worker.jsAccept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: MSCC=NR; exp-session-id=b6d0ece2-29a7-4143-931c-d621648d7cb8; ai_user=gPFm7QcR2pV4O/zkZSC6dC\|2024-10-02T10:16:49.985Z; ai_session=KeivHP7d5TFls18euJ+R3i\|1727864209993\|1727864209993; _fbp=fb.1.1727864210794.836094937724409315; _clck=1x4xmda%7C2%7Cfpo%7C0%7C1736; _uetsid=70ac830080a711efa9fc9be06d42c5d1; _uetvid=70acc12080a711efa4bbe5908cfb5aee; _clsk=z8aa33%7C1727864211918%7C1%7C0%7Ct.clarity.ms%2Fcollect; MC1=GUID=40944b817c6f43219ea5caba422ead52&HASH=4094&LV=202410&V=4&LU=1727864214076; MS0=5d5a28dc628a46d8918acde28b77f98f
Source: global traffic	HTTP traffic detected: GET /bing-bat.js HTTP/1.1Host: apps.microsoft.comConnection: keep-alivePragma: no-cacheCache-Control: no-cacheUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://apps.microsoft.com/service-worker.jsAccept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: MSCC=NR; exp-session-id=b6d0ece2-29a7-4143-931c-d621648d7cb8; ai_user=gPFm7QcR2pV4O/zkZSC6dC\|2024-10-02T10:16:49.985Z; ai_session=KeivHP7d5TFls18euJ+R3i\|1727864209993\|1727864209993; _fbp=fb.1.1727864210794.836094937724409315; _clck=1x4xmda%7C2%7Cfpo%7C0%7C1736; _uetsid=70ac830080a711efa9fc9be06d42c5d1; _uetvid=70acc12080a711efa4bbe5908cfb5aee; _clsk=z8aa33%7C1727864211918%7C1%7C0%7Ct.clarity.ms%2Fcollect; MC1=GUID=40944b817c6f43219ea5caba422ead52&HASH=4094&LV=202410&V=4&LU=1727864214076; MS0=5d5a28dc628a46d8918acde28b77f98f
Source: global traffic	HTTP traffic detected: GET /crx/blobs/AY4GWKDQIk_LzFaPKkVeG5kjrY2DSnx9vAOISkAQOoUiB7UAr3ctR1HE3o70iDC7T1ZWF5lMEcB1tpSB3Nz2v6hUR5ioHSyOWNrjqmubSP1Sq4lVK1emAMZSmuV73iDI0_0bj6Ca_uMOmBP187AlKQ/OLFEABKOENFAOLJNDFECAMGILLLCPIAK_6_0_11_0.crx HTTP/1.1Host: clients2.googleusercontent.comConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /clarity.js HTTP/1.1Host: apps.microsoft.comConnection: keep-alivePragma: no-cacheCache-Control: no-cacheUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://apps.microsoft.com/service-worker.jsAccept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: MSCC=NR; exp-session-id=b6d0ece2-29a7-4143-931c-d621648d7cb8; ai_user=gPFm7QcR2pV4O/zkZSC6dC\|2024-10-02T10:16:49.985Z; ai_session=KeivHP7d5TFls18euJ+R3i\|1727864209993\|1727864209993; _fbp=fb.1.1727864210794.836094937724409315; _clck=1x4xmda%7C2%7Cfpo%7C0%7C1736; _uetsid=70ac830080a711efa9fc9be06d42c5d1; _uetvid=70acc12080a711efa4bbe5908cfb5aee; _clsk=z8aa33%7C1727864211918%7C1%7C0%7Ct.clarity.ms%2Fcollect; MC1=GUID=40944b817c6f43219ea5caba422ead52&HASH=4094&LV=202410&V=4&LU=1727864214076; MS0=5d5a28dc628a46d8918acde28b77f98f
Source: global traffic	HTTP traffic detected: GET /color-worker.js HTTP/1.1Host: apps.microsoft.comConnection: keep-alivePragma: no-cacheCache-Control: no-cacheUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://apps.microsoft.com/service-worker.jsAccept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: MSCC=NR; exp-session-id=b6d0ece2-29a7-4143-931c-d621648d7cb8; ai_user=gPFm7QcR2pV4O/zkZSC6dC\|2024-10-02T10:16:49.985Z; ai_session=KeivHP7d5TFls18euJ+R3i\|1727864209993\|1727864209993; _fbp=fb.1.1727864210794.836094937724409315; _clck=1x4xmda%7C2%7Cfpo%7C0%7C1736; _uetsid=70ac830080a711efa9fc9be06d42c5d1; _uetvid=70acc12080a711efa4bbe5908cfb5aee; _clsk=z8aa33%7C1727864211918%7C1%7C0%7Ct.clarity.ms%2Fcollect; MC1=GUID=40944b817c6f43219ea5caba422ead52&HASH=4094&LV=202410&V=4&LU=1727864214076; MS0=5d5a28dc628a46d8918acde28b77f98f
Source: global traffic	HTTP traffic detected: GET /webstore/inlineinstall/detail/olfeabkoenfaoljndfecamgilllcpiak HTTP/1.1Host: chrome.google.comConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /offline.html HTTP/1.1Host: apps.microsoft.comConnection: keep-alivePragma: no-cacheCache-Control: no-cacheUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://apps.microsoft.com/service-worker.jsAccept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: MSCC=NR; exp-session-id=b6d0ece2-29a7-4143-931c-d621648d7cb8; ai_user=gPFm7QcR2pV4O/zkZSC6dC\|2024-10-02T10:16:49.985Z; ai_session=KeivHP7d5TFls18euJ+R3i\|1727864209993\|1727864209993; _fbp=fb.1.1727864210794.836094937724409315; _clck=1x4xmda%7C2%7Cfpo%7C0%7C1736; _uetsid=70ac830080a711efa9fc9be06d42c5d1; _uetvid=70acc12080a711efa4bbe5908cfb5aee; _clsk=z8aa33%7C1727864211918%7C1%7C0%7Ct.clarity.ms%2Fcollect; MC1=GUID=40944b817c6f43219ea5caba422ead52&HASH=4094&LV=202410&V=4&LU=1727864214076; MS0=5d5a28dc628a46d8918acde28b77f98f
Source: global traffic	HTTP traffic detected: GET /shoelace-dark-2.15.1.css HTTP/1.1Host: apps.microsoft.comConnection: keep-alivePragma: no-cacheCache-Control: no-cacheUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://apps.microsoft.com/service-worker.jsAccept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: MSCC=NR; exp-session-id=b6d0ece2-29a7-4143-931c-d621648d7cb8; ai_user=gPFm7QcR2pV4O/zkZSC6dC\|2024-10-02T10:16:49.985Z; ai_session=KeivHP7d5TFls18euJ+R3i\|1727864209993\|1727864209993; _fbp=fb.1.1727864210794.836094937724409315; _clck=1x4xmda%7C2%7Cfpo%7C0%7C1736; _uetsid=70ac830080a711efa9fc9be06d42c5d1; _uetvid=70acc12080a711efa4bbe5908cfb5aee; _clsk=z8aa33%7C1727864211918%7C1%7C0%7Ct.clarity.ms%2Fcollect; MC1=GUID=40944b817c6f43219ea5caba422ead52&HASH=4094&LV=202410&V=4&LU=1727864214076; MS0=5d5a28dc628a46d8918acde28b77f98f
Source: global traffic	HTTP traffic detected: GET /phishinglist/list/v2 HTTP/1.1Host: software.seznam.czConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Origin: chrome-extension://olfeabkoenfaoljndfecamgilllcpiakSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /shoelace-light-2.15.1.css HTTP/1.1Host: apps.microsoft.comConnection: keep-alivePragma: no-cacheCache-Control: no-cacheUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://apps.microsoft.com/service-worker.jsAccept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: MSCC=NR; exp-session-id=b6d0ece2-29a7-4143-931c-d621648d7cb8; ai_user=gPFm7QcR2pV4O/zkZSC6dC\|2024-10-02T10:16:49.985Z; ai_session=KeivHP7d5TFls18euJ+R3i\|1727864209993\|1727864209993; _fbp=fb.1.1727864210794.836094937724409315; _clck=1x4xmda%7C2%7Cfpo%7C0%7C1736; _uetsid=70ac830080a711efa9fc9be06d42c5d1; _uetvid=70acc12080a711efa4bbe5908cfb5aee; _clsk=z8aa33%7C1727864211918%7C1%7C0%7Ct.clarity.ms%2Fcollect; MC1=GUID=40944b817c6f43219ea5caba422ead52&HASH=4094&LV=202410&V=4&LU=1727864214076; MS0=5d5a28dc628a46d8918acde28b77f98f
Source: global traffic	HTTP traffic detected: GET /vite-index.html HTTP/1.1Host: apps.microsoft.comConnection: keep-alivePragma: no-cacheCache-Control: no-cacheUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://apps.microsoft.com/service-worker.jsAccept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: MSCC=NR; exp-session-id=b6d0ece2-29a7-4143-931c-d621648d7cb8; ai_user=gPFm7QcR2pV4O/zkZSC6dC\|2024-10-02T10:16:49.985Z; ai_session=KeivHP7d5TFls18euJ+R3i\|1727864209993\|1727864209993; _fbp=fb.1.1727864210794.836094937724409315; _clck=1x4xmda%7C2%7Cfpo%7C0%7C1736; _uetsid=70ac830080a711efa9fc9be06d42c5d1; _uetvid=70acc12080a711efa4bbe5908cfb5aee; _clsk=z8aa33%7C1727864211918%7C1%7C0%7Ct.clarity.ms%2Fcollect; MC1=GUID=40944b817c6f43219ea5caba422ead52&HASH=4094&LV=202410&V=4&LU=1727864214076; MS0=5d5a28dc628a46d8918acde28b77f98f
Source: global traffic	HTTP traffic detected: GET /phishinglist/list/v2 HTTP/1.1Host: software.seznam.czConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Origin: chrome-extension://olfeabkoenfaoljndfecamgilllcpiakSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9If-None-Match: "0d3d9b65b89032e8640ff38a07a98de029eb2e9846c242e1ee11ffb96f927d03"
Source: global traffic	HTTP traffic detected: GET /crx/blobs/AY4GWKA7rRcfuiuOTi8MMh_yoPCiNMHFVQA6NVDkcJ6zsobnt4zWcbRwYlrOwIINIn3dxpNWaiKHNeuobj12XqBwh5d8WNR7RnSviL81nMFK9aE9MaMvmUFs3QvljNfFE-4AxlKa5T2E6wPqA8HFDB89XXj_lJRRoGXW/BGJPFHPJCGDPPJBGNPNJLLOKBMCDLLIG_6_1_11_0.crx HTTP/1.1Host: clients2.googleusercontent.comConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /webstore/inlineinstall/detail/bgjpfhpjcgdppjbgnpnjllokbmcdllig HTTP/1.1Host: chrome.google.comConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /gphotos?action=install&hl=en&gl=ch&brand=GGLA&scrid=AD0E3D47-9B39-483F-83C6-9B8C783457F6&v=(null) HTTP/1.1Accept: /Accept-Encoding: gzipUser-Agent: Google Photos Screensaver 2.0 (gzip)Host: pack.google.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /update/packages.inf HTTP/1.1Host: download.seznam.cz
Source: global traffic	HTTP traffic detected: GET /update/cz.seznam.software.sznsetup-1.2.7-win32.zip HTTP/1.1Host: download.seznam.cz
Source: global traffic	HTTP traffic detected: GET /update/cz.seznam.software.szninstall-1.1.15-win32.zip HTTP/1.1Host: download.seznam.cz
Source: global traffic	HTTP traffic detected: GET /feeds/posts/default HTTP/1.1Accept: /Accept-Encoding: gzipUser-Agent: Picasa/3.9.141.255 (gzip)Host: picasa-readme.blogspot.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /support/bin/answer.py?hl=en&answer=93773 HTTP/1.1Accept: text/html, application/xhtml+xml, image/jxr, /Accept-Language: en-CHUser-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: picasa.google.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /update/packages.inf HTTP/1.1Host: download.seznam.cz
Source: global traffic	HTTP traffic detected: GET /update/cz.seznam.software.lightspeed-1210-12.10.18-win32.zip HTTP/1.1Host: download.seznam.cz
Source: global traffic	HTTP traffic detected: GET /update/cz.seznam.software.libszndesktop-2.1.35-win32.zip HTTP/1.1Host: download.seznam.cz
Source: global traffic	HTTP traffic detected: GET /update/cz.seznam.software.szndesktop-2.0.32-win32.zip HTTP/1.1Host: download.seznam.cz
Source: global traffic	HTTP traffic detected: GET /update/cz.seznam.software.libfoxcub-3.3.8-win32.zip HTTP/1.1Host: download.seznam.cz
Source: global traffic	HTTP traffic detected: GET /update/cz.seznam.software.libfoxcub64-3.3.8-win32.zip HTTP/1.1Host: download.seznam.cz
Source: global traffic	HTTP traffic detected: GET /update/cz.seznam.software.ielisticka3-3.3.5-win32.zip HTTP/1.1Host: download.seznam.cz
Source: global traffic	HTTP traffic detected: GET /update/szn-software-fflisticka-4.0.8-win32.zip HTTP/1.1Host: download.seznam.cz

Source: Picasa3.exe, 00000014.00000002.2593399186.0000000007223000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Minor bugfixes to the text tool, web sync, and virtual albums</span></span></div><div><br /></div></span></span></div><div><br /></div></content><link rel='edit' type='application/atom+xml' href='http://www.blogger.com/feeds/1456569655786168306/posts/default/3576455443803502313'/><link rel='self' type='application/atom+xml' href='http://www.blogger.com/feeds/1456569655786168306/posts/default/3576455443803502313'/><link rel='alternate' type='text/html' href='http://picasa-readme.blogspot.com/2008/10/picasa-30-out-of-beta-build-xxxx.html' title='Picasa 3.0 (out of beta!) -- Build 57.53'/><author><name>Picasa Team</name><uri>http://www.blogger.com/profile/00823187511285450623</uri><email>noreply@blogger.com</email><gd:image rel='http://schemas.google.com/g/2005#thumbnail' width='16' height='16' src='https://img1.blogblog.com/img/b16-rounded.gif'/></author></entry><entry><id>tag:blogger.com,1999:blog-1456569655786168306.post-6597548198970830433</id><published>2008-09-30T16:40:00.000-07:00</published><updated>2008-09-30T16:43:01.938-07:00</updated><category scheme="http://www.blogger.com/atom/ns#" term="autoupdate"/><title type='text'>Build 57.24</title><content type='html'><span style="font-style: italic;">Automatic update for Picasa 3 beta testers.</span><br /><br />Changes in this release are:<br /><ul><li>Bug fixes.</li><li>Updated RAW support for more cameras including: Canon 1000D and the Powershot A720, Nikon D700, and Olympus E-520.<br /></li><li>Increased YouTube file size upload limit to 1GB.<br /></li></ul>Visit our <a href="http://groups.google.com/group/picasa">Google Group</a> to give us feedback, and discuss Picasa with other users.</content><link rel='edit' type='application/atom+xml' href='http://www.blogger.com/feeds/1456569655786168306/posts/default/6597548198970830433'/><link rel='self' type='application/atom+xml' href='http://www.blogger.com/feeds/1456569655786168306/posts/default/6597548198970830433'/><link rel='alternate' type='text/html' href='http://picasa-readme.blogspot.com/2008/09/build-5724.html' title='Build 57.24'/><author><name>Picasa Team</name><uri>http://www.blogger.com/profile/00823187511285450623</uri><email>noreply@blogger.com</email><gd:image rel='http://schemas.google.com/g/2005#thumbnail' width='16' height='16' src='https://img1.blogblog.com/img/b16-rounded.gif'/></author></entry><entry><id>tag:blogger.com,1999:blog-1456569655786168306.post-1237605142260003533</id><published>2008-09-02T12:00:00.000-07:00</published><updated>2008-10-29T16:15:59.995-07:00</updated><title type='text'>Picasa 3.0 (beta) -- Build 57.19</title><content type='html'><span class="Apple-style-span" style="font-style: italic;">Initial public beta release of Picasa 3.0. equals www.youtube.com (Youtube)
Source: Picasa3.exe, 00000014.00000002.2593399186.0000000007223000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: </content><link rel='edit' type='application/atom+xml' href='http://www.blogger.com/feeds/1456569655786168306/posts/default/2231948156028307071'/><link rel='self' type='application/atom+xml' href='http://www.blogger.com/feeds/1456569655786168306/posts/default/2231948156028307071'/><link rel='alternate' type='text/html' href='http://picasa-readme.blogspot.com/2012/04/picasa-3.html' title='Picasa 3.9: Now with Google+ sharing and tagging'/><author><name>Picasa Team</name><uri>http://www.blogger.com/profile/00823187511285450623</uri><email>noreply@blogger.com</email><gd:image rel='http://schemas.google.com/g/2005#thumbnail' width='16' height='16' src='https://img1.blogblog.com/img/b16-rounded.gif'/></author><media:thumbnail xmlns:media="http://search.yahoo.com/mrss/" url="https://lh5.googleusercontent.com/torawRKsQC9zYeAfBTnwj0vDXOgZc_h0dLzbT9cuJHTARJVy8hKIualz1K6Eyxrk5N0BqzOcE0q033Bobgt1A4ugxIGsBqnvlYQG1zqx4F28kqDOzhg=s72-c" height="72" width="72"/></entry><entry><id>tag:blogger.com,1999:blog-1456569655786168306.post-1272700194270571942</id><published>2010-10-20T13:09:00.000-07:00</published><updated>2010-10-20T21:45:11.829-07:00</updated><title type='text'>Picasa 3.8 now available in 38 languages</title><content type='html'>People around the world can now enjoy the updates in Picasa 3.8. The latest Picasa update is now available in 38 languages. This update includes; batch uploading and other synchronization controls with Picasa Web Albums, the addition of Picnik's photo-editor, Face Movie and more. Face Movie is a fun way to showcase photos centered around one person. <br /> equals www.yahoo.com (Yahoo)
Source: Picasa3.exe, 00000014.00000002.2593399186.0000000007223000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Feedback and questions are also welcome in our <a href="http://groups.google.com/group/Picasa">forums</a>.</span></span></div><br /><br /><object width="425" height="344"><param name="movie" value="http://www.youtube.com/v/rskC6c_5L1M&amp;hl=en&amp;fs=1"><param name="allowFullScreen" value="true"><param name="allowscriptaccess" value="always"><embed src="http://www.youtube.com/v/rskC6c_5L1M&amp;hl=en&amp;fs=1" type="application/x-shockwave-flash" allowscriptaccess="always" allowfullscreen="true" width="425" height="344"></embed></object><br /><br /><div><span class="Apple-style-span" style="color: rgb(51, 51, 51); ">A brief summary of changes in this release, versus Picasa 2:</span><br /></div><div><span class="Apple-style-span" style="font-size:small;"><span class="Apple-style-span" style="color: rgb(51, 51, 51);"><br /></span></span></div><div><span class="Apple-style-span" style="line-height: 20px; "><div><span class="Apple-style-span" style="font-weight: bold; "><span class="Apple-style-span" style="font-size:small;"><span class="Apple-style-span" style="color: rgb(51, 51, 51);">Better integration between desktop and the web</span></span></span></div><div><span class="Apple-style-span" style="font-size:small;"><span class="Apple-style-span" style="color: rgb(51, 51, 51);"> equals www.youtube.com (Youtube)
Source: Picasa3.exe, 00000014.00000002.2593399186.000000000716B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Feedback and questions are also welcome in our <a href="http://groups.google.com/group/Picasa">forums</a>.</span></span></div><br /><br /><object width="425" height="344"><param name="movie" value="http://www.youtube.com/v/rskC6c_5L1M&hl=en&fs=1"><param name="allowFullScreen" value="true"><param name="allowscriptaccess" value="always"><embed src="http://www.youtube.com/v/rskC6c_5L1M&hl=en&fs=1" type="application/x-shockwave-flash" allowscriptaccess="always" allowfullscreen="true" width="425" height="344"></embed></object><br /><br /><div><span class="Apple-style-span" style="color: rgb(51, 51, 51); ">A brief summary of changes in this release, versus Picasa 2:</span><br /></div><div><span class="Apple-style-span" style="font-size:small;"><span class="Apple-style-span" style="color: rgb(51, 51, 51);"><br /></span></span></div><div><span class="Apple-style-span" style="line-height: 20px; "><div><span class="Apple-style-span" style="font-weight: bold; "><span class="Apple-style-span" style="font-size:small;"><span class="Apple-style-span" style="color: rgb(51, 51, 51);">Better integration between desktop and the web</span></span></span></div><div><span class="Apple-style-span" style="font-size:small;"><span class="Apple-style-span" style="color: rgb(51, 51, 51);"> equals www.youtube.com (Youtube)
Source: GPhotos.scr, 00000011.00000000.1542724484.000000000062E000.00000002.00000001.01000000.0000000F.sdmp	String found in binary or memory: Fgaiahttps://www.google.com/accounts/OAuthLoginhttps://picasaweb.google.com/c/https://www.google.com/m8/feeds/https://mail.google.com/http://gdata.youtube.comhttps://www.googleapis.com/auth/plus.settingshttps://www.googleapis.com/auth/plus.media.readonlyhttps://www.googleapis.com/auth/plus.media.uploadhttps://www.googleapis.com/auth/plus.mehttps://www.googleapis.com/auth/plus.profiles.readhttps://www.googleapis.com/auth/plus.circles.readhttps://www.googleapis.com/auth/plus.stream.writehttps://www.googleapis.com/auth/photoshttps://www.googleapis.com/auth/userinfo%23emailhttps://www.google.comGaiaUrlwebupdatesoauthloginyoutubeplus.settingsplus.media.readonlyplus.media.uploadplus.meplus.profiles.readplus.circles.readplus.firstpartyplus.stream.writemailrelaycp.managercplh2mailThis account is not enabled for Google Photos.Gaia:NoPWAThis account is not enabled for Google+Gaia::NoGPlusYou are not signed up for a Gmail AccountGaia::NoGmailYou are either not signed up for YouTube or your YouTube account is not connected to your Google accountGaia::NoYouTubeYou are not signed up for this serviceGaia::NoServicehttps://picasaweb.google.com/lh/picasaSignupRedirhttps://plus.google.com/https://www.google.com/accounts/NewAccount?service=mailhttps://www.youtube.com/create_channel?upsell=uploadPUTHEADPOSTGET%s: %sContent-encodinggzipGZip detected- inflatingFailed to inflate GZip dataFailed to inflate GZIP dataContent-typeimageReceived response: equals www.youtube.com (Youtube)
Source: Picasa3.exe, 00000012.00000000.1603749985.0000000000C6A000.00000002.00000001.01000000.00000012.sdmp	String found in binary or memory: Fgaiahttps://www.google.com/accounts/OAuthLoginhttps://picasaweb.google.com/c/https://www.google.com/m8/feeds/https://mail.google.com/https://www.googleapis.com/auth/plus.settingshttps://www.googleapis.com/auth/plus.media.readonlyhttps://www.googleapis.com/auth/plus.media.uploadhttps://www.googleapis.com/auth/plus.mehttps://www.googleapis.com/auth/plus.profiles.readhttps://www.googleapis.com/auth/plus.circles.readhttps://www.googleapis.com/auth/plus.stream.writehttps://www.googleapis.com/auth/photoshttps://www.googleapis.com/auth/userinfo%23emailhttps://www.google.comGaiaUrlwebupdatesoauthloginplus.settingsplus.media.readonlyplus.media.uploadplus.meplus.profiles.readplus.circles.readplus.firstpartyplus.stream.writemailrelaycp.managercplh2mailThis account is not enabled for Google Photos.Gaia:NoPWAThis account is not enabled for Google+Gaia::NoGPlusYou are not signed up for a Gmail AccountGaia::NoGmailYou are either not signed up for YouTube or your YouTube account is not connected to your Google accountGaia::NoYouTubeYou are not signed up for this serviceGaia::NoServicehttps://picasaweb.google.com/lh/picasaSignupRedirhttps://plus.google.com/https://www.google.com/accounts/NewAccount?service=mailhttps://www.youtube.com/create_channel?upsell=upload%3B%3A%25%disable_contact_sync{id}https://picasaweb.google.com/data/urls?version=1&alt=rss{username}Software\Google\Photos%s URL not foundLighthouse::urlerrorgphoto:settingsgphoto:syncgphoto:uploadgphoto:quotalimitpaidgphoto:etaggphoto:frOptinOptedOutUndecided&gl=%sFailed to parse URL listLHUrls::ParseErrorLDomain://lh::userpostemailAlbumrecentCommentsgalleryalbumPagealbum_entryphotoPageupgradeStoragehttps://photos.google.comvideoPostTargetresumableVideoUploadUrlupgradeVideoemailRelayupdateRequiredGoogle Photos is temporarily unavailableLighthouse::ServiceUnavailableESWeb Albums is temporarily unavailableLighthouse::ServiceUnavailablelhpicasaweb.google.comlh2.google.comphotos.google.com/feed/entry//feed/?alt=rss equals www.youtube.com (Youtube)
Source: Picasa3.exe, 00000014.00000002.2506191744.0000000004241000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: In addition, the Photo Viewer software that accompanies Picasa 3 on Windows is not included on the Mac.</div><div><br /></div><div>Picasa for Mac requires an Intel-based Mac and Mac OS X 10.4+.</div><div><br /></div><div>We'd like to hear your feedback on this beta -- please visit our <a href="http://www.google.com/support/forum/p/Picasa?hl=en">support forum</a> and let us know how Picasa works for you, and how we can make it better.</div><div><br /></div><div><span class="Apple-style-span" style="border-collapse: separate; white-space: pre; font-family:Arial;font-size:10px;"><object width="425" height="344"><param name="movie" value="http://www.youtube.com/v/NDKFjc3_wrk&hl=en&fs=1"><param name="allowFullScreen" value="true"><param name="allowscriptaccess" value="always"><embed src="http://www.youtube.com/v/NDKFjc3_wrk&hl=en&fs=1" type="application/x-shockwave-flash" allowscriptaccess="always" allowfullscreen="true" width="425" height="344"></embed></object></span><br /></div><div><br /></div></span> equals www.youtube.com (Youtube)
Source: Picasa3.exe, 00000012.00000000.1603749985.0000000000C6A000.00000002.00000001.01000000.00000012.sdmp	String found in binary or memory: K<style><!--span{width: 220px; height: 20px; white-space:nowrap; overflow:hidden; text-overflow:ellipsis} body,td,a,p,.h{background-color: #F3F3F3;font-family:arial,sans-serif;font-size: 14px;}.h{font-size: 20px;}.q{color:#0000cc;}//--></style><meta http-equiv='refresh' content='60'><style><!--body,td,a,p,.h{background-color: #EFEFEF;font-family:arial,sans-serif;font-size: 14px;}.h{font-size: 20px;}.q{color:#0000cc;}//--></style><html><head>%s<body topmargin=20 leftmargin=8><html><head>%s<body topmargin=4 leftmargin=4><form action=search><input size=45 maxLength=256 name=q><input type=submit value='Picasa Search'></form><html><head>%s<body topmargin=20 leftmargin=20><form action=search><input size=55 maxLength=256 name=q><input type=submit value='Picasa Search'></form>OkytSocketytHTTPdimage/jpegimagedbidhttp://%s/%s/thumb/%s.jpghttp://%s/%s/image/%s.jpghttp://%s/%s/original/%s<?xml version="1.0" encoding="utf-8" ?>rss2.0versionhttp://www.pheed.com/pheed/xmlns:photohttp://search.yahoo.com/msrss/xmlns:mediahttp://picasaweb.google.com/lh/picasaweb/xmlns:gphotochanneltitlelinkgphoto:usergphoto:idgphoto:locationpicasa:dbidpicasa:albumidhttp://%s/%s/album%d.htmlhttp://%s/%s/rssalbum%d.rssitempubDategphoto:filenamepubdategphoto:rsslinkgphoto:widthgphoto:heightphoto:thumbnailphoto:imgsrcmedia:groupmedia:contenturltrueisDefaultmedia:thumbnailfileSizetype, equals www.yahoo.com (Yahoo)
Source: Picasa3.exe, 00000014.00000002.2586100840.0000000006F6F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: We're happy to announce the launch of Picasa 3.5, the latest release of Picasa photo management software. If you don't want to wait until we autoupdate everyone to Picasa 3.5, you can download it at <a href="http://picasa.google.com/">picasa.google.com</a>.<br /><br />This ReadMe page appears when a new version of Picasa software is available, and tells you what changes and improvements are in each release.<br /><br />Picasa 3.5 is a significant upgrade from Picasa 3.1. For an in-depth overview of what's new, you can play the video below, read our launch post on the <a href="http://googlephotos.blogspot.com/">Google Photos blog</a>, or consult the "<a href="http://picasa.google.com/support/bin/answer.py?answer=93773&ctx=readme">Picasa 3 New Features</a>" support document. Feedback and questions are also welcome in our <a href="http://groups.google.com/group/Picasa">user forums</a>.<br /><br /><object width="560" height="340"><param name="movie" value="http://www.youtube.com/v/gYO2uhrIZJ4&hl=en& equals www.youtube.com (Youtube)
Source: Picasa3.exe, 00000014.00000002.2506191744.0000000004241000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: We're happy to announce the launch of Picasa 3.5, the latest release of Picasa photo management software. If you don't want to wait until we autoupdate everyone to Picasa 3.5, you can download it at <a href="http://picasa.google.com/">picasa.google.com</a>.<br /><br />This ReadMe page appears when a new version of Picasa software is available, and tells you what changes and improvements are in each release.<br /><br />Picasa 3.5 is a significant upgrade from Picasa 3.1. For an in-depth overview of what's new, you can play the video below, read our launch post on the <a href="http://googlephotos.blogspot.com/">Google Photos blog</a>, or consult the "<a href="http://picasa.google.com/support/bin/answer.py?answer=93773&ctx=readme">Picasa 3 New Features</a>" support document. Feedback and questions are also welcome in our <a href="http://groups.google.com/group/Picasa">user forums</a>.<br /><br /><object width="560" height="340"><param name="movie" value="http://www.youtube.com/v/gYO2uhrIZJ4&hl=en&fs=1 equals www.youtube.com (Youtube)
Source: Picasa3.exe, 00000014.00000002.2506191744.0000000004241000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: We're happy to announce the launch of Picasa 3.5, the latest release of Picasa photo management software. If you don't want to wait until we autoupdate everyone to Picasa 3.5, you can download it at <a href="http://picasa.google.com/">picasa.google.com</a>.<br /><br />This ReadMe page appears when a new version of Picasa software is available, and tells you what changes and improvements are in each release.<br /><br />Picasa 3.5 is a significant upgrade from Picasa 3.1. For an in-depth overview of what's new, you can play the video below, read our launch post on the <a href="http://googlephotos.blogspot.com/">Google Photos blog</a>, or consult the "<a href="http://picasa.google.com/support/bin/answer.py?answer=93773&ctx=readme">Picasa 3 New Features</a>" support document. Feedback and questions are also welcome in our <a href="http://groups.google.com/group/Picasa">user forums</a>.<br /><br /><object width="560" height="340"><param name="movie" value="http://www.youtube.com/v/gYO2uhrIZJ4&hl=en&fs=1&rel=0&hd=1"><param name="allowFullScreen" value="true"><param name="allowscriptaccess" value="always"><embed src="http://www.youtube.com/v/gYO2uhrIZJ4&hl=en&fs=1&rel=0&hd=1" type="application/x-shockwave-flash" allowscriptaccess="always" allowfullscreen="true" width="560" height="340"></embed></object><br /><br />A brief summary of changes in this release, versus Picasa 3.1:<br /><br /><strong>Name tags</strong><br /><ul><li>Name tags help you organize your photos by what matters most: the people in them.<br /></li><li>Picasa identifies similar faces in your photos and puts these into the "Unnamed people" album. To add a name tag, just click "Add a name" and type the person's name.<br /></li><li>After you've tagged some pictures, you can do creative things with your name tags, like finding all the photos with the same two people in them or creating a face collage with just one click.<br /></li><li> equals www.youtube.com (Youtube)
Source: Picasa3.exe, 00000014.00000002.2506191744.0000000004241000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: We're happy to announce the launch of Picasa 3.5, the latest release of Picasa photo management software. If you don't want to wait until we autoupdate everyone to Picasa 3.5, you can download it at <a href="http://picasa.google.com/">picasa.google.com</a>.<br /><br />This ReadMe page appears when a new version of Picasa software is available, and tells you what changes and improvements are in each release.<br /><br />Picasa 3.5 is a significant upgrade from Picasa 3.1. For an in-depth overview of what's new, you can play the video below, read our launch post on the <a href="http://googlephotos.blogspot.com/">Google Photos blog</a>, or consult the "<a href="http://picasa.google.com/support/bin/answer.py?answer=93773&ctx=readme">Picasa 3 New Features</a>" support document. Feedback and questions are also welcome in our <a href="http://groups.google.com/group/Picasa">user forums</a>.<br /><br /><object width="560" height="340"><param name="movie" value="http://www.youtube.com/v/gYO2uhrIZJ4&hl=en&fs=1&rel=0&hd=1"><param name="allowFullScreen" value="true"><param name="allowscriptaccess" value="always"><embed src="http://www.youtube.com/v/gYO2uhrIZJ4&hl=en&fs=1&rel=0&hd=1" type="application/x-shockwave-flash" allowscriptaccess="always" allowfullscreen="true" width="560" height="340"></embed></object><br /><br />A brief summary of changes in this release, versus Picasa 3.1:<br /><br /><strong>Name tags</strong><br /><ul><li>Name tags help you organize your photos by what matters most: the people in them.<br /></li><li>Picasa identifies similar faces in your photos and puts these into the "Unnamed people" album. To add a name tag, just click "Add a name" and type the person's name.<br /></li><li>After you've tagged some pictures, you can do creative things with your name tags, like finding all the photos with the same two people in them or creating a face collage with just one click.<br /></li><li>x0 equals www.youtube.com (Youtube)
Source: Picasa3.exe, 00000014.00000002.2563942835.0000000006D99000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: aram name="allowscriptaccess" value="always"><embed src="http://www.youtube.com/v/NDKFjc3_wrk&hl=en&fs=1" type="application/x-shockwave-flash" allowscriptaccess="always" allowfullscreen="true" width="425" height="344"></embed></object></span><br /></div><div><br /></div></span> equals www.youtube.com (Youtube)
Source: setuppicasa39-setup.exe, 00000010.00000002.1664870898.00000000031AA000.00000004.00000020.00020000.00000000.sdmp, setuppicasa39-setup.exe, 00000010.00000002.1664870898.00000000035FF000.00000004.00000020.00020000.00000000.sdmp, GPhotos.scr, 00000011.00000000.1542724484.000000000062E000.00000002.00000001.01000000.0000000F.sdmp	String found in binary or memory: https://www.youtube.com/create_channel?upsell=upload equals www.youtube.com (Youtube)
Source: PicasaPhotoViewer.exe, 00000015.00000000.1692209976.000000000070D000.00000002.00000001.01000000.00000019.sdmp	String found in binary or memory: ugp7Dgaiahttps://www.google.com/accounts/OAuthLoginhttps://picasaweb.google.com/c/https://www.google.com/m8/feeds/https://mail.google.com/http://gdata.youtube.comhttps://www.googleapis.com/auth/plus.settingshttps://www.googleapis.com/auth/plus.media.readonlyhttps://www.googleapis.com/auth/plus.media.uploadhttps://www.googleapis.com/auth/plus.mehttps://www.googleapis.com/auth/plus.profiles.readhttps://www.googleapis.com/auth/plus.circles.readhttps://www.googleapis.com/auth/plus.stream.writehttps://www.googleapis.com/auth/photoshttps://www.googleapis.com/auth/userinfo%23emailhttps://www.google.comGaiaUrlwebupdatesoauthloginyoutubeplus.settingsplus.media.readonlyplus.media.uploadplus.meplus.profiles.readplus.circles.readplus.firstpartyplus.stream.writemailrelaycp.managercplh2mailThis account is not enabled for Google Photos.Gaia:NoPWAThis account is not enabled for Google+Gaia::NoGPlusYou are not signed up for a Gmail AccountGaia::NoGmailYou are either not signed up for YouTube or your YouTube account is not connected to your Google accountGaia::NoYouTubeYou are not signed up for this serviceGaia::NoServicehttps://picasaweb.google.com/lh/picasaSignupRedirhttps://plus.google.com/https://www.google.com/accounts/NewAccount?service=mailhttps://www.youtube.com/create_channel?upsell=uploadConnection failedUploadError::ConnectFailedRequest failedUploadError::RequestFailedimageentryreledit-mediahrefalternatetext/htmlcontentsrcpublishedpubDateupdatedgphoto:idgphoto:widthgphoto:heightgphoto:clientgphoto:checksumgphoto:sizemedia:keywordscodeinternalReasonapplication/atom+xml%s/data/feed/api/user/%s/albumid/%s?xmlerrors=1PUT%s/data/feed/api/user/%s?kind=album&access=privatevisible equals www.youtube.com (Youtube)

Source: global traffic	DNS traffic detected: DNS query: pack.google.com
Source: global traffic	DNS traffic detected: DNS query: download.seznam.cz
Source: global traffic	DNS traffic detected: DNS query: picasa.google.com
Source: global traffic	DNS traffic detected: DNS query: picasa-readme.blogspot.com
Source: global traffic	DNS traffic detected: DNS query: support.google.com
Source: global traffic	DNS traffic detected: DNS query: clients2.googleusercontent.com
Source: global traffic	DNS traffic detected: DNS query: lh3.googleusercontent.com
Source: global traffic	DNS traffic detected: DNS query: chrome.cloudflare-dns.com
Source: global traffic	DNS traffic detected: DNS query: apis.google.com
Source: global traffic	DNS traffic detected: DNS query: h.imedia.cz
Source: global traffic	DNS traffic detected: DNS query: sentry.sklik.cz
Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: chrome.google.com
Source: global traffic	DNS traffic detected: DNS query: software.seznam.cz
Source: global traffic	DNS traffic detected: DNS query: h.seznam.cz

Source: unknown

HTTP traffic detected: POST /dns-query HTTP/1.1Host: chrome.cloudflare-dns.comConnection: keep-aliveContent-Length: 128Accept: application/dns-messageAccept-Language: *User-Agent: ChromeAccept-Encoding: identityContent-Type: application/dns-message

Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundP3P: CP="This is not a P3P policy! See g.co/p3phelp for more info."Strict-Transport-Security: max-age=31536000; includeSubdomainsContent-Type: text/html; charset=UTF-8Date: Wed, 02 Oct 2024 10:16:36 GMTExpires: Wed, 02 Oct 2024 10:16:36 GMTCache-Control: private, max-age=0Content-Security-Policy-Report-Only: object-src 'none';base-uri 'self';script-src 'nonce-IP6YhjyZ5zH1GbKIYwQC' 'unsafe-inline' 'unsafe-eval' 'strict-dynamic' https: http: 'report-sample';report-uri https://csp.withgoogle.com/csp/scfeP3P: CP="This is not a P3P policy! See g.co/p3phelp for more info."X-Content-Type-Options: nosniffServer: support-content-uiX-XSS-Protection: 0X-Frame-Options: SAMEORIGINSet-Cookie: NID=517=6vc2afBzm5gk4mPKuql_mQ3rKSVagR0-666zy5fO9R-BJd9VVHTKac1hL8PYBKfsE7QKQj--ZkI9P2x8fL0XJIMzeE4-wSN0Cx7P3rE203XNog8Dh9kYHu1KGT7J4c_LQKQm2PrvT5_GZStgW-Jm8tj9Ltn_84w_euix-7o-Le3edvPI2Q; expires=Thu, 03-Apr-2025 10:16:36 GMT; path=/; domain=.google.com; HttpOnlySet-Cookie: NID=517=6vc2afBzm5gk4mPKuql_mQ3rKSVagR0-666zy5fO9R-BJd9VVHTKac1hL8PYBKfsE7QKQj--ZkI9P2x8fL0XJIMzeE4-wSN0Cx7P3rE203XNog8Dh9kYHu1KGT7J4c_LQKQm2PrvT5_GZStgW-Jm8tj9Ltn_84w_euix-7o-Le3edvPI2Q; expires=Thu, 03-Apr-2025 10:16:36 GMT; path=/; domain=.google.com; HttpOnlyAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Accept-Ranges: noneVary: Accept-EncodingConnection: closeTransfer-Encoding: chunked
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/html; charset=UTF-8Referrer-Policy: no-referrerContent-Length: 1568Date: Wed, 02 Oct 2024 10:16:02 GMTData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 65 6e 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 0a 20 20 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 73 74 79 6c 65 3e 0a 20 20 20 20 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 30 70 78 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 31 38 30 70 78 3b 70 61 64 64 69 6e 67 3a 33 30 70 78 20 30 20 31 35 70 78 7d 2a 20 3e 20 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 65 72 72 6f 72 73 2f 72 6f 62 6f 74 2e 70 6e 67 29 20 31 30 30 25 20 35 70 78 20 6e 6f 2d 72 65 70 65 61 74 3b 70 61 64 64 69 6e 67 2d 72 69 67 68 74 3a 32 30 35 70 78 7d 70 7b 6d 61 72 67 69 6e 3a 31 31 70 78 20 30 20 32 32 70 78 3b 6f 76 65 72 66 6c 6f 77 3a 68 69 64 64 65 6e 7d 69 6e 73 7b 63 6f 6c 6f 72 3a 23 37 37 37 3b 74 65 78 74 2d 64 65 63 6f 72 61 74 69 6f 6e 3a 6e 6f 6e 65 7d 61 20 69 6d 67 7b 62 6f 72 64 65 72 3a 30 7d 40 6d 65 64 69 61 20 73 63 72 65 65 6e 20 61 6e 64 20 28 6d 61 78 2d 77 69 64 74 68 3a 37 37 32 70 78 29 7b 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 6e 6f 6e 65 3b 6d 61 72 67 69 6e 2d 74 6f 70 3a 30 3b 6d 61 78 2d 77 69 64 74 68 3a 6e 6f 6e 65 3b 70 61 64 64 69 6e 67 2d 72 69 67 68 74 3a 30 7d 7d 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 62 72 61 6e 64 69 6e 67 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 2f 31 78 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 5f 63 6f 6c 6f 72 5f 31 35 30 78 35 34 64 70 2e 70 6e 67 29 20 6e 6f 2d 72 65 70 65 61 74 3b 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 2d 35 70 78 7d 40 6d 65 64 69 61 20 6f 6e 6c 79 20 73 63 72 65 65 6e 20 61 6e 64 20 28 6d 69 6e 2d 72 65 73 6f 6c 75 74 69 6f 6e 3a 31 39 32 64 70 69 29 7b 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 62 72 61 6e 64 69 6e 67 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 2f 32 78 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 5f 63 6f 6c 6f 72 5f 31 35 30 78 35 34 64 70 2e 70 6e 67 29 20

Source: Picasa3.exe, 00000012.00000000.1603749985.0000000000C6A000.00000002.00000001.01000000.00000012.sdmp	String found in binary or memory: http://%s/%s/album%d.html
Source: Picasa3.exe, 00000012.00000000.1603749985.0000000000C6A000.00000002.00000001.01000000.00000012.sdmp	String found in binary or memory: http://%s/%s/image/%s.jpg
Source: Picasa3.exe, 00000012.00000000.1603749985.0000000000C6A000.00000002.00000001.01000000.00000012.sdmp	String found in binary or memory: http://%s/%s/rssalbum%d.rss
Source: Picasa3.exe, 00000012.00000000.1603749985.0000000000C6A000.00000002.00000001.01000000.00000012.sdmp	String found in binary or memory: http://%s/%s/thumb/%s.jpg
Source: Picasa3.exe, 00000012.00000000.1603749985.0000000000C6A000.00000002.00000001.01000000.00000012.sdmp	String found in binary or memory: http://%s/%s/thumb/%s.jpghttp://%s/%s/image/%s.jpghttp://%s/%s/original/%s
Source: Picasa3.exe, 00000014.00000002.2599824731.0000000010A0C000.00000002.00000001.01000000.00000014.sdmp	String found in binary or memory: http://Picasa.google.com/
Source: Picasa3.exe, 00000014.00000002.2482072226.0000000002E92000.00000004.00000020.00020000.00000000.sdmp, Picasa3.exe, 00000014.00000002.2596878839.000000000862D000.00000004.00000010.00020000.00000000.sdmp, Picasa3.exe, 00000014.00000002.2596878839.000000000863C000.00000004.00000010.00020000.00000000.sdmp, Picasa3.exe, 00000014.00000002.2482072226.0000000002EAA000.00000004.00000020.00020000.00000000.sdmp, Picasa3.exe, 00000014.00000003.2141243034.0000000001215000.00000004.00000020.00020000.00000000.sdmp, Picasa3.exe, 00000014.00000003.2142383735.00000000011D3000.00000004.00000020.00020000.00000000.sdmp, Picasa3.exe, 00000014.00000003.2141243034.0000000001221000.00000004.00000020.00020000.00000000.sdmp, Picasa3.exe, 00000014.00000002.2467205779.00000000011A2000.00000004.00000020.00020000.00000000.sdmp, PicasaPhotoViewer.exe, 00000015.00000000.1692209976.000000000070D000.00000002.00000001.01000000.00000019.sdmp	String found in binary or memory: http://clients2.google.com/service/update2
Source: Picasa3.exe, 00000012.00000000.1603749985.0000000000C6A000.00000002.00000001.01000000.00000012.sdmp	String found in binary or memory: http://clients2.google.com/service/update2omahaURLLifescapeUpdaterupdate
Source: setuppicasa39-setup.exe, 00000010.00000002.1664870898.00000000029F6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.thawte.com/ThawtePremiumServerCA.crl0
Source: 1a4e5ccd35a56d84281a143f831563be.exe, 0000000F.00000002.2435414779.0000000000414000.00000004.00000001.01000000.00000006.sdmp, setuppicasa39-setup.exe, 00000010.00000002.1664870898.000000000459F000.00000004.00000020.00020000.00000000.sdmp, setuppicasa39-setup.exe, 00000010.00000002.1664870898.00000000032A7000.00000004.00000020.00020000.00000000.sdmp, setuppicasa39-setup.exe, 00000010.00000002.1664870898.0000000002E88000.00000004.00000020.00020000.00000000.sdmp, setuppicasa39-setup.exe, 00000010.00000002.1664870898.000000000467E000.00000004.00000020.00020000.00000000.sdmp, setuppicasa39-setup.exe, 00000010.00000002.1664870898.00000000029F6000.00000004.00000020.00020000.00000000.sdmp, PicasaPhotoViewer.exe, 00000015.00000003.1750777100.0000000000AF4000.00000004.00000020.00020000.00000000.sdmp, PicasaPhotoViewer.exe, 00000015.00000002.1780753263.0000000003B00000.00000004.00000020.00020000.00000000.sdmp, PicasaPhotoViewer.exe, 00000015.00000003.1775638859.0000000000A66000.00000004.00000020.00020000.00000000.sdmp, UNZIP.EXE, 00000026.00000002.1812336800.0000000000430000.00000040.00000001.01000000.00000020.sdmp, UNZIP.EXE, 00000028.00000002.1816767609.000000000042B000.00000040.00000001.01000000.00000020.sdmp, UNZIP.EXE, 00000058.00000002.2099499225.0000000000428000.00000040.00000001.01000000.00000026.sdmp, CPY.EXE, 0000005C.00000002.2102179386.0000000000B00000.00000004.00000020.00020000.00000000.sdmp, UNZIP.EXE, 0000005D.00000002.2105385323.0000000000428000.00000040.00000001.01000000.00000026.sdmp, CPY.EXE, 00000061.00000002.2108099884.0000000000E09000.00000004.00000020.00020000.00000000.sdmp, CPY.EXE, 00000064.00000002.2115643669.0000000000ECA000.00000004.00000020.00020000.00000000.sdmp, UNZIP.EXE, 00000066.00000002.2120076164.0000000000428000.00000040.00000001.01000000.00000026.sdmp, CPY.EXE, 0000006A.00000002.2122729835.0000000000629000.00000004.00000020.00020000.00000000.sdmp, CPY.EXE, 00000070.00000002.2131296204.0000000000CD9000.00000004.00000020.00020000.00000000.sdmp, sznpp.exe, 0000007C.00000000.2152804918.0000000000BFB000.00000002.00000001.01000000.0000002C.sdmp, UNZIP.EXE, 0000007D.00000002.2173171240.000000000042B000.00000040.00000001.01000000.00000026.sdmp	String found in binary or memory: http://crl.thawte.com/ThawteTimestampingCA.crl0
Source: setuppicasa39-setup.exe, 00000010.00000002.1664870898.00000000029F6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cs-g2-crl.thawte.com/ThawteCSG2.crl0
Source: Picasa3.exe, 00000014.00000002.2593399186.0000000007244000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://dl.google.com/photos/picasamac38.dmg
Source: Picasa3.exe, 00000014.00000002.2593399186.0000000007223000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://dl.google.com/photos/picasamac38.dmg"><span
Source: Picasa3.exe, 00000014.00000002.2563942835.0000000006D99000.00000004.00000020.00020000.00000000.sdmp, Picasa3.exe, 00000014.00000002.2586100840.0000000006F6F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://dl.google.com/picasa/picasa3-setup.exe
Source: Picasa3.exe, 00000014.00000002.2593399186.0000000007244000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://dl.google.com/picasa/picasa38-setup.exe
Source: Picasa3.exe, 00000014.00000002.2593399186.0000000007223000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://dl.google.com/picasa/picasa38-setup.exe"><span
Source: Picasa3.exe, 00000012.00000000.1603749985.0000000000C6A000.00000002.00000001.01000000.00000012.sdmp	String found in binary or memory: http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab#version=6
Source: Picasa3.exe, 00000012.00000000.1603749985.0000000000C6A000.00000002.00000001.01000000.00000012.sdmp	String found in binary or memory: http://earth.google.com
Source: Picasa3.exe, 00000012.00000000.1603749985.0000000000C6A000.00000002.00000001.01000000.00000012.sdmp	String found in binary or memory: http://earth.google.com/kml/2.0
Source: Picasa3.exe, 00000012.00000000.1603749985.0000000000C6A000.00000002.00000001.01000000.00000012.sdmp	String found in binary or memory: http://earth.google.com/kml/2.0xmlnsFolderPicasa
Source: setuppicasa39-setup.exe, 00000010.00000002.1664870898.00000000031AA000.00000004.00000020.00020000.00000000.sdmp, Picasa3.exe, 00000012.00000000.1603749985.0000000000C6A000.00000002.00000001.01000000.00000012.sdmp, PicasaPhotoViewer.exe, 00000015.00000000.1692209976.000000000070D000.00000002.00000001.01000000.00000019.sdmp	String found in binary or memory: http://earth.google.com/kml/2.1
Source: setuppicasa39-setup.exe, 00000010.00000002.1664870898.00000000031AA000.00000004.00000020.00020000.00000000.sdmp, PicasaPhotoViewer.exe, 00000015.00000000.1692209976.000000000070D000.00000002.00000001.01000000.00000019.sdmp	String found in binary or memory: http://earth.google.com/kml/2.1xmlnsgphoto:timestampgphoto:starexif:tagsexif:distanceexif:exposureex
Source: Picasa3.exe, 00000012.00000000.1603749985.0000000000C6A000.00000002.00000001.01000000.00000012.sdmp	String found in binary or memory: http://earth.google.comTag
Source: setuppicasa39-setup.exe, 00000010.00000002.1664870898.00000000035FF000.00000004.00000020.00020000.00000000.sdmp, GPhotos.scr, 00000011.00000000.1542724484.000000000062E000.00000002.00000001.01000000.0000000F.sdmp	String found in binary or memory: http://ericorth.kir.corp.google.com:8888
Source: setuppicasa39-setup.exe, 00000010.00000002.1664870898.00000000035FF000.00000004.00000020.00020000.00000000.sdmp, GPhotos.scr, 00000011.00000000.1542724484.000000000062E000.00000002.00000001.01000000.0000000F.sdmp	String found in binary or memory: http://ericorth.kir.corp.google.com:8888/gphotos?action=retrconfig&email=/gphotos?action=postconfigr
Source: Picasa3.exe, 00000012.00000000.1604678624.0000000000DF8000.00000002.00000001.01000000.00000012.sdmp, Picasa3.exe, 00000014.00000003.1626531844.00000000040E2000.00000004.00000020.00020000.00000000.sdmp, Picasa3.exe, 00000014.00000002.2599824731.000000001140C000.00000002.00000001.01000000.00000014.sdmp, Picasa3.exe, 00000014.00000002.2599824731.0000000010A0C000.00000002.00000001.01000000.00000014.sdmp, Picasa3.exe, 00000014.00000002.2482072226.0000000002EAA000.00000004.00000020.00020000.00000000.sdmp, Picasa3.exe, 00000014.00000003.1626203204.0000000003FB3000.00000004.00000020.00020000.00000000.sdmp, Picasa3.exe, 00000014.00000002.2599824731.000000001000C000.00000002.00000001.01000000.00000014.sdmp	String found in binary or memory: http://forums.picasa.com/
Source: setuppicasa39-setup.exe, 00000010.00000002.1664870898.00000000031AA000.00000004.00000020.00020000.00000000.sdmp, setuppicasa39-setup.exe, 00000010.00000002.1664870898.00000000035FF000.00000004.00000020.00020000.00000000.sdmp, GPhotos.scr, 00000011.00000000.1542724484.000000000062E000.00000002.00000001.01000000.0000000F.sdmp, Picasa3.exe, 00000012.00000000.1603749985.0000000000C6A000.00000002.00000001.01000000.00000012.sdmp, PicasaPhotoViewer.exe, 00000015.00000000.1692209976.000000000070D000.00000002.00000001.01000000.00000019.sdmp	String found in binary or memory: http://gdata.youtube.com
Source: Picasa3.exe, 00000012.00000000.1603749985.0000000000C6A000.00000002.00000001.01000000.00000012.sdmp	String found in binary or memory: http://gdata.youtube.com/schemas/2007
Source: Picasa3.exe, 00000012.00000000.1603749985.0000000000C6A000.00000002.00000001.01000000.00000012.sdmp	String found in binary or memory: http://gdata.youtube.com/schemas/2007/categories.cat
Source: Picasa3.exe, 00000014.00000002.2506191744.0000000004241000.00000004.00000020.00020000.00000000.sdmp, Picasa3.exe, 00000014.00000002.2599824731.000000001140C000.00000002.00000001.01000000.00000014.sdmp, Picasa3.exe, 00000014.00000002.2599824731.0000000010A0C000.00000002.00000001.01000000.00000014.sdmp, Picasa3.exe, 00000014.00000003.1626203204.0000000003FB3000.00000004.00000020.00020000.00000000.sdmp, Picasa3.exe, 00000014.00000002.2599824731.000000001000C000.00000002.00000001.01000000.00000014.sdmp, Picasa3.exe, 00000014.00000002.2586100840.0000000006F6F000.00000004.00000020.00020000.00000000.sdmp, Picasa3.exe, 00000014.00000002.2593399186.000000000716B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://googlephotos.blogspot.com/
Source: Picasa3.exe, 00000014.00000002.2593399186.0000000007223000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://googlephotos.blogspot.com/">Google
Source: Picasa3.exe, 00000012.00000000.1603749985.0000000000C6A000.00000002.00000001.01000000.00000012.sdmp	String found in binary or memory: http://googlephotos.blogspot.com/HelpURL::ReadMehttp://picasa.google.com/support/bin/answer.py?answe
Source: Picasa3.exe, 00000014.00000002.2506191744.0000000004241000.00000004.00000020.00020000.00000000.sdmp, Picasa3.exe, 00000014.00000002.2586100840.0000000006F6F000.00000004.00000020.00020000.00000000.sdmp, Picasa3.exe, 00000014.00000002.2593399186.000000000716B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://groups.google.com/group/Picasa
Source: Picasa3.exe, 00000014.00000002.2593399186.0000000007223000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://groups.google.com/group/Picasa">forums</a>.</span></span></div&g
Source: Picasa3.exe, 00000014.00000002.2506191744.0000000004241000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://groups.google.com/group/picasa
Source: Picasa3.exe, 00000014.00000002.2593399186.0000000007223000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://groups.google.com/group/picasa">Google
Source: setuppicasa39-setup.exe, 00000010.00000002.1664870898.0000000003831000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://internet.e-mail
Source: setuppicasa39-setup.exe, 00000010.00000002.1664870898.0000000004788000.00000004.00000020.00020000.00000000.sdmp, setuppicasa39-setup.exe, 00000010.00000002.1664870898.00000000031AA000.00000004.00000020.00020000.00000000.sdmp, setuppicasa39-setup.exe, 00000010.00000002.1664870898.0000000004419000.00000004.00000020.00020000.00000000.sdmp, setuppicasa39-setup.exe, 00000010.00000002.1664870898.00000000035FF000.00000004.00000020.00020000.00000000.sdmp, GPhotos.scr, 00000011.00000002.1554998935.0000000002750000.00000004.00000020.00020000.00000000.sdmp, GPhotos.scr, 00000011.00000000.1542724484.000000000062E000.00000002.00000001.01000000.0000000F.sdmp, Picasa3.exe, 00000012.00000000.1603749985.0000000000C6A000.00000002.00000001.01000000.00000012.sdmp, Picasa3.exe, 00000014.00000002.2482072226.0000000002EAA000.00000004.00000020.00020000.00000000.sdmp, PicasaPhotoViewer.exe, 00000015.00000003.1768334402.000000000284E000.00000004.00000020.00020000.00000000.sdmp, PicasaPhotoViewer.exe, 00000015.00000002.1779527117.0000000002854000.00000004.00000020.00020000.00000000.sdmp, PicasaPhotoViewer.exe, 00000015.00000000.1692209976.000000000070D000.00000002.00000001.01000000.00000019.sdmp	String found in binary or memory: http://iptc.org/std/Iptc4xmpCore/1.0/xmlns/
Source: Picasa3.exe, 00000014.00000002.2482072226.0000000002EAA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://iptc.org/std/Iptc4xmpCore/1.0/xmlns/em#
Source: GPhotos.scr, 00000011.00000002.1554998935.0000000002750000.00000004.00000020.00020000.00000000.sdmp, GPhotos.scr, 00000011.00000000.1542724484.000000000062E000.00000002.00000001.01000000.0000000F.sdmp, Picasa3.exe, 00000012.00000000.1603749985.0000000000C6A000.00000002.00000001.01000000.00000012.sdmp, Picasa3.exe, 00000014.00000002.2482072226.0000000002EAA000.00000004.00000020.00020000.00000000.sdmp, PicasaPhotoViewer.exe, 00000015.00000003.1768334402.000000000284E000.00000004.00000020.00020000.00000000.sdmp, PicasaPhotoViewer.exe, 00000015.00000002.1779527117.0000000002854000.00000004.00000020.00020000.00000000.sdmp, PicasaPhotoViewer.exe, 00000015.00000000.1692209976.000000000070D000.00000002.00000001.01000000.00000019.sdmp	String found in binary or memory: http://iptc.org/std/Iptc4xmpExt/2008-02-29/
Source: Picasa3.exe, 00000014.00000002.2482072226.0000000002EAA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://iptc.org/std/Iptc4xmpExt/2008-02-29/e2
Source: Picasa3.exe, 00000014.00000002.2482072226.0000000002EAA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://iptc.org/std/Iptc4xmpExt/2008-02-29/j2
Source: setuppicasa39-setup.exe, 00000010.00000002.1664870898.000000000369C000.00000004.00000020.00020000.00000000.sdmp, GPhotos.scr, 00000011.00000000.1542961815.00000000006EF000.00000002.00000001.01000000.0000000F.sdmp, Picasa3.exe, 00000014.00000002.2599824731.000000001140C000.00000002.00000001.01000000.00000014.sdmp	String found in binary or memory: http://lh2.google.com.vn/data/feed/api/all?kind=photo&filter=1&max-results=100&alt=rss
Source: setuppicasa39-setup.exe, 00000010.00000002.1664870898.000000000369C000.00000004.00000020.00020000.00000000.sdmp, GPhotos.scr, 00000011.00000000.1542961815.00000000006EF000.00000002.00000001.01000000.0000000F.sdmp, Picasa3.exe, 00000014.00000002.2599824731.000000001140C000.00000002.00000001.01000000.00000014.sdmp	String found in binary or memory: http://lh2.google.com/data/feed/api/all?kind=photo&filter=1&
Source: setuppicasa39-setup.exe, 00000010.00000002.1664870898.000000000369C000.00000004.00000020.00020000.00000000.sdmp, GPhotos.scr, 00000011.00000000.1542961815.00000000006EF000.00000002.00000001.01000000.0000000F.sdmp, Picasa3.exe, 00000014.00000003.1626531844.00000000040E2000.00000004.00000020.00020000.00000000.sdmp, Picasa3.exe, 00000014.00000002.2599824731.000000001140C000.00000002.00000001.01000000.00000014.sdmp, Picasa3.exe, 00000014.00000002.2599824731.0000000010A0C000.00000002.00000001.01000000.00000014.sdmp, Picasa3.exe, 00000014.00000003.1626203204.0000000003FB3000.00000004.00000020.00020000.00000000.sdmp, Picasa3.exe, 00000014.00000002.2599824731.000000001000C000.00000002.00000001.01000000.00000014.sdmp	String found in binary or memory: http://lh2.google.com/data/feed/api/all?kind=photo&filter=1&max-results=100&alt=rss
Source: GPhotos.scr, 00000011.00000002.1554998935.0000000002744000.00000004.00000020.00020000.00000000.sdmp, Picasa3.exe, 00000014.00000002.2482072226.0000000002E32000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://lh2.google.com/data/feed/api/all?kind=photo&filter=1&max-results=100&alt=rss
Source: GPhotos.scr, 00000011.00000002.1554998935.0000000002744000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://lh2.google.com/data/feed/api/all?kind=photo&filter=1&max-results=100&alt=rssu
Source: setuppicasa39-setup.exe, 00000010.00000002.1664870898.000000000369C000.00000004.00000020.00020000.00000000.sdmp, GPhotos.scr, 00000011.00000000.1542961815.00000000006EF000.00000002.00000001.01000000.0000000F.sdmp, Picasa3.exe, 00000014.00000002.2599824731.0000000010A0C000.00000002.00000001.01000000.00000014.sdmp	String found in binary or memory: http://lh2.google.rs/data/feed/api/all?kind=photo&filter=1&max-results=100&alt=rss
Source: Picasa3.exe, 00000012.00000000.1603749985.0000000000C6A000.00000002.00000001.01000000.00000012.sdmp	String found in binary or memory: http://localhost:%d/%s/image/%s.jpg
Source: Picasa3.exe, 00000012.00000000.1603749985.0000000000C6A000.00000002.00000001.01000000.00000012.sdmp	String found in binary or memory: http://localhost:%d/%s/thumb/%s.jpg
Source: setuppicasa39-setup.exe, 00000010.00000002.1664870898.0000000003831000.00000004.00000020.00020000.00000000.sdmp, Picasa3.exe, 00000014.00000002.2599824731.000000001000C000.00000002.00000001.01000000.00000014.sdmp	String found in binary or memory: http://mail.google.com
Source: Picasa3.exe, 00000012.00000000.1603749985.0000000000C6A000.00000002.00000001.01000000.00000012.sdmp	String found in binary or memory: http://mail.google.com/mail/help/intl/%s/about.html
Source: Picasa3.exe, 00000012.00000000.1603749985.0000000000C6A000.00000002.00000001.01000000.00000012.sdmp	String found in binary or memory: http://mail.google.com/mail/help/intl/%s/about.htmli18n
Source: setuppicasa39-setup.exe, 00000010.00000002.1664870898.00000000032A7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://maps.google.com/maps?file=api&v=2&client=google-picasa-client&sensor=false
Source: Picasa3.exe, 00000012.00000000.1603749985.0000000000C6A000.00000002.00000001.01000000.00000012.sdmp	String found in binary or memory: http://maps.google.com/maps?q=%g
Source: setuppicasa39-setup.exe, 00000010.00000002.1664870898.00000000032A7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://maps.googleapis.com/maps/api/js?client=google-picasa-client&sensor=false&v=3
Source: 1a4e5ccd35a56d84281a143f831563be.exe, 0000000C.00000000.1432448821.000000000040C000.00000002.00000001.01000000.00000006.sdmp, setuppicasa39-setup.exe, 00000010.00000000.1489441264.0000000000409000.00000008.00000001.01000000.0000000B.sdmp, setuppicasa39-setup.exe, 00000010.00000002.1664870898.00000000032A7000.00000004.00000020.00020000.00000000.sdmp, setuppicasa39-setup.exe, 00000010.00000002.1660522898.0000000000409000.00000004.00000001.01000000.0000000B.sdmp, listicka.exe, 00000016.00000000.1706188175.0000000000409000.00000008.00000001.01000000.0000001A.sdmp, listicka.exe, 00000016.00000002.2422886994.0000000000409000.00000004.00000001.01000000.0000001A.sdmp	String found in binary or memory: http://nsis.sf.net/NSIS_ErrorError
Source: 1a4e5ccd35a56d84281a143f831563be.exe, 0000000F.00000002.2435414779.0000000000414000.00000004.00000001.01000000.00000006.sdmp, setuppicasa39-setup.exe, 00000010.00000002.1664870898.000000000459F000.00000004.00000020.00020000.00000000.sdmp, setuppicasa39-setup.exe, 00000010.00000002.1664870898.00000000032A7000.00000004.00000020.00020000.00000000.sdmp, setuppicasa39-setup.exe, 00000010.00000002.1664870898.0000000002E88000.00000004.00000020.00020000.00000000.sdmp, setuppicasa39-setup.exe, 00000010.00000002.1664870898.000000000467E000.00000004.00000020.00020000.00000000.sdmp, setuppicasa39-setup.exe, 00000010.00000002.1664870898.00000000029F6000.00000004.00000020.00020000.00000000.sdmp, PicasaPhotoViewer.exe, 00000015.00000003.1750777100.0000000000AF4000.00000004.00000020.00020000.00000000.sdmp, PicasaPhotoViewer.exe, 00000015.00000002.1780753263.0000000003B00000.00000004.00000020.00020000.00000000.sdmp, PicasaPhotoViewer.exe, 00000015.00000003.1775638859.0000000000A66000.00000004.00000020.00020000.00000000.sdmp, UNZIP.EXE, 00000026.00000002.1812336800.0000000000430000.00000040.00000001.01000000.00000020.sdmp, UNZIP.EXE, 00000028.00000002.1816767609.000000000042B000.00000040.00000001.01000000.00000020.sdmp, UNZIP.EXE, 00000058.00000002.2099499225.0000000000428000.00000040.00000001.01000000.00000026.sdmp, CPY.EXE, 0000005C.00000002.2102179386.0000000000B00000.00000004.00000020.00020000.00000000.sdmp, UNZIP.EXE, 0000005D.00000002.2105385323.0000000000428000.00000040.00000001.01000000.00000026.sdmp, CPY.EXE, 00000061.00000002.2108099884.0000000000E09000.00000004.00000020.00020000.00000000.sdmp, CPY.EXE, 00000064.00000002.2115643669.0000000000ECA000.00000004.00000020.00020000.00000000.sdmp, UNZIP.EXE, 00000066.00000002.2120076164.0000000000428000.00000040.00000001.01000000.00000026.sdmp, CPY.EXE, 0000006A.00000002.2122729835.0000000000629000.00000004.00000020.00020000.00000000.sdmp, CPY.EXE, 00000070.00000002.2131296204.0000000000CD9000.00000004.00000020.00020000.00000000.sdmp, sznpp.exe, 0000007C.00000000.2152804918.0000000000BFB000.00000002.00000001.01000000.0000002C.sdmp, UNZIP.EXE, 0000007D.00000002.2173171240.000000000042B000.00000040.00000001.01000000.00000026.sdmp	String found in binary or memory: http://ocsp.thawte.com0
Source: setuppicasa39-setup.exe, 00000010.00000002.1664870898.000000000369C000.00000004.00000020.00020000.00000000.sdmp, GPhotos.scr, 00000011.00000000.1542961815.00000000006EF000.00000002.00000001.01000000.0000000F.sdmp, Picasa3.exe, 00000014.00000002.2599824731.000000001000C000.00000002.00000001.01000000.00000014.sdmp	String found in binary or memory: http://pack.google.co.uk/feeds.
Source: setuppicasa39-setup.exe, 00000010.00000002.1664870898.000000000369C000.00000004.00000020.00020000.00000000.sdmp, GPhotos.scr, 00000011.00000000.1542961815.00000000006EF000.00000002.00000001.01000000.0000000F.sdmp, Picasa3.exe, 00000014.00000002.2599824731.0000000010A0C000.00000002.00000001.01000000.00000014.sdmp	String found in binary or memory: http://pack.google.com.br/feeds.
Source: Picasa3.exe, 00000014.00000002.2599824731.0000000010A0C000.00000002.00000001.01000000.00000014.sdmp, Picasa3.exe, 00000014.00000002.2599824731.000000001000C000.00000002.00000001.01000000.00000014.sdmp	String found in binary or memory: http://pack.google.com/feeds
Source: Picasa3.exe, 00000014.00000002.2599824731.0000000010A0C000.00000002.00000001.01000000.00000014.sdmp, Picasa3.exe, 00000014.00000003.1626203204.0000000003FB3000.00000004.00000020.00020000.00000000.sdmp, Picasa3.exe, 00000014.00000002.2599824731.000000001000C000.00000002.00000001.01000000.00000014.sdmp, Picasa3.exe, 00000014.00000002.2482072226.0000000002E7B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://pack.google.com/feeds.
Source: setuppicasa39-setup.exe, 00000010.00000002.1664870898.00000000035FF000.00000004.00000020.00020000.00000000.sdmp, GPhotos.scr, 00000011.00000000.1542724484.000000000062E000.00000002.00000001.01000000.0000000F.sdmp	String found in binary or memory: http://pack.google.com/feeds.MetadataNode::TipDiscoverMeasure
Source: GPhotos.scr, 00000011.00000003.1552747031.0000000000B45000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://pack.google.com/gphotos?action=install&hl=en&gl=ch&brand=GGLA&scrid=AD0E3D47-9B39-483F-83C6-9
Source: GPhotos.scr, 00000011.00000002.1553040041.0000000000199000.00000004.00000010.00020000.00000000.sdmp	String found in binary or memory: http://pack.google.com/gphotos?action=install&hl=en&gl=ch&brand=GGLA&scrid=AD0E3D47-9B39-483F-8Profi
Source: setuppicasa39-setup.exe, 00000010.00000002.1664870898.000000000369C000.00000004.00000020.00020000.00000000.sdmp, GPhotos.scr, 00000011.00000000.1542961815.00000000006EF000.00000002.00000001.01000000.0000000F.sdmp, Picasa3.exe, 00000014.00000002.2599824731.000000001000C000.00000002.00000001.01000000.00000014.sdmp	String found in binary or memory: http://pack.google.dk/feeds.
Source: setuppicasa39-setup.exe, 00000010.00000002.1664870898.000000000369C000.00000004.00000020.00020000.00000000.sdmp, GPhotos.scr, 00000011.00000000.1542961815.00000000006EF000.00000002.00000001.01000000.0000000F.sdmp, Picasa3.exe, 00000014.00000002.2599824731.0000000010A0C000.00000002.00000001.01000000.00000014.sdmp	String found in binary or memory: http://pack.google.rs/feeds.
Source: Picasa3.exe, 00000012.00000000.1603749985.0000000000C6A000.00000002.00000001.01000000.00000012.sdmp	String found in binary or memory: http://photos.hello.com/interface/AlbumStack.gif
Source: Picasa3.exe, 00000012.00000000.1603749985.0000000000C6A000.00000002.00000001.01000000.00000012.sdmp	String found in binary or memory: http://photos.hello.com/interface/AlbumStackSelected.gif
Source: Picasa3.exe, 00000012.00000000.1603749985.0000000000C6A000.00000002.00000001.01000000.00000012.sdmp	String found in binary or memory: http://photos.hello.com/interface/AppsBtn-hello.gif
Source: Picasa3.exe, 00000012.00000000.1603749985.0000000000C6A000.00000002.00000001.01000000.00000012.sdmp	String found in binary or memory: http://photos.hello.com/interface/AppsBtn-picasa.gif
Source: Picasa3.exe, 00000012.00000000.1603749985.0000000000C6A000.00000002.00000001.01000000.00000012.sdmp	String found in binary or memory: http://photos.hello.com/interface/AppsBtn.gif
Source: Picasa3.exe, 00000012.00000000.1603749985.0000000000C6A000.00000002.00000001.01000000.00000012.sdmp	String found in binary or memory: http://photos.hello.com/interface/boxes/B11.gif
Source: Picasa3.exe, 00000012.00000000.1603749985.0000000000C6A000.00000002.00000001.01000000.00000012.sdmp	String found in binary or memory: http://photos.hello.com/interface/boxes/B13.gif
Source: Picasa3.exe, 00000012.00000000.1603749985.0000000000C6A000.00000002.00000001.01000000.00000012.sdmp	String found in binary or memory: http://photos.hello.com/interface/boxes/B31.gif
Source: Picasa3.exe, 00000012.00000000.1603749985.0000000000C6A000.00000002.00000001.01000000.00000012.sdmp	String found in binary or memory: http://photos.hello.com/interface/boxes/B33.gif
Source: Picasa3.exe, 00000012.00000000.1603749985.0000000000C6A000.00000002.00000001.01000000.00000012.sdmp	String found in binary or memory: http://photos.hello.com/interface/boxes/S11.gif
Source: Picasa3.exe, 00000012.00000000.1603749985.0000000000C6A000.00000002.00000001.01000000.00000012.sdmp	String found in binary or memory: http://photos.hello.com/interface/boxes/S12.gif
Source: Picasa3.exe, 00000012.00000000.1603749985.0000000000C6A000.00000002.00000001.01000000.00000012.sdmp	String found in binary or memory: http://photos.hello.com/interface/boxes/S13.gif
Source: Picasa3.exe, 00000012.00000000.1603749985.0000000000C6A000.00000002.00000001.01000000.00000012.sdmp	String found in binary or memory: http://photos.hello.com/interface/boxes/S21.gif
Source: Picasa3.exe, 00000012.00000000.1603749985.0000000000C6A000.00000002.00000001.01000000.00000012.sdmp	String found in binary or memory: http://photos.hello.com/interface/boxes/S23.gif
Source: Picasa3.exe, 00000012.00000000.1603749985.0000000000C6A000.00000002.00000001.01000000.00000012.sdmp	String found in binary or memory: http://photos.hello.com/interface/boxes/S31.gif
Source: Picasa3.exe, 00000012.00000000.1603749985.0000000000C6A000.00000002.00000001.01000000.00000012.sdmp	String found in binary or memory: http://photos.hello.com/interface/boxes/S32.gif
Source: Picasa3.exe, 00000012.00000000.1603749985.0000000000C6A000.00000002.00000001.01000000.00000012.sdmp	String found in binary or memory: http://photos.hello.com/interface/boxes/S33.gif
Source: Picasa3.exe, 00000012.00000000.1603749985.0000000000C6A000.00000002.00000001.01000000.00000012.sdmp	String found in binary or memory: http://photos.hello.com/interface/boxes/spacer.gif
Source: Picasa3.exe, 00000012.00000000.1603749985.0000000000C6A000.00000002.00000001.01000000.00000012.sdmp	String found in binary or memory: http://photos.hello.com/interface/spacer.gif
Source: Picasa3.exe, 00000012.00000000.1603749985.0000000000C6A000.00000002.00000001.01000000.00000012.sdmp	String found in binary or memory: http://photos.hello.com/scripts.js
Source: Picasa3.exe, 00000012.00000000.1603749985.0000000000C6A000.00000002.00000001.01000000.00000012.sdmp	String found in binary or memory: http://photos.hello.com/styles.css
Source: setuppicasa39-setup.exe, 00000010.00000002.1664870898.0000000003831000.00000004.00000020.00020000.00000000.sdmp, Picasa3.exe, 00000014.00000002.2482072226.0000000002E92000.00000004.00000020.00020000.00000000.sdmp, Picasa3.exe, 00000014.00000002.2506191744.0000000004114000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://picasa-readme.blogspot.com/
Source: Picasa3.exe, 00000014.00000002.2593399186.0000000007223000.00000004.00000020.00020000.00000000.sdmp, Picasa3.exe, 00000014.00000002.2506191744.0000000004114000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://picasa-readme.blogspot.com/2008/08/picasa-30-beta-build-3717.html
Source: Picasa3.exe, 00000014.00000002.2593399186.0000000007223000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://picasa-readme.blogspot.com/2008/09/build-5724.html
Source: Picasa3.exe, 00000014.00000002.2593399186.0000000007223000.00000004.00000020.00020000.00000000.sdmp, Picasa3.exe, 00000014.00000002.2589400232.0000000007039000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://picasa-readme.blogspot.com/2008/10/picasa-30-out-of-beta-build-xxxx.html
Source: Picasa3.exe, 00000014.00000002.2482072226.0000000002EAA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://picasa-readme.blogspot.com/2009/09/picasa-35-now-with-name-tags-build-7967.html
Source: Picasa3.exe, 00000014.00000002.2482072226.0000000002EAA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://picasa-readme.blogspot.com/2009/12/picasa-36-now-with-collaborative-albums.html
Source: Picasa3.exe, 00000014.00000002.2593399186.0000000007223000.00000004.00000020.00020000.00000000.sdmp, Picasa3.exe, 00000014.00000002.2482072226.0000000002EAA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://picasa-readme.blogspot.com/2010/10/picasa-38-now-available-in-35-languages.html
Source: Picasa3.exe, 00000014.00000002.2482072226.0000000002EAA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://picasa-readme.blogspot.com/2010/10/picasa-38-now-available-in-35-languages.htmliew
Source: Picasa3.exe, 00000014.00000002.2593399186.0000000007223000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://picasa-readme.blogspot.com/2012/04/picasa-3.html
Source: Picasa3.exe, 00000014.00000002.2467205779.00000000011B6000.00000004.00000020.00020000.00000000.sdmp, Picasa3.exe, 00000014.00000002.2482072226.0000000002EAA000.00000004.00000020.00020000.00000000.sdmp, Picasa3.exe, 00000014.00000003.2141243034.0000000001205000.00000004.00000020.00020000.00000000.sdmp, Picasa3.exe, 00000014.00000003.2144975853.0000000001231000.00000004.00000020.00020000.00000000.sdmp, Picasa3.exe, 00000014.00000002.2597529140.00000000091DD000.00000004.00000010.00020000.00000000.sdmp, Picasa3.exe, 00000014.00000003.2141243034.0000000001221000.00000004.00000020.00020000.00000000.sdmp, Picasa3.exe, 00000014.00000002.2467205779.0000000001230000.00000004.00000020.00020000.00000000.sdmp, Picasa3.exe, 00000014.00000002.2482072226.0000000002E7B000.00000004.00000020.00020000.00000000.sdmp, Picasa3.exe, 00000014.00000002.2506191744.0000000004114000.00000004.00000020.00020000.00000000.sdmp, Picasa3.exe, 00000014.00000002.2467205779.000000000120E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://picasa-readme.blogspot.com/feeds/posts/default
Source: Picasa3.exe, 00000014.00000002.2467205779.00000000011B6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://picasa-readme.blogspot.com/feeds/posts/default(
Source: Picasa3.exe, 00000014.00000002.2482072226.0000000002E92000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://picasa-readme.blogspot.com/update2
Source: Picasa3.exe, 00000014.00000002.2599824731.0000000010A0C000.00000002.00000001.01000000.00000014.sdmp	String found in binary or memory: http://picasa.google.co.jp/
Source: Picasa3.exe, 00000014.00000002.2599824731.0000000010A0C000.00000002.00000001.01000000.00000014.sdmp	String found in binary or memory: http://picasa.google.co.kr/support?ctx=picasa
Source: Picasa3.exe, 00000014.00000002.2599824731.000000001140C000.00000002.00000001.01000000.00000014.sdmp	String found in binary or memory: http://picasa.google.com.tr/support/bin/answer.py?answer=11139
Source: Picasa3.exe, 00000014.00000002.2599824731.000000001140C000.00000002.00000001.01000000.00000014.sdmp	String found in binary or memory: http://picasa.google.com.tr/support/bin/answer.py?answer=141059
Source: Picasa3.exe, 00000014.00000002.2599824731.000000001140C000.00000002.00000001.01000000.00000014.sdmp	String found in binary or memory: http://picasa.google.com.tr/support/bin/answer.py?answer=53209
Source: Picasa3.exe, 00000014.00000002.2599824731.000000001140C000.00000002.00000001.01000000.00000014.sdmp	String found in binary or memory: http://picasa.google.com.tr/support/bin/topic.py?topic=16056
Source: Picasa3.exe, 00000014.00000002.2599824731.000000001140C000.00000002.00000001.01000000.00000014.sdmp	String found in binary or memory: http://picasa.google.com.vn/support?ctx=picasa
Source: Picasa3.exe, 00000014.00000002.2482072226.0000000002EAA000.00000004.00000020.00020000.00000000.sdmp, Picasa3.exe, 00000014.00000002.2589400232.0000000007039000.00000004.00000020.00020000.00000000.sdmp, Picasa3.exe, 00000014.00000003.1626203204.0000000003FB3000.00000004.00000020.00020000.00000000.sdmp, Picasa3.exe, 00000014.00000002.2599824731.000000001000C000.00000002.00000001.01000000.00000014.sdmp, Picasa3.exe, 00000014.00000002.2586100840.0000000006F6F000.00000004.00000020.00020000.00000000.sdmp, Picasa3.exe, 00000014.00000002.2482072226.0000000002E7B000.00000004.00000020.00020000.00000000.sdmp, Picasa3.exe, 00000014.00000002.2593399186.000000000716B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://picasa.google.com/
Source: Picasa3.exe, 00000014.00000002.2593399186.0000000007223000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://picasa.google.com/"><span
Source: Picasa3.exe, 00000014.00000002.2593399186.0000000007223000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://picasa.google.com/">picasa.google.com</a>.<br
Source: Picasa3.exe, 00000014.00000002.2599824731.0000000010A0C000.00000002.00000001.01000000.00000014.sdmp, Picasa3.exe, 00000014.00000002.2599824731.000000001000C000.00000002.00000001.01000000.00000014.sdmp	String found in binary or memory: http://picasa.google.com/.
Source: Picasa3.exe, 00000012.00000000.1604678624.0000000000DF8000.00000002.00000001.01000000.00000012.sdmp	String found in binary or memory: http://picasa.google.com/AOne
Source: Picasa3.exe, 00000012.00000000.1603749985.0000000000C6A000.00000002.00000001.01000000.00000012.sdmp	String found in binary or memory: http://picasa.google.com/assets/logo.gif
Source: setuppicasa39-setup.exe, 00000010.00000002.1664870898.0000000003831000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://picasa.google.com/assets/logo_kmz.gif
Source: setuppicasa39-setup.exe, 00000010.00000002.1664870898.00000000032A7000.00000004.00000020.00020000.00000000.sdmp, PicasaPhotoViewer.exe, 00000015.00000003.1769352161.0000000003272000.00000004.00000020.00020000.00000000.sdmp, PicasaPhotoViewer.exe, 00000015.00000003.1770457054.0000000002831000.00000004.00000020.00020000.00000000.sdmp, PicasaPhotoViewer.exe, 00000015.00000003.1770788161.0000000003273000.00000004.00000020.00020000.00000000.sdmp, PicasaPhotoViewer.exe, 00000015.00000003.1774735111.0000000002835000.00000004.00000020.00020000.00000000.sdmp, PicasaPhotoViewer.exe, 00000015.00000003.1771353717.0000000003273000.00000004.00000020.00020000.00000000.sdmp, PicasaPhotoViewer.exe, 00000015.00000003.1761252169.0000000003255000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://picasa.google.com/features.html
Source: Picasa3.exe, 00000012.00000000.1603749985.0000000000C6A000.00000002.00000001.01000000.00000012.sdmp	String found in binary or memory: http://picasa.google.com/index.html
Source: Picasa3.exe, 00000012.00000000.1603749985.0000000000C6A000.00000002.00000001.01000000.00000012.sdmp	String found in binary or memory: http://picasa.google.com/intl/%s/terms.html
Source: setuppicasa39-setup.exe, 00000010.00000002.1664870898.000000000369C000.00000004.00000020.00020000.00000000.sdmp, GPhotos.scr, 00000011.00000000.1542961815.00000000006EF000.00000002.00000001.01000000.0000000F.sdmp, Picasa3.exe, 00000014.00000002.2599824731.000000001000C000.00000002.00000001.01000000.00000014.sdmp	String found in binary or memory: http://picasa.google.com/intl/ar/#utm_source=gph-et-ar&utm_medium=et&utm_campaign=ar-screens
Source: setuppicasa39-setup.exe, 00000010.00000002.1664870898.000000000369C000.00000004.00000020.00020000.00000000.sdmp, GPhotos.scr, 00000011.00000000.1542961815.00000000006EF000.00000002.00000001.01000000.0000000F.sdmp, Picasa3.exe, 00000014.00000002.2599824731.000000001000C000.00000002.00000001.01000000.00000014.sdmp	String found in binary or memory: http://picasa.google.com/intl/bg/#utm_source=gph-et-bg&utm_medium=et&utm_campaign=bg-screens
Source: setuppicasa39-setup.exe, 00000010.00000002.1664870898.000000000369C000.00000004.00000020.00020000.00000000.sdmp, GPhotos.scr, 00000011.00000000.1542961815.00000000006EF000.00000002.00000001.01000000.0000000F.sdmp, Picasa3.exe, 00000014.00000002.2599824731.000000001000C000.00000002.00000001.01000000.00000014.sdmp	String found in binary or memory: http://picasa.google.com/intl/ca/#utm_source=gph-et-en&utm_medium=et&utm_campaign=en-protect
Source: setuppicasa39-setup.exe, 00000010.00000002.1664870898.000000000369C000.00000004.00000020.00020000.00000000.sdmp, GPhotos.scr, 00000011.00000000.1542961815.00000000006EF000.00000002.00000001.01000000.0000000F.sdmp, Picasa3.exe, 00000014.00000002.2599824731.000000001000C000.00000002.00000001.01000000.00000014.sdmp	String found in binary or memory: http://picasa.google.com/intl/cs/#utm_source=gph-et-en&utm_medium=et&utm_campaign=cs-screens
Source: setuppicasa39-setup.exe, 00000010.00000002.1664870898.000000000369C000.00000004.00000020.00020000.00000000.sdmp, GPhotos.scr, 00000011.00000000.1542961815.00000000006EF000.00000002.00000001.01000000.0000000F.sdmp, Picasa3.exe, 00000014.00000002.2599824731.000000001000C000.00000002.00000001.01000000.00000014.sdmp	String found in binary or memory: http://picasa.google.com/intl/de/#utm_source=gph-et-de&utm_medium=et&utm_campaign=de-screens
Source: setuppicasa39-setup.exe, 00000010.00000002.1664870898.000000000369C000.00000004.00000020.00020000.00000000.sdmp, GPhotos.scr, 00000011.00000000.1542961815.00000000006EF000.00000002.00000001.01000000.0000000F.sdmp, Picasa3.exe, 00000014.00000002.2599824731.000000001000C000.00000002.00000001.01000000.00000014.sdmp	String found in binary or memory: http://picasa.google.com/intl/el/#utm_source=gph-et-el&utm_medium=et&utm_campaign=el-screens
Source: setuppicasa39-setup.exe, 00000010.00000002.1664870898.000000000369C000.00000004.00000020.00020000.00000000.sdmp, GPhotos.scr, 00000011.00000000.1542961815.00000000006EF000.00000002.00000001.01000000.0000000F.sdmp, Picasa3.exe, 00000014.00000003.1626531844.00000000040E2000.00000004.00000020.00020000.00000000.sdmp, Picasa3.exe, 00000014.00000002.2599824731.000000001140C000.00000002.00000001.01000000.00000014.sdmp, Picasa3.exe, 00000014.00000002.2599824731.0000000010A0C000.00000002.00000001.01000000.00000014.sdmp, Picasa3.exe, 00000014.00000003.1626203204.0000000003FB3000.00000004.00000020.00020000.00000000.sdmp, Picasa3.exe, 00000014.00000002.2599824731.000000001000C000.00000002.00000001.01000000.00000014.sdmp	String found in binary or memory: http://picasa.google.com/intl/en/#utm_source=gph-et-en&utm_medium=et&utm_campaign=en-screens
Source: setuppicasa39-setup.exe, 00000010.00000002.1664870898.000000000369C000.00000004.00000020.00020000.00000000.sdmp, GPhotos.scr, 00000011.00000000.1542961815.00000000006EF000.00000002.00000001.01000000.0000000F.sdmp, Picasa3.exe, 00000014.00000002.2599824731.0000000010A0C000.00000002.00000001.01000000.00000014.sdmp	String found in binary or memory: http://picasa.google.com/intl/en/#utm_source=gph-et-en&utm_medium=et&utm_campaign=fil-screen
Source: Picasa3.exe, 00000014.00000002.2482072226.0000000002EAA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://picasa.google.com/intl/en/#utm_source=gph-et-en&utm_medium=et&utm_campaign=en-screensaver
Source: GPhotos.scr, 00000011.00000002.1554998935.0000000002750000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://picasa.google.com/intl/en/#utm_source=gph-et-en&utm_medium=et&utm_campaign=en-screensaver.
Source: setuppicasa39-setup.exe, 00000010.00000002.1664870898.00000000035FF000.00000004.00000020.00020000.00000000.sdmp, GPhotos.scr, 00000011.00000000.1542724484.000000000062E000.00000002.00000001.01000000.0000000F.sdmp	String found in binary or memory: http://picasa.google.com/intl/en/#utm_source=gph-et-en&utm_medium=et&utm_campaign=en-screensaverCGen
Source: setuppicasa39-setup.exe, 00000010.00000002.1664870898.000000000369C000.00000004.00000020.00020000.00000000.sdmp, GPhotos.scr, 00000011.00000000.1542961815.00000000006EF000.00000002.00000001.01000000.0000000F.sdmp, Picasa3.exe, 00000014.00000002.2599824731.000000001000C000.00000002.00000001.01000000.00000014.sdmp	String found in binary or memory: http://picasa.google.com/intl/en_uk/#utm_source=gph-et-en&utm_medium=et&utm_campaign=en-scre
Source: setuppicasa39-setup.exe, 00000010.00000002.1664870898.000000000369C000.00000004.00000020.00020000.00000000.sdmp, GPhotos.scr, 00000011.00000000.1542961815.00000000006EF000.00000002.00000001.01000000.0000000F.sdmp, Picasa3.exe, 00000014.00000002.2599824731.000000001000C000.00000002.00000001.01000000.00000014.sdmp	String found in binary or memory: http://picasa.google.com/intl/es/#utm_source=gph-et-en&utm_medium=et&utm_campaign=es-screens
Source: setuppicasa39-setup.exe, 00000010.00000002.1664870898.000000000369C000.00000004.00000020.00020000.00000000.sdmp, GPhotos.scr, 00000011.00000000.1542961815.00000000006EF000.00000002.00000001.01000000.0000000F.sdmp, Picasa3.exe, 00000014.00000002.2599824731.0000000010A0C000.00000002.00000001.01000000.00000014.sdmp	String found in binary or memory: http://picasa.google.com/intl/fi/#utm_source=gph-et-fi&utm_medium=et&utm_campaign=fi-screens
Source: setuppicasa39-setup.exe, 00000010.00000002.1664870898.000000000369C000.00000004.00000020.00020000.00000000.sdmp, GPhotos.scr, 00000011.00000000.1542961815.00000000006EF000.00000002.00000001.01000000.0000000F.sdmp, Picasa3.exe, 00000014.00000002.2599824731.0000000010A0C000.00000002.00000001.01000000.00000014.sdmp	String found in binary or memory: http://picasa.google.com/intl/fr/#utm_source=gph-et-fr&utm_medium=et&utm_campaign=fr-screens
Source: setuppicasa39-setup.exe, 00000010.00000002.1664870898.000000000369C000.00000004.00000020.00020000.00000000.sdmp, GPhotos.scr, 00000011.00000000.1542961815.00000000006EF000.00000002.00000001.01000000.0000000F.sdmp, Picasa3.exe, 00000014.00000002.2599824731.0000000010A0C000.00000002.00000001.01000000.00000014.sdmp	String found in binary or memory: http://picasa.google.com/intl/hi/#utm_source=gph-et-hi&utm_medium=et&utm_campaign=hi-screens
Source: setuppicasa39-setup.exe, 00000010.00000002.1664870898.000000000369C000.00000004.00000020.00020000.00000000.sdmp, GPhotos.scr, 00000011.00000000.1542961815.00000000006EF000.00000002.00000001.01000000.0000000F.sdmp, Picasa3.exe, 00000014.00000002.2599824731.0000000010A0C000.00000002.00000001.01000000.00000014.sdmp	String found in binary or memory: http://picasa.google.com/intl/hu/#utm_source=gph-et-hu&utm_medium=et&utm_campaign=hu-screens
Source: setuppicasa39-setup.exe, 00000010.00000002.1664870898.000000000369C000.00000004.00000020.00020000.00000000.sdmp, GPhotos.scr, 00000011.00000000.1542961815.00000000006EF000.00000002.00000001.01000000.0000000F.sdmp, Picasa3.exe, 00000014.00000002.2599824731.0000000010A0C000.00000002.00000001.01000000.00000014.sdmp	String found in binary or memory: http://picasa.google.com/intl/id/#utm_source=gph-et-id&utm_medium=et&utm_campaign=id-screens
Source: setuppicasa39-setup.exe, 00000010.00000002.1664870898.000000000369C000.00000004.00000020.00020000.00000000.sdmp, GPhotos.scr, 00000011.00000000.1542961815.00000000006EF000.00000002.00000001.01000000.0000000F.sdmp, Picasa3.exe, 00000014.00000002.2599824731.0000000010A0C000.00000002.00000001.01000000.00000014.sdmp	String found in binary or memory: http://picasa.google.com/intl/ja/#utm_source=gph-et-ja&utm_medium=et&utm_campaign=ja-screens
Source: setuppicasa39-setup.exe, 00000010.00000002.1664870898.000000000369C000.00000004.00000020.00020000.00000000.sdmp, GPhotos.scr, 00000011.00000000.1542961815.00000000006EF000.00000002.00000001.01000000.0000000F.sdmp, Picasa3.exe, 00000014.00000002.2599824731.0000000010A0C000.00000002.00000001.01000000.00000014.sdmp	String found in binary or memory: http://picasa.google.com/intl/ko/#utm_source=gph-et-en&utm_medium=et&utm_campaign=en-screens
Source: setuppicasa39-setup.exe, 00000010.00000002.1664870898.000000000369C000.00000004.00000020.00020000.00000000.sdmp, GPhotos.scr, 00000011.00000000.1542961815.00000000006EF000.00000002.00000001.01000000.0000000F.sdmp, Picasa3.exe, 00000014.00000002.2599824731.0000000010A0C000.00000002.00000001.01000000.00000014.sdmp	String found in binary or memory: http://picasa.google.com/intl/lt/#utm_source=gph-et-lt&utm_medium=et&utm_campaign=lt-screens
Source: setuppicasa39-setup.exe, 00000010.00000002.1664870898.000000000369C000.00000004.00000020.00020000.00000000.sdmp, GPhotos.scr, 00000011.00000000.1542961815.00000000006EF000.00000002.00000001.01000000.0000000F.sdmp, Picasa3.exe, 00000014.00000002.2599824731.0000000010A0C000.00000002.00000001.01000000.00000014.sdmp	String found in binary or memory: http://picasa.google.com/intl/lv/#utm_source=gph-et-lv&utm_medium=et&utm_campaign=lv-screens
Source: setuppicasa39-setup.exe, 00000010.00000002.1664870898.000000000369C000.00000004.00000020.00020000.00000000.sdmp, GPhotos.scr, 00000011.00000000.1542961815.00000000006EF000.00000002.00000001.01000000.0000000F.sdmp, Picasa3.exe, 00000014.00000002.2599824731.0000000010A0C000.00000002.00000001.01000000.00000014.sdmp	String found in binary or memory: http://picasa.google.com/intl/nl/#utm_source=gph-et-nl&utm_medium=et&utm_campaign=nl-screens
Source: setuppicasa39-setup.exe, 00000010.00000002.1664870898.000000000369C000.00000004.00000020.00020000.00000000.sdmp, GPhotos.scr, 00000011.00000000.1542961815.00000000006EF000.00000002.00000001.01000000.0000000F.sdmp, Picasa3.exe, 00000014.00000002.2599824731.0000000010A0C000.00000002.00000001.01000000.00000014.sdmp	String found in binary or memory: http://picasa.google.com/intl/pl/#utm_source=gph-et-en&utm_medium=et&utm_campaign=en-screens
Source: setuppicasa39-setup.exe, 00000010.00000002.1664870898.000000000369C000.00000004.00000020.00020000.00000000.sdmp, GPhotos.scr, 00000011.00000000.1542961815.00000000006EF000.00000002.00000001.01000000.0000000F.sdmp, Picasa3.exe, 00000014.00000002.2599824731.0000000010A0C000.00000002.00000001.01000000.00000014.sdmp	String found in binary or memory: http://picasa.google.com/intl/pt-BR/#utm_source=gph-et-en&utm_medium=et&utm_campaign=en-scre
Source: setuppicasa39-setup.exe, 00000010.00000002.1664870898.000000000369C000.00000004.00000020.00020000.00000000.sdmp, GPhotos.scr, 00000011.00000000.1542961815.00000000006EF000.00000002.00000001.01000000.0000000F.sdmp, Picasa3.exe, 00000014.00000002.2599824731.0000000010A0C000.00000002.00000001.01000000.00000014.sdmp	String found in binary or memory: http://picasa.google.com/intl/pt_PT/#utm_source=gph-et-pt_PT&utm_medium=et&utm_campaign=pt_P
Source: setuppicasa39-setup.exe, 00000010.00000002.1664870898.000000000369C000.00000004.00000020.00020000.00000000.sdmp, GPhotos.scr, 00000011.00000000.1542961815.00000000006EF000.00000002.00000001.01000000.0000000F.sdmp, Picasa3.exe, 00000014.00000002.2599824731.0000000010A0C000.00000002.00000001.01000000.00000014.sdmp	String found in binary or memory: http://picasa.google.com/intl/ro/#utm_source=gph-et-ro&utm_medium=et&utm_campaign=ro-screens
Source: setuppicasa39-setup.exe, 00000010.00000002.1664870898.000000000369C000.00000004.00000020.00020000.00000000.sdmp, GPhotos.scr, 00000011.00000000.1542961815.00000000006EF000.00000002.00000001.01000000.0000000F.sdmp, Picasa3.exe, 00000014.00000002.2599824731.0000000010A0C000.00000002.00000001.01000000.00000014.sdmp	String found in binary or memory: http://picasa.google.com/intl/ru/#utm_source=gph-et-ru&utm_medium=et&utm_campaign=ru-screens
Source: setuppicasa39-setup.exe, 00000010.00000002.1664870898.000000000369C000.00000004.00000020.00020000.00000000.sdmp, GPhotos.scr, 00000011.00000000.1542961815.00000000006EF000.00000002.00000001.01000000.0000000F.sdmp, Picasa3.exe, 00000014.00000002.2599824731.0000000010A0C000.00000002.00000001.01000000.00000014.sdmp	String found in binary or memory: http://picasa.google.com/intl/sk/#utm_source=gph-et-sk&utm_medium=et&utm_campaign=sk-screens
Source: setuppicasa39-setup.exe, 00000010.00000002.1664870898.000000000369C000.00000004.00000020.00020000.00000000.sdmp, GPhotos.scr, 00000011.00000000.1542961815.00000000006EF000.00000002.00000001.01000000.0000000F.sdmp, Picasa3.exe, 00000014.00000002.2599824731.0000000010A0C000.00000002.00000001.01000000.00000014.sdmp	String found in binary or memory: http://picasa.google.com/intl/sl/#utm_source=gph-et-sl&utm_medium=et&utm_campaign=sl-screens
Source: setuppicasa39-setup.exe, 00000010.00000002.1664870898.000000000369C000.00000004.00000020.00020000.00000000.sdmp, GPhotos.scr, 00000011.00000000.1542961815.00000000006EF000.00000002.00000001.01000000.0000000F.sdmp, Picasa3.exe, 00000014.00000002.2599824731.000000001140C000.00000002.00000001.01000000.00000014.sdmp	String found in binary or memory: http://picasa.google.com/intl/th/#utm_source=gph-et-en&utm_medium=et&utm_campaign=en-screens
Source: setuppicasa39-setup.exe, 00000010.00000002.1664870898.000000000369C000.00000004.00000020.00020000.00000000.sdmp, GPhotos.scr, 00000011.00000000.1542961815.00000000006EF000.00000002.00000001.01000000.0000000F.sdmp, Picasa3.exe, 00000014.00000002.2599824731.000000001140C000.00000002.00000001.01000000.00000014.sdmp	String found in binary or memory: http://picasa.google.com/intl/tr/#utm_source=gph-et-en&utm_medium=et&utm_campaign=en-screens
Source: setuppicasa39-setup.exe, 00000010.00000002.1664870898.000000000369C000.00000004.00000020.00020000.00000000.sdmp, GPhotos.scr, 00000011.00000000.1542961815.00000000006EF000.00000002.00000001.01000000.0000000F.sdmp, Picasa3.exe, 00000014.00000002.2599824731.000000001140C000.00000002.00000001.01000000.00000014.sdmp	String found in binary or memory: http://picasa.google.com/intl/vi/#utm_source=gph-et-en&utm_medium=et&utm_campaign=en-screens
Source: setuppicasa39-setup.exe, 00000010.00000002.1664870898.000000000369C000.00000004.00000020.00020000.00000000.sdmp, GPhotos.scr, 00000011.00000000.1542961815.00000000006EF000.00000002.00000001.01000000.0000000F.sdmp, Picasa3.exe, 00000014.00000002.2599824731.000000001140C000.00000002.00000001.01000000.00000014.sdmp	String found in binary or memory: http://picasa.google.com/intl/zh-CN/#utm_source=gph-et-zh_CN&utm_medium=et&utm_campaign=zh_C
Source: setuppicasa39-setup.exe, 00000010.00000002.1664870898.000000000369C000.00000004.00000020.00020000.00000000.sdmp, GPhotos.scr, 00000011.00000000.1542961815.00000000006EF000.00000002.00000001.01000000.0000000F.sdmp, Picasa3.exe, 00000014.00000002.2599824731.000000001140C000.00000002.00000001.01000000.00000014.sdmp	String found in binary or memory: http://picasa.google.com/intl/zh-TW/#utm_source=gph-et-zh-TW&utm_medium=et&utm_campaign=zh-T
Source: Picasa3.exe, 00000012.00000000.1603749985.0000000000C6A000.00000002.00000001.01000000.00000012.sdmp, Picasa3.exe, 00000014.00000003.1626531844.00000000040E2000.00000004.00000020.00020000.00000000.sdmp, Picasa3.exe, 00000014.00000002.2599824731.0000000010A0C000.00000002.00000001.01000000.00000014.sdmp, Picasa3.exe, 00000014.00000003.1626203204.0000000003FB3000.00000004.00000020.00020000.00000000.sdmp, Picasa3.exe, 00000014.00000002.2599824731.000000001000C000.00000002.00000001.01000000.00000014.sdmp, Picasa3.exe, 00000014.00000002.2482072226.0000000002E7B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://picasa.google.com/support/bin/answer.py?answer=11139
Source: Picasa3.exe, 00000014.00000002.2599824731.000000001140C000.00000002.00000001.01000000.00000014.sdmp	String found in binary or memory: http://picasa.google.com/support/bin/answer.py?answer=11139&hl=th
Source: Picasa3.exe, 00000014.00000002.2599824731.000000001140C000.00000002.00000001.01000000.00000014.sdmp	String found in binary or memory: http://picasa.google.com/support/bin/answer.py?answer=11139&hl=uk
Source: Picasa3.exe, 00000014.00000002.2599824731.000000001140C000.00000002.00000001.01000000.00000014.sdmp	String found in binary or memory: http://picasa.google.com/support/bin/answer.py?answer=11139&hl=vi
Source: Picasa3.exe, 00000012.00000000.1603749985.0000000000C6A000.00000002.00000001.01000000.00000012.sdmp	String found in binary or memory: http://picasa.google.com/support/bin/answer.py?answer=11511
Source: setuppicasa39-setup.exe, 00000010.00000002.1664870898.0000000003831000.00000004.00000020.00020000.00000000.sdmp, Picasa3.exe, 00000012.00000000.1603749985.0000000000C6A000.00000002.00000001.01000000.00000012.sdmp, Picasa3.exe, 00000014.00000003.1626531844.00000000040E2000.00000004.00000020.00020000.00000000.sdmp, Picasa3.exe, 00000014.00000002.2599824731.000000001140C000.00000002.00000001.01000000.00000014.sdmp, Picasa3.exe, 00000014.00000002.2599824731.0000000010A0C000.00000002.00000001.01000000.00000014.sdmp, Picasa3.exe, 00000014.00000002.2482072226.0000000002EAA000.00000004.00000020.00020000.00000000.sdmp, Picasa3.exe, 00000014.00000003.1626203204.0000000003FB3000.00000004.00000020.00020000.00000000.sdmp, Picasa3.exe, 00000014.00000002.2599824731.000000001000C000.00000002.00000001.01000000.00000014.sdmp	String found in binary or memory: http://picasa.google.com/support/bin/answer.py?answer=139492
Source: Picasa3.exe, 00000014.00000002.2599824731.000000001140C000.00000002.00000001.01000000.00000014.sdmp, Picasa3.exe, 00000014.00000002.2599824731.000000001000C000.00000002.00000001.01000000.00000014.sdmp	String found in binary or memory: http://picasa.google.com/support/bin/answer.py?answer=139492&hl=uk
Source: Picasa3.exe, 00000012.00000000.1603749985.0000000000C6A000.00000002.00000001.01000000.00000012.sdmp	String found in binary or memory: http://picasa.google.com/support/bin/answer.py?answer=139492&hl=%sSplashThreadruntime
Source: Picasa3.exe, 00000014.00000002.2482072226.0000000002EAA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://picasa.google.com/support/bin/answer.py?answer=139492ar)
Source: Picasa3.exe, 00000012.00000000.1603749985.0000000000C6A000.00000002.00000001.01000000.00000012.sdmp, Picasa3.exe, 00000014.00000003.1626531844.00000000040E2000.00000004.00000020.00020000.00000000.sdmp, Picasa3.exe, 00000014.00000002.2599824731.0000000010A0C000.00000002.00000001.01000000.00000014.sdmp, Picasa3.exe, 00000014.00000002.2482072226.0000000002EAA000.00000004.00000020.00020000.00000000.sdmp, Picasa3.exe, 00000014.00000003.1626203204.0000000003FB3000.00000004.00000020.00020000.00000000.sdmp, Picasa3.exe, 00000014.00000002.2599824731.000000001000C000.00000002.00000001.01000000.00000014.sdmp	String found in binary or memory: http://picasa.google.com/support/bin/answer.py?answer=141059
Source: Picasa3.exe, 00000014.00000002.2599824731.000000001140C000.00000002.00000001.01000000.00000014.sdmp	String found in binary or memory: http://picasa.google.com/support/bin/answer.py?answer=141059&hl=th
Source: Picasa3.exe, 00000014.00000002.2599824731.000000001140C000.00000002.00000001.01000000.00000014.sdmp	String found in binary or memory: http://picasa.google.com/support/bin/answer.py?answer=141059&hl=uk
Source: Picasa3.exe, 00000014.00000002.2599824731.000000001140C000.00000002.00000001.01000000.00000014.sdmp	String found in binary or memory: http://picasa.google.com/support/bin/answer.py?answer=141059&hl=vi
Source: Picasa3.exe, 00000014.00000002.2482072226.0000000002EAA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://picasa.google.com/support/bin/answer.py?answer=141059)V
Source: Picasa3.exe, 00000012.00000000.1603749985.0000000000C6A000.00000002.00000001.01000000.00000012.sdmp	String found in binary or memory: http://picasa.google.com/support/bin/answer.py?answer=141059iPhotoError::HelpURL
Source: Picasa3.exe, 00000014.00000002.2482072226.0000000002EAA000.00000004.00000020.00020000.00000000.sdmp, Picasa3.exe, 00000014.00000002.2586100840.0000000006F6F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://picasa.google.com/support/bin/answer.py?answer=26374
Source: Picasa3.exe, 00000012.00000000.1603749985.0000000000C6A000.00000002.00000001.01000000.00000012.sdmp	String found in binary or memory: http://picasa.google.com/support/bin/answer.py?answer=39551
Source: Picasa3.exe, 00000012.00000000.1603749985.0000000000C6A000.00000002.00000001.01000000.00000012.sdmp	String found in binary or memory: http://picasa.google.com/support/bin/answer.py?answer=39551-----------------------------------------
Source: Picasa3.exe, 00000014.00000002.2593399186.0000000007244000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://picasa.google.com/support/bin/answer.py?answer=43901
Source: Picasa3.exe, 00000014.00000002.2593399186.0000000007223000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://picasa.google.com/support/bin/answer.py?answer=43901"><span
Source: Picasa3.exe, 00000012.00000000.1603749985.0000000000C6A000.00000002.00000001.01000000.00000012.sdmp, Picasa3.exe, 00000014.00000003.1626531844.00000000040E2000.00000004.00000020.00020000.00000000.sdmp, Picasa3.exe, 00000014.00000002.2599824731.000000001140C000.00000002.00000001.01000000.00000014.sdmp, Picasa3.exe, 00000014.00000002.2599824731.0000000010A0C000.00000002.00000001.01000000.00000014.sdmp, Picasa3.exe, 00000014.00000003.1626203204.0000000003FB3000.00000004.00000020.00020000.00000000.sdmp, Picasa3.exe, 00000014.00000002.2599824731.000000001000C000.00000002.00000001.01000000.00000014.sdmp, Picasa3.exe, 00000014.00000002.2482072226.0000000002E7B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://picasa.google.com/support/bin/answer.py?answer=53209
Source: Picasa3.exe, 00000014.00000002.2599824731.000000001140C000.00000002.00000001.01000000.00000014.sdmp	String found in binary or memory: http://picasa.google.com/support/bin/answer.py?answer=53209&hl=th
Source: Picasa3.exe, 00000014.00000002.2599824731.000000001140C000.00000002.00000001.01000000.00000014.sdmp	String found in binary or memory: http://picasa.google.com/support/bin/answer.py?answer=53209&hl=uk
Source: Picasa3.exe, 00000014.00000002.2506191744.0000000004241000.00000004.00000020.00020000.00000000.sdmp, Picasa3.exe, 00000014.00000002.2586100840.0000000006F6F000.00000004.00000020.00020000.00000000.sdmp, Picasa3.exe, 00000014.00000002.2593399186.000000000716B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://picasa.google.com/support/bin/answer.py?answer=93773
Source: Picasa3.exe, 00000014.00000002.2506191744.0000000004241000.00000004.00000020.00020000.00000000.sdmp, Picasa3.exe, 00000014.00000002.2586100840.0000000006F6F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://picasa.google.com/support/bin/answer.py?answer=93773&ctx=readme
Source: Picasa3.exe, 00000014.00000002.2593399186.0000000007223000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://picasa.google.com/support/bin/answer.py?answer=93773"><span
Source: Picasa3.exe, 00000014.00000002.2593399186.0000000007223000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://picasa.google.com/support/bin/answer.py?answer=93773">Picasa
Source: Picasa3.exe, 00000012.00000000.1603749985.0000000000C6A000.00000002.00000001.01000000.00000012.sdmp	String found in binary or memory: http://picasa.google.com/support/bin/answer.py?hl=%s&answer=156272
Source: Picasa3.exe, 00000012.00000000.1603749985.0000000000C6A000.00000002.00000001.01000000.00000012.sdmp	String found in binary or memory: http://picasa.google.com/support/bin/answer.py?hl=%s&answer=156272InfoTextUnnamedShownclustering_con
Source: setuppicasa39-setup.exe, 00000010.00000002.1664870898.0000000003831000.00000004.00000020.00020000.00000000.sdmp, Picasa3.exe, 00000014.00000002.2599824731.000000001000C000.00000002.00000001.01000000.00000014.sdmp	String found in binary or memory: http://picasa.google.com/support/bin/answer.py?hl=en&answer=15625
Source: Picasa3.exe, 00000014.00000003.1626531844.00000000040E2000.00000004.00000020.00020000.00000000.sdmp, Picasa3.exe, 00000014.00000002.2599824731.000000001140C000.00000002.00000001.01000000.00000014.sdmp, Picasa3.exe, 00000014.00000002.2599824731.0000000010A0C000.00000002.00000001.01000000.00000014.sdmp, Picasa3.exe, 00000014.00000003.1626203204.0000000003FB3000.00000004.00000020.00020000.00000000.sdmp, Picasa3.exe, 00000014.00000002.2599824731.000000001000C000.00000002.00000001.01000000.00000014.sdmp	String found in binary or memory: http://picasa.google.com/support/bin/answer.py?hl=en&answer=93773
Source: Picasa3.exe, 00000014.00000002.2593399186.0000000007223000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://picasa.google.com/support/bin/answer.py?hl=en&answer=93773">Picasa
Source: Picasa3.exe, 00000014.00000002.2482072226.0000000002EAA000.00000004.00000020.00020000.00000000.sdmp, Picasa3.exe, 00000014.00000002.2419587665.0000000000180000.00000004.00000010.00020000.00000000.sdmp	String found in binary or memory: http://picasa.google.com/support/bin/answer.py?hl=en&answer=93773
Source: Picasa3.exe, 00000012.00000000.1603749985.0000000000C6A000.00000002.00000001.01000000.00000012.sdmp	String found in binary or memory: http://picasa.google.com/support/bin/answer.py?hl=en&answer=93773CThumbUI::showfeatureslinkSaverUpgr
Source: Picasa3.exe, 00000014.00000002.2599824731.0000000010A0C000.00000002.00000001.01000000.00000014.sdmp	String found in binary or memory: http://picasa.google.com/support/bin/answer.py?hl=fi&answer=93773
Source: Picasa3.exe, 00000014.00000002.2599824731.0000000010A0C000.00000002.00000001.01000000.00000014.sdmp	String found in binary or memory: http://picasa.google.com/support/bin/answer.py?hl=fil&answer=93773
Source: Picasa3.exe, 00000014.00000002.2599824731.0000000010A0C000.00000002.00000001.01000000.00000014.sdmp	String found in binary or memory: http://picasa.google.com/support/bin/answer.py?hl=fr&answer=93773
Source: Picasa3.exe, 00000014.00000002.2599824731.0000000010A0C000.00000002.00000001.01000000.00000014.sdmp	String found in binary or memory: http://picasa.google.com/support/bin/answer.py?hl=hi&answer=93773
Source: Picasa3.exe, 00000014.00000002.2599824731.0000000010A0C000.00000002.00000001.01000000.00000014.sdmp	String found in binary or memory: http://picasa.google.com/support/bin/answer.py?hl=hu&answer=93773
Source: Picasa3.exe, 00000014.00000002.2599824731.0000000010A0C000.00000002.00000001.01000000.00000014.sdmp	String found in binary or memory: http://picasa.google.com/support/bin/answer.py?hl=id&answer=93773
Source: Picasa3.exe, 00000014.00000002.2599824731.0000000010A0C000.00000002.00000001.01000000.00000014.sdmp	String found in binary or memory: http://picasa.google.com/support/bin/answer.py?hl=it&answer=93773
Source: Picasa3.exe, 00000014.00000002.2599824731.0000000010A0C000.00000002.00000001.01000000.00000014.sdmp	String found in binary or memory: http://picasa.google.com/support/bin/answer.py?hl=iw&answer=93773
Source: Picasa3.exe, 00000014.00000002.2599824731.0000000010A0C000.00000002.00000001.01000000.00000014.sdmp	String found in binary or memory: http://picasa.google.com/support/bin/answer.py?hl=ja&answer=93773
Source: Picasa3.exe, 00000014.00000002.2599824731.0000000010A0C000.00000002.00000001.01000000.00000014.sdmp	String found in binary or memory: http://picasa.google.com/support/bin/answer.py?hl=ko&answer=93773
Source: Picasa3.exe, 00000014.00000002.2599824731.0000000010A0C000.00000002.00000001.01000000.00000014.sdmp	String found in binary or memory: http://picasa.google.com/support/bin/answer.py?hl=lt&answer=93773
Source: Picasa3.exe, 00000014.00000002.2599824731.0000000010A0C000.00000002.00000001.01000000.00000014.sdmp	String found in binary or memory: http://picasa.google.com/support/bin/answer.py?hl=lv&answer=93773
Source: Picasa3.exe, 00000014.00000002.2599824731.0000000010A0C000.00000002.00000001.01000000.00000014.sdmp	String found in binary or memory: http://picasa.google.com/support/bin/answer.py?hl=nl&answer=93773
Source: Picasa3.exe, 00000014.00000002.2599824731.0000000010A0C000.00000002.00000001.01000000.00000014.sdmp	String found in binary or memory: http://picasa.google.com/support/bin/answer.py?hl=no&answer=93773
Source: Picasa3.exe, 00000014.00000002.2599824731.0000000010A0C000.00000002.00000001.01000000.00000014.sdmp	String found in binary or memory: http://picasa.google.com/support/bin/answer.py?hl=pl&answer=93773
Source: Picasa3.exe, 00000014.00000002.2599824731.0000000010A0C000.00000002.00000001.01000000.00000014.sdmp	String found in binary or memory: http://picasa.google.com/support/bin/answer.py?hl=pt-BR&answer=93773
Source: Picasa3.exe, 00000014.00000002.2599824731.0000000010A0C000.00000002.00000001.01000000.00000014.sdmp	String found in binary or memory: http://picasa.google.com/support/bin/answer.py?hl=pt_PT&answer=93773
Source: Picasa3.exe, 00000014.00000002.2599824731.0000000010A0C000.00000002.00000001.01000000.00000014.sdmp	String found in binary or memory: http://picasa.google.com/support/bin/answer.py?hl=ro&answer=93773
Source: Picasa3.exe, 00000014.00000002.2599824731.0000000010A0C000.00000002.00000001.01000000.00000014.sdmp	String found in binary or memory: http://picasa.google.com/support/bin/answer.py?hl=ru&answer=93773
Source: Picasa3.exe, 00000014.00000002.2599824731.000000001140C000.00000002.00000001.01000000.00000014.sdmp	String found in binary or memory: http://picasa.google.com/support/bin/answer.py?hl=se&answer=11139
Source: Picasa3.exe, 00000014.00000002.2599824731.000000001140C000.00000002.00000001.01000000.00000014.sdmp	String found in binary or memory: http://picasa.google.com/support/bin/answer.py?hl=se&answer=141059
Source: Picasa3.exe, 00000014.00000002.2599824731.0000000010A0C000.00000002.00000001.01000000.00000014.sdmp	String found in binary or memory: http://picasa.google.com/support/bin/answer.py?hl=sk&answer=93773
Source: Picasa3.exe, 00000014.00000002.2599824731.0000000010A0C000.00000002.00000001.01000000.00000014.sdmp	String found in binary or memory: http://picasa.google.com/support/bin/answer.py?hl=sl&answer=93773
Source: Picasa3.exe, 00000014.00000002.2599824731.000000001140C000.00000002.00000001.01000000.00000014.sdmp	String found in binary or memory: http://picasa.google.com/support/bin/answer.py?hl=sv&answer=53209
Source: Picasa3.exe, 00000014.00000002.2599824731.000000001140C000.00000002.00000001.01000000.00000014.sdmp	String found in binary or memory: http://picasa.google.com/support/bin/answer.py?hl=sv&answer=93773
Source: Picasa3.exe, 00000014.00000002.2599824731.000000001140C000.00000002.00000001.01000000.00000014.sdmp	String found in binary or memory: http://picasa.google.com/support/bin/answer.py?hl=th&answer=93773
Source: Picasa3.exe, 00000014.00000002.2599824731.000000001140C000.00000002.00000001.01000000.00000014.sdmp	String found in binary or memory: http://picasa.google.com/support/bin/answer.py?hl=tr&answer=93773
Source: Picasa3.exe, 00000014.00000002.2599824731.000000001140C000.00000002.00000001.01000000.00000014.sdmp	String found in binary or memory: http://picasa.google.com/support/bin/answer.py?hl=vi&answer=93773
Source: Picasa3.exe, 00000014.00000002.2599824731.000000001140C000.00000002.00000001.01000000.00000014.sdmp	String found in binary or memory: http://picasa.google.com/support/bin/answer.py?hl=zh-TW&answer=11139
Source: Picasa3.exe, 00000014.00000002.2599824731.000000001140C000.00000002.00000001.01000000.00000014.sdmp	String found in binary or memory: http://picasa.google.com/support/bin/answer.py?hl=zh-TW&answer=141059
Source: Picasa3.exe, 00000014.00000002.2599824731.000000001140C000.00000002.00000001.01000000.00000014.sdmp	String found in binary or memory: http://picasa.google.com/support/bin/answer.py?hl=zh-TW&answer=53209
Source: Picasa3.exe, 00000014.00000002.2599824731.000000001140C000.00000002.00000001.01000000.00000014.sdmp	String found in binary or memory: http://picasa.google.com/support/bin/answer.py?hl=zh-TW&answer=93773
Source: Picasa3.exe, 00000014.00000002.2599824731.000000001140C000.00000002.00000001.01000000.00000014.sdmp	String found in binary or memory: http://picasa.google.com/support/bin/answer.py?hl=zh_CN&answer=11139
Source: Picasa3.exe, 00000014.00000002.2599824731.000000001140C000.00000002.00000001.01000000.00000014.sdmp	String found in binary or memory: http://picasa.google.com/support/bin/answer.py?hl=zh_CN&answer=141059
Source: Picasa3.exe, 00000014.00000002.2599824731.000000001140C000.00000002.00000001.01000000.00000014.sdmp	String found in binary or memory: http://picasa.google.com/support/bin/answer.py?hl=zh_CN&answer=53209
Source: Picasa3.exe, 00000014.00000002.2599824731.000000001140C000.00000002.00000001.01000000.00000014.sdmp	String found in binary or memory: http://picasa.google.com/support/bin/answer.py?hl=zh_CN&answer=93773
Source: setuppicasa39-setup.exe	String found in binary or memory: http://picasa.google.com/support/bin/request.py?contact_type=uninstall
Source: setuppicasa39-setup.exe, 00000010.00000002.1704699696.0000000004CA3000.00000002.00000001.01000000.0000000C.sdmp	String found in binary or memory: http://picasa.google.com/support/bin/request.py?contact_type=uninstallptPTpt_PTpt_BRzhCNzh_CNzh_TW&h
Source: Picasa3.exe, 00000012.00000000.1603749985.0000000000C6A000.00000002.00000001.01000000.00000012.sdmp, Picasa3.exe, 00000014.00000003.1626531844.00000000040E2000.00000004.00000020.00020000.00000000.sdmp, Picasa3.exe, 00000014.00000002.2599824731.000000001140C000.00000002.00000001.01000000.00000014.sdmp, Picasa3.exe, 00000014.00000002.2599824731.0000000010A0C000.00000002.00000001.01000000.00000014.sdmp, Picasa3.exe, 00000014.00000003.1626203204.0000000003FB3000.00000004.00000020.00020000.00000000.sdmp, Picasa3.exe, 00000014.00000002.2599824731.000000001000C000.00000002.00000001.01000000.00000014.sdmp, Picasa3.exe, 00000014.00000002.2482072226.0000000002E7B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://picasa.google.com/support/bin/topic.py?topic=16056
Source: Picasa3.exe, 00000012.00000000.1603749985.0000000000C6A000.00000002.00000001.01000000.00000012.sdmp	String found in binary or memory: http://picasa.google.com/support/bin/topic.py?topic=16056il_BurnPanel::imapierrorlinkError
Source: Picasa3.exe, 00000014.00000002.2482072226.0000000002E92000.00000004.00000020.00020000.00000000.sdmp, Picasa3.exe, 00000014.00000002.2599824731.000000001140C000.00000002.00000001.01000000.00000014.sdmp, Picasa3.exe, 00000014.00000002.2599824731.0000000010A0C000.00000002.00000001.01000000.00000014.sdmp, Picasa3.exe, 00000014.00000003.1626203204.0000000003FB3000.00000004.00000020.00020000.00000000.sdmp, Picasa3.exe, 00000014.00000002.2599824731.000000001000C000.00000002.00000001.01000000.00000014.sdmp, PicasaPhotoViewer.exe, 00000015.00000000.1692209976.000000000070D000.00000002.00000001.01000000.00000019.sdmp	String found in binary or memory: http://picasa.google.com/support?ctx=picasa
Source: Picasa3.exe, 00000012.00000000.1603749985.0000000000C6A000.00000002.00000001.01000000.00000012.sdmp	String found in binary or memory: http://picasa.google.com/support?ctx=picasaHELPID_DEFAULTi18n
Source: setuppicasa39-setup.exe, 00000010.00000002.1664870898.00000000031AA000.00000004.00000020.00020000.00000000.sdmp, PicasaPhotoViewer.exe, 00000015.00000000.1692209976.000000000070D000.00000002.00000001.01000000.00000019.sdmp	String found in binary or memory: http://picasa.google.com/support?ctx=picasatooltip3dfilmstripprintlocateemailblogslingshot_minimizep
Source: setuppicasa39-setup.exe, 00000010.00000002.1664870898.000000000369C000.00000004.00000020.00020000.00000000.sdmp, GPhotos.scr, 00000011.00000000.1542961815.00000000006EF000.00000002.00000001.01000000.0000000F.sdmp, Picasa3.exe, 00000014.00000002.2599824731.000000001000C000.00000002.00000001.01000000.00000014.sdmp	String found in binary or memory: http://picasa.google.dk/intl/da/#utm_source=gph-et-en&utm_medium=et&utm_campaign=da-screensa
Source: Picasa3.exe, 00000014.00000002.2599824731.0000000010A0C000.00000002.00000001.01000000.00000014.sdmp	String found in binary or memory: http://picasa.google.it/support/bin/answer.py?answer=11139
Source: Picasa3.exe, 00000014.00000002.2599824731.0000000010A0C000.00000002.00000001.01000000.00000014.sdmp, Picasa3.exe, 00000014.00000002.2599824731.000000001000C000.00000002.00000001.01000000.00000014.sdmp	String found in binary or memory: http://picasa.google.it/support/bin/answer.py?answer=139492
Source: Picasa3.exe, 00000014.00000002.2599824731.0000000010A0C000.00000002.00000001.01000000.00000014.sdmp	String found in binary or memory: http://picasa.google.it/support/bin/answer.py?answer=141059
Source: Picasa3.exe, 00000014.00000002.2599824731.0000000010A0C000.00000002.00000001.01000000.00000014.sdmp	String found in binary or memory: http://picasa.google.it/support/bin/answer.py?answer=53209
Source: Picasa3.exe, 00000014.00000002.2599824731.0000000010A0C000.00000002.00000001.01000000.00000014.sdmp	String found in binary or memory: http://picasa.google.nl/support/bin/answer.py?answer=11139
Source: Picasa3.exe, 00000014.00000002.2599824731.0000000010A0C000.00000002.00000001.01000000.00000014.sdmp, Picasa3.exe, 00000014.00000002.2599824731.000000001000C000.00000002.00000001.01000000.00000014.sdmp	String found in binary or memory: http://picasa.google.nl/support/bin/answer.py?answer=139492
Source: Picasa3.exe, 00000014.00000002.2599824731.0000000010A0C000.00000002.00000001.01000000.00000014.sdmp	String found in binary or memory: http://picasa.google.nl/support/bin/answer.py?answer=141059
Source: Picasa3.exe, 00000014.00000002.2599824731.0000000010A0C000.00000002.00000001.01000000.00000014.sdmp	String found in binary or memory: http://picasa.google.nl/support/bin/answer.py?answer=53209
Source: Picasa3.exe, 00000014.00000002.2599824731.0000000010A0C000.00000002.00000001.01000000.00000014.sdmp	String found in binary or memory: http://picasa.google.nl/support/bin/topic.py?topic=14609
Source: Picasa3.exe, 00000014.00000002.2599824731.0000000010A0C000.00000002.00000001.01000000.00000014.sdmp	String found in binary or memory: http://picasa.google.ro/
Source: Picasa3.exe, 00000014.00000002.2599824731.0000000010A0C000.00000002.00000001.01000000.00000014.sdmp	String found in binary or memory: http://picasa.google.rs/
Source: setuppicasa39-setup.exe, 00000010.00000002.1664870898.000000000369C000.00000004.00000020.00020000.00000000.sdmp, GPhotos.scr, 00000011.00000000.1542961815.00000000006EF000.00000002.00000001.01000000.0000000F.sdmp, Picasa3.exe, 00000014.00000002.2599824731.0000000010A0C000.00000002.00000001.01000000.00000014.sdmp	String found in binary or memory: http://picasa.google.rs/intl/sr/#utm_source=gph-et-sr&utm_medium=et&utm_campaign=sr-screensa
Source: Picasa3.exe, 00000014.00000002.2599824731.0000000010A0C000.00000002.00000001.01000000.00000014.sdmp	String found in binary or memory: http://picasa.google.rs/support/bin/answer.py?answer=11139
Source: Picasa3.exe, 00000014.00000002.2599824731.0000000010A0C000.00000002.00000001.01000000.00000014.sdmp	String found in binary or memory: http://picasa.google.rs/support/bin/answer.py?answer=141059
Source: Picasa3.exe, 00000014.00000002.2599824731.0000000010A0C000.00000002.00000001.01000000.00000014.sdmp	String found in binary or memory: http://picasa.google.rs/support/bin/answer.py?answer=53209
Source: Picasa3.exe, 00000014.00000002.2599824731.0000000010A0C000.00000002.00000001.01000000.00000014.sdmp	String found in binary or memory: http://picasa.google.rs/support/bin/answer.py?hl=sr&answer=93773
Source: Picasa3.exe, 00000014.00000002.2599824731.0000000010A0C000.00000002.00000001.01000000.00000014.sdmp	String found in binary or memory: http://picasa.google.rs/support/bin/topic.py?topic=16056
Source: Picasa3.exe, 00000014.00000002.2599824731.0000000010A0C000.00000002.00000001.01000000.00000014.sdmp	String found in binary or memory: http://picasa.google.rs/support?ctx=picasa
Source: Picasa3.exe, 00000014.00000002.2599824731.0000000010A0C000.00000002.00000001.01000000.00000014.sdmp	String found in binary or memory: http://picasa.google.ru/support?ctx=picasa
Source: Picasa3.exe, 00000012.00000000.1603749985.0000000000C6A000.00000002.00000001.01000000.00000012.sdmp	String found in binary or memory: http://picasa.smo/buttons
Source: Picasa3.exe, 00000012.00000000.1603749985.0000000000C6A000.00000002.00000001.01000000.00000012.sdmp	String found in binary or memory: http://picasa.smo/buttonsP
Source: Picasa3.exe, 00000014.00000003.1626531844.00000000040E2000.00000004.00000020.00020000.00000000.sdmp, Picasa3.exe, 00000014.00000002.2482072226.0000000002E92000.00000004.00000020.00020000.00000000.sdmp, Picasa3.exe, 00000014.00000002.2599824731.000000001140C000.00000002.00000001.01000000.00000014.sdmp, Picasa3.exe, 00000014.00000002.2599824731.0000000010A0C000.00000002.00000001.01000000.00000014.sdmp, Picasa3.exe, 00000014.00000003.1626203204.0000000003FB3000.00000004.00000020.00020000.00000000.sdmp, Picasa3.exe, 00000014.00000002.2599824731.000000001000C000.00000002.00000001.01000000.00000014.sdmp	String found in binary or memory: http://picasa2.blogspot.com/
Source: Picasa3.exe, 00000012.00000000.1604678624.0000000000DF8000.00000002.00000001.01000000.00000012.sdmp	String found in binary or memory: http://picasa2.blogspot.com/3Some
Source: Picasa3.exe, 00000014.00000002.2599824731.000000001140C000.00000002.00000001.01000000.00000014.sdmp	String found in binary or memory: http://picasa2.blogspot.com/?hl=vi
Source: Picasa3.exe, 00000014.00000002.2482072226.0000000002E92000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://picasa2.blogspot.com/e.
Source: setuppicasa39-setup.exe, 00000010.00000002.1664870898.00000000035FF000.00000004.00000020.00020000.00000000.sdmp, GPhotos.scr, 00000011.00000000.1542724484.000000000062E000.00000002.00000001.01000000.0000000F.sdmp	String found in binary or memory: http://picasaweb.google.com/data/feed/base/user/
Source: setuppicasa39-setup.exe, 00000010.00000002.1664870898.00000000035FF000.00000004.00000020.00020000.00000000.sdmp, GPhotos.scr, 00000011.00000000.1542724484.000000000062E000.00000002.00000001.01000000.0000000F.sdmp	String found in binary or memory: http://picasaweb.google.com/home
Source: setuppicasa39-setup.exe, 00000010.00000002.1664870898.00000000035FF000.00000004.00000020.00020000.00000000.sdmp, GPhotos.scr, 00000011.00000000.1542724484.000000000062E000.00000002.00000001.01000000.0000000F.sdmp	String found in binary or memory: http://picasaweb.google.com/lh/favorites
Source: setuppicasa39-setup.exe, 00000010.00000002.1664870898.00000000035FF000.00000004.00000020.00020000.00000000.sdmp, GPhotos.scr, 00000011.00000000.1542724484.000000000062E000.00000002.00000001.01000000.0000000F.sdmp	String found in binary or memory: http://picasaweb.google.com/lh/favoriteshttp://picasaweb.google.com/home?kind=album&alt=rss&hl=en_US
Source: Picasa3.exe, 00000012.00000000.1603749985.0000000000C6A000.00000002.00000001.01000000.00000012.sdmp	String found in binary or memory: http://picasaweb.google.com/lh/nameTagOpt
Source: Picasa3.exe, 00000012.00000000.1603749985.0000000000C6A000.00000002.00000001.01000000.00000012.sdmp	String found in binary or memory: http://picasaweb.google.com/lh/nameTagOptDoNotConfirmReducedUploadquotalearnmorehttps://support.goog
Source: Picasa3.exe, 00000012.00000000.1603749985.0000000000C6A000.00000002.00000001.01000000.00000012.sdmp	String found in binary or memory: http://picasaweb.google.com/lh/picasaweb/
Source: Picasa3.exe, 00000012.00000000.1603749985.0000000000C6A000.00000002.00000001.01000000.00000012.sdmp	String found in binary or memory: http://picasaweb.google.com/support/bin/request.py?contact_type=bug
Source: Picasa3.exe, 00000012.00000000.1603749985.0000000000C6A000.00000002.00000001.01000000.00000012.sdmp	String found in binary or memory: http://picasaweb.google.com/support/bin/request.py?contact_type=bugPicasa2
Source: Picasa3.exe, 00000012.00000000.1603749985.0000000000C6A000.00000002.00000001.01000000.00000012.sdmp	String found in binary or memory: http://schemas.google.com/contacts/2008/rel#photo
Source: setuppicasa39-setup.exe, 00000010.00000002.1664870898.00000000031AA000.00000004.00000020.00020000.00000000.sdmp, Picasa3.exe, 00000012.00000000.1603749985.0000000000C6A000.00000002.00000001.01000000.00000012.sdmp, PicasaPhotoViewer.exe, 00000015.00000000.1692209976.000000000070D000.00000002.00000001.01000000.00000019.sdmp	String found in binary or memory: http://schemas.google.com/g/2005
Source: Picasa3.exe, 00000012.00000000.1603749985.0000000000C6A000.00000002.00000001.01000000.00000012.sdmp	String found in binary or memory: http://schemas.google.com/g/2005#home
Source: Picasa3.exe, 00000012.00000000.1603749985.0000000000C6A000.00000002.00000001.01000000.00000012.sdmp	String found in binary or memory: http://schemas.google.com/g/2005#homerelgd:deletedgContact:systemGroupFriendsFocusGroup::FriendsFami
Source: Picasa3.exe, 00000012.00000000.1603749985.0000000000C6A000.00000002.00000001.01000000.00000012.sdmp, PicasaPhotoViewer.exe, 00000015.00000000.1692209976.000000000070D000.00000002.00000001.01000000.00000019.sdmp	String found in binary or memory: http://schemas.google.com/g/2005#kind
Source: Picasa3.exe, 00000014.00000002.2593399186.0000000007223000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://schemas.google.com/g/2005#thumbnail
Source: Picasa3.exe, 00000012.00000000.1603749985.0000000000C6A000.00000002.00000001.01000000.00000012.sdmp	String found in binary or memory: http://schemas.google.com/g/2008/ordering#comesAfter
Source: Picasa3.exe, 00000012.00000000.1603749985.0000000000C6A000.00000002.00000001.01000000.00000012.sdmp	String found in binary or memory: http://schemas.google.com/g/2008/ordering#first
Source: setuppicasa39-setup.exe, 00000010.00000002.1664870898.00000000031AA000.00000004.00000020.00020000.00000000.sdmp, Picasa3.exe, 00000012.00000000.1603749985.0000000000C6A000.00000002.00000001.01000000.00000012.sdmp, PicasaPhotoViewer.exe, 00000015.00000000.1692209976.000000000070D000.00000002.00000001.01000000.00000019.sdmp	String found in binary or memory: http://schemas.google.com/photos/2007
Source: Picasa3.exe, 00000012.00000000.1603749985.0000000000C6A000.00000002.00000001.01000000.00000012.sdmp	String found in binary or memory: http://schemas.google.com/photos/2007#album
Source: Picasa3.exe, 00000012.00000000.1603749985.0000000000C6A000.00000002.00000001.01000000.00000012.sdmp	String found in binary or memory: http://schemas.google.com/photos/2007#albumDownload
Source: Picasa3.exe, 00000012.00000000.1603749985.0000000000C6A000.00000002.00000001.01000000.00000012.sdmp, PicasaPhotoViewer.exe, 00000015.00000000.1692209976.000000000070D000.00000002.00000001.01000000.00000019.sdmp	String found in binary or memory: http://schemas.google.com/photos/2007#photo
Source: Picasa3.exe, 00000012.00000000.1603749985.0000000000C6A000.00000002.00000001.01000000.00000012.sdmp	String found in binary or memory: http://schemas.google.com/photos/20073.9.6picasa_versioncreateSubjectgphoto:opgphoto:itemidgphoto:ga
Source: setuppicasa39-setup.exe, 00000010.00000002.1664870898.00000000031AA000.00000004.00000020.00020000.00000000.sdmp, PicasaPhotoViewer.exe, 00000015.00000000.1692209976.000000000070D000.00000002.00000001.01000000.00000019.sdmp	String found in binary or memory: http://schemas.google.com/photos/2007xmlns:gphotohttp://search.yahoo.com/mrss/xmlns:mediahttp://sche
Source: setuppicasa39-setup.exe, 00000010.00000002.1664870898.00000000031AA000.00000004.00000020.00020000.00000000.sdmp, Picasa3.exe, 00000012.00000000.1603749985.0000000000C6A000.00000002.00000001.01000000.00000012.sdmp, PicasaPhotoViewer.exe, 00000015.00000000.1692209976.000000000070D000.00000002.00000001.01000000.00000019.sdmp	String found in binary or memory: http://schemas.google.com/photos/exif/2007
Source: setuppicasa39-setup.exe, 00000010.00000002.1664870898.00000000031AA000.00000004.00000020.00020000.00000000.sdmp, Picasa3.exe, 00000012.00000000.1603749985.0000000000C6A000.00000002.00000001.01000000.00000012.sdmp, Picasa3.exe, 00000014.00000002.2593399186.0000000007223000.00000004.00000020.00020000.00000000.sdmp, PicasaPhotoViewer.exe, 00000015.00000000.1692209976.000000000070D000.00000002.00000001.01000000.00000019.sdmp	String found in binary or memory: http://search.yahoo.com/mrss/
Source: Picasa3.exe, 00000012.00000000.1603749985.0000000000C6A000.00000002.00000001.01000000.00000012.sdmp	String found in binary or memory: http://search.yahoo.com/msrss/
Source: setuppicasa39-setup.exe, 00000010.00000002.1664870898.0000000003DA5000.00000004.00000020.00020000.00000000.sdmp, Picasa3.exe, Picasa3.exe, 00000014.00000002.2533437740.000000000488F000.00000002.00000001.01000000.00000016.sdmp	String found in binary or memory: http://stats.picasa.com/apps/get.stats.uploader.php
Source: setuppicasa39-setup.exe, 00000010.00000002.1664870898.0000000003DA5000.00000004.00000020.00020000.00000000.sdmp, Picasa3.exe, 00000014.00000002.2533437740.000000000488F000.00000002.00000001.01000000.00000016.sdmp	String found in binary or memory: http://stats.picasa.com/apps/get.stats.uploader.phpPluginNameOverrideXmlOverrideUrlOverrideytIAction
Source: Picasa3.exe, 00000014.00000002.2593399186.0000000007223000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://support.google.com/picasa/bin/answer.py?hl=en&amp;answer=1319659&amp;topic=1751920&qu
Source: Picasa3.exe, 00000014.00000002.2593399186.0000000007223000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://support.google.com/picasa/bin/answer.py?hl=en&amp;answer=39500&amp;topic=1751920&quot
Source: Picasa3.exe, 00000014.00000002.2506191744.000000000417F000.00000004.00000020.00020000.00000000.sdmp, Picasa3.exe, 00000014.00000002.2593399186.000000000716B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://support.google.com/picasa/bin/answer.py?hl=en&answer=39500&topic=1751920
Source: Picasa3.exe, 00000014.00000002.2506191744.000000000417F000.00000004.00000020.00020000.00000000.sdmp, Picasa3.exe, 00000014.00000002.2593399186.000000000716B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://support.google.com/plus/bin/answer.py?answer=2370124
Source: Picasa3.exe, 00000014.00000002.2593399186.0000000007223000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://support.google.com/plus/bin/answer.py?answer=2370124"><span
Source: 1a4e5ccd35a56d84281a143f831563be.exe, 0000000F.00000002.2435414779.0000000000414000.00000004.00000001.01000000.00000006.sdmp, setuppicasa39-setup.exe, 00000010.00000002.1664870898.000000000459F000.00000004.00000020.00020000.00000000.sdmp, setuppicasa39-setup.exe, 00000010.00000002.1664870898.00000000032A7000.00000004.00000020.00020000.00000000.sdmp, setuppicasa39-setup.exe, 00000010.00000002.1664870898.0000000002E88000.00000004.00000020.00020000.00000000.sdmp, setuppicasa39-setup.exe, 00000010.00000002.1664870898.000000000467E000.00000004.00000020.00020000.00000000.sdmp, setuppicasa39-setup.exe, 00000010.00000002.1664870898.00000000029F6000.00000004.00000020.00020000.00000000.sdmp, PicasaPhotoViewer.exe, 00000015.00000003.1750870600.0000000000AEB000.00000004.00000020.00020000.00000000.sdmp, PicasaPhotoViewer.exe, 00000015.00000002.1780753263.0000000003B00000.00000004.00000020.00020000.00000000.sdmp, PicasaPhotoViewer.exe, 00000015.00000003.1775638859.0000000000A66000.00000004.00000020.00020000.00000000.sdmp, UNZIP.EXE, 00000026.00000002.1812336800.0000000000430000.00000040.00000001.01000000.00000020.sdmp, UNZIP.EXE, 00000028.00000002.1816767609.000000000042B000.00000040.00000001.01000000.00000020.sdmp, UNZIP.EXE, 00000058.00000002.2099499225.0000000000428000.00000040.00000001.01000000.00000026.sdmp, CPY.EXE, 0000005C.00000002.2102179386.0000000000B00000.00000004.00000020.00020000.00000000.sdmp, UNZIP.EXE, 0000005D.00000002.2105385323.0000000000428000.00000040.00000001.01000000.00000026.sdmp, CPY.EXE, 00000061.00000002.2108099884.0000000000E09000.00000004.00000020.00020000.00000000.sdmp, CPY.EXE, 00000064.00000002.2115643669.0000000000ECA000.00000004.00000020.00020000.00000000.sdmp, UNZIP.EXE, 00000066.00000002.2120076164.0000000000428000.00000040.00000001.01000000.00000026.sdmp, CPY.EXE, 0000006A.00000002.2122729835.0000000000629000.00000004.00000020.00020000.00000000.sdmp, CPY.EXE, 00000070.00000002.2131296204.0000000000CD9000.00000004.00000020.00020000.00000000.sdmp, sznpp.exe, 0000007C.00000000.2152804918.0000000000BFB000.00000002.00000001.01000000.0000002C.sdmp, UNZIP.EXE, 0000007D.00000002.2173171240.000000000042B000.00000040.00000001.01000000.00000026.sdmp	String found in binary or memory: http://ts-aia.ws.symantec.com/tss-ca-g2.cer0
Source: 1a4e5ccd35a56d84281a143f831563be.exe, 0000000F.00000002.2435414779.0000000000414000.00000004.00000001.01000000.00000006.sdmp, setuppicasa39-setup.exe, 00000010.00000002.1664870898.000000000459F000.00000004.00000020.00020000.00000000.sdmp, setuppicasa39-setup.exe, 00000010.00000002.1664870898.00000000032A7000.00000004.00000020.00020000.00000000.sdmp, setuppicasa39-setup.exe, 00000010.00000002.1664870898.0000000002E88000.00000004.00000020.00020000.00000000.sdmp, setuppicasa39-setup.exe, 00000010.00000002.1664870898.000000000467E000.00000004.00000020.00020000.00000000.sdmp, setuppicasa39-setup.exe, 00000010.00000002.1664870898.00000000029F6000.00000004.00000020.00020000.00000000.sdmp, PicasaPhotoViewer.exe, 00000015.00000003.1750870600.0000000000AEB000.00000004.00000020.00020000.00000000.sdmp, PicasaPhotoViewer.exe, 00000015.00000002.1780753263.0000000003B00000.00000004.00000020.00020000.00000000.sdmp, PicasaPhotoViewer.exe, 00000015.00000003.1775638859.0000000000A66000.00000004.00000020.00020000.00000000.sdmp, UNZIP.EXE, 00000026.00000002.1812336800.0000000000430000.00000040.00000001.01000000.00000020.sdmp, UNZIP.EXE, 00000028.00000002.1816767609.000000000042B000.00000040.00000001.01000000.00000020.sdmp, UNZIP.EXE, 00000058.00000002.2099499225.0000000000428000.00000040.00000001.01000000.00000026.sdmp, CPY.EXE, 0000005C.00000002.2102179386.0000000000B00000.00000004.00000020.00020000.00000000.sdmp, UNZIP.EXE, 0000005D.00000002.2105385323.0000000000428000.00000040.00000001.01000000.00000026.sdmp, CPY.EXE, 00000061.00000002.2108099884.0000000000E09000.00000004.00000020.00020000.00000000.sdmp, CPY.EXE, 00000064.00000002.2115643669.0000000000ECA000.00000004.00000020.00020000.00000000.sdmp, UNZIP.EXE, 00000066.00000002.2120076164.0000000000428000.00000040.00000001.01000000.00000026.sdmp, CPY.EXE, 0000006A.00000002.2122729835.0000000000629000.00000004.00000020.00020000.00000000.sdmp, CPY.EXE, 00000070.00000002.2131296204.0000000000CD9000.00000004.00000020.00020000.00000000.sdmp, sznpp.exe, 0000007C.00000000.2152804918.0000000000BFB000.00000002.00000001.01000000.0000002C.sdmp, UNZIP.EXE, 0000007D.00000002.2173171240.000000000042B000.00000040.00000001.01000000.00000026.sdmp	String found in binary or memory: http://ts-crl.ws.symantec.com/tss-ca-g2.crl0(
Source: 1a4e5ccd35a56d84281a143f831563be.exe, 0000000F.00000002.2435414779.0000000000414000.00000004.00000001.01000000.00000006.sdmp, setuppicasa39-setup.exe, 00000010.00000002.1664870898.000000000459F000.00000004.00000020.00020000.00000000.sdmp, setuppicasa39-setup.exe, 00000010.00000002.1664870898.00000000032A7000.00000004.00000020.00020000.00000000.sdmp, setuppicasa39-setup.exe, 00000010.00000002.1664870898.0000000002E88000.00000004.00000020.00020000.00000000.sdmp, setuppicasa39-setup.exe, 00000010.00000002.1664870898.000000000467E000.00000004.00000020.00020000.00000000.sdmp, setuppicasa39-setup.exe, 00000010.00000002.1664870898.00000000029F6000.00000004.00000020.00020000.00000000.sdmp, PicasaPhotoViewer.exe, 00000015.00000003.1750870600.0000000000AEB000.00000004.00000020.00020000.00000000.sdmp, PicasaPhotoViewer.exe, 00000015.00000002.1780753263.0000000003B00000.00000004.00000020.00020000.00000000.sdmp, PicasaPhotoViewer.exe, 00000015.00000003.1775638859.0000000000A66000.00000004.00000020.00020000.00000000.sdmp, UNZIP.EXE, 00000026.00000002.1812336800.0000000000430000.00000040.00000001.01000000.00000020.sdmp, UNZIP.EXE, 00000028.00000002.1816767609.000000000042B000.00000040.00000001.01000000.00000020.sdmp, UNZIP.EXE, 00000058.00000002.2099499225.0000000000428000.00000040.00000001.01000000.00000026.sdmp, CPY.EXE, 0000005C.00000002.2102179386.0000000000B00000.00000004.00000020.00020000.00000000.sdmp, UNZIP.EXE, 0000005D.00000002.2105385323.0000000000428000.00000040.00000001.01000000.00000026.sdmp, CPY.EXE, 00000061.00000002.2108099884.0000000000E09000.00000004.00000020.00020000.00000000.sdmp, CPY.EXE, 00000064.00000002.2115643669.0000000000ECA000.00000004.00000020.00020000.00000000.sdmp, UNZIP.EXE, 00000066.00000002.2120076164.0000000000428000.00000040.00000001.01000000.00000026.sdmp, CPY.EXE, 0000006A.00000002.2122729835.0000000000629000.00000004.00000020.00020000.00000000.sdmp, CPY.EXE, 00000070.00000002.2131296204.0000000000CD9000.00000004.00000020.00020000.00000000.sdmp, sznpp.exe, 0000007C.00000000.2152804918.0000000000BFB000.00000002.00000001.01000000.0000002C.sdmp, UNZIP.EXE, 0000007D.00000002.2173171240.000000000042B000.00000040.00000001.01000000.00000026.sdmp	String found in binary or memory: http://ts-ocsp.ws.symantec.com07
Source: setuppicasa39-setup.exe, 00000010.00000002.1664870898.0000000003831000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://updates.picasasoftware.com/picasa2/public/currentversion.ini
Source: Picasa3.exe, 00000012.00000000.1603749985.0000000000C6A000.00000002.00000001.01000000.00000012.sdmp	String found in binary or memory: http://uploads.gdata.youtube.com
Source: Picasa3.exe, 00000012.00000000.1603749985.0000000000C6A000.00000002.00000001.01000000.00000012.sdmp	String found in binary or memory: http://uploads.gdata.youtube.comhttp://gdata.youtube.comhttp://search.yahoo.com/mrss/http://gdata.yo
Source: Picasa3.exe, 00000012.00000000.1603749985.0000000000C6A000.00000002.00000001.01000000.00000012.sdmp	String found in binary or memory: http://video.google.com
Source: Picasa3.exe, 00000012.00000000.1603749985.0000000000C6A000.00000002.00000001.01000000.00000012.sdmp	String found in binary or memory: http://video.google.com/googleplayer.swf?videoUrl=%s
Source: Picasa3.exe, 00000012.00000000.1603749985.0000000000C6A000.00000002.00000001.01000000.00000012.sdmp	String found in binary or memory: http://video.google.com/googleplayer.swf?videoUrl=%s&autoplay=yes
Source: Picasa3.exe, 00000012.00000000.1603749985.0000000000C6A000.00000002.00000001.01000000.00000012.sdmp	String found in binary or memory: http://vp.video.google.com/videodownload?version=0&secureurl=jgAAADNI5rdEqehq2NF9eKwMNPUIAAq3YqAYcNm
Source: setuppicasa39-setup.exe, 00000010.00000002.1664870898.0000000004788000.00000004.00000020.00020000.00000000.sdmp, setuppicasa39-setup.exe, 00000010.00000002.1664870898.00000000031AA000.00000004.00000020.00020000.00000000.sdmp, setuppicasa39-setup.exe, 00000010.00000002.1664870898.0000000004419000.00000004.00000020.00020000.00000000.sdmp, setuppicasa39-setup.exe, 00000010.00000002.1664870898.00000000035FF000.00000004.00000020.00020000.00000000.sdmp, GPhotos.scr, 00000011.00000002.1554998935.0000000002750000.00000004.00000020.00020000.00000000.sdmp, GPhotos.scr, 00000011.00000000.1542724484.000000000062E000.00000002.00000001.01000000.0000000F.sdmp, Picasa3.exe, 00000012.00000000.1603749985.0000000000C6A000.00000002.00000001.01000000.00000012.sdmp, Picasa3.exe, 00000014.00000002.2482072226.0000000002EAA000.00000004.00000020.00020000.00000000.sdmp, PicasaPhotoViewer.exe, 00000015.00000000.1692209976.000000000070D000.00000002.00000001.01000000.00000019.sdmp, PicasaPhotoViewer.exe, 00000015.00000003.1775225286.0000000002848000.00000004.00000020.00020000.00000000.sdmp, PicasaPhotoViewer.exe, 00000015.00000003.1770457054.0000000002847000.00000004.00000020.00020000.00000000.sdmp, PicasaPhotoViewer.exe, 00000015.00000003.1774341456.0000000002847000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.aiim.org/pdfa/ns/extension/
Source: Picasa3.exe, 00000014.00000002.2482072226.0000000002EAA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.aiim.org/pdfa/ns/extension/#6
Source: GPhotos.scr, 00000011.00000002.1554998935.0000000002750000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.aiim.org/pdfa/ns/extension/rceRef#
Source: setuppicasa39-setup.exe, 00000010.00000002.1664870898.0000000004788000.00000004.00000020.00020000.00000000.sdmp, setuppicasa39-setup.exe, 00000010.00000002.1664870898.00000000031AA000.00000004.00000020.00020000.00000000.sdmp, setuppicasa39-setup.exe, 00000010.00000002.1664870898.0000000004419000.00000004.00000020.00020000.00000000.sdmp, setuppicasa39-setup.exe, 00000010.00000002.1664870898.00000000035FF000.00000004.00000020.00020000.00000000.sdmp, GPhotos.scr, 00000011.00000002.1554998935.0000000002750000.00000004.00000020.00020000.00000000.sdmp, GPhotos.scr, 00000011.00000000.1542724484.000000000062E000.00000002.00000001.01000000.0000000F.sdmp, Picasa3.exe, 00000012.00000000.1603749985.0000000000C6A000.00000002.00000001.01000000.00000012.sdmp, Picasa3.exe, 00000014.00000002.2482072226.0000000002EAA000.00000004.00000020.00020000.00000000.sdmp, PicasaPhotoViewer.exe, 00000015.00000003.1768334402.000000000284E000.00000004.00000020.00020000.00000000.sdmp, PicasaPhotoViewer.exe, 00000015.00000002.1779527117.0000000002854000.00000004.00000020.00020000.00000000.sdmp, PicasaPhotoViewer.exe, 00000015.00000000.1692209976.000000000070D000.00000002.00000001.01000000.00000019.sdmp	String found in binary or memory: http://www.aiim.org/pdfa/ns/field#
Source: GPhotos.scr, 00000011.00000002.1554998935.0000000002750000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.aiim.org/pdfa/ns/field#ersion#
Source: Picasa3.exe, 00000014.00000002.2482072226.0000000002EAA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.aiim.org/pdfa/ns/field#y#festItem#
Source: GPhotos.scr, 00000011.00000002.1554998935.0000000002750000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.aiim.org/pdfa/ns/field#y#mlns/o
Source: setuppicasa39-setup.exe, 00000010.00000002.1664870898.0000000004788000.00000004.00000020.00020000.00000000.sdmp, setuppicasa39-setup.exe, 00000010.00000002.1664870898.00000000031AA000.00000004.00000020.00020000.00000000.sdmp, setuppicasa39-setup.exe, 00000010.00000002.1664870898.0000000004419000.00000004.00000020.00020000.00000000.sdmp, setuppicasa39-setup.exe, 00000010.00000002.1664870898.00000000035FF000.00000004.00000020.00020000.00000000.sdmp, GPhotos.scr, 00000011.00000002.1554998935.0000000002750000.00000004.00000020.00020000.00000000.sdmp, GPhotos.scr, 00000011.00000000.1542724484.000000000062E000.00000002.00000001.01000000.0000000F.sdmp, Picasa3.exe, 00000012.00000000.1603749985.0000000000C6A000.00000002.00000001.01000000.00000012.sdmp, Picasa3.exe, 00000014.00000002.2482072226.0000000002EAA000.00000004.00000020.00020000.00000000.sdmp, PicasaPhotoViewer.exe, 00000015.00000000.1692209976.000000000070D000.00000002.00000001.01000000.00000019.sdmp, PicasaPhotoViewer.exe, 00000015.00000003.1775225286.0000000002848000.00000004.00000020.00020000.00000000.sdmp, PicasaPhotoViewer.exe, 00000015.00000003.1770457054.0000000002847000.00000004.00000020.00020000.00000000.sdmp, PicasaPhotoViewer.exe, 00000015.00000003.1774341456.0000000002847000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.aiim.org/pdfa/ns/id/
Source: GPhotos.scr, 00000011.00000002.1554998935.0000000002750000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.aiim.org/pdfa/ns/id/&#W
Source: Picasa3.exe, 00000014.00000002.2482072226.0000000002EAA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.aiim.org/pdfa/ns/id/9
Source: setuppicasa39-setup.exe, 00000010.00000002.1664870898.0000000004788000.00000004.00000020.00020000.00000000.sdmp, setuppicasa39-setup.exe, 00000010.00000002.1664870898.00000000031AA000.00000004.00000020.00020000.00000000.sdmp, setuppicasa39-setup.exe, 00000010.00000002.1664870898.0000000004419000.00000004.00000020.00020000.00000000.sdmp, setuppicasa39-setup.exe, 00000010.00000002.1664870898.00000000035FF000.00000004.00000020.00020000.00000000.sdmp, GPhotos.scr, 00000011.00000002.1554998935.0000000002750000.00000004.00000020.00020000.00000000.sdmp, GPhotos.scr, 00000011.00000000.1542724484.000000000062E000.00000002.00000001.01000000.0000000F.sdmp, Picasa3.exe, 00000012.00000000.1603749985.0000000000C6A000.00000002.00000001.01000000.00000012.sdmp, Picasa3.exe, 00000014.00000002.2482072226.0000000002EAA000.00000004.00000020.00020000.00000000.sdmp, PicasaPhotoViewer.exe, 00000015.00000003.1768334402.000000000284E000.00000004.00000020.00020000.00000000.sdmp, PicasaPhotoViewer.exe, 00000015.00000002.1779527117.0000000002854000.00000004.00000020.00020000.00000000.sdmp, PicasaPhotoViewer.exe, 00000015.00000000.1692209976.000000000070D000.00000002.00000001.01000000.00000019.sdmp	String found in binary or memory: http://www.aiim.org/pdfa/ns/property#
Source: GPhotos.scr, 00000011.00000002.1554998935.0000000002750000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.aiim.org/pdfa/ns/property#festItem#
Source: GPhotos.scr, 00000011.00000002.1554998935.0000000002750000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.aiim.org/pdfa/ns/property#mlns/
Source: Picasa3.exe, 00000014.00000002.2482072226.0000000002EAA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.aiim.org/pdfa/ns/property#mlns/m#_6
Source: setuppicasa39-setup.exe, 00000010.00000002.1664870898.0000000004788000.00000004.00000020.00020000.00000000.sdmp, setuppicasa39-setup.exe, 00000010.00000002.1664870898.00000000031AA000.00000004.00000020.00020000.00000000.sdmp, setuppicasa39-setup.exe, 00000010.00000002.1664870898.0000000004419000.00000004.00000020.00020000.00000000.sdmp, setuppicasa39-setup.exe, 00000010.00000002.1664870898.00000000035FF000.00000004.00000020.00020000.00000000.sdmp, GPhotos.scr, 00000011.00000002.1554998935.0000000002750000.00000004.00000020.00020000.00000000.sdmp, GPhotos.scr, 00000011.00000000.1542724484.000000000062E000.00000002.00000001.01000000.0000000F.sdmp, Picasa3.exe, 00000012.00000000.1603749985.0000000000C6A000.00000002.00000001.01000000.00000012.sdmp, Picasa3.exe, 00000014.00000002.2482072226.0000000002EAA000.00000004.00000020.00020000.00000000.sdmp, PicasaPhotoViewer.exe, 00000015.00000003.1768334402.000000000284E000.00000004.00000020.00020000.00000000.sdmp, PicasaPhotoViewer.exe, 00000015.00000002.1779527117.0000000002854000.00000004.00000020.00020000.00000000.sdmp, PicasaPhotoViewer.exe, 00000015.00000000.1692209976.000000000070D000.00000002.00000001.01000000.00000019.sdmp	String found in binary or memory: http://www.aiim.org/pdfa/ns/schema#
Source: GPhotos.scr, 00000011.00000002.1554998935.0000000002750000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.aiim.org/pdfa/ns/schema#nifestItem#
Source: Picasa3.exe, 00000014.00000002.2482072226.0000000002EAA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.aiim.org/pdfa/ns/schema#ual/1.0/
Source: setuppicasa39-setup.exe, 00000010.00000002.1664870898.0000000004788000.00000004.00000020.00020000.00000000.sdmp, setuppicasa39-setup.exe, 00000010.00000002.1664870898.00000000031AA000.00000004.00000020.00020000.00000000.sdmp, setuppicasa39-setup.exe, 00000010.00000002.1664870898.0000000004419000.00000004.00000020.00020000.00000000.sdmp, setuppicasa39-setup.exe, 00000010.00000002.1664870898.00000000035FF000.00000004.00000020.00020000.00000000.sdmp, GPhotos.scr, 00000011.00000002.1554998935.0000000002750000.00000004.00000020.00020000.00000000.sdmp, GPhotos.scr, 00000011.00000000.1542724484.000000000062E000.00000002.00000001.01000000.0000000F.sdmp, Picasa3.exe, 00000012.00000000.1603749985.0000000000C6A000.00000002.00000001.01000000.00000012.sdmp, Picasa3.exe, 00000014.00000002.2482072226.0000000002EAA000.00000004.00000020.00020000.00000000.sdmp, PicasaPhotoViewer.exe, 00000015.00000003.1768334402.000000000284E000.00000004.00000020.00020000.00000000.sdmp, PicasaPhotoViewer.exe, 00000015.00000002.1779527117.0000000002854000.00000004.00000020.00020000.00000000.sdmp, PicasaPhotoViewer.exe, 00000015.00000000.1692209976.000000000070D000.00000002.00000001.01000000.00000019.sdmp	String found in binary or memory: http://www.aiim.org/pdfa/ns/type#
Source: GPhotos.scr, 00000011.00000002.1554998935.0000000002750000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.aiim.org/pdfa/ns/type#ManifestItem#
Source: GPhotos.scr, 00000011.00000002.1554998935.0000000002750000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.aiim.org/pdfa/ns/type#ty#
Source: Picasa3.exe, 00000014.00000002.2482072226.0000000002EAA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.aiim.org/pdfa/ns/type#ty#mlns/
Source: setuppicasa39-setup.exe, 00000010.00000002.1664870898.0000000004749000.00000004.00000020.00020000.00000000.sdmp, setuppicasa39-setup.exe, 00000010.00000002.1664870898.0000000004788000.00000004.00000020.00020000.00000000.sdmp, setuppicasa39-setup.exe, 00000010.00000002.1664870898.000000000467E000.00000004.00000020.00020000.00000000.sdmp, setuppicasa39-setup.exe, 00000010.00000002.1664870898.00000000029F6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.apple.com/DTDs/PropertyList-1.0.dtd
Source: Picasa3.exe, 00000014.00000002.2593399186.0000000007223000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.blogger.com/atom/ns#
Source: Picasa3.exe, 00000014.00000002.2506191744.0000000004241000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.blogger.com/feeds/1456569655786168306/posts/default
Source: Picasa3.exe, 00000014.00000002.2593399186.0000000007223000.00000004.00000020.00020000.00000000.sdmp, Picasa3.exe, 00000014.00000002.2589400232.0000000007039000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.blogger.com/feeds/1456569655786168306/posts/default/1237605142260003533
Source: Picasa3.exe, 00000014.00000002.2593399186.0000000007223000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.blogger.com/feeds/1456569655786168306/posts/default/1272700194270571942
Source: Picasa3.exe, 00000014.00000002.2593399186.0000000007223000.00000004.00000020.00020000.00000000.sdmp, Picasa3.exe, 00000014.00000002.2589400232.0000000007039000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.blogger.com/feeds/1456569655786168306/posts/default/2231948156028307071
Source: Picasa3.exe, 00000014.00000002.2593399186.0000000007223000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.blogger.com/feeds/1456569655786168306/posts/default/3576455443803502313
Source: Picasa3.exe, 00000014.00000002.2593399186.0000000007223000.00000004.00000020.00020000.00000000.sdmp, Picasa3.exe, 00000014.00000002.2589400232.0000000007039000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.blogger.com/feeds/1456569655786168306/posts/default/6597548198970830433
Source: Picasa3.exe, 00000014.00000002.2593399186.0000000007223000.00000004.00000020.00020000.00000000.sdmp, Picasa3.exe, 00000014.00000002.2482072226.0000000002E7B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.blogger.com/profile/00823187511285450623
Source: Picasa3.exe, 00000014.00000002.2593399186.0000000007223000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.blogger.com/styles/atom.css
Source: setuppicasa39-setup.exe, 00000010.00000002.1664870898.00000000031AA000.00000004.00000020.00020000.00000000.sdmp, Picasa3.exe, 00000012.00000000.1603749985.0000000000C6A000.00000002.00000001.01000000.00000012.sdmp, PicasaPhotoViewer.exe, 00000015.00000000.1692209976.000000000070D000.00000002.00000001.01000000.00000019.sdmp	String found in binary or memory: http://www.georss.org/georss
Source: Picasa3.exe, 00000012.00000000.1603749985.0000000000C6A000.00000002.00000001.01000000.00000012.sdmp	String found in binary or memory: http://www.georss.org/georssxmlns:georsshttp://www.opengis.net/gmlxmlns:gmlhttp://schemas.google.com
Source: setuppicasa39-setup.exe, 00000010.00000002.1664870898.0000000003831000.00000004.00000020.00020000.00000000.sdmp, Picasa3.exe, 00000012.00000000.1603749985.0000000000C6A000.00000002.00000001.01000000.00000012.sdmp, Picasa3.exe, 00000014.00000002.2599824731.000000001000C000.00000002.00000001.01000000.00000014.sdmp	String found in binary or memory: http://www.google.com
Source: Picasa3.exe, 00000012.00000000.1603749985.0000000000C6A000.00000002.00000001.01000000.00000012.sdmp, Picasa3.exe, 00000014.00000002.2506191744.000000000417F000.00000004.00000020.00020000.00000000.sdmp, Picasa3.exe, 00000014.00000002.2506191744.0000000004241000.00000004.00000020.00020000.00000000.sdmp, Picasa3.exe, 00000014.00000002.2593399186.0000000007223000.00000004.00000020.00020000.00000000.sdmp, Picasa3.exe, 00000014.00000002.2593399186.000000000716B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.google.com/
Source: Picasa3.exe, 00000012.00000000.1603749985.0000000000C6A000.00000002.00000001.01000000.00000012.sdmp	String found in binary or memory: http://www.google.com/You
Source: Picasa3.exe, 00000012.00000000.1603749985.0000000000C6A000.00000002.00000001.01000000.00000012.sdmp	String found in binary or memory: http://www.google.com/intl/%s/privacypolicy.html
Source: setuppicasa39-setup.exe, 00000010.00000002.1664870898.000000000467E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.google.com/picasa
Source: setuppicasa39-setup.exe, 00000010.00000002.1664870898.0000000004788000.00000004.00000020.00020000.00000000.sdmp, Picasa3.exe, 00000012.00000000.1603749985.0000000000C6A000.00000002.00000001.01000000.00000012.sdmp	String found in binary or memory: http://www.google.com/privacypolicy.html
Source: setuppicasa39-setup.exe, setuppicasa39-setup.exe, 00000010.00000002.1704699696.0000000004CA3000.00000002.00000001.01000000.0000000C.sdmp	String found in binary or memory: http://www.google.com/search?q=
Source: Picasa3.exe, 00000014.00000002.2593399186.0000000007223000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.google.com/support/forum/p/Picasa">our
Source: Picasa3.exe, 00000014.00000002.2593399186.0000000007244000.00000004.00000020.00020000.00000000.sdmp, Picasa3.exe, 00000014.00000002.2506191744.0000000004241000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.google.com/support/forum/p/Picasa?hl=en
Source: Picasa3.exe, 00000014.00000002.2593399186.0000000007223000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.google.com/support/forum/p/Picasa?hl=en"><span
Source: Picasa3.exe, 00000014.00000002.2599824731.0000000010A0C000.00000002.00000001.01000000.00000014.sdmp	String found in binary or memory: http://www.google.com/support/forum/p/picasa?hl=pt_PT
Source: Picasa3.exe, 00000012.00000000.1603749985.0000000000C6A000.00000002.00000001.01000000.00000012.sdmp	String found in binary or memory: http://www.google.com/support/picasa/?p=picasa_get_started
Source: Picasa3.exe, 00000012.00000000.1603749985.0000000000C6A000.00000002.00000001.01000000.00000012.sdmp	String found in binary or memory: http://www.google.com/support/picasa/?p=picasa_get_startedUploadOptionMenu::usesize800800
Source: setuppicasa39-setup.exe, 00000010.00000002.1664870898.00000000031AA000.00000004.00000020.00020000.00000000.sdmp, Picasa3.exe, 00000012.00000000.1603749985.0000000000C6A000.00000002.00000001.01000000.00000012.sdmp, Picasa3.exe, 00000014.00000002.2596878839.000000000862D000.00000004.00000010.00020000.00000000.sdmp, PicasaPhotoViewer.exe, 00000015.00000000.1692209976.000000000070D000.00000002.00000001.01000000.00000019.sdmp	String found in binary or memory: http://www.google.com/update2/request
Source: Picasa3.exe, 00000012.00000000.1603749985.0000000000C6A000.00000002.00000001.01000000.00000012.sdmp	String found in binary or memory: http://www.google.com/video/uploader/form/videoonline
Source: Picasa3.exe, 00000012.00000000.1603749985.0000000000C6A000.00000002.00000001.01000000.00000012.sdmp	String found in binary or memory: http://www.google.com/video/uploader/form/videoonlinesessionStatusadditionalInfouploader_service.Goo
Source: Picasa3.exe, 00000012.00000000.1603749985.0000000000C6A000.00000002.00000001.01000000.00000012.sdmp	String found in binary or memory: http://www.google.comLastCommentsPubDateLastActivityPubDateCActivityBackground
Source: Picasa3.exe, 00000014.00000002.2599824731.0000000010A0C000.00000002.00000001.01000000.00000014.sdmp	String found in binary or memory: http://www.google.ro/policies/privacy/
Source: Picasa3.exe, 00000014.00000002.2599824731.0000000010A0C000.00000002.00000001.01000000.00000014.sdmp	String found in binary or memory: http://www.google.ro/policies/terms/
Source: Picasa3.exe, 00000012.00000000.1603749985.0000000000C6A000.00000002.00000001.01000000.00000012.sdmp	String found in binary or memory: http://www.macromedia.com/shockwave/download/index.cgi?P1_Prod_Version=ShockwaveFlash
Source: setuppicasa39-setup.exe, 00000010.00000002.1664870898.00000000031AA000.00000004.00000020.00020000.00000000.sdmp, setuppicasa39-setup.exe, 00000010.00000002.1664870898.0000000004419000.00000004.00000020.00020000.00000000.sdmp, setuppicasa39-setup.exe, 00000010.00000002.1664870898.00000000035FF000.00000004.00000020.00020000.00000000.sdmp, GPhotos.scr, 00000011.00000002.1554998935.0000000002750000.00000004.00000020.00020000.00000000.sdmp, GPhotos.scr, 00000011.00000000.1542724484.000000000062E000.00000002.00000001.01000000.0000000F.sdmp, Picasa3.exe, 00000012.00000000.1603749985.0000000000C6A000.00000002.00000001.01000000.00000012.sdmp, Picasa3.exe, 00000014.00000002.2482072226.0000000002EAA000.00000004.00000020.00020000.00000000.sdmp, PicasaPhotoViewer.exe, 00000015.00000003.1768334402.000000000284E000.00000004.00000020.00020000.00000000.sdmp, PicasaPhotoViewer.exe, 00000015.00000002.1779527117.0000000002854000.00000004.00000020.00020000.00000000.sdmp, PicasaPhotoViewer.exe, 00000015.00000000.1692209976.000000000070D000.00000002.00000001.01000000.00000019.sdmp	String found in binary or memory: http://www.metadataworkinggroup.com/schemas/regions/
Source: setuppicasa39-setup.exe, 00000010.00000002.1664870898.0000000004788000.00000004.00000020.00020000.00000000.sdmp, setuppicasa39-setup.exe, 00000010.00000002.1664870898.00000000031AA000.00000004.00000020.00020000.00000000.sdmp, setuppicasa39-setup.exe, 00000010.00000002.1664870898.0000000004419000.00000004.00000020.00020000.00000000.sdmp, setuppicasa39-setup.exe, 00000010.00000002.1664870898.00000000035FF000.00000004.00000020.00020000.00000000.sdmp, GPhotos.scr, 00000011.00000002.1554998935.0000000002750000.00000004.00000020.00020000.00000000.sdmp, GPhotos.scr, 00000011.00000000.1542724484.000000000062E000.00000002.00000001.01000000.0000000F.sdmp, Picasa3.exe, 00000012.00000000.1603749985.0000000000C6A000.00000002.00000001.01000000.00000012.sdmp, Picasa3.exe, 00000014.00000002.2482072226.0000000002EAA000.00000004.00000020.00020000.00000000.sdmp, PicasaPhotoViewer.exe, 00000015.00000000.1692209976.000000000070D000.00000002.00000001.01000000.00000019.sdmp, PicasaPhotoViewer.exe, 00000015.00000003.1775225286.0000000002848000.00000004.00000020.00020000.00000000.sdmp, PicasaPhotoViewer.exe, 00000015.00000003.1770457054.0000000002847000.00000004.00000020.00020000.00000000.sdmp, PicasaPhotoViewer.exe, 00000015.00000003.1774341456.0000000002847000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.npes.org/pdfx/ns/id/
Source: setuppicasa39-setup.exe, 00000010.00000002.1664870898.00000000031AA000.00000004.00000020.00020000.00000000.sdmp, Picasa3.exe, 00000012.00000000.1603749985.0000000000C6A000.00000002.00000001.01000000.00000012.sdmp, PicasaPhotoViewer.exe, 00000015.00000000.1692209976.000000000070D000.00000002.00000001.01000000.00000019.sdmp	String found in binary or memory: http://www.opengis.net/gml
Source: Picasa3.exe, 00000012.00000000.1603749985.0000000000C6A000.00000002.00000001.01000000.00000012.sdmp	String found in binary or memory: http://www.pheed.com/pheed/
Source: Picasa3.exe, 00000012.00000000.1603749985.0000000000C6A000.00000002.00000001.01000000.00000012.sdmp	String found in binary or memory: http://www.pheed.com/pheed/xmlns:photohttp://search.yahoo.com/msrss/xmlns:mediahttp://picasaweb.goog
Source: Picasa3.exe, 00000014.00000002.2482072226.0000000002E92000.00000004.00000020.00020000.00000000.sdmp, Picasa3.exe, 00000014.00000002.2599824731.000000001140C000.00000002.00000001.01000000.00000014.sdmp, Picasa3.exe, 00000014.00000002.2599824731.0000000010A0C000.00000002.00000001.01000000.00000014.sdmp, Picasa3.exe, 00000014.00000003.1626203204.0000000003FB3000.00000004.00000020.00020000.00000000.sdmp, Picasa3.exe, 00000014.00000002.2599824731.000000001000C000.00000002.00000001.01000000.00000014.sdmp	String found in binary or memory: http://www.picasa.com/contact/feedback.php
Source: Picasa3.exe, 00000012.00000000.1604678624.0000000000DF8000.00000002.00000001.01000000.00000012.sdmp, Picasa3.exe, 00000014.00000003.1626531844.00000000040E2000.00000004.00000020.00020000.00000000.sdmp, Picasa3.exe, 00000014.00000002.2482072226.0000000002E92000.00000004.00000020.00020000.00000000.sdmp, Picasa3.exe, 00000014.00000002.2599824731.000000001140C000.00000002.00000001.01000000.00000014.sdmp, Picasa3.exe, 00000014.00000002.2599824731.0000000010A0C000.00000002.00000001.01000000.00000014.sdmp, Picasa3.exe, 00000014.00000003.1626203204.0000000003FB3000.00000004.00000020.00020000.00000000.sdmp, Picasa3.exe, 00000014.00000002.2599824731.000000001000C000.00000002.00000001.01000000.00000014.sdmp	String found in binary or memory: http://www.picasa.com/support/
Source: Picasa3.exe, 00000014.00000002.2482072226.0000000002E92000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.picasa.com/support/n
Source: Picasa3.exe, 00000012.00000000.1603749985.0000000000C6A000.00000002.00000001.01000000.00000012.sdmp	String found in binary or memory: http://www.picnik.com/service/
Source: Picasa3.exe, 00000012.00000000.1603749985.0000000000C6A000.00000002.00000001.01000000.00000012.sdmp	String found in binary or memory: http://www.picnik.com/service/_ckeditpanel/picnikbasePicnikWarnDon
Source: setuppicasa39-setup.exe, 00000010.00000002.1664870898.0000000003831000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.stereopsis.com/bg.gif);
Source: Picasa3.exe, 00000012.00000000.1603749985.0000000000C40000.00000002.00000001.01000000.00000012.sdmp, PicasaPhotoViewer.exe, 00000015.00000000.1692209976.00000000006EA000.00000002.00000001.01000000.00000019.sdmp	String found in binary or memory: http://www.winimage.com/zLibDll
Source: setuppicasa39-setup.exe, 00000010.00000002.1664870898.00000000032A7000.00000004.00000020.00020000.00000000.sdmp, GPhotos.scr, 00000011.00000000.1542724484.0000000000610000.00000002.00000001.01000000.0000000F.sdmp	String found in binary or memory: http://www.winimage.com/zLibDlll
Source: Picasa3.exe, 00000014.00000002.2506191744.0000000004241000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.youtube.com/v/NDKFjc3_wrk&hl=en&fs=1
Source: Picasa3.exe, 00000014.00000002.2506191744.0000000004241000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.youtube.com/v/gYO2uhrIZJ4&hl=en&fs=1
Source: Picasa3.exe, 00000014.00000002.2506191744.0000000004241000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.youtube.com/v/gYO2uhrIZJ4&hl=en&fs=1&rel=0&hd=1
Source: Picasa3.exe, 00000014.00000002.2593399186.0000000007223000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.youtube.com/v/rskC6c_5L1M&amp;hl=en&amp;fs=1"
Source: Picasa3.exe, 00000014.00000002.2593399186.0000000007223000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.youtube.com/v/rskC6c_5L1M&amp;hl=en&amp;fs=1"><param
Source: Picasa3.exe, 00000014.00000002.2506191744.000000000417F000.00000004.00000020.00020000.00000000.sdmp, Picasa3.exe, 00000014.00000002.2593399186.000000000716B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.youtube.com/v/rskC6c_5L1M&hl=en&fs=1
Source: Picasa3.exe, 00000012.00000000.1603749985.0000000000C6A000.00000002.00000001.01000000.00000012.sdmp, Picasa3.exe, 00000014.00000003.1626531844.00000000040E2000.00000004.00000020.00020000.00000000.sdmp, Picasa3.exe, 00000014.00000002.2482072226.0000000002E92000.00000004.00000020.00020000.00000000.sdmp, Picasa3.exe, 00000014.00000002.2599824731.000000001140C000.00000002.00000001.01000000.00000014.sdmp, Picasa3.exe, 00000014.00000002.2599824731.0000000010A0C000.00000002.00000001.01000000.00000014.sdmp, Picasa3.exe, 00000014.00000003.1626203204.0000000003FB3000.00000004.00000020.00020000.00000000.sdmp, Picasa3.exe, 00000014.00000002.2599824731.000000001000C000.00000002.00000001.01000000.00000014.sdmp	String found in binary or memory: http://youtube.com/my_videos
Source: Picasa3.exe, 00000014.00000002.2599824731.000000001140C000.00000002.00000001.01000000.00000014.sdmp	String found in binary or memory: http://youtube.com/my_videos?hl=vi
Source: Picasa3.exe, 00000012.00000000.1603749985.0000000000C6A000.00000002.00000001.01000000.00000012.sdmp	String found in binary or memory: http://youtube.com/my_videosCYouTubeUploader::urlmyvideosThere
Source: Picasa3.exe, 00000014.00000002.2599824731.0000000010A0C000.00000002.00000001.01000000.00000014.sdmp	String found in binary or memory: http://youtube.com/sajat_videoklipek
Source: setuppicasa39-setup.exe, 00000010.00000002.1664870898.00000000031AA000.00000004.00000020.00020000.00000000.sdmp, setuppicasa39-setup.exe, 00000010.00000002.1664870898.00000000035FF000.00000004.00000020.00020000.00000000.sdmp, GPhotos.scr, 00000011.00000000.1542724484.000000000062E000.00000002.00000001.01000000.0000000F.sdmp, Picasa3.exe, 00000012.00000000.1603749985.0000000000C6A000.00000002.00000001.01000000.00000012.sdmp, PicasaPhotoViewer.exe, 00000015.00000000.1692209976.000000000070D000.00000002.00000001.01000000.00000019.sdmp	String found in binary or memory: https://accounts.google.com/o/oauth2/
Source: setuppicasa39-setup.exe, 00000010.00000002.1664870898.00000000035FF000.00000004.00000020.00020000.00000000.sdmp, GPhotos.scr, 00000011.00000000.1542724484.000000000062E000.00000002.00000001.01000000.0000000F.sdmp, Picasa3.exe, 00000012.00000000.1603749985.0000000000C6A000.00000002.00000001.01000000.00000012.sdmp	String found in binary or memory: https://accounts.google.com/o/oauth2/962788293942.apps.googleusercontent.comUigxU4n_nVPLcipw7lmKSWRn
Source: Picasa3.exe, 00000014.00000002.2593399186.0000000007223000.00000004.00000020.00020000.00000000.sdmp, Picasa3.exe, 00000014.00000002.2593399186.000000000716B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhdYMorlhvaoU2vdx-Au0-wABULVhkz6vqRku4godi
Source: setuppicasa39-setup.exe, 00000010.00000002.1664870898.0000000003831000.00000004.00000020.00020000.00000000.sdmp, Picasa3.exe, 00000014.00000002.2563942835.0000000006BBD000.00000004.00000020.00020000.00000000.sdmp, Picasa3.exe, 00000014.00000002.2506191744.0000000004114000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://client4.google.com/providers/printers2.html
Source: setuppicasa39-setup.exe, 00000010.00000002.1664870898.0000000003831000.00000004.00000020.00020000.00000000.sdmp, Picasa3.exe, 00000014.00000002.2563942835.0000000006BBD000.00000004.00000020.00020000.00000000.sdmp, Picasa3.exe, 00000014.00000002.2506191744.0000000004114000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://client4.google.com/providers/xml
Source: setuppicasa39-setup.exe, 00000010.00000002.1664870898.0000000004749000.00000004.00000020.00020000.00000000.sdmp, setuppicasa39-setup.exe, 00000010.00000002.1664870898.000000000467E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://clients2.google.com/cr
Source: setuppicasa39-setup.exe, 00000010.00000002.1664870898.00000000031AA000.00000004.00000020.00020000.00000000.sdmp, setuppicasa39-setup.exe, 00000010.00000002.1664870898.0000000004419000.00000004.00000020.00020000.00000000.sdmp, setuppicasa39-setup.exe, 00000010.00000002.1664870898.00000000035FF000.00000004.00000020.00020000.00000000.sdmp, GPhotos.scr, 00000011.00000000.1542724484.000000000062E000.00000002.00000001.01000000.0000000F.sdmp, Picasa3.exe, 00000012.00000000.1603749985.0000000000C6A000.00000002.00000001.01000000.00000012.sdmp, PicasaPhotoViewer.exe, 00000015.00000000.1692209976.000000000070D000.00000002.00000001.01000000.00000019.sdmp	String found in binary or memory: https://clients2.google.com/cr/report
Source: setuppicasa39-setup.exe, 00000010.00000002.1664870898.00000000031AA000.00000004.00000020.00020000.00000000.sdmp, setuppicasa39-setup.exe, 00000010.00000002.1664870898.0000000004419000.00000004.00000020.00020000.00000000.sdmp, setuppicasa39-setup.exe, 00000010.00000002.1664870898.00000000035FF000.00000004.00000020.00020000.00000000.sdmp, GPhotos.scr, 00000011.00000000.1542724484.000000000062E000.00000002.00000001.01000000.0000000F.sdmp, Picasa3.exe, 00000012.00000000.1603749985.0000000000C6A000.00000002.00000001.01000000.00000012.sdmp, PicasaPhotoViewer.exe, 00000015.00000000.1692209976.000000000070D000.00000002.00000001.01000000.00000019.sdmp	String found in binary or memory: https://clients2.google.com/cr/reportPicasaLastCrashDump
Source: setuppicasa39-setup.exe, 00000010.00000002.1664870898.0000000004749000.00000004.00000020.00020000.00000000.sdmp, setuppicasa39-setup.exe, 00000010.00000002.1664870898.000000000467E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://clients2.google.com/cr3600200000YESTRUE1NOFALSE0Could
Source: Picasa3.exe, 00000014.00000003.2144975853.000000000123E000.00000004.00000020.00020000.00000000.sdmp, Picasa3.exe, 00000014.00000003.2141243034.0000000001221000.00000004.00000020.00020000.00000000.sdmp, Picasa3.exe, 00000014.00000002.2467205779.000000000123E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://csp.withgoogle.com/csp/clientupdate-aus/1
Source: Picasa3.exe, 00000014.00000002.2593399186.0000000007223000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://img1.blogblog.com/img/b16-rounded.gif
Source: Picasa3.exe, 00000014.00000002.2593399186.0000000007223000.00000004.00000020.00020000.00000000.sdmp, Picasa3.exe, 00000014.00000002.2593399186.000000000716B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://lh5.googleusercontent.com/torawRKsQC9zYeAfBTnwj0vDXOgZc_h0dLzbT9cuJHTARJVy8hKIualz1K6Eyxrk5N
Source: Picasa3.exe, 00000014.00000002.2593399186.0000000007223000.00000004.00000020.00020000.00000000.sdmp, Picasa3.exe, 00000014.00000002.2593399186.000000000716B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://lh6.googleusercontent.com/U1Wgkz0b0L79g0MrXkIR-u3WrLnN-6LfWpKMewRPk7cimpKgDjQOFOB8iYJlE0WMtl
Source: Picasa3.exe, 00000014.00000002.2593399186.0000000007244000.00000004.00000020.00020000.00000000.sdmp, Picasa3.exe, 00000014.00000002.2593399186.0000000007223000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://lh6.googleusercontent.com/cj7rHSEh-D7AQlIfvrTNPlz54826dAcKs41-1aVifrCkILBD5-XDZMBfl7sfLOw6oC
Source: setuppicasa39-setup.exe, 00000010.00000002.1664870898.00000000031AA000.00000004.00000020.00020000.00000000.sdmp, setuppicasa39-setup.exe, 00000010.00000002.1664870898.00000000035FF000.00000004.00000020.00020000.00000000.sdmp, GPhotos.scr, 00000011.00000000.1542724484.000000000062E000.00000002.00000001.01000000.0000000F.sdmp, Picasa3.exe, 00000012.00000000.1603749985.0000000000C6A000.00000002.00000001.01000000.00000012.sdmp, PicasaPhotoViewer.exe, 00000015.00000000.1692209976.000000000070D000.00000002.00000001.01000000.00000019.sdmp	String found in binary or memory: https://mail.google.com/
Source: Picasa3.exe, 00000012.00000000.1603749985.0000000000C6A000.00000002.00000001.01000000.00000012.sdmp	String found in binary or memory: https://mail.google.com/a/%s/?ui=pb&v=sm
Source: Picasa3.exe, 00000012.00000000.1603749985.0000000000C6A000.00000002.00000001.01000000.00000012.sdmp	String found in binary or memory: https://mail.google.com/a/%s/?ui=pb&v=smhttps://mail.google.com/mail?ui=pb&v=sm%x%x%x%x-GMAIL_ATGMAI
Source: Picasa3.exe, 00000012.00000000.1603749985.0000000000C6A000.00000002.00000001.01000000.00000012.sdmp	String found in binary or memory: https://mail.google.com/mail?ui=pb&v=sm
Source: 1a4e5ccd35a56d84281a143f831563be.exe, 0000000F.00000002.2419971867.000000000012E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://napoveda.seznam.cz/cz/smluvni-podminky/podminky-seznam-doplnky/0x00F1
Source: 1a4e5ccd35a56d84281a143f831563be.exe, 0000000F.00000002.2419971867.000000000012E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://napoveda.seznam.cz/cz/smluvni-podminky/podminky-seznam-doplnky/open
Source: Picasa3.exe, 00000014.00000002.2482072226.0000000002E92000.00000004.00000020.00020000.00000000.sdmp, Picasa3.exe, 00000014.00000002.2506191744.0000000004241000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://photos.blogger.com/picasa-post.g
Source: Picasa3.exe, 00000014.00000002.2482072226.0000000002E92000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://photos.blogger.com/picasa-post.g(s
Source: Picasa3.exe, 00000012.00000000.1603749985.0000000000C6A000.00000002.00000001.01000000.00000012.sdmp	String found in binary or memory: https://photos.google.com
Source: Picasa3.exe, 00000012.00000000.1603749985.0000000000C6A000.00000002.00000001.01000000.00000012.sdmp	String found in binary or memory: https://photos.google.com/apps
Source: Picasa3.exe, 00000012.00000000.1603749985.0000000000C6A000.00000002.00000001.01000000.00000012.sdmp	String found in binary or memory: https://photos.google.com/appslistboxcaptionpopuplistOriginal
Source: Picasa3.exe, 00000012.00000000.1603749985.0000000000C6A000.00000002.00000001.01000000.00000012.sdmp	String found in binary or memory: https://photos.google.comvideoPostTargetresumableVideoUploadUrlupgradeVideoemailRelayupdateRequiredG
Source: setuppicasa39-setup.exe, 00000010.00000002.1664870898.00000000031AA000.00000004.00000020.00020000.00000000.sdmp, setuppicasa39-setup.exe, 00000010.00000002.1664870898.00000000035FF000.00000004.00000020.00020000.00000000.sdmp, GPhotos.scr, 00000011.00000000.1542724484.000000000062E000.00000002.00000001.01000000.0000000F.sdmp, Picasa3.exe, 00000012.00000000.1603749985.0000000000C6A000.00000002.00000001.01000000.00000012.sdmp, PicasaPhotoViewer.exe, 00000015.00000000.1692209976.000000000070D000.00000002.00000001.01000000.00000019.sdmp	String found in binary or memory: https://picasaweb.google.com
Source: setuppicasa39-setup.exe, 00000010.00000002.1664870898.00000000031AA000.00000004.00000020.00020000.00000000.sdmp, setuppicasa39-setup.exe, 00000010.00000002.1664870898.00000000035FF000.00000004.00000020.00020000.00000000.sdmp, GPhotos.scr, 00000011.00000000.1542724484.000000000062E000.00000002.00000001.01000000.0000000F.sdmp, Picasa3.exe, 00000012.00000000.1603749985.0000000000C6A000.00000002.00000001.01000000.00000012.sdmp, PicasaPhotoViewer.exe, 00000015.00000000.1692209976.000000000070D000.00000002.00000001.01000000.00000019.sdmp	String found in binary or memory: https://picasaweb.google.com/c/
Source: setuppicasa39-setup.exe, 00000010.00000002.1664870898.00000000035FF000.00000004.00000020.00020000.00000000.sdmp, GPhotos.scr, 00000011.00000000.1542724484.000000000062E000.00000002.00000001.01000000.0000000F.sdmp, Picasa3.exe, 00000012.00000000.1603749985.0000000000C6A000.00000002.00000001.01000000.00000012.sdmp	String found in binary or memory: https://picasaweb.google.com/data/urls?version=1&alt=rss
Source: Picasa3.exe, 00000014.00000002.2506191744.0000000004241000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://picasaweb.google.com/data/urls?version=1&alt=rss&gl=CH
Source: setuppicasa39-setup.exe, 00000010.00000002.1664870898.00000000031AA000.00000004.00000020.00020000.00000000.sdmp, PicasaPhotoViewer.exe, 00000015.00000000.1692209976.000000000070D000.00000002.00000001.01000000.00000019.sdmp	String found in binary or memory: https://picasaweb.google.com/data/urls?version=1&alt=rssSoftware
Source: setuppicasa39-setup.exe, 00000010.00000002.1664870898.00000000031AA000.00000004.00000020.00020000.00000000.sdmp, setuppicasa39-setup.exe, 00000010.00000002.1664870898.00000000035FF000.00000004.00000020.00020000.00000000.sdmp, GPhotos.scr, 00000011.00000000.1542724484.000000000062E000.00000002.00000001.01000000.0000000F.sdmp, Picasa3.exe, 00000012.00000000.1603749985.0000000000C6A000.00000002.00000001.01000000.00000012.sdmp, PicasaPhotoViewer.exe, 00000015.00000000.1692209976.000000000070D000.00000002.00000001.01000000.00000019.sdmp	String found in binary or memory: https://picasaweb.google.com/lh/picasaSignupRedir
Source: setuppicasa39-setup.exe, 00000010.00000002.1664870898.00000000031AA000.00000004.00000020.00020000.00000000.sdmp, setuppicasa39-setup.exe, 00000010.00000002.1664870898.00000000035FF000.00000004.00000020.00020000.00000000.sdmp, GPhotos.scr, 00000011.00000000.1542724484.000000000062E000.00000002.00000001.01000000.0000000F.sdmp, Picasa3.exe, 00000012.00000000.1603749985.0000000000C6A000.00000002.00000001.01000000.00000012.sdmp, PicasaPhotoViewer.exe, 00000015.00000000.1692209976.000000000070D000.00000002.00000001.01000000.00000019.sdmp	String found in binary or memory: https://picasaweb.google.com/lh/picasaSignupRedirhttps://plus.google.com/https://www.google.com/acco
Source: setuppicasa39-setup.exe, 00000010.00000002.1664870898.00000000031AA000.00000004.00000020.00020000.00000000.sdmp, setuppicasa39-setup.exe, 00000010.00000002.1664870898.00000000035FF000.00000004.00000020.00020000.00000000.sdmp, GPhotos.scr, 00000011.00000000.1542724484.000000000062E000.00000002.00000001.01000000.0000000F.sdmp, Picasa3.exe, 00000012.00000000.1603749985.0000000000C6A000.00000002.00000001.01000000.00000012.sdmp, PicasaPhotoViewer.exe, 00000015.00000000.1692209976.000000000070D000.00000002.00000001.01000000.00000019.sdmp	String found in binary or memory: https://plus.google.com/
Source: Picasa3.exe, 00000012.00000000.1603749985.0000000000C6A000.00000002.00000001.01000000.00000012.sdmp	String found in binary or memory: https://plus.google.com/photos/%s/albums/%s
Source: Picasa3.exe, 00000012.00000000.1603749985.0000000000C6A000.00000002.00000001.01000000.00000012.sdmp	String found in binary or memory: https://plus.google.com/photos/%s/albums/%sNot
Source: setuppicasa39-setup.exe, 00000010.00000002.1664870898.0000000003831000.00000004.00000020.00020000.00000000.sdmp, Picasa3.exe, 00000014.00000002.2506191744.0000000004241000.00000004.00000020.00020000.00000000.sdmp, Picasa3.exe, 00000014.00000002.2482072226.0000000002E7B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://secure.picasa.com/support/account.php
Source: setuppicasa39-setup.exe, 00000010.00000002.1664870898.0000000003831000.00000004.00000020.00020000.00000000.sdmp, Picasa3.exe, 00000014.00000002.2506191744.0000000004241000.00000004.00000020.00020000.00000000.sdmp, Picasa3.exe, 00000014.00000002.2482072226.0000000002F0B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://secure.picasa.com/support/account.php?do=password
Source: Picasa3.exe, 00000014.00000002.2506191744.0000000004241000.00000004.00000020.00020000.00000000.sdmp, Picasa3.exe, 00000014.00000002.2599824731.000000001140C000.00000002.00000001.01000000.00000014.sdmp, Picasa3.exe, 00000014.00000002.2599824731.0000000010A0C000.00000002.00000001.01000000.00000014.sdmp, Picasa3.exe, 00000014.00000003.1626203204.0000000003FB3000.00000004.00000020.00020000.00000000.sdmp, Picasa3.exe, 00000014.00000002.2599824731.000000001000C000.00000002.00000001.01000000.00000014.sdmp, Picasa3.exe, 00000014.00000002.2482072226.0000000002E7B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://secure.picasa.com/support/register.php
Source: Picasa3.exe, 00000012.00000000.1603749985.0000000000C6A000.00000002.00000001.01000000.00000012.sdmp	String found in binary or memory: https://support.google.com/drive/?p=picasa
Source: setuppicasa39-setup.exe, 00000010.00000002.1664870898.0000000003831000.00000004.00000020.00020000.00000000.sdmp, Picasa3.exe, 00000014.00000002.2599824731.000000001000C000.00000002.00000001.01000000.00000014.sdmp	String found in binary or memory: https://support.google.com/photos/?p=storage
Source: Picasa3.exe, 00000014.00000002.2506191744.0000000004241000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://support.google.com/picasa/answer/52532?hl=en
Source: setuppicasa39-setup.exe, 00000010.00000003.1659418312.000000000067F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://support.google.com/plus/?p=gpautobackupPublisherGoogle
Source: setuppicasa39-setup.exe, 00000010.00000002.1664870898.0000000003831000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://support.google.com/plus/answer/1647509#cost
Source: Picasa3.exe, 00000012.00000000.1603749985.0000000000C6A000.00000002.00000001.01000000.00000012.sdmp	String found in binary or memory: https://uploader.picasa.com/froogle.php?q=%s
Source: Picasa3.exe, 00000012.00000000.1603749985.0000000000C6A000.00000002.00000001.01000000.00000012.sdmp	String found in binary or memory: https://uploader.picasa.com/froogle.php?q=%sthumbui/mainuipanelthumbui/acquirepanelthumbui/infowellt
Source: Picasa3.exe, 00000012.00000000.1603749985.0000000000C6A000.00000002.00000001.01000000.00000012.sdmp	String found in binary or memory: https://uploader.picasa.com/providers/php/generate.xml.php?prID=%s&country=%s
Source: Picasa3.exe, 00000012.00000000.1603749985.0000000000C6A000.00000002.00000001.01000000.00000012.sdmp	String found in binary or memory: https://uploader.picasa.com/providers/php/generate.xml.php?prID=%s&country=%sclientlanguagehttp://lo
Source: setuppicasa39-setup.exe, 00000010.00000002.1664870898.00000000031AA000.00000004.00000020.00020000.00000000.sdmp, setuppicasa39-setup.exe, 00000010.00000002.1664870898.00000000035FF000.00000004.00000020.00020000.00000000.sdmp, GPhotos.scr, 00000011.00000000.1542724484.000000000062E000.00000002.00000001.01000000.0000000F.sdmp, Picasa3.exe, 00000012.00000000.1603749985.0000000000C6A000.00000002.00000001.01000000.00000012.sdmp, PicasaPhotoViewer.exe, 00000015.00000000.1692209976.000000000070D000.00000002.00000001.01000000.00000019.sdmp	String found in binary or memory: https://www-googleapis-staging.sandbox.google.com
Source: setuppicasa39-setup.exe, 00000010.00000002.1664870898.00000000031AA000.00000004.00000020.00020000.00000000.sdmp, setuppicasa39-setup.exe, 00000010.00000002.1664870898.00000000035FF000.00000004.00000020.00020000.00000000.sdmp, GPhotos.scr, 00000011.00000000.1542724484.000000000062E000.00000002.00000001.01000000.0000000F.sdmp, Picasa3.exe, 00000012.00000000.1603749985.0000000000C6A000.00000002.00000001.01000000.00000012.sdmp, PicasaPhotoViewer.exe, 00000015.00000000.1692209976.000000000070D000.00000002.00000001.01000000.00000019.sdmp	String found in binary or memory: https://www-googleapis-test.sandbox.google.com
Source: setuppicasa39-setup.exe, 00000010.00000002.1664870898.00000000031AA000.00000004.00000020.00020000.00000000.sdmp, setuppicasa39-setup.exe, 00000010.00000002.1664870898.00000000035FF000.00000004.00000020.00020000.00000000.sdmp, GPhotos.scr, 00000011.00000000.1542724484.000000000062E000.00000002.00000001.01000000.0000000F.sdmp, Picasa3.exe, 00000012.00000000.1603749985.0000000000C6A000.00000002.00000001.01000000.00000012.sdmp, PicasaPhotoViewer.exe, 00000015.00000000.1692209976.000000000070D000.00000002.00000001.01000000.00000019.sdmp	String found in binary or memory: https://www-googleapis-test.sandbox.google.comhttps://www-googleapis-staging.sandbox.google.comhttps
Source: setuppicasa39-setup.exe, 00000010.00000002.1664870898.0000000003831000.00000004.00000020.00020000.00000000.sdmp, setuppicasa39-setup.exe, 00000010.00000002.1664870898.00000000031AA000.00000004.00000020.00020000.00000000.sdmp, setuppicasa39-setup.exe, 00000010.00000002.1664870898.00000000035FF000.00000004.00000020.00020000.00000000.sdmp, GPhotos.scr, 00000011.00000000.1542724484.000000000062E000.00000002.00000001.01000000.0000000F.sdmp, Picasa3.exe, 00000012.00000000.1603749985.0000000000C6A000.00000002.00000001.01000000.00000012.sdmp, Picasa3.exe, 00000014.00000002.2506191744.0000000004241000.00000004.00000020.00020000.00000000.sdmp, Picasa3.exe, 00000014.00000002.2482072226.0000000002EAA000.00000004.00000020.00020000.00000000.sdmp, PicasaPhotoViewer.exe, 00000015.00000000.1692209976.000000000070D000.00000002.00000001.01000000.00000019.sdmp	String found in binary or memory: https://www.google.com
Source: setuppicasa39-setup.exe, 00000010.00000002.1664870898.00000000032A7000.00000004.00000020.00020000.00000000.sdmp, Picasa3.exe, 00000014.00000002.2599824731.000000001140C000.00000002.00000001.01000000.00000014.sdmp, PicasaPhotoViewer.exe, 00000015.00000000.1697683801.0000000000864000.00000002.00000001.01000000.00000019.sdmp	String found in binary or memory: https://www.google.com.tr/accounts/ForgotPasswd
Source: setuppicasa39-setup.exe, 00000010.00000002.1664870898.00000000031AA000.00000004.00000020.00020000.00000000.sdmp, Picasa3.exe, 00000012.00000000.1603749985.0000000000C6A000.00000002.00000001.01000000.00000012.sdmp, PicasaPhotoViewer.exe, 00000015.00000000.1692209976.000000000070D000.00000002.00000001.01000000.00000019.sdmp	String found in binary or memory: https://www.google.com/
Source: setuppicasa39-setup.exe, 00000010.00000002.1664870898.00000000031AA000.00000004.00000020.00020000.00000000.sdmp, PicasaPhotoViewer.exe, 00000015.00000000.1692209976.000000000070D000.00000002.00000001.01000000.00000019.sdmp	String found in binary or memory: https://www.google.com/Working
Source: setuppicasa39-setup.exe, 00000010.00000002.1664870898.00000000032A7000.00000004.00000020.00020000.00000000.sdmp, Picasa3.exe, 00000014.00000003.1626531844.00000000040E2000.00000004.00000020.00020000.00000000.sdmp, Picasa3.exe, 00000014.00000002.2599824731.000000001140C000.00000002.00000001.01000000.00000014.sdmp, Picasa3.exe, 00000014.00000002.2599824731.0000000010A0C000.00000002.00000001.01000000.00000014.sdmp, Picasa3.exe, 00000014.00000003.1626203204.0000000003FB3000.00000004.00000020.00020000.00000000.sdmp, Picasa3.exe, 00000014.00000002.2599824731.000000001000C000.00000002.00000001.01000000.00000014.sdmp, Picasa3.exe, 00000014.00000002.2482072226.0000000002E7B000.00000004.00000020.00020000.00000000.sdmp, PicasaPhotoViewer.exe, 00000015.00000003.1768334402.000000000284E000.00000004.00000020.00020000.00000000.sdmp, PicasaPhotoViewer.exe, 00000015.00000003.1770457054.0000000002831000.00000004.00000020.00020000.00000000.sdmp, PicasaPhotoViewer.exe, 00000015.00000003.1774735111.0000000002835000.00000004.00000020.00020000.00000000.sdmp, PicasaPhotoViewer.exe, 00000015.00000000.1697683801.0000000000864000.00000002.00000001.01000000.00000019.sdmp, PicasaPhotoViewer.exe, 00000015.00000003.1775225286.000000000283A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/accounts/ForgotPasswd
Source: setuppicasa39-setup.exe, 00000010.00000002.1664870898.00000000032A7000.00000004.00000020.00020000.00000000.sdmp, Picasa3.exe, 00000014.00000002.2599824731.0000000010A0C000.00000002.00000001.01000000.00000014.sdmp, PicasaPhotoViewer.exe, 00000015.00000000.1697683801.0000000000864000.00000002.00000001.01000000.00000019.sdmp	String found in binary or memory: https://www.google.com/accounts/ForgotPasswd?hl=pt_BR
Source: setuppicasa39-setup.exe, 00000010.00000002.1664870898.00000000031AA000.00000004.00000020.00020000.00000000.sdmp, setuppicasa39-setup.exe, 00000010.00000002.1664870898.00000000035FF000.00000004.00000020.00020000.00000000.sdmp, GPhotos.scr, 00000011.00000000.1542724484.000000000062E000.00000002.00000001.01000000.0000000F.sdmp, Picasa3.exe, 00000012.00000000.1603749985.0000000000C6A000.00000002.00000001.01000000.00000012.sdmp, PicasaPhotoViewer.exe, 00000015.00000000.1692209976.000000000070D000.00000002.00000001.01000000.00000019.sdmp	String found in binary or memory: https://www.google.com/accounts/NewAccount?service=mail
Source: Picasa3.exe, 00000014.00000002.2506191744.0000000004241000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/accounts/NewAccount?service=videoonline
Source: setuppicasa39-setup.exe, 00000010.00000002.1664870898.00000000031AA000.00000004.00000020.00020000.00000000.sdmp, setuppicasa39-setup.exe, 00000010.00000002.1664870898.00000000035FF000.00000004.00000020.00020000.00000000.sdmp, GPhotos.scr, 00000011.00000000.1542724484.000000000062E000.00000002.00000001.01000000.0000000F.sdmp, Picasa3.exe, 00000012.00000000.1603749985.0000000000C6A000.00000002.00000001.01000000.00000012.sdmp, PicasaPhotoViewer.exe, 00000015.00000000.1692209976.000000000070D000.00000002.00000001.01000000.00000019.sdmp	String found in binary or memory: https://www.google.com/accounts/OAuthLogin
Source: setuppicasa39-setup.exe, 00000010.00000002.1664870898.00000000031AA000.00000004.00000020.00020000.00000000.sdmp, setuppicasa39-setup.exe, 00000010.00000002.1664870898.00000000035FF000.00000004.00000020.00020000.00000000.sdmp, GPhotos.scr, 00000011.00000000.1542724484.000000000062E000.00000002.00000001.01000000.0000000F.sdmp, Picasa3.exe, 00000012.00000000.1603749985.0000000000C6A000.00000002.00000001.01000000.00000012.sdmp, PicasaPhotoViewer.exe, 00000015.00000000.1692209976.000000000070D000.00000002.00000001.01000000.00000019.sdmp	String found in binary or memory: https://www.google.com/accounts/OAuthLoginhttps://picasaweb.google.com/c/https://www.google.com/m8/f
Source: setuppicasa39-setup.exe, 00000010.00000002.1664870898.00000000032A7000.00000004.00000020.00020000.00000000.sdmp, Picasa3.exe, 00000014.00000002.2599824731.000000001000C000.00000002.00000001.01000000.00000014.sdmp, PicasaPhotoViewer.exe, 00000015.00000000.1697683801.0000000000864000.00000002.00000001.01000000.00000019.sdmp	String found in binary or memory: https://www.google.com/accounts/ServiceLogin?hl=ar_US&continue=http%3A%2F%2Fpicasaweb.google.com
Source: setuppicasa39-setup.exe, 00000010.00000002.1664870898.00000000032A7000.00000004.00000020.00020000.00000000.sdmp, Picasa3.exe, 00000014.00000002.2599824731.000000001000C000.00000002.00000001.01000000.00000014.sdmp, PicasaPhotoViewer.exe, 00000015.00000000.1697683801.0000000000864000.00000002.00000001.01000000.00000019.sdmp	String found in binary or memory: https://www.google.com/accounts/ServiceLogin?hl=bg&continue=http%3A%2F%2Fpicasaweb.google.com%2F
Source: setuppicasa39-setup.exe, 00000010.00000002.1664870898.00000000032A7000.00000004.00000020.00020000.00000000.sdmp, Picasa3.exe, 00000014.00000002.2599824731.000000001000C000.00000002.00000001.01000000.00000014.sdmp, PicasaPhotoViewer.exe, 00000015.00000000.1697683801.0000000000864000.00000002.00000001.01000000.00000019.sdmp	String found in binary or memory: https://www.google.com/accounts/ServiceLogin?hl=ca_ES&continue=http%3A%2F%2Fpicasaweb.google.com
Source: setuppicasa39-setup.exe, 00000010.00000002.1664870898.00000000032A7000.00000004.00000020.00020000.00000000.sdmp, Picasa3.exe, 00000014.00000002.2599824731.000000001000C000.00000002.00000001.01000000.00000014.sdmp, PicasaPhotoViewer.exe, 00000015.00000000.1697683801.0000000000864000.00000002.00000001.01000000.00000019.sdmp	String found in binary or memory: https://www.google.com/accounts/ServiceLogin?hl=cs&continue=http%3A%2F%2Fpicasaweb.google.com%2F
Source: setuppicasa39-setup.exe, 00000010.00000002.1664870898.00000000032A7000.00000004.00000020.00020000.00000000.sdmp, Picasa3.exe, 00000014.00000002.2599824731.000000001000C000.00000002.00000001.01000000.00000014.sdmp, PicasaPhotoViewer.exe, 00000015.00000000.1697683801.0000000000864000.00000002.00000001.01000000.00000019.sdmp	String found in binary or memory: https://www.google.com/accounts/ServiceLogin?hl=de_DE&continue=http%3A%2F%2Fpicasaweb.google.com
Source: setuppicasa39-setup.exe, 00000010.00000002.1664870898.00000000032A7000.00000004.00000020.00020000.00000000.sdmp, Picasa3.exe, 00000014.00000002.2599824731.000000001000C000.00000002.00000001.01000000.00000014.sdmp, PicasaPhotoViewer.exe, 00000015.00000000.1697683801.0000000000864000.00000002.00000001.01000000.00000019.sdmp	String found in binary or memory: https://www.google.com/accounts/ServiceLogin?hl=el&continue=http%3A%2F%2Fpicasaweb.google.com%2F
Source: setuppicasa39-setup.exe, 00000010.00000002.1664870898.00000000032A7000.00000004.00000020.00020000.00000000.sdmp, Picasa3.exe, 00000014.00000002.2599824731.000000001000C000.00000002.00000001.01000000.00000014.sdmp, PicasaPhotoViewer.exe, 00000015.00000000.1697683801.0000000000864000.00000002.00000001.01000000.00000019.sdmp	String found in binary or memory: https://www.google.com/accounts/ServiceLogin?hl=en_GB&continue=http%3A%2F%2Fpicasaweb.google.com
Source: setuppicasa39-setup.exe, 00000010.00000002.1664870898.00000000032A7000.00000004.00000020.00020000.00000000.sdmp, Picasa3.exe, 00000014.00000003.1626531844.00000000040E2000.00000004.00000020.00020000.00000000.sdmp, Picasa3.exe, 00000014.00000002.2599824731.000000001140C000.00000002.00000001.01000000.00000014.sdmp, Picasa3.exe, 00000014.00000002.2599824731.0000000010A0C000.00000002.00000001.01000000.00000014.sdmp, Picasa3.exe, 00000014.00000003.1626203204.0000000003FB3000.00000004.00000020.00020000.00000000.sdmp, Picasa3.exe, 00000014.00000002.2599824731.000000001000C000.00000002.00000001.01000000.00000014.sdmp, PicasaPhotoViewer.exe, 00000015.00000003.1768334402.000000000284E000.00000004.00000020.00020000.00000000.sdmp, PicasaPhotoViewer.exe, 00000015.00000000.1697683801.0000000000864000.00000002.00000001.01000000.00000019.sdmp	String found in binary or memory: https://www.google.com/accounts/ServiceLogin?hl=en_US&continue=http%3A%2F%2Fpicasaweb.google.com
Source: Picasa3.exe, 00000014.00000002.2482072226.0000000002EAA000.00000004.00000020.00020000.00000000.sdmp, PicasaPhotoViewer.exe, 00000015.00000003.1768334402.000000000284E000.00000004.00000020.00020000.00000000.sdmp, PicasaPhotoViewer.exe, 00000015.00000002.1779594524.000000000285D000.00000004.00000020.00020000.00000000.sdmp, PicasaPhotoViewer.exe, 00000015.00000003.1775391488.000000000285D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/accounts/ServiceLogin?hl=en_US&continue=http%3A%2F%2Fpicasaweb.google.com%2Fh
Source: setuppicasa39-setup.exe, 00000010.00000002.1664870898.00000000032A7000.00000004.00000020.00020000.00000000.sdmp, Picasa3.exe, 00000014.00000002.2599824731.000000001000C000.00000002.00000001.01000000.00000014.sdmp, PicasaPhotoViewer.exe, 00000015.00000000.1697683801.0000000000864000.00000002.00000001.01000000.00000019.sdmp	String found in binary or memory: https://www.google.com/accounts/ServiceLogin?hl=es_ES&continue=http%3A%2F%2Fpicasaweb.google.com
Source: setuppicasa39-setup.exe, 00000010.00000002.1664870898.00000000032A7000.00000004.00000020.00020000.00000000.sdmp, Picasa3.exe, 00000014.00000002.2599824731.0000000010A0C000.00000002.00000001.01000000.00000014.sdmp, PicasaPhotoViewer.exe, 00000015.00000000.1697683801.0000000000864000.00000002.00000001.01000000.00000019.sdmp	String found in binary or memory: https://www.google.com/accounts/ServiceLogin?hl=fi_fi&continue=http%3A%2F%2Fpicasaweb.google.com
Source: setuppicasa39-setup.exe, 00000010.00000002.1664870898.00000000032A7000.00000004.00000020.00020000.00000000.sdmp, Picasa3.exe, 00000014.00000002.2599824731.0000000010A0C000.00000002.00000001.01000000.00000014.sdmp, PicasaPhotoViewer.exe, 00000015.00000000.1697683801.0000000000864000.00000002.00000001.01000000.00000019.sdmp	String found in binary or memory: https://www.google.com/accounts/ServiceLogin?hl=fil_PH&continue=http%3A%2F%2Fpicasaweb.google.co
Source: setuppicasa39-setup.exe, 00000010.00000002.1664870898.00000000032A7000.00000004.00000020.00020000.00000000.sdmp, Picasa3.exe, 00000014.00000002.2599824731.0000000010A0C000.00000002.00000001.01000000.00000014.sdmp, PicasaPhotoViewer.exe, 00000015.00000000.1697683801.0000000000864000.00000002.00000001.01000000.00000019.sdmp	String found in binary or memory: https://www.google.com/accounts/ServiceLogin?hl=fr_FR&continue=http%3A%2F%2Fpicasaweb.google.com
Source: setuppicasa39-setup.exe, 00000010.00000002.1664870898.00000000032A7000.00000004.00000020.00020000.00000000.sdmp, Picasa3.exe, 00000014.00000002.2599824731.0000000010A0C000.00000002.00000001.01000000.00000014.sdmp, PicasaPhotoViewer.exe, 00000015.00000000.1697683801.0000000000864000.00000002.00000001.01000000.00000019.sdmp	String found in binary or memory: https://www.google.com/accounts/ServiceLogin?hl=hu_HU&continue=http%3A%2F%2Fpicasaweb.google.com
Source: setuppicasa39-setup.exe, 00000010.00000002.1664870898.00000000032A7000.00000004.00000020.00020000.00000000.sdmp, Picasa3.exe, 00000014.00000002.2599824731.0000000010A0C000.00000002.00000001.01000000.00000014.sdmp, PicasaPhotoViewer.exe, 00000015.00000000.1697683801.0000000000864000.00000002.00000001.01000000.00000019.sdmp	String found in binary or memory: https://www.google.com/accounts/ServiceLogin?hl=id_ID&continue=http%3A%2F%2Fpicasaweb.google.com
Source: setuppicasa39-setup.exe, 00000010.00000002.1664870898.00000000032A7000.00000004.00000020.00020000.00000000.sdmp, Picasa3.exe, 00000014.00000002.2599824731.0000000010A0C000.00000002.00000001.01000000.00000014.sdmp, PicasaPhotoViewer.exe, 00000015.00000000.1697683801.0000000000864000.00000002.00000001.01000000.00000019.sdmp	String found in binary or memory: https://www.google.com/accounts/ServiceLogin?hl=it&continue=http%3A%2F%2Fpicasaweb.google.com%2F
Source: setuppicasa39-setup.exe, 00000010.00000002.1664870898.00000000032A7000.00000004.00000020.00020000.00000000.sdmp, Picasa3.exe, 00000014.00000002.2599824731.0000000010A0C000.00000002.00000001.01000000.00000014.sdmp, PicasaPhotoViewer.exe, 00000015.00000000.1697683801.0000000000864000.00000002.00000001.01000000.00000019.sdmp	String found in binary or memory: https://www.google.com/accounts/ServiceLogin?hl=ja_JP&continue=http%3A%2F%2Fpicasaweb.google.com
Source: setuppicasa39-setup.exe, 00000010.00000002.1664870898.00000000032A7000.00000004.00000020.00020000.00000000.sdmp, Picasa3.exe, 00000014.00000002.2599824731.0000000010A0C000.00000002.00000001.01000000.00000014.sdmp, PicasaPhotoViewer.exe, 00000015.00000000.1697683801.0000000000864000.00000002.00000001.01000000.00000019.sdmp	String found in binary or memory: https://www.google.com/accounts/ServiceLogin?hl=ko_KR&continue=http%3A%2F%2Fpicasaweb.google.com
Source: setuppicasa39-setup.exe, 00000010.00000002.1664870898.00000000032A7000.00000004.00000020.00020000.00000000.sdmp, Picasa3.exe, 00000014.00000002.2599824731.0000000010A0C000.00000002.00000001.01000000.00000014.sdmp, PicasaPhotoViewer.exe, 00000015.00000000.1697683801.0000000000864000.00000002.00000001.01000000.00000019.sdmp	String found in binary or memory: https://www.google.com/accounts/ServiceLogin?hl=lv_LV&continue=http%3A%2F%2Fpicasaweb.google.com
Source: setuppicasa39-setup.exe, 00000010.00000002.1664870898.00000000032A7000.00000004.00000020.00020000.00000000.sdmp, Picasa3.exe, 00000014.00000002.2599824731.0000000010A0C000.00000002.00000001.01000000.00000014.sdmp, PicasaPhotoViewer.exe, 00000015.00000000.1697683801.0000000000864000.00000002.00000001.01000000.00000019.sdmp	String found in binary or memory: https://www.google.com/accounts/ServiceLogin?hl=nl_US&continue=http%3A%2F%2Fpicasaweb.google.com
Source: setuppicasa39-setup.exe, 00000010.00000002.1664870898.00000000032A7000.00000004.00000020.00020000.00000000.sdmp, Picasa3.exe, 00000014.00000002.2599824731.0000000010A0C000.00000002.00000001.01000000.00000014.sdmp, PicasaPhotoViewer.exe, 00000015.00000000.1697683801.0000000000864000.00000002.00000001.01000000.00000019.sdmp	String found in binary or memory: https://www.google.com/accounts/ServiceLogin?hl=no_US&continue=http%3A%2F%2Fpicasaweb.google.com
Source: setuppicasa39-setup.exe, 00000010.00000002.1664870898.00000000032A7000.00000004.00000020.00020000.00000000.sdmp, Picasa3.exe, 00000014.00000002.2599824731.0000000010A0C000.00000002.00000001.01000000.00000014.sdmp, PicasaPhotoViewer.exe, 00000015.00000000.1697683801.0000000000864000.00000002.00000001.01000000.00000019.sdmp	String found in binary or memory: https://www.google.com/accounts/ServiceLogin?hl=pl&continue=http%3A%2F%2Fpicasaweb.google.com%2F
Source: setuppicasa39-setup.exe, 00000010.00000002.1664870898.00000000032A7000.00000004.00000020.00020000.00000000.sdmp, Picasa3.exe, 00000014.00000002.2599824731.0000000010A0C000.00000002.00000001.01000000.00000014.sdmp, PicasaPhotoViewer.exe, 00000015.00000000.1697683801.0000000000864000.00000002.00000001.01000000.00000019.sdmp	String found in binary or memory: https://www.google.com/accounts/ServiceLogin?hl=pt_BR&continue=http%3A%2F%2Fpicasaweb.google.com
Source: setuppicasa39-setup.exe, 00000010.00000002.1664870898.00000000032A7000.00000004.00000020.00020000.00000000.sdmp, Picasa3.exe, 00000014.00000002.2599824731.0000000010A0C000.00000002.00000001.01000000.00000014.sdmp, PicasaPhotoViewer.exe, 00000015.00000000.1697683801.0000000000864000.00000002.00000001.01000000.00000019.sdmp	String found in binary or memory: https://www.google.com/accounts/ServiceLogin?hl=pt_PT&continue=http%3A%2F%2Fpicasaweb.google.com
Source: setuppicasa39-setup.exe, 00000010.00000002.1664870898.00000000032A7000.00000004.00000020.00020000.00000000.sdmp, Picasa3.exe, 00000014.00000002.2599824731.0000000010A0C000.00000002.00000001.01000000.00000014.sdmp, PicasaPhotoViewer.exe, 00000015.00000000.1697683801.0000000000864000.00000002.00000001.01000000.00000019.sdmp	String found in binary or memory: https://www.google.com/accounts/ServiceLogin?hl=ro&continue=http%3A%2F%2Fpicasaweb.google.com%2F
Source: setuppicasa39-setup.exe, 00000010.00000002.1664870898.00000000032A7000.00000004.00000020.00020000.00000000.sdmp, Picasa3.exe, 00000014.00000002.2599824731.0000000010A0C000.00000002.00000001.01000000.00000014.sdmp, PicasaPhotoViewer.exe, 00000015.00000000.1697683801.0000000000864000.00000002.00000001.01000000.00000019.sdmp	String found in binary or memory: https://www.google.com/accounts/ServiceLogin?hl=ru&continue=http%3A%2F%2Fpicasaweb.google.com%2F
Source: setuppicasa39-setup.exe, 00000010.00000002.1664870898.00000000032A7000.00000004.00000020.00020000.00000000.sdmp, Picasa3.exe, 00000014.00000002.2599824731.0000000010A0C000.00000002.00000001.01000000.00000014.sdmp, PicasaPhotoViewer.exe, 00000015.00000000.1697683801.0000000000864000.00000002.00000001.01000000.00000019.sdmp	String found in binary or memory: https://www.google.com/accounts/ServiceLogin?hl=sl_SI&continue=http%3A%2F%2Fpicasaweb.google.com
Source: setuppicasa39-setup.exe, 00000010.00000002.1664870898.00000000032A7000.00000004.00000020.00020000.00000000.sdmp, Picasa3.exe, 00000014.00000002.2599824731.0000000010A0C000.00000002.00000001.01000000.00000014.sdmp, PicasaPhotoViewer.exe, 00000015.00000000.1697683801.0000000000864000.00000002.00000001.01000000.00000019.sdmp	String found in binary or memory: https://www.google.com/accounts/ServiceLogin?hl=sv_SE&continue=http%3A%2F%2Fpicasaweb.google.com
Source: setuppicasa39-setup.exe, 00000010.00000002.1664870898.00000000032A7000.00000004.00000020.00020000.00000000.sdmp, Picasa3.exe, 00000014.00000002.2599824731.000000001140C000.00000002.00000001.01000000.00000014.sdmp, PicasaPhotoViewer.exe, 00000015.00000000.1697683801.0000000000864000.00000002.00000001.01000000.00000019.sdmp	String found in binary or memory: https://www.google.com/accounts/ServiceLogin?hl=th&
Source: setuppicasa39-setup.exe, 00000010.00000002.1664870898.00000000032A7000.00000004.00000020.00020000.00000000.sdmp, Picasa3.exe, 00000014.00000002.2599824731.000000001140C000.00000002.00000001.01000000.00000014.sdmp, PicasaPhotoViewer.exe, 00000015.00000000.1697683801.0000000000864000.00000002.00000001.01000000.00000019.sdmp	String found in binary or memory: https://www.google.com/accounts/ServiceLogin?hl=tr&continue=http%3A%2F%2Fpicasaweb.google.com%2F
Source: setuppicasa39-setup.exe, 00000010.00000002.1664870898.00000000032A7000.00000004.00000020.00020000.00000000.sdmp, Picasa3.exe, 00000014.00000002.2599824731.000000001140C000.00000002.00000001.01000000.00000014.sdmp, PicasaPhotoViewer.exe, 00000015.00000000.1697683801.0000000000864000.00000002.00000001.01000000.00000019.sdmp	String found in binary or memory: https://www.google.com/accounts/ServiceLogin?hl=vi_VN&continue=http%3A%2F%2Fpicasaweb.google.com
Source: setuppicasa39-setup.exe, 00000010.00000002.1664870898.00000000032A7000.00000004.00000020.00020000.00000000.sdmp, Picasa3.exe, 00000014.00000002.2599824731.000000001140C000.00000002.00000001.01000000.00000014.sdmp, PicasaPhotoViewer.exe, 00000015.00000000.1697683801.0000000000864000.00000002.00000001.01000000.00000019.sdmp	String found in binary or memory: https://www.google.com/accounts/ServiceLogin?hl=zh_CN&continue=http%3A%2F%2Fpicasaweb.google.com
Source: Picasa3.exe, 00000012.00000000.1603749985.0000000000C6A000.00000002.00000001.01000000.00000012.sdmp	String found in binary or memory: https://www.google.com/contacts
Source: Picasa3.exe, 00000012.00000000.1603749985.0000000000C6A000.00000002.00000001.01000000.00000012.sdmp	String found in binary or memory: https://www.google.com/contactsrefresh_contactsonline_contactcountsyncgplusrevertcreateemailsfullnam
Source: setuppicasa39-setup.exe, 00000010.00000002.1664870898.0000000003831000.00000004.00000020.00020000.00000000.sdmp, Picasa3.exe, 00000014.00000002.2599824731.000000001000C000.00000002.00000001.01000000.00000014.sdmp	String found in binary or memory: https://www.google.com/intl/en/policies/privacy/
Source: setuppicasa39-setup.exe, 00000010.00000002.1664870898.0000000003831000.00000004.00000020.00020000.00000000.sdmp, Picasa3.exe, 00000014.00000002.2599824731.000000001000C000.00000002.00000001.01000000.00000014.sdmp	String found in binary or memory: https://www.google.com/intl/en/policies/terms/
Source: Picasa3.exe, 00000014.00000002.2599824731.0000000010A0C000.00000002.00000001.01000000.00000014.sdmp	String found in binary or memory: https://www.google.com/intl/iw/policies/privacy/
Source: Picasa3.exe, 00000014.00000002.2599824731.0000000010A0C000.00000002.00000001.01000000.00000014.sdmp	String found in binary or memory: https://www.google.com/intl/iw/policies/terms/
Source: Picasa3.exe, 00000014.00000002.2599824731.0000000010A0C000.00000002.00000001.01000000.00000014.sdmp, Picasa3.exe, 00000014.00000002.2599824731.000000001000C000.00000002.00000001.01000000.00000014.sdmp	String found in binary or memory: https://www.google.com/intl/pt-BR/policies/privacy/
Source: Picasa3.exe, 00000014.00000002.2599824731.0000000010A0C000.00000002.00000001.01000000.00000014.sdmp, Picasa3.exe, 00000014.00000002.2599824731.000000001000C000.00000002.00000001.01000000.00000014.sdmp	String found in binary or memory: https://www.google.com/intl/pt-BR/policies/terms/
Source: setuppicasa39-setup.exe, 00000010.00000002.1664870898.00000000031AA000.00000004.00000020.00020000.00000000.sdmp, setuppicasa39-setup.exe, 00000010.00000002.1664870898.00000000035FF000.00000004.00000020.00020000.00000000.sdmp, GPhotos.scr, 00000011.00000000.1542724484.000000000062E000.00000002.00000001.01000000.0000000F.sdmp, Picasa3.exe, 00000012.00000000.1603749985.0000000000C6A000.00000002.00000001.01000000.00000012.sdmp, PicasaPhotoViewer.exe, 00000015.00000000.1692209976.000000000070D000.00000002.00000001.01000000.00000019.sdmp	String found in binary or memory: https://www.google.com/m8/feeds/
Source: Picasa3.exe, 00000014.00000002.2482072226.0000000002E92000.00000004.00000020.00020000.00000000.sdmp, Picasa3.exe, 00000014.00000002.2599824731.000000001140C000.00000002.00000001.01000000.00000014.sdmp, Picasa3.exe, 00000014.00000002.2599824731.0000000010A0C000.00000002.00000001.01000000.00000014.sdmp, Picasa3.exe, 00000014.00000003.1626203204.0000000003FB3000.00000004.00000020.00020000.00000000.sdmp, Picasa3.exe, 00000014.00000002.2599824731.000000001000C000.00000002.00000001.01000000.00000014.sdmp	String found in binary or memory: https://www.google.com/policies/privacy/
Source: setuppicasa39-setup.exe, 00000010.00000003.1659418312.000000000067F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/policies/privacy/http://www.google.ro/policies/privacy/https://www.google.com
Source: setuppicasa39-setup.exe, 00000010.00000002.1664870898.0000000003831000.00000004.00000020.00020000.00000000.sdmp, Picasa3.exe, 00000014.00000002.2599824731.000000001000C000.00000002.00000001.01000000.00000014.sdmp	String found in binary or memory: https://www.google.com/policies/terms
Source: Picasa3.exe, 00000014.00000002.2482072226.0000000002E92000.00000004.00000020.00020000.00000000.sdmp, Picasa3.exe, 00000014.00000002.2599824731.000000001140C000.00000002.00000001.01000000.00000014.sdmp, Picasa3.exe, 00000014.00000002.2599824731.0000000010A0C000.00000002.00000001.01000000.00000014.sdmp, Picasa3.exe, 00000014.00000003.1626203204.0000000003FB3000.00000004.00000020.00020000.00000000.sdmp, Picasa3.exe, 00000014.00000002.2599824731.000000001000C000.00000002.00000001.01000000.00000014.sdmp	String found in binary or memory: https://www.google.com/policies/terms/
Source: setuppicasa39-setup.exe, 00000010.00000003.1659418312.000000000067F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/policies/terms/http://www.google.ro/policies/terms/https://www.google.com/int
Source: Picasa3.exe, 00000014.00000002.2482072226.0000000002E92000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/tbproxy/usagestats
Source: Picasa3.exe, 00000012.00000000.1603749985.0000000000C6A000.00000002.00000001.01000000.00000012.sdmp	String found in binary or memory: https://www.google.com/tbproxy/usagestatsLastStatsTransmissionpicasa
Source: setuppicasa39-setup.exe, 00000010.00000002.1664870898.00000000032A7000.00000004.00000020.00020000.00000000.sdmp, Picasa3.exe, 00000014.00000002.2599824731.000000001000C000.00000002.00000001.01000000.00000014.sdmp, PicasaPhotoViewer.exe, 00000015.00000000.1697683801.0000000000864000.00000002.00000001.01000000.00000019.sdmp	String found in binary or memory: https://www.google.cz/accounts/ForgotPasswd
Source: setuppicasa39-setup.exe, 00000010.00000002.1664870898.00000000032A7000.00000004.00000020.00020000.00000000.sdmp, Picasa3.exe, 00000014.00000002.2599824731.000000001000C000.00000002.00000001.01000000.00000014.sdmp, PicasaPhotoViewer.exe, 00000015.00000000.1697683801.0000000000864000.00000002.00000001.01000000.00000019.sdmp	String found in binary or memory: https://www.google.de/accounts/ForgotPasswd
Source: setuppicasa39-setup.exe, 00000010.00000002.1664870898.00000000032A7000.00000004.00000020.00020000.00000000.sdmp, Picasa3.exe, 00000014.00000002.2599824731.000000001000C000.00000002.00000001.01000000.00000014.sdmp, PicasaPhotoViewer.exe, 00000015.00000000.1697683801.0000000000864000.00000002.00000001.01000000.00000019.sdmp	String found in binary or memory: https://www.google.es/accounts/ForgotPasswd
Source: setuppicasa39-setup.exe, 00000010.00000002.1664870898.00000000032A7000.00000004.00000020.00020000.00000000.sdmp, Picasa3.exe, 00000014.00000002.2599824731.0000000010A0C000.00000002.00000001.01000000.00000014.sdmp, PicasaPhotoViewer.exe, 00000015.00000000.1697683801.0000000000864000.00000002.00000001.01000000.00000019.sdmp	String found in binary or memory: https://www.google.nl/accounts/ForgotPasswd
Source: setuppicasa39-setup.exe, 00000010.00000002.1664870898.00000000032A7000.00000004.00000020.00020000.00000000.sdmp, Picasa3.exe, 00000014.00000002.2599824731.0000000010A0C000.00000002.00000001.01000000.00000014.sdmp, PicasaPhotoViewer.exe, 00000015.00000000.1697683801.0000000000864000.00000002.00000001.01000000.00000019.sdmp	String found in binary or memory: https://www.google.rs/accounts/ForgotPasswd
Source: setuppicasa39-setup.exe, 00000010.00000002.1664870898.00000000032A7000.00000004.00000020.00020000.00000000.sdmp, Picasa3.exe, 00000014.00000002.2599824731.0000000010A0C000.00000002.00000001.01000000.00000014.sdmp, PicasaPhotoViewer.exe, 00000015.00000000.1697683801.0000000000864000.00000002.00000001.01000000.00000019.sdmp	String found in binary or memory: https://www.google.rs/accounts/ServiceLogin?hl=sr&continue=http%3A%2F%2Fpicasaweb.google.rs%2Fho
Source: setuppicasa39-setup.exe, 00000010.00000002.1664870898.00000000031AA000.00000004.00000020.00020000.00000000.sdmp, setuppicasa39-setup.exe, 00000010.00000002.1664870898.00000000035FF000.00000004.00000020.00020000.00000000.sdmp, GPhotos.scr, 00000011.00000000.1542724484.000000000062E000.00000002.00000001.01000000.0000000F.sdmp, Picasa3.exe, 00000012.00000000.1603749985.0000000000C6A000.00000002.00000001.01000000.00000012.sdmp, PicasaPhotoViewer.exe, 00000015.00000000.1692209976.000000000070D000.00000002.00000001.01000000.00000019.sdmp	String found in binary or memory: https://www.googleapis.com
Source: setuppicasa39-setup.exe, 00000010.00000002.1664870898.00000000031AA000.00000004.00000020.00020000.00000000.sdmp, setuppicasa39-setup.exe, 00000010.00000002.1664870898.00000000035FF000.00000004.00000020.00020000.00000000.sdmp, GPhotos.scr, 00000011.00000000.1542724484.000000000062E000.00000002.00000001.01000000.0000000F.sdmp, Picasa3.exe, 00000012.00000000.1603749985.0000000000C6A000.00000002.00000001.01000000.00000012.sdmp, PicasaPhotoViewer.exe, 00000015.00000000.1692209976.000000000070D000.00000002.00000001.01000000.00000019.sdmp	String found in binary or memory: https://www.googleapis.com/auth/photos
Source: setuppicasa39-setup.exe, 00000010.00000002.1664870898.00000000031AA000.00000004.00000020.00020000.00000000.sdmp, setuppicasa39-setup.exe, 00000010.00000002.1664870898.00000000035FF000.00000004.00000020.00020000.00000000.sdmp, GPhotos.scr, 00000011.00000000.1542724484.000000000062E000.00000002.00000001.01000000.0000000F.sdmp, Picasa3.exe, 00000012.00000000.1603749985.0000000000C6A000.00000002.00000001.01000000.00000012.sdmp, PicasaPhotoViewer.exe, 00000015.00000000.1692209976.000000000070D000.00000002.00000001.01000000.00000019.sdmp	String found in binary or memory: https://www.googleapis.com/auth/plus.circles.read
Source: setuppicasa39-setup.exe, 00000010.00000002.1664870898.00000000031AA000.00000004.00000020.00020000.00000000.sdmp, setuppicasa39-setup.exe, 00000010.00000002.1664870898.00000000035FF000.00000004.00000020.00020000.00000000.sdmp, GPhotos.scr, 00000011.00000000.1542724484.000000000062E000.00000002.00000001.01000000.0000000F.sdmp, Picasa3.exe, 00000012.00000000.1603749985.0000000000C6A000.00000002.00000001.01000000.00000012.sdmp, PicasaPhotoViewer.exe, 00000015.00000000.1692209976.000000000070D000.00000002.00000001.01000000.00000019.sdmp	String found in binary or memory: https://www.googleapis.com/auth/plus.me
Source: setuppicasa39-setup.exe, 00000010.00000002.1664870898.00000000031AA000.00000004.00000020.00020000.00000000.sdmp, setuppicasa39-setup.exe, 00000010.00000002.1664870898.00000000035FF000.00000004.00000020.00020000.00000000.sdmp, GPhotos.scr, 00000011.00000000.1542724484.000000000062E000.00000002.00000001.01000000.0000000F.sdmp, Picasa3.exe, 00000012.00000000.1603749985.0000000000C6A000.00000002.00000001.01000000.00000012.sdmp, PicasaPhotoViewer.exe, 00000015.00000000.1692209976.000000000070D000.00000002.00000001.01000000.00000019.sdmp	String found in binary or memory: https://www.googleapis.com/auth/plus.media.readonly
Source: setuppicasa39-setup.exe, 00000010.00000002.1664870898.00000000031AA000.00000004.00000020.00020000.00000000.sdmp, setuppicasa39-setup.exe, 00000010.00000002.1664870898.00000000035FF000.00000004.00000020.00020000.00000000.sdmp, GPhotos.scr, 00000011.00000000.1542724484.000000000062E000.00000002.00000001.01000000.0000000F.sdmp, Picasa3.exe, 00000012.00000000.1603749985.0000000000C6A000.00000002.00000001.01000000.00000012.sdmp, PicasaPhotoViewer.exe, 00000015.00000000.1692209976.000000000070D000.00000002.00000001.01000000.00000019.sdmp	String found in binary or memory: https://www.googleapis.com/auth/plus.media.upload
Source: setuppicasa39-setup.exe, 00000010.00000002.1664870898.00000000031AA000.00000004.00000020.00020000.00000000.sdmp, setuppicasa39-setup.exe, 00000010.00000002.1664870898.00000000035FF000.00000004.00000020.00020000.00000000.sdmp, GPhotos.scr, 00000011.00000000.1542724484.000000000062E000.00000002.00000001.01000000.0000000F.sdmp, Picasa3.exe, 00000012.00000000.1603749985.0000000000C6A000.00000002.00000001.01000000.00000012.sdmp, PicasaPhotoViewer.exe, 00000015.00000000.1692209976.000000000070D000.00000002.00000001.01000000.00000019.sdmp	String found in binary or memory: https://www.googleapis.com/auth/plus.profiles.read
Source: setuppicasa39-setup.exe, 00000010.00000002.1664870898.00000000031AA000.00000004.00000020.00020000.00000000.sdmp, setuppicasa39-setup.exe, 00000010.00000002.1664870898.00000000035FF000.00000004.00000020.00020000.00000000.sdmp, GPhotos.scr, 00000011.00000000.1542724484.000000000062E000.00000002.00000001.01000000.0000000F.sdmp, Picasa3.exe, 00000012.00000000.1603749985.0000000000C6A000.00000002.00000001.01000000.00000012.sdmp, PicasaPhotoViewer.exe, 00000015.00000000.1692209976.000000000070D000.00000002.00000001.01000000.00000019.sdmp	String found in binary or memory: https://www.googleapis.com/auth/plus.settings
Source: setuppicasa39-setup.exe, 00000010.00000002.1664870898.00000000031AA000.00000004.00000020.00020000.00000000.sdmp, setuppicasa39-setup.exe, 00000010.00000002.1664870898.00000000035FF000.00000004.00000020.00020000.00000000.sdmp, GPhotos.scr, 00000011.00000000.1542724484.000000000062E000.00000002.00000001.01000000.0000000F.sdmp, Picasa3.exe, 00000012.00000000.1603749985.0000000000C6A000.00000002.00000001.01000000.00000012.sdmp, PicasaPhotoViewer.exe, 00000015.00000000.1692209976.000000000070D000.00000002.00000001.01000000.00000019.sdmp	String found in binary or memory: https://www.googleapis.com/auth/plus.stream.write
Source: setuppicasa39-setup.exe, 00000010.00000002.1664870898.00000000031AA000.00000004.00000020.00020000.00000000.sdmp, setuppicasa39-setup.exe, 00000010.00000002.1664870898.00000000035FF000.00000004.00000020.00020000.00000000.sdmp, GPhotos.scr, 00000011.00000000.1542724484.000000000062E000.00000002.00000001.01000000.0000000F.sdmp, Picasa3.exe, 00000012.00000000.1603749985.0000000000C6A000.00000002.00000001.01000000.00000012.sdmp, PicasaPhotoViewer.exe, 00000015.00000000.1692209976.000000000070D000.00000002.00000001.01000000.00000019.sdmp	String found in binary or memory: https://www.googleapis.com/auth/userinfo%23email
Source: setuppicasa39-setup.exe, 00000010.00000002.1664870898.00000000031AA000.00000004.00000020.00020000.00000000.sdmp, setuppicasa39-setup.exe, 00000010.00000002.1664870898.00000000035FF000.00000004.00000020.00020000.00000000.sdmp, GPhotos.scr, 00000011.00000000.1542724484.000000000062E000.00000002.00000001.01000000.0000000F.sdmp, Picasa3.exe, 00000012.00000000.1603749985.0000000000C6A000.00000002.00000001.01000000.00000012.sdmp, PicasaPhotoViewer.exe, 00000015.00000000.1692209976.000000000070D000.00000002.00000001.01000000.00000019.sdmp	String found in binary or memory: https://www.youtube.com/create_channel?upsell=upload

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49865
Source: unknown	Network traffic detected: HTTP traffic on port 49817 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49863
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49862
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49861
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49982
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49860
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49981
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49980
Source: unknown	Network traffic detected: HTTP traffic on port 49932 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49898 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49875 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49852 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49795 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49990 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49859
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49737
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49979
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49736
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49857
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49978
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49856
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49977
Source: unknown	Network traffic detected: HTTP traffic on port 49772 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49855
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49976
Source: unknown	Network traffic detected: HTTP traffic on port 49841 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49854
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49975
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49853
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49974
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49852
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49973
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49851
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49972
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49850
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49971
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49970
Source: unknown	Network traffic detected: HTTP traffic on port 49967 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49784 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49749 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50004 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49909 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49806 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49943 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49849
Source: unknown	Network traffic detected: HTTP traffic on port 49714 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49848
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49969
Source: unknown	Network traffic detected: HTTP traffic on port 49978 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49847
Source: unknown	Network traffic detected: HTTP traffic on port 49886 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49968
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49846
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49967
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49845
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49966
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49723
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49844
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49965
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49843
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49964
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49721
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49842
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49963
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49720
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49841
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49962
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49840
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49961
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49960
Source: unknown	Network traffic detected: HTTP traffic on port 50015 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50040 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49966 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49989 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49760 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49828 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49933 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49805 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49839
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49838
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49959
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49837
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49716
Source: unknown	Network traffic detected: HTTP traffic on port 49715 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49958
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49715
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49836
Source: unknown	Network traffic detected: HTTP traffic on port 49921 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49957
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49714
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49835
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49956
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49834
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49955
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49833
Source: unknown	Network traffic detected: HTTP traffic on port 49887 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49954
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49832
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49953
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49831
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49952
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49830
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49951
Source: unknown	Network traffic detected: HTTP traffic on port 49839 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49950
Source: unknown	Network traffic detected: HTTP traffic on port 49944 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49910 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49853 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49796 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49709
Source: unknown	Network traffic detected: HTTP traffic on port 49955 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49708
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49829
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49828
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49949
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49827
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49948
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49826
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49947
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49704
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49825
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49946
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49824
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49945
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49702
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49823
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49944
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49822
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49943
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49788
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49787
Source: unknown	Network traffic detected: HTTP traffic on port 50061 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49786
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49785
Source: unknown	Network traffic detected: HTTP traffic on port 49922 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49784
Source: unknown	Network traffic detected: HTTP traffic on port 49945 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49783
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49782
Source: unknown	Network traffic detected: HTTP traffic on port 50017 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49781
Source: unknown	Network traffic detected: HTTP traffic on port 49968 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49785 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50049 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49807 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49980 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49736 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49759 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49779
Source: unknown	Network traffic detected: HTTP traffic on port 49885 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49778
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49899
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49777
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49898
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49776
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49897
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49775
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49896
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49895
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49773
Source: unknown	Network traffic detected: HTTP traffic on port 49862 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49894
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49772
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49893
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49892
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49891
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49890
Source: unknown	Network traffic detected: HTTP traffic on port 49897 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49911 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49957 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49851 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49830 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49889
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49888
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49887
Source: unknown	Network traffic detected: HTTP traffic on port 49758 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49886
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49885
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49763
Source: unknown	Network traffic detected: HTTP traffic on port 49863 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49884
Source: unknown	Network traffic detected: HTTP traffic on port 50038 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49762
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49883
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49761
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49882
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49881
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49760
Source: unknown	Network traffic detected: HTTP traffic on port 49840 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49880
Source: unknown	Network traffic detected: HTTP traffic on port 49702 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49896 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49797 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49956 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50005 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49979 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49759
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49758
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49879
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49878
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49999
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49877
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49998
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49755
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49876
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49997
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49875
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49754
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49996
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49874
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49995
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49873
Source: unknown	Network traffic detected: HTTP traffic on port 49923 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49994
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49751
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49872
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49993
Source: unknown	Network traffic detected: HTTP traffic on port 50016 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49818 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49750
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49871
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49992
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49870
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49990
Source: unknown	Network traffic detected: HTTP traffic on port 49786 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49874 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49829 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49934 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50027 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49749
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49869
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49868
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49989
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49867
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49866
Source: unknown	Network traffic detected: HTTP traffic on port 50013 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50059 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49803 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49826 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49906 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49849 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49900 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49837 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49975 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49929 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49872 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49964 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49798 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49861 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49999 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49918 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49873 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49787 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49930 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50001 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49850 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49963 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49799
Source: unknown	Network traffic detected: HTTP traffic on port 50037 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49798
Source: unknown	Network traffic detected: HTTP traffic on port 50012 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49797
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50009
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49796
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49795
Source: unknown	Network traffic detected: HTTP traffic on port 49952 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49794
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49793
Source: unknown	Network traffic detected: HTTP traffic on port 49814 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49792
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49791
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49790
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50001
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50003
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50002
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50005
Source: unknown	Network traffic detected: HTTP traffic on port 49895 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50004
Source: unknown	Network traffic detected: HTTP traffic on port 49723 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50048 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49825 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49884 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49907 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49941 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49789
Source: unknown	Network traffic detected: HTTP traffic on port 49997 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49779 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49859 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49871 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49894 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50003 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49965 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49799 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49942 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49977 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49816 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50035 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49919 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49954 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50014 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49788 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49827 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49882 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49848 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49838 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49976 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49953 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49815 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49908 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50024 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49883 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49860 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49778 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49755 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49998 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49673 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49931 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50058 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49804 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50002 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49920 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49708 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49926 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49949 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49800 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49789 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50056
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50058
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50057
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50059
Source: unknown	Network traffic detected: HTTP traffic on port 49961 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49720 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50022 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50061
Source: unknown	Network traffic detected: HTTP traffic on port 50045 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49881 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49950 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49996 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50010 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49812 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50056 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49893 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49915 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49823 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49777 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49790 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49869 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50009 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49972 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49834 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50057 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49892 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49904 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49847 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49709 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49927 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49822 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49870 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49938 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49811 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49754 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50018
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50017
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50019
Source: unknown	Network traffic detected: HTTP traffic on port 49813 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49951 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49974 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50010
Source: unknown	Network traffic detected: HTTP traffic on port 49836 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49916 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50012
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50011
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50014
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50013
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50016
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50015
Source: unknown	Network traffic detected: HTTP traffic on port 49939 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49776 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49845 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49791 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49868 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50021
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50020
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50022
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50024
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50027
Source: unknown	Network traffic detected: HTTP traffic on port 49879 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49802 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50021 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50030
Source: unknown	Network traffic detected: HTTP traffic on port 49905 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49995 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50011 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49928 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50031
Source: unknown	Network traffic detected: HTTP traffic on port 49857 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50033
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50035
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50038
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50037
Source: unknown	Network traffic detected: HTTP traffic on port 49801 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49940 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49824 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50041
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50040
Source: unknown	Network traffic detected: HTTP traffic on port 49973 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49891 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50033 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50043
Source: unknown	Network traffic detected: HTTP traffic on port 49835 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49917 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50042
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50045
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50044
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50049
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50048
Source: unknown	Network traffic detected: HTTP traffic on port 49880 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49962 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49775 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50044 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49846 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49792 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49890 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49970 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50042 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49781 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49878 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49912 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49935 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49958 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49889 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49866 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49820 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49946 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50018 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49763 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49855 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49981 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49901 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49924 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49819 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49844 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49947 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49793 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49831 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50031 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49751 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49992 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50043 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49782 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49969 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49994 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50020 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49856 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49913 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49808 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49867 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49821
Source: unknown	Network traffic detected: HTTP traffic on port 49865 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49942
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49820
Source: unknown	Network traffic detected: HTTP traffic on port 49842 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49941
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49940
Source: unknown	Network traffic detected: HTTP traffic on port 49704 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49762 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49833 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49819
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49818
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49939
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49938
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49817
Source: unknown	Network traffic detected: HTTP traffic on port 49810 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49816
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49937
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49815
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49936
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49814
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49935
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49813
Source: unknown	Network traffic detected: HTTP traffic on port 49902 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49934
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49812
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49933
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49811
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49932
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49810
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49931
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49930
Source: unknown	Network traffic detected: HTTP traffic on port 49925 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49971 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49794 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49936 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49876 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49960 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49809
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49808

Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.16:49702 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.16:49704 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 77.75.76.70:443 -> 192.168.2.16:49708 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.217.23.110:443 -> 192.168.2.16:49716 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.217.23.110:443 -> 192.168.2.16:49715 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.65:443 -> 192.168.2.16:49736 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.65:443 -> 192.168.2.16:49737 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.185.174:443 -> 192.168.2.16:49755 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.185.174:443 -> 192.168.2.16:49754 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.217.23.110:443 -> 192.168.2.16:49772 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.217.23.110:443 -> 192.168.2.16:49773 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.217.23.110:443 -> 192.168.2.16:49775 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 77.75.76.70:443 -> 192.168.2.16:49776 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.190.159.64:443 -> 192.168.2.16:49926 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 77.75.78.30:443 -> 192.168.2.16:49960 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 77.75.78.30:443 -> 192.168.2.16:49966 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 77.75.78.30:443 -> 192.168.2.16:49969 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 77.75.78.30:443 -> 192.168.2.16:49972 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 77.75.78.30:443 -> 192.168.2.16:49981 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 77.75.78.30:443 -> 192.168.2.16:49996 version: TLS 1.2

Spam, unwanted Advertisements and Ransom Demands

Writes many files with high entropy

Source: C:\Users\user\Desktop\1a4e5ccd35a56d84281a143f831563be.exe	File created: C:\Users\user\AppData\Local\Temp\nsm983C.tmp\listicka.exe entropy: 7.99973343481	Jump to dropped file
Source: C:\Users\user\Desktop\1a4e5ccd35a56d84281a143f831563be.exe	File created: C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe entropy: 7.99944334747	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsm983C.tmp\listicka.exe	File created: C:\Users\user\AppData\Roaming\Seznam.cz\install\com.microsoft.msdn.msvcr100-10.0.40219.325-win32.zip entropy: 7.99902013967	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsm983C.tmp\listicka.exe	File created: C:\Users\user\AppData\Roaming\Seznam.cz\install\com.microsoft.msdn.msvcr110-11.0.51106.1-win32.zip entropy: 7.99803893501	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsm983C.tmp\listicka.exe	File created: C:\Users\user\AppData\Roaming\Seznam.cz\install\cz.seznam.software.libfoxcub-3.3.4-win32.zip entropy: 7.99937504474	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsm983C.tmp\listicka.exe	File created: C:\Users\user\AppData\Roaming\Seznam.cz\install\cz.seznam.software.libfoxcub64-3.3.4-win32.zip entropy: 7.9934403699	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsm983C.tmp\listicka.exe	File created: C:\Users\user\AppData\Roaming\Seznam.cz\install\cz.seznam.software.libszndesktop-2.1.29-win32.zip entropy: 7.9975528811	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsm983C.tmp\listicka.exe	File created: C:\Users\user\AppData\Roaming\Seznam.cz\install\cz.seznam.software.lightspeed-1210-12.10.12-win32.zip entropy: 7.99527419193	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsm983C.tmp\listicka.exe	File created: C:\Users\user\AppData\Roaming\Seznam.cz\install\cz.seznam.software.lightspeed-1210-12.10.17-win32.zip entropy: 7.99527148225	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsm983C.tmp\listicka.exe	File created: C:\Users\user\AppData\Roaming\Seznam.cz\install\cz.seznam.software.pp-1.0.2-win32.zip entropy: 7.99611761346	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsm983C.tmp\listicka.exe	File created: C:\Users\user\AppData\Roaming\Seznam.cz\install\cz.seznam.software.szndesktop-2.0.31-win32.zip entropy: 7.99148015785	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsm983C.tmp\listicka.exe	File created: C:\Users\user\AppData\Roaming\Seznam.cz\install\cz.seznam.software.szninstall-1.1.14-win32.zip entropy: 7.99734638525	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsm983C.tmp\listicka.exe	File created: C:\Users\user\AppData\Roaming\Seznam.cz\install\cz.seznam.software.sznsetup-1.2.6-win32.zip entropy: 7.99808441613	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsm983C.tmp\listicka.exe	File created: C:\Users\user\AppData\Roaming\Seznam.cz\install\szn-software-fflisticka-4.0.4-win32.zip entropy: 7.99500794712	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\Seznam.cz\sznsetup-lt.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\90SNK17T\cz.seznam.software.sznsetup-1.2.7-win32[1].zip entropy: 7.99751989556	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\Seznam.cz\sznsetup-lt.exe	File created: C:\Users\user\AppData\Local\Temp\~0069FB97.00001B74.sznpkg\download\cz.seznam.software.sznsetup-1.2.7-win32.zip entropy: 7.99751989556	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\Seznam.cz\sznsetup-lt.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\AN5UOLP8\cz.seznam.software.szninstall-1.1.15-win32[1].zip entropy: 7.99622148951	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\Seznam.cz\sznsetup-lt.exe	File created: C:\Users\user\AppData\Local\Temp\~0069FB97.00001B74.sznpkg\download\cz.seznam.software.szninstall-1.1.15-win32.zip entropy: 7.99622148951	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\Seznam.cz\sznsetup.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\90SNK17T\cz.seznam.software.libfoxcub-3.3.8-win32[1].zip entropy: 7.99928054353	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\Seznam.cz\sznsetup.exe	File created: C:\Users\user\AppData\Local\Temp\~006A2DE2.00000DD4.sznpkg\download\cz.seznam.software.libfoxcub-3.3.8-win32.zip entropy: 7.99928054353	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\Seznam.cz\sznsetup.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\AN5UOLP8\cz.seznam.software.libfoxcub64-3.3.8-win32[1].zip entropy: 7.99330512834	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\Seznam.cz\sznsetup.exe	File created: C:\Users\user\AppData\Local\Temp\~006A2DE2.00000DD4.sznpkg\download\cz.seznam.software.libfoxcub64-3.3.8-win32.zip entropy: 7.99330512834	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\Seznam.cz\sznsetup.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\AN5UOLP8\szn-software-fflisticka-4.0.8-win32[1].zip entropy: 7.99598048244	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\Seznam.cz\sznsetup.exe	File created: C:\Users\user\AppData\Local\Temp\~006A2DE2.00000DD4.sznpkg\download\szn-software-fflisticka-4.0.8-win32.zip entropy: 7.99598048244	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\Seznam.cz\sznsetup.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\C7S8M5VS\cz.seznam.software.lightspeed-1210-12.10.18-win32[1].zip entropy: 7.99452128979	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\Seznam.cz\sznsetup.exe	File created: C:\Users\user\AppData\Local\Temp\~006A2DE2.00000DD4.sznpkg\download\cz.seznam.software.lightspeed-1210-12.10.18-win32.zip entropy: 7.99452128979	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\Seznam.cz\sznsetup.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\33CUD2J1\cz.seznam.software.libszndesktop-2.1.35-win32[1].zip entropy: 7.99829572997	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\Seznam.cz\sznsetup.exe	File created: C:\Users\user\AppData\Local\Temp\~006A2DE2.00000DD4.sznpkg\download\cz.seznam.software.libszndesktop-2.1.35-win32.zip entropy: 7.99829572997	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\Seznam.cz\sznsetup.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\AN5UOLP8\cz.seznam.software.szndesktop-2.0.32-win32[1].zip entropy: 7.991462256	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\Seznam.cz\sznsetup.exe	File created: C:\Users\user\AppData\Local\Temp\~006A2DE2.00000DD4.sznpkg\download\cz.seznam.software.szndesktop-2.0.32-win32.zip entropy: 7.991462256	Jump to dropped file

Source: conhost.exe

Process created: 41

System Summary

Submitted sample is a known malware sample

Source: C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe	Dropped file: MD5: 23b7d7d024abb0f558420e098800bf27 Family: OceanLotus Alias: OceanLotus, , Cobalt Kitty , APT-C-00, SeaLotus, APT32 Description: OceanLotus is an APT group that was first disclosed and named by QI-ANXIN. The APT group carried out targeted attacks against Chinese government, research institutes, maritime institutions, and shipping companies since 2012. The group, called as APT32 by FireEye, also targeted corporations with a vested interest in Vietnams manufacturing, consumer products, and hospitality sectors. Furthermore, it has also targeted foreign governments, as well as Vietnamese dissidents and journalists since at least 2013. References: https://www.fireeye.com/blog/threat-research/2017/05/cyber-espionage-apt32.html https://www.cybereason.com/labs-operation-cobalt-kitty-a-large-scale-apt-in-asia-carried-out-by-the-oceanlotus-group/https://www.scmagazineuk.com/ocean-lotus-groupapt-32-identified-as-vietnamese-apt-group/article/663565/Data Source: https://github.com/RedDrip7/APT_Digital_Weapon
Source: C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe	Dropped file: MD5: 23b7d7d024abb0f558420e098800bf27 Family: OceanLotus Alias: OceanLotus, , Cobalt Kitty , APT-C-00, SeaLotus, APT32 Description: OceanLotus is an APT group that was first disclosed and named by QI-ANXIN. The APT group carried out targeted attacks against Chinese government, research institutes, maritime institutions, and shipping companies since 2012. The group, called as APT32 by FireEye, also targeted corporations with a vested interest in Vietnams manufacturing, consumer products, and hospitality sectors. Furthermore, it has also targeted foreign governments, as well as Vietnamese dissidents and journalists since at least 2013. References: https://www.fireeye.com/blog/threat-research/2017/05/cyber-espionage-apt32.html https://www.cybereason.com/labs-operation-cobalt-kitty-a-large-scale-apt-in-asia-carried-out-by-the-oceanlotus-group/https://www.scmagazineuk.com/ocean-lotus-groupapt-32-identified-as-vietnamese-apt-group/article/663565/Data Source: https://github.com/RedDrip7/APT_Digital_Weapon
Source: C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe	Dropped file: MD5: 23b7d7d024abb0f558420e098800bf27 Family: OceanLotus Alias: OceanLotus, , Cobalt Kitty , APT-C-00, SeaLotus, APT32 Description: OceanLotus is an APT group that was first disclosed and named by QI-ANXIN. The APT group carried out targeted attacks against Chinese government, research institutes, maritime institutions, and shipping companies since 2012. The group, called as APT32 by FireEye, also targeted corporations with a vested interest in Vietnams manufacturing, consumer products, and hospitality sectors. Furthermore, it has also targeted foreign governments, as well as Vietnamese dissidents and journalists since at least 2013. References: https://www.fireeye.com/blog/threat-research/2017/05/cyber-espionage-apt32.html https://www.cybereason.com/labs-operation-cobalt-kitty-a-large-scale-apt-in-asia-carried-out-by-the-oceanlotus-group/https://www.scmagazineuk.com/ocean-lotus-groupapt-32-identified-as-vietnamese-apt-group/article/663565/Data Source: https://github.com/RedDrip7/APT_Digital_Weapon
Source: C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe	Dropped file: MD5: 23b7d7d024abb0f558420e098800bf27 Family: OceanLotus Alias: OceanLotus, , Cobalt Kitty , APT-C-00, SeaLotus, APT32 Description: OceanLotus is an APT group that was first disclosed and named by QI-ANXIN. The APT group carried out targeted attacks against Chinese government, research institutes, maritime institutions, and shipping companies since 2012. The group, called as APT32 by FireEye, also targeted corporations with a vested interest in Vietnams manufacturing, consumer products, and hospitality sectors. Furthermore, it has also targeted foreign governments, as well as Vietnamese dissidents and journalists since at least 2013. References: https://www.fireeye.com/blog/threat-research/2017/05/cyber-espionage-apt32.html https://www.cybereason.com/labs-operation-cobalt-kitty-a-large-scale-apt-in-asia-carried-out-by-the-oceanlotus-group/https://www.scmagazineuk.com/ocean-lotus-groupapt-32-identified-as-vietnamese-apt-group/article/663565/Data Source: https://github.com/RedDrip7/APT_Digital_Weapon

Source: C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe

Code function: 16_2_04C926E0 ntusercheck,GlobalAlloc,lstrcpynW,

16_2_04C926E0

Source: C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe

File created: C:\Windows\SysWOW64\GPhotos.scr

Jump to behavior

Source: C:\Users\user\Desktop\1a4e5ccd35a56d84281a143f831563be.exe	Code function: 15_2_73A34F30	15_2_73A34F30
Source: C:\Users\user\Desktop\1a4e5ccd35a56d84281a143f831563be.exe	Code function: 15_2_73A32077	15_2_73A32077
Source: C:\Users\user\Desktop\1a4e5ccd35a56d84281a143f831563be.exe	Code function: 15_2_73A34C40	15_2_73A34C40
Source: C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe	Code function: 16_2_04C97CF0	16_2_04C97CF0
Source: C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe	Code function: 16_2_04C9F421	16_2_04C9F421
Source: C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe	Code function: 16_2_04C96A7D	16_2_04C96A7D
Source: C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe	Code function: 16_2_04C98F8D	16_2_04C98F8D
Source: C:\Program Files (x86)\Google\Picasa3\Picasa3.exe	Code function: 20_2_033E522B	20_2_033E522B
Source: C:\Program Files (x86)\Google\Picasa3\Picasa3.exe	Code function: 20_2_033E9229	20_2_033E9229
Source: C:\Program Files (x86)\Google\Picasa3\Picasa3.exe	Code function: 20_2_033E4112	20_2_033E4112
Source: C:\Program Files (x86)\Google\Picasa3\Picasa3.exe	Code function: 20_2_033C0100	20_2_033C0100
Source: C:\Program Files (x86)\Google\Picasa3\Picasa3.exe	Code function: 20_2_033D1190	20_2_033D1190
Source: C:\Program Files (x86)\Google\Picasa3\Picasa3.exe	Code function: 20_2_033EB1F1	20_2_033EB1F1
Source: C:\Program Files (x86)\Google\Picasa3\Picasa3.exe	Code function: 20_2_033BE0B0	20_2_033BE0B0
Source: C:\Program Files (x86)\Google\Picasa3\Picasa3.exe	Code function: 20_2_033EB733	20_2_033EB733
Source: C:\Program Files (x86)\Google\Picasa3\Picasa3.exe	Code function: 20_2_033EC6B9	20_2_033EC6B9
Source: C:\Program Files (x86)\Google\Picasa3\Picasa3.exe	Code function: 20_2_033E141B	20_2_033E141B
Source: C:\Program Files (x86)\Google\Picasa3\Picasa3.exe	Code function: 20_2_033DA8B0	20_2_033DA8B0
Source: C:\Program Files (x86)\Google\Picasa3\Picasa3.exe	Code function: 20_2_033EDE49	20_2_033EDE49
Source: C:\Program Files (x86)\Google\Picasa3\Picasa3.exe	Code function: 20_2_033DFD20	20_2_033DFD20
Source: C:\Program Files (x86)\Google\Picasa3\Picasa3.exe	Code function: 20_2_033EBDF3	20_2_033EBDF3
Source: C:\Program Files (x86)\Google\Picasa3\Picasa3.exe	Code function: 20_2_033EACAF	20_2_033EACAF
Source: C:\Program Files (x86)\Google\Picasa3\Picasa3.exe	Code function: 20_2_04043450	20_2_04043450
Source: C:\Program Files (x86)\Google\Picasa3\Picasa3.exe	Code function: 20_2_04065468	20_2_04065468
Source: C:\Program Files (x86)\Google\Picasa3\Picasa3.exe	Code function: 20_2_04042500	20_2_04042500
Source: C:\Program Files (x86)\Google\Picasa3\Picasa3.exe	Code function: 20_2_04056560	20_2_04056560
Source: C:\Program Files (x86)\Google\Picasa3\Picasa3.exe	Code function: 20_2_04042600	20_2_04042600
Source: C:\Program Files (x86)\Google\Picasa3\Picasa3.exe	Code function: 20_2_04071701	20_2_04071701
Source: C:\Program Files (x86)\Google\Picasa3\Picasa3.exe	Code function: 20_2_04032730	20_2_04032730
Source: C:\Program Files (x86)\Google\Picasa3\Picasa3.exe	Code function: 20_2_0406F73C	20_2_0406F73C
Source: C:\Program Files (x86)\Google\Picasa3\Picasa3.exe	Code function: 20_2_0403B070	20_2_0403B070
Source: C:\Program Files (x86)\Google\Picasa3\Picasa3.exe	Code function: 20_2_04065070	20_2_04065070
Source: C:\Program Files (x86)\Google\Picasa3\Picasa3.exe	Code function: 20_2_040340B0	20_2_040340B0
Source: C:\Program Files (x86)\Google\Picasa3\Picasa3.exe	Code function: 20_2_040711BF	20_2_040711BF
Source: C:\Program Files (x86)\Google\Picasa3\Picasa3.exe	Code function: 20_2_040691CB	20_2_040691CB
Source: C:\Program Files (x86)\Google\Picasa3\Picasa3.exe	Code function: 20_2_04037280	20_2_04037280
Source: C:\Program Files (x86)\Google\Picasa3\Picasa3.exe	Code function: 20_2_04072303	20_2_04072303
Source: C:\Program Files (x86)\Google\Picasa3\Picasa3.exe	Code function: 20_2_04074359	20_2_04074359
Source: C:\Program Files (x86)\Google\Picasa3\Picasa3.exe	Code function: 20_2_04071C43	20_2_04071C43
Source: C:\Program Files (x86)\Google\Picasa3\Picasa3.exe	Code function: 20_2_04060E40	20_2_04060E40
Source: C:\Program Files (x86)\Google\Picasa3\Picasa3.exe	Code function: 20_2_0403DEF0	20_2_0403DEF0
Source: C:\Program Files (x86)\Google\Picasa3\Picasa3.exe	Code function: 20_2_04036F10	20_2_04036F10
Source: C:\Program Files (x86)\Google\Picasa3\Picasa3.exe	Code function: 20_2_04044810	20_2_04044810
Source: C:\Program Files (x86)\Google\Picasa3\Picasa3.exe	Code function: 20_2_04059810	20_2_04059810
Source: C:\Program Files (x86)\Google\Picasa3\Picasa3.exe	Code function: 20_2_0406B890	20_2_0406B890
Source: C:\Program Files (x86)\Google\Picasa3\Picasa3.exe	Code function: 20_2_04067B7F	20_2_04067B7F
Source: C:\Program Files (x86)\Google\Picasa3\Picasa3.exe	Code function: 20_2_04072BC9	20_2_04072BC9
Source: C:\Program Files (x86)\Google\Picasa3\Picasa3.exe	Code function: 20_2_04838D40	20_2_04838D40
Source: C:\Program Files (x86)\Google\Picasa3\Picasa3.exe	Code function: 20_2_04831410	20_2_04831410
Source: C:\Program Files (x86)\Google\Picasa3\Picasa3.exe	Code function: 20_2_0481F430	20_2_0481F430
Source: C:\Program Files (x86)\Google\Picasa3\Picasa3.exe	Code function: 20_2_04879445	20_2_04879445
Source: C:\Program Files (x86)\Google\Picasa3\Picasa3.exe	Code function: 20_2_0488A469	20_2_0488A469
Source: C:\Program Files (x86)\Google\Picasa3\Picasa3.exe	Code function: 20_2_0483D470	20_2_0483D470
Source: C:\Program Files (x86)\Google\Picasa3\Picasa3.exe	Code function: 20_2_048275B0	20_2_048275B0
Source: C:\Program Files (x86)\Google\Picasa3\Picasa3.exe	Code function: 20_2_048835EB	20_2_048835EB
Source: C:\Program Files (x86)\Google\Picasa3\Picasa3.exe	Code function: 20_2_0480B510	20_2_0480B510
Source: C:\Program Files (x86)\Google\Picasa3\Picasa3.exe	Code function: 20_2_04828510	20_2_04828510
Source: C:\Program Files (x86)\Google\Picasa3\Picasa3.exe	Code function: 20_2_04823680	20_2_04823680
Source: C:\Program Files (x86)\Google\Picasa3\Picasa3.exe	Code function: 20_2_048126C0	20_2_048126C0
Source: C:\Program Files (x86)\Google\Picasa3\Picasa3.exe	Code function: 20_2_04865600	20_2_04865600
Source: C:\Program Files (x86)\Google\Picasa3\Picasa3.exe	Code function: 20_2_04884640	20_2_04884640
Source: C:\Program Files (x86)\Google\Picasa3\Picasa3.exe	Code function: 20_2_047E66B0	20_2_047E66B0
Source: C:\Program Files (x86)\Google\Picasa3\Picasa3.exe	Code function: 20_2_04836670	20_2_04836670
Source: C:\Program Files (x86)\Google\Picasa3\Picasa3.exe	Code function: 20_2_0487D78E	20_2_0487D78E
Source: C:\Program Files (x86)\Google\Picasa3\Picasa3.exe	Code function: 20_2_048687C0	20_2_048687C0
Source: C:\Program Files (x86)\Google\Picasa3\Picasa3.exe	Code function: 20_2_048107F0	20_2_048107F0
Source: C:\Program Files (x86)\Google\Picasa3\Picasa3.exe	Code function: 20_2_0483A710	20_2_0483A710
Source: C:\Program Files (x86)\Google\Picasa3\Picasa3.exe	Code function: 20_2_048830A9	20_2_048830A9
Source: C:\Program Files (x86)\Google\Picasa3\Picasa3.exe	Code function: 20_2_047F3050	20_2_047F3050
Source: C:\Program Files (x86)\Google\Picasa3\Picasa3.exe	Code function: 20_2_04802020	20_2_04802020
Source: C:\Program Files (x86)\Google\Picasa3\Picasa3.exe	Code function: 20_2_04836040	20_2_04836040
Source: C:\Program Files (x86)\Google\Picasa3\Picasa3.exe	Code function: 20_2_04813180	20_2_04813180
Source: C:\Program Files (x86)\Google\Picasa3\Picasa3.exe	Code function: 20_2_047E8150	20_2_047E8150
Source: C:\Program Files (x86)\Google\Picasa3\Picasa3.exe	Code function: 20_2_0483E1F0	20_2_0483E1F0
Source: C:\Program Files (x86)\Google\Picasa3\Picasa3.exe	Code function: 20_2_047EC190	20_2_047EC190
Source: C:\Program Files (x86)\Google\Picasa3\Picasa3.exe	Code function: 20_2_04880233	20_2_04880233
Source: C:\Program Files (x86)\Google\Picasa3\Picasa3.exe	Code function: 20_2_04811380	20_2_04811380
Source: C:\Program Files (x86)\Google\Picasa3\Picasa3.exe	Code function: 20_2_04874325	20_2_04874325
Source: C:\Program Files (x86)\Google\Picasa3\Picasa3.exe	Code function: 20_2_047E53B8	20_2_047E53B8
Source: C:\Program Files (x86)\Google\Picasa3\Picasa3.exe	Code function: 20_2_04847360	20_2_04847360
Source: C:\Program Files (x86)\Google\Picasa3\Picasa3.exe	Code function: 20_2_0480CDF0	20_2_0480CDF0
Source: C:\Program Files (x86)\Google\Picasa3\Picasa3.exe	Code function: 20_2_047F1D00	20_2_047F1D00
Source: C:\Program Files (x86)\Google\Picasa3\Picasa3.exe	Code function: 20_2_0486FD20	20_2_0486FD20
Source: C:\Program Files (x86)\Google\Picasa3\Picasa3.exe	Code function: 20_2_0481AD70	20_2_0481AD70
Source: C:\Program Files (x86)\Google\Picasa3\Picasa3.exe	Code function: 20_2_047EBE50	20_2_047EBE50
Source: C:\Program Files (x86)\Google\Picasa3\Picasa3.exe	Code function: 20_2_04887EA7	20_2_04887EA7
Source: C:\Program Files (x86)\Google\Picasa3\Picasa3.exe	Code function: 20_2_0487DEEC	20_2_0487DEEC
Source: C:\Program Files (x86)\Google\Picasa3\Picasa3.exe	Code function: 20_2_0481AEF0	20_2_0481AEF0
Source: C:\Program Files (x86)\Google\Picasa3\Picasa3.exe	Code function: 20_2_047FFEF0	20_2_047FFEF0
Source: C:\Program Files (x86)\Google\Picasa3\Picasa3.exe	Code function: 20_2_0487BE1D	20_2_0487BE1D
Source: C:\Program Files (x86)\Google\Picasa3\Picasa3.exe	Code function: 20_2_0480BE40	20_2_0480BE40
Source: C:\Program Files (x86)\Google\Picasa3\Picasa3.exe	Code function: 20_2_047E3EB0	20_2_047E3EB0
Source: C:\Program Files (x86)\Google\Picasa3\Picasa3.exe	Code function: 20_2_04815880	20_2_04815880
Source: C:\Program Files (x86)\Google\Picasa3\Picasa3.exe	Code function: 20_2_04842890	20_2_04842890
Source: C:\Program Files (x86)\Google\Picasa3\Picasa3.exe	Code function: 20_2_048778B0	20_2_048778B0
Source: C:\Program Files (x86)\Google\Picasa3\Picasa3.exe	Code function: 20_2_0488499F	20_2_0488499F
Source: C:\Program Files (x86)\Google\Picasa3\Picasa3.exe	Code function: 20_2_047FCAE0	20_2_047FCAE0
Source: C:\Program Files (x86)\Google\Picasa3\Picasa3.exe	Code function: 20_2_0481FA40	20_2_0481FA40
Source: C:\Program Files (x86)\Google\Picasa3\Picasa3.exe	Code function: 20_2_047E5A90	20_2_047E5A90
Source: C:\Program Files (x86)\Google\Picasa3\Picasa3.exe	Code function: 20_2_04871A70	20_2_04871A70
Source: C:\Program Files (x86)\Google\Picasa3\Picasa3.exe	Code function: 20_2_047F4B30	20_2_047F4B30
Source: C:\Program Files (x86)\Google\Picasa3\Picasa3.exe	Code function: 20_2_047EFB10	20_2_047EFB10
Source: C:\Program Files (x86)\Google\Picasa3\Picasa3.exe	Code function: 20_2_04808B70	20_2_04808B70
Source: C:\Program Files (x86)\Google\Picasa3\Picasa3.exe	Code function: 20_2_047F6B80	20_2_047F6B80
Source: C:\Program Files (x86)\Google\Picasa3\Picasa3.exe	Code function: 20_2_100028F0	20_2_100028F0
Source: C:\Users\user\AppData\Local\Temp\~0069FB97.00001B74.sznpkg\UNZIP.EXE	Code function: 38_2_00408850	38_2_00408850
Source: C:\Users\user\AppData\Local\Temp\~0069FB97.00001B74.sznpkg\UNZIP.EXE	Code function: 38_2_0040C820	38_2_0040C820
Source: C:\Users\user\AppData\Local\Temp\~0069FB97.00001B74.sznpkg\UNZIP.EXE	Code function: 38_2_00403490	38_2_00403490
Source: C:\Users\user\AppData\Local\Temp\~0069FB97.00001B74.sznpkg\UNZIP.EXE	Code function: 38_2_00411170	38_2_00411170
Source: C:\Users\user\AppData\Local\Temp\~0069FB97.00001B74.sznpkg\UNZIP.EXE	Code function: 38_2_0040E900	38_2_0040E900
Source: C:\Users\user\AppData\Local\Temp\~0069FB97.00001B74.sznpkg\UNZIP.EXE	Code function: 38_2_0040CE49	38_2_0040CE49
Source: C:\Users\user\AppData\Local\Temp\~0069FB97.00001B74.sznpkg\UNZIP.EXE	Code function: 38_2_0040CE50	38_2_0040CE50
Source: C:\Users\user\AppData\Local\Temp\~0069FB97.00001B74.sznpkg\UNZIP.EXE	Code function: 38_2_00402210	38_2_00402210
Source: C:\Users\user\AppData\Local\Temp\~0069FB97.00001B74.sznpkg\UNZIP.EXE	Code function: 38_2_00408EC0	38_2_00408EC0
Source: C:\Users\user\AppData\Local\Temp\~0069FB97.00001B74.sznpkg\UNZIP.EXE	Code function: 38_2_00417EE3	38_2_00417EE3
Source: C:\Users\user\AppData\Local\Temp\~0069FB97.00001B74.sznpkg\UNZIP.EXE	Code function: 38_2_00402EF0	38_2_00402EF0
Source: C:\Users\user\AppData\Local\Temp\~0069FB97.00001B74.sznpkg\UNZIP.EXE	Code function: 38_2_0040F280	38_2_0040F280
Source: C:\Users\user\AppData\Local\Temp\~0069FB97.00001B74.sznpkg\UNZIP.EXE	Code function: 38_2_00409FD0	38_2_00409FD0
Source: C:\Users\user\AppData\Local\Temp\~0069FB97.00001B74.sznpkg\UNZIP.EXE	Code function: 38_2_004093E0	38_2_004093E0
Source: C:\Users\user\AppData\Roaming\Seznam.cz\bin\szndesktop.exe	Code function: 135_2_6C28CD7F	135_2_6C28CD7F
Source: C:\Users\user\AppData\Roaming\Seznam.cz\bin\szndesktop.exe	Code function: 135_2_6C2C8DB8	135_2_6C2C8DB8
Source: C:\Users\user\AppData\Roaming\Seznam.cz\bin\szndesktop.exe	Code function: 135_2_6C23AEB5	135_2_6C23AEB5
Source: C:\Users\user\AppData\Roaming\Seznam.cz\bin\szndesktop.exe	Code function: 135_2_6C2D6F10	135_2_6C2D6F10
Source: C:\Users\user\AppData\Roaming\Seznam.cz\bin\szndesktop.exe	Code function: 135_2_6C2309FB	135_2_6C2309FB
Source: C:\Users\user\AppData\Roaming\Seznam.cz\bin\szndesktop.exe	Code function: 135_2_6C23AB7B	135_2_6C23AB7B
Source: C:\Users\user\AppData\Roaming\Seznam.cz\bin\szndesktop.exe	Code function: 135_2_6C2DEBA7	135_2_6C2DEBA7
Source: C:\Users\user\AppData\Roaming\Seznam.cz\bin\szndesktop.exe	Code function: 135_2_6C2D2B84	135_2_6C2D2B84
Source: C:\Users\user\AppData\Roaming\Seznam.cz\bin\szndesktop.exe	Code function: 135_2_6C230BC8	135_2_6C230BC8
Source: C:\Users\user\AppData\Roaming\Seznam.cz\bin\szndesktop.exe	Code function: 135_2_6C24EBDD	135_2_6C24EBDD
Source: C:\Users\user\AppData\Roaming\Seznam.cz\bin\szndesktop.exe	Code function: 135_2_6C230549	135_2_6C230549
Source: C:\Users\user\AppData\Roaming\Seznam.cz\bin\szndesktop.exe	Code function: 135_2_6C2605BE	135_2_6C2605BE
Source: C:\Users\user\AppData\Roaming\Seznam.cz\bin\szndesktop.exe	Code function: 135_2_6C23059C	135_2_6C23059C
Source: C:\Users\user\AppData\Roaming\Seznam.cz\bin\szndesktop.exe	Code function: 135_2_6C2405D2	135_2_6C2405D2
Source: C:\Users\user\AppData\Roaming\Seznam.cz\bin\szndesktop.exe	Code function: 135_2_6C2486A2	135_2_6C2486A2
Source: C:\Users\user\AppData\Roaming\Seznam.cz\bin\szndesktop.exe	Code function: 135_2_6C2AC698	135_2_6C2AC698
Source: C:\Users\user\AppData\Roaming\Seznam.cz\bin\szndesktop.exe	Code function: 135_2_6C2AA693	135_2_6C2AA693
Source: C:\Users\user\AppData\Roaming\Seznam.cz\bin\szndesktop.exe	Code function: 135_2_6C2B86F4	135_2_6C2B86F4
Source: C:\Users\user\AppData\Roaming\Seznam.cz\bin\szndesktop.exe	Code function: 135_2_6C2DE7B6	135_2_6C2DE7B6
Source: C:\Users\user\AppData\Roaming\Seznam.cz\bin\szndesktop.exe	Code function: 135_2_6C23A7EB	135_2_6C23A7EB
Source: C:\Users\user\AppData\Roaming\Seznam.cz\bin\szndesktop.exe	Code function: 135_2_6C24208B	135_2_6C24208B
Source: C:\Users\user\AppData\Roaming\Seznam.cz\bin\szndesktop.exe	Code function: 135_2_6C2C20CF	135_2_6C2C20CF
Source: C:\Users\user\AppData\Roaming\Seznam.cz\bin\szndesktop.exe	Code function: 135_2_6C2B2146	135_2_6C2B2146
Source: C:\Users\user\AppData\Roaming\Seznam.cz\bin\szndesktop.exe	Code function: 135_2_6C24DCBB	135_2_6C24DCBB
Source: C:\Users\user\AppData\Roaming\Seznam.cz\bin\szndesktop.exe	Code function: 135_2_6C23BDA0	135_2_6C23BDA0
Source: C:\Users\user\AppData\Roaming\Seznam.cz\bin\szndesktop.exe	Code function: 135_2_6C275837	135_2_6C275837
Source: C:\Users\user\AppData\Roaming\Seznam.cz\bin\szndesktop.exe	Code function: 135_2_6C259840	135_2_6C259840
Source: C:\Users\user\AppData\Roaming\Seznam.cz\bin\szndesktop.exe	Code function: 135_2_6C2DD8C3	135_2_6C2DD8C3
Source: C:\Users\user\AppData\Roaming\Seznam.cz\bin\szndesktop.exe	Code function: 135_2_6C2AD8DA	135_2_6C2AD8DA
Source: C:\Users\user\AppData\Roaming\Seznam.cz\bin\szndesktop.exe	Code function: 135_2_6C241906	135_2_6C241906
Source: C:\Users\user\AppData\Roaming\Seznam.cz\bin\szndesktop.exe	Code function: 135_2_6C23BA5E	135_2_6C23BA5E
Source: C:\Users\user\AppData\Roaming\Seznam.cz\bin\szndesktop.exe	Code function: 135_2_6C2DBB66	135_2_6C2DBB66
Source: C:\Users\user\AppData\Roaming\Seznam.cz\bin\szndesktop.exe	Code function: 135_2_6C267579	135_2_6C267579
Source: C:\Users\user\AppData\Roaming\Seznam.cz\bin\szndesktop.exe	Code function: 135_2_6C2AB63B	135_2_6C2AB63B
Source: C:\Users\user\AppData\Roaming\Seznam.cz\bin\szndesktop.exe	Code function: 135_2_6C2CD670	135_2_6C2CD670
Source: C:\Users\user\AppData\Roaming\Seznam.cz\bin\szndesktop.exe	Code function: 135_2_6C2B56B4	135_2_6C2B56B4
Source: C:\Users\user\AppData\Roaming\Seznam.cz\bin\szndesktop.exe	Code function: 135_2_6C299002	135_2_6C299002
Source: C:\Users\user\AppData\Roaming\Seznam.cz\bin\szndesktop.exe	Code function: 135_2_6C2E10E6	135_2_6C2E10E6
Source: C:\Users\user\AppData\Roaming\Seznam.cz\bin\szndesktop.exe	Code function: 135_2_6C2370ED	135_2_6C2370ED
Source: C:\Users\user\AppData\Roaming\Seznam.cz\bin\szndesktop.exe	Code function: 135_2_6C231137	135_2_6C231137
Source: C:\Users\user\AppData\Roaming\Seznam.cz\bin\szndesktop.exe	Code function: 135_2_6C2C714C	135_2_6C2C714C
Source: C:\Users\user\AppData\Roaming\Seznam.cz\bin\szndesktop.exe	Code function: 135_2_6C253155	135_2_6C253155
Source: C:\Users\user\AppData\Roaming\Seznam.cz\bin\szndesktop.exe	Code function: 135_2_6C247216	135_2_6C247216
Source: C:\Users\user\AppData\Roaming\Seznam.cz\bin\szndesktop.exe	Code function: 135_2_6C2492E9	135_2_6C2492E9
Source: C:\Users\user\AppData\Roaming\Seznam.cz\bin\szndesktop.exe	Code function: 135_2_6C23B35D	135_2_6C23B35D
Source: C:\Users\user\AppData\Roaming\Seznam.cz\bin\szndesktop.exe	Code function: 135_2_6C35EB00	135_2_6C35EB00
Source: C:\Users\user\AppData\Roaming\Seznam.cz\bin\szndesktop.exe	Code function: 135_2_6C36E4A0	135_2_6C36E4A0
Source: C:\Users\user\AppData\Roaming\Seznam.cz\bin\szndesktop.exe	Code function: 135_2_6C33E670	135_2_6C33E670
Source: C:\Users\user\AppData\Roaming\Seznam.cz\bin\szndesktop.exe	Code function: 135_2_6C3707E0	135_2_6C3707E0
Source: C:\Users\user\AppData\Roaming\Seznam.cz\bin\szndesktop.exe	Code function: 135_2_6C36E240	135_2_6C36E240

Source: C:\Users\user\AppData\Local\Temp\~0069FB97.00001B74.sznpkg\UNZIP.EXE	Code function: String function: 00412920 appears 297 times
Source: C:\Users\user\AppData\Local\Temp\~0069FB97.00001B74.sznpkg\UNZIP.EXE	Code function: String function: 00406640 appears 57 times
Source: C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe	Code function: String function: 04C97C8C appears 38 times
Source: C:\Program Files (x86)\Google\Picasa3\Picasa3.exe	Code function: String function: 0487784C appears 46 times
Source: C:\Program Files (x86)\Google\Picasa3\Picasa3.exe	Code function: String function: 0482BBE0 appears 33 times
Source: C:\Program Files (x86)\Google\Picasa3\Picasa3.exe	Code function: String function: 048734CE appears 109 times
Source: C:\Program Files (x86)\Google\Picasa3\Picasa3.exe	Code function: String function: 0404A590 appears 51 times
Source: C:\Program Files (x86)\Google\Picasa3\Picasa3.exe	Code function: String function: 047E7C90 appears 40 times
Source: C:\Program Files (x86)\Google\Picasa3\Picasa3.exe	Code function: String function: 04859BE0 appears 40 times
Source: C:\Program Files (x86)\Google\Picasa3\Picasa3.exe	Code function: String function: 033DFCBC appears 39 times
Source: C:\Program Files (x86)\Google\Picasa3\Picasa3.exe	Code function: String function: 04832DE0 appears 88 times
Source: C:\Program Files (x86)\Google\Picasa3\Picasa3.exe	Code function: String function: 047E3300 appears 67 times
Source: C:\Program Files (x86)\Google\Picasa3\Picasa3.exe	Code function: String function: 033CDD30 appears 51 times
Source: C:\Program Files (x86)\Google\Picasa3\Picasa3.exe	Code function: String function: 04065014 appears 39 times
Source: C:\Users\user\AppData\Roaming\Seznam.cz\bin\szndesktop.exe	Code function: String function: 6C234BAC appears 37 times
Source: C:\Users\user\AppData\Roaming\Seznam.cz\bin\szndesktop.exe	Code function: String function: 6C11A5B1 appears 82 times
Source: C:\Users\user\AppData\Roaming\Seznam.cz\bin\szndesktop.exe	Code function: String function: 6C36CA60 appears 56 times
Source: C:\Users\user\AppData\Roaming\Seznam.cz\bin\szndesktop.exe	Code function: String function: 6C23517A appears 64 times
Source: C:\Users\user\AppData\Roaming\Seznam.cz\bin\szndesktop.exe	Code function: String function: 6C11A5E7 appears 128 times
Source: C:\Users\user\AppData\Roaming\Seznam.cz\bin\szndesktop.exe	Code function: String function: 6C11A57E appears 282 times
Source: C:\Users\user\AppData\Roaming\Seznam.cz\bin\szndesktop.exe	Code function: String function: 6C22E590 appears 34 times
Source: C:\Users\user\AppData\Roaming\Seznam.cz\bin\szndesktop.exe	Code function: String function: 6C22FF6A appears 136 times
Source: C:\Users\user\AppData\Roaming\Seznam.cz\bin\szndesktop.exe	Code function: String function: 6C22FFE8 appears 71 times

Source: C:\Windows\SysWOW64\cmd.exe

Process created: C:\Users\user\AppData\Local\Temp\~0069FB97.00001B74.sznpkg\REG.EXE REG DELETE "HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall\SeznamInstall" /f /va

Source: classification engine

Classification label: mal72.rans.evad.winZIP@317/1031@40/38

Source: C:\Program Files (x86)\Google\Picasa3\Picasa3.exe

Code function: 20_2_04036450 GetLastError,FormatMessageA,LocalFree,

20_2_04036450

Source: C:\Users\user\AppData\Local\Temp\~0069FB97.00001B74.sznpkg\UNZIP.EXE	Code function: 38_2_00412830 GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueA,LookupPrivilegeValueA,GetLastError,AdjustTokenPrivileges,AdjustTokenPrivileges,GetLastError,CloseHandle,LookupPrivilegeValueA,AdjustTokenPrivileges,GetLastError,CloseHandle,		38_2_00412830
Source: C:\Users\user\AppData\Local\Temp\~0069FB97.00001B74.sznpkg\REG.EXE	Code function: 42_2_01003280 GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,GetLastError,		42_2_01003280

Source: C:\Users\user\AppData\Roaming\Seznam.cz\bin\szndesktop.exe

Code function: 135_2_6C10DAAA ?_Statvfs@sys@tr2@std@@YA?AUspace_info@123@PB_W@Z,__EH_prolog3_GS,wcslen,GetDiskFreeSpaceExW,

135_2_6C10DAAA

Source: C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe

Code function: 16_2_04C91D20 CoCreateInstance,

16_2_04C91D20

Source: C:\Program Files (x86)\Google\Picasa3\Picasa3.exe

Code function: 20_2_033B2780 lstrlenW,_malloc,WideCharToMultiByte,LoadLibraryExA,FindResourceA,LoadResource,SizeofResource,FreeLibrary,

20_2_033B2780

Source: C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe

File created: C:\Program Files (x86)\Google\Picasa3

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe

File created: C:\Users\Public\Desktop\Picasa 3.lnk

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2080:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5744:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4132:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7324:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3916:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6608:120:WilError_03
Source: C:\Program Files (x86)\Google\Picasa3\PicasaPhotoViewer.exe	Mutant created: \Sessions\1\BaseNamedObjects\Slingshot
Source: C:\Windows\SysWOW64\rundll32.exe	Mutant created: \Sessions\1\BaseNamedObjects\{42FD847D-5CAE-41A6-ACA4-9BDF58CE3344}
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7384:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:304:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3616:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4020:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2932:120:WilError_03
Source: C:\Program Files (x86)\Google\Picasa3\PicasaPhotoViewer.exe	Mutant created: \Sessions\1\BaseNamedObjects\Slingshot_setup
Source: C:\Program Files (x86)\Google\Picasa3\Picasa3.exe	Mutant created: \Sessions\1\BaseNamedObjects\Picasa
Source: C:\Users\user\AppData\Roaming\Seznam.cz\sznsetup.exe	Mutant created: \Sessions\1\BaseNamedObjects\szn-install-2012-d258fa602b6b6016a83aa6553428620f
Source: C:\Users\user\AppData\Roaming\Seznam.cz\bin\szndesktop.exe	Mutant created: \Sessions\1\BaseNamedObjects\LightSpeed-ServiceApp-runmutexszndesktop.exe
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2084:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4184:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7452:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5232:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6464:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7460:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2188:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3640:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7872:120:WilError_03
Source: C:\Program Files (x86)\Google\Picasa3\Picasa3.exe	Mutant created: \Sessions\1\BaseNamedObjects\Picasa2
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7844:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5488:120:WilError_03

Source: C:\Users\user\Desktop\1a4e5ccd35a56d84281a143f831563be.exe

File created: C:\Users\user\AppData\Local\Temp\nsf8723.tmp

Jump to behavior

Source: C:\Users\user\AppData\Roaming\Seznam.cz\sznsetup-lt.exe

Process created: C:\Windows\SysWOW64\cmd.exe cmd /S /C "install.bat C:\Users\user\AppData\Roaming\Seznam.cz"

Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

System information queried: HandleInformation

Source: C:\Users\user\Desktop\1a4e5ccd35a56d84281a143f831563be.exe

File read: C:\Users\desktop.ini

Jump to behavior

Source: C:\Windows\System32\rundll32.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: unknown

Process created: C:\Windows\System32\rundll32.exe C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding

Source: UNZIP.EXE

String found in binary or memory: C:/Users/user/AppData/Roaming/Seznam.cz/install/com.microsoft.msdn.msvcr110-11.0.51106.1-win32.zip

Source: unknown	Process created: C:\Windows\System32\rundll32.exe C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
Source: unknown	Process created: C:\Users\user\Desktop\1a4e5ccd35a56d84281a143f831563be.exe "C:\Users\user\Desktop\1a4e5ccd35a56d84281a143f831563be.exe"
Source: unknown	Process created: C:\Users\user\Desktop\1a4e5ccd35a56d84281a143f831563be.exe "C:\Users\user\Desktop\1a4e5ccd35a56d84281a143f831563be.exe"
Source: C:\Users\user\Desktop\1a4e5ccd35a56d84281a143f831563be.exe	Process created: C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe setuppicasa39-setup.exe
Source: C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe	Process created: C:\Windows\SysWOW64\GPhotos.scr "C:\Windows\system32\GPhotos.scr" /c /installcheck
Source: C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe	Process created: C:\Program Files (x86)\Google\Picasa3\Picasa3.exe "C:\Program Files (x86)\Google\Picasa3\Picasa3.exe" /register
Source: unknown	Process created: C:\Program Files (x86)\Google\Picasa3\Picasa3.exe "C:\Program Files (x86)\Google\Picasa3\Picasa3.exe"
Source: C:\Program Files (x86)\Google\Picasa3\Picasa3.exe	Process created: C:\Program Files (x86)\Google\Picasa3\PicasaPhotoViewer.exe /config
Source: C:\Users\user\Desktop\1a4e5ccd35a56d84281a143f831563be.exe	Process created: C:\Users\user\AppData\Local\Temp\nsm983C.tmp\listicka.exe listicka.exe /S
Source: C:\Users\user\AppData\Local\Temp\nsm983C.tmp\listicka.exe	Process created: C:\Users\user\AppData\Roaming\Seznam.cz\sznsetup-lt.exe "C:\Users\user\AppData\Roaming\Seznam.cz\sznsetup-lt.exe" -T "C:\Users\user\AppData\Roaming\Seznam.cz" -R "$\install" http://download.seznam.cz/update
Source: C:\Users\user\AppData\Roaming\Seznam.cz\sznsetup-lt.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\nsm983C.tmp\listicka.exe	Process created: C:\Users\user\AppData\Roaming\Seznam.cz\sznsetup-lt.exe "C:\Users\user\AppData\Roaming\Seznam.cz\sznsetup-lt.exe" -T "C:\Users\user\AppData\Roaming\Seznam.cz" -i cz.seznam.software.szninstall
Source: C:\Users\user\AppData\Roaming\Seznam.cz\sznsetup-lt.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Program Files (x86)\Google\Picasa3\Picasa3.exe	Process created: C:\Program Files\Internet Explorer\iexplore.exe "C:\Program Files\Internet Explorer\iexplore.exe" -nohome "http://picasa.google.com/support/bin/answer.py?hl=en&answer=93773"
Source: C:\Program Files\Internet Explorer\iexplore.exe	Process created: C:\Program Files (x86)\Internet Explorer\iexplore.exe "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3720 CREDAT:9474 /prefetch:2
Source: C:\Program Files (x86)\Internet Explorer\iexplore.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\BHO\ie_to_edge_stub.exe "C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\BHO\ie_to_edge_stub.exe" --from-ie-to-edge=3 --ie-frame-hwnd=602e8
Source: C:\Program Files\Internet Explorer\iexplore.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\BHO\ie_to_edge_stub.exe "C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\BHO\ie_to_edge_stub.exe" --from-ie-to-edge=3 --ie-frame-hwnd=602e8
Source: C:\Program Files (x86)\Internet Explorer\iexplore.exe	Process created: C:\Program Files (x86)\Java\jre-1.8\bin\ssvagent.exe "C:\PROGRA~2\Java\jre-1.8\bin\ssvagent.exe" -new
Source: C:\Program Files\Internet Explorer\iexplore.exe	Process created: C:\Program Files (x86)\Java\jre-1.8\bin\ssvagent.exe "C:\PROGRA~2\Java\jre-1.8\bin\ssvagent.exe" -new
Source: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\BHO\ie_to_edge_stub.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --from-ie-to-edge=3 --ie-frame-hwnd=602e8
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2244 --field-trial-handle=2004,i,1639013666010223883,15040558206664522354,262144 /prefetch:3
Source: C:\Users\user\AppData\Roaming\Seznam.cz\sznsetup-lt.exe	Process created: C:\Users\user\AppData\Local\Temp\~0069FB97.00001B74.sznpkg\UNZIP.EXE C:\Users\user\AppData\Local\Temp\~0069FB97.00001B74.sznpkg\unzip.exe -d C:\Users\user\AppData\Local\Temp\~006A18C4.00001B74.sznpkg -o C:\Users\user\AppData\Local\Temp\~0069FB97.00001B74.sznpkg\download\cz.seznam.software.sznsetup-1.2.7-win32.zip
Source: C:\Users\user\AppData\Roaming\Seznam.cz\sznsetup-lt.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /S /C "install.bat C:\Users\user\AppData\Roaming\Seznam.cz"
Source: C:\Users\user\AppData\Roaming\Seznam.cz\sznsetup-lt.exe	Process created: C:\Users\user\AppData\Local\Temp\~0069FB97.00001B74.sznpkg\UNZIP.EXE C:\Users\user\AppData\Local\Temp\~0069FB97.00001B74.sznpkg\unzip.exe -d C:\Users\user\AppData\Local\Temp\~006A1AF6.00001B74.sznpkg -o C:\Users\user\AppData\Local\Temp\~0069FB97.00001B74.sznpkg\download\cz.seznam.software.szninstall-1.1.15-win32.zip
Source: C:\Users\user\AppData\Roaming\Seznam.cz\sznsetup-lt.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /S /C "install.bat C:\Users\user\AppData\Roaming\Seznam.cz"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\~0069FB97.00001B74.sznpkg\REG.EXE REG DELETE "HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall\SeznamInstall" /f /va
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\~0069FB97.00001B74.sznpkg\REG.EXE REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall\SeznamInstall" /f
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\~0069FB97.00001B74.sznpkg\REG.EXE REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall\SeznamInstall" /f /v "InstallLocation" /d C:\Users\user\AppData\Roaming\Seznam.cz
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\~0069FB97.00001B74.sznpkg\REG.EXE REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall\SeznamInstall" /f /v "DisplayName" /d "Seznam Software"
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=1724 --field-trial-handle=2004,i,1639013666010223883,15040558206664522354,262144 /prefetch:8
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\~0069FB97.00001B74.sznpkg\REG.EXE REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall\SeznamInstall" /f /v "DisplayIcon" /d "C:\Users\user\AppData\Roaming\Seznam.cz\szninstall.exe,0"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\~0069FB97.00001B74.sznpkg\REG.EXE REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall\SeznamInstall" /f /v "UninstallString" /d "\"C:\Users\user\AppData\Roaming\Seznam.cz\szninstall.exe\" -X"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\~0069FB97.00001B74.sznpkg\REG.EXE REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall\SeznamInstall" /f /v "ModifyPath" /d "C:\Users\user\AppData\Roaming\Seznam.cz\szninstall.exe"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\~0069FB97.00001B74.sznpkg\REG.EXE REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall\SeznamInstall" /f /v "Publisher" /d "Seznam.cz"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\~0069FB97.00001B74.sznpkg\REG.EXE REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall\SeznamInstall" /f /v "URLInfoAbout" /d "http://software.seznam.cz"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\~0069FB97.00001B74.sznpkg\REG.EXE REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall\SeznamInstall" /f /v "Comments" /d "Vsechny aplikace spolecnosti Seznam.cz a.s."
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\~0069FB97.00001B74.sznpkg\REG.EXE REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall\SeznamInstall" /f /v "NoRepair" /t REG_DWORD /d 1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\~0069FB97.00001B74.sznpkg\REG.EXE REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall\SeznamInstall" /f /v "NoModify" /t REG_DWORD /d 0
Source: C:\Users\user\AppData\Local\Temp\nsm983C.tmp\listicka.exe	Process created: C:\Users\user\AppData\Roaming\Seznam.cz\szninstall.exe "C:\Users\user\AppData\Roaming\Seznam.cz\szninstall.exe" -s -u -i cz.seznam.software.autoupdate szn-software-listicka
Source: C:\Users\user\AppData\Roaming\Seznam.cz\szninstall.exe	Process created: C:\Users\user\AppData\Roaming\Seznam.cz\sznsetup.exe C:\Users\user\AppData\Roaming\Seznam.cz\sznsetup.exe -V
Source: C:\Users\user\AppData\Roaming\Seznam.cz\sznsetup.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=6596 --field-trial-handle=2004,i,1639013666010223883,15040558206664522354,262144 /prefetch:8
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-GB --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --mojo-platform-channel-handle=3720 --field-trial-handle=2004,i,1639013666010223883,15040558206664522354,262144 /prefetch:8
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\cookie_exporter.exe cookie_exporter.exe --cookie-json=1188
Source: C:\Users\user\AppData\Roaming\Seznam.cz\szninstall.exe	Process created: C:\Users\user\AppData\Roaming\Seznam.cz\sznsetup.exe C:\Users\user\AppData\Roaming\Seznam.cz\sznsetup.exe -T C:\Users\user\AppData\Roaming\Seznam.cz -i -u cz.seznam.software.autoupdate szn-software-listicka -p
Source: C:\Users\user\AppData\Roaming\Seznam.cz\sznsetup.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Program Files\Internet Explorer\iexplore.exe	Process created: C:\Program Files (x86)\Internet Explorer\iexplore.exe "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3720 CREDAT:202066 /prefetch:2
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-GB --service-sandbox-type=audio --mojo-platform-channel-handle=4984 --field-trial-handle=2004,i,1639013666010223883,15040558206664522354,262144 /prefetch:8
Source: C:\Users\user\AppData\Roaming\Seznam.cz\sznsetup.exe	Process created: C:\Users\user\AppData\Local\Temp\~006A2DE2.00000DD4.sznpkg\UNZIP.EXE C:\Users\user\AppData\Local\Temp\~006A2DE2.00000DD4.sznpkg\unzip.exe -d C:\Users\user\AppData\Local\Temp\~006A81A0.00000DD4.sznpkg -o C:\Users\user\AppData\Roaming\Seznam.cz\install\cz.seznam.software.autoupdate-1.0.8-win32.zip
Source: C:\Users\user\AppData\Local\Temp\~006A2DE2.00000DD4.sznpkg\UNZIP.EXE	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Roaming\Seznam.cz\sznsetup.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /S /C "install.bat C:\Users\user\AppData\Roaming\Seznam.cz"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\~006A2DE2.00000DD4.sznpkg\REG.EXE REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "cz.seznam.software.autoupdate" /d "\"C:\Users\user\AppData\Roaming\Seznam.cz\szninstall.exe\" -c"
Source: C:\Users\user\AppData\Roaming\Seznam.cz\sznsetup.exe	Process created: C:\Users\user\AppData\Local\Temp\~006A2DE2.00000DD4.sznpkg\UNZIP.EXE C:\Users\user\AppData\Local\Temp\~006A2DE2.00000DD4.sznpkg\unzip.exe -d C:\Users\user\AppData\Local\Temp\~006A8374.00000DD4.sznpkg -o C:\Users\user\AppData\Roaming\Seznam.cz\install\szn-software-base-1.0.0-win32.zip
Source: C:\Users\user\AppData\Local\Temp\~006A2DE2.00000DD4.sznpkg\UNZIP.EXE	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Roaming\Seznam.cz\sznsetup.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /S /C "install.bat C:\Users\user\AppData\Roaming\Seznam.cz"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Roaming\Seznam.cz\sznsetup.exe	Process created: C:\Users\user\AppData\Local\Temp\~006A2DE2.00000DD4.sznpkg\UNZIP.EXE C:\Users\user\AppData\Local\Temp\~006A2DE2.00000DD4.sznpkg\unzip.exe -d C:\Users\user\AppData\Local\Temp\~006A848E.00000DD4.sznpkg -o C:\Users\user\AppData\Roaming\Seznam.cz\install\com.microsoft.msdn.msvcr110-11.0.51106.1-win32.zip
Source: C:\Users\user\AppData\Local\Temp\~006A2DE2.00000DD4.sznpkg\UNZIP.EXE	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Roaming\Seznam.cz\sznsetup.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /S /C "install.bat C:\Users\user\AppData\Roaming\Seznam.cz"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\~006A2DE2.00000DD4.sznpkg\CPY.EXE cpy msvcp110.dll "C:\Users\user\AppData\Roaming\Seznam.cz\bin"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\~006A2DE2.00000DD4.sznpkg\CPY.EXE cpy msvcr110.dll "C:\Users\user\AppData\Roaming\Seznam.cz\bin"
Source: C:\Users\user\AppData\Roaming\Seznam.cz\sznsetup.exe	Process created: C:\Users\user\AppData\Local\Temp\~006A2DE2.00000DD4.sznpkg\UNZIP.EXE C:\Users\user\AppData\Local\Temp\~006A2DE2.00000DD4.sznpkg\unzip.exe -d C:\Users\user\AppData\Local\Temp\~006A8960.00000DD4.sznpkg -o C:\Users\user\AppData\Local\Temp\~006A2DE2.00000DD4.sznpkg\download\cz.seznam.software.lightspeed-1210-12.10.18-win32.zip
Source: C:\Users\user\AppData\Local\Temp\~006A2DE2.00000DD4.sznpkg\UNZIP.EXE	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Roaming\Seznam.cz\sznsetup.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /S /C "install.bat C:\Users\user\AppData\Roaming\Seznam.cz"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\~006A2DE2.00000DD4.sznpkg\CPY.EXE cpy lightspeed.dll "C:\Users\user\AppData\Roaming\Seznam.cz\bin"
Source: C:\Users\user\AppData\Roaming\Seznam.cz\sznsetup.exe	Process created: C:\Users\user\AppData\Local\Temp\~006A2DE2.00000DD4.sznpkg\UNZIP.EXE C:\Users\user\AppData\Local\Temp\~006A2DE2.00000DD4.sznpkg\unzip.exe -d C:\Users\user\AppData\Local\Temp\~006A8B64.00000DD4.sznpkg -o C:\Users\user\AppData\Local\Temp\~006A2DE2.00000DD4.sznpkg\download\cz.seznam.software.libszndesktop-2.1.35-win32.zip
Source: C:\Users\user\AppData\Local\Temp\~006A2DE2.00000DD4.sznpkg\UNZIP.EXE	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Roaming\Seznam.cz\sznsetup.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /S /C "install.bat C:\Users\user\AppData\Roaming\Seznam.cz"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\~006A2DE2.00000DD4.sznpkg\CPY.EXE cpy "szndesktop.exe" "C:\Users\user\AppData\Roaming\Seznam.cz\bin"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\~006A2DE2.00000DD4.sznpkg\CPY.EXE cpy "szndesktop.conf" "C:\Users\user\AppData\Roaming\Seznam.cz\conf"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\~006A2DE2.00000DD4.sznpkg\CPY.EXE cpy "szndesktop.webpak" "C:\Users\user\AppData\Roaming\Seznam.cz\data"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\~006A2DE2.00000DD4.sznpkg\CPY.EXE cpy "sznpp.exe" "C:\Users\user\AppData\Roaming\Seznam.cz\bin"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\~006A2DE2.00000DD4.sznpkg\REG.EXE reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall\SeznamInstall" /v DisplayVersion /t REG_SZ /d "2.1.35" /f
Source: C:\Users\user\AppData\Roaming\Seznam.cz\sznsetup.exe	Process created: C:\Users\user\AppData\Local\Temp\~006A2DE2.00000DD4.sznpkg\UNZIP.EXE C:\Users\user\AppData\Local\Temp\~006A2DE2.00000DD4.sznpkg\unzip.exe -d C:\Users\user\AppData\Local\Temp\~006A9140.00000DD4.sznpkg -o C:\Users\user\AppData\Local\Temp\~006A2DE2.00000DD4.sznpkg\download\cz.seznam.software.szndesktop-2.0.32-win32.zip
Source: C:\Users\user\AppData\Local\Temp\~006A2DE2.00000DD4.sznpkg\UNZIP.EXE	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Roaming\Seznam.cz\sznsetup.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /S /C "install.bat C:\Users\user\AppData\Roaming\Seznam.cz"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\~006A2DE2.00000DD4.sznpkg\CPY.EXE cpy "wszndesktop.exe" "C:\Users\user\AppData\Roaming\Seznam.cz\bin"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\~006A2DE2.00000DD4.sznpkg\REG.EXE REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "cz.seznam.software.szndesktop" /d "\"C:\Users\user\AppData\Roaming\Seznam.cz\bin\wszndesktop.exe\" -q"
Source: C:\Users\user\AppData\Roaming\Seznam.cz\sznsetup.exe	Process created: C:\Users\user\AppData\Local\Temp\~006A2DE2.00000DD4.sznpkg\UNZIP.EXE C:\Users\user\AppData\Local\Temp\~006A2DE2.00000DD4.sznpkg\unzip.exe -d C:\Users\user\AppData\Local\Temp\~006A93FF.00000DD4.sznpkg -o C:\Users\user\AppData\Local\Temp\~006A2DE2.00000DD4.sznpkg\download\cz.seznam.software.libfoxcub-3.3.8-win32.zip
Source: C:\Users\user\AppData\Local\Temp\~006A2DE2.00000DD4.sznpkg\UNZIP.EXE	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Roaming\Seznam.cz\sznsetup.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /S /C "install.bat C:\Users\user\AppData\Roaming\Seznam.cz"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\~006A2DE2.00000DD4.sznpkg\CPY.EXE cpy libfoxcub.dll "C:\Users\user\AppData\Roaming\Seznam.cz\bin"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\~006A2DE2.00000DD4.sznpkg\CPY.EXE cpy libfoxcub-x64.dll "C:\Users\user\AppData\Roaming\Seznam.cz\bin"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\~006A2DE2.00000DD4.sznpkg\CPY.EXE cpy libfoxcub.conf "C:\Users\user\AppData\Roaming\Seznam.cz\conf\szndesktop.d"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\~006A2DE2.00000DD4.sznpkg\CPY.EXE cpy foxcub.conf "C:\Users\user\AppData\Roaming\Seznam.cz\conf\libfoxcub"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\~006A2DE2.00000DD4.sznpkg\CPY.EXE cpy remote.conf "C:\Users\user\AppData\Roaming\Seznam.cz\conf\libfoxcub"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\~006A2DE2.00000DD4.sznpkg\CPY.EXE cpy listickaconfig.webpak "C:\Users\user\AppData\Roaming\Seznam.cz\data"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\~006A2DE2.00000DD4.sznpkg\CPY.EXE cpy listickanastaveni.webpak "C:\Users\user\AppData\Roaming\Seznam.cz\data"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\~006A2DE2.00000DD4.sznpkg\CPY.EXE cpy speeddial.webpak "C:\Users\user\AppData\Roaming\Seznam.cz\data"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe libfoxcub.dll,UpgradeListicka
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\~006A2DE2.00000DD4.sznpkg\REG.EXE REG QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\szn-software-listicka" /v "UninstallString"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\~006A2DE2.00000DD4.sznpkg\REG.EXE REG QUERY "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\szn-software-listicka" /v "UninstallString"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\~006A2DE2.00000DD4.sznpkg\REG.EXE REG DELETE "HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Explorer Bars\{EA837F48-5AD1-443E-AE34-FFE03CBF3099}" /F
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\AppData\Roaming\Seznam.cz\bin\sznpp.exe "C:\Users\user\AppData\Roaming\Seznam.cz\bin\sznpp.exe" -v report-ielisticka-install --status=0
Source: C:\Users\user\AppData\Roaming\Seznam.cz\sznsetup.exe	Process created: C:\Users\user\AppData\Local\Temp\~006A2DE2.00000DD4.sznpkg\UNZIP.EXE C:\Users\user\AppData\Local\Temp\~006A2DE2.00000DD4.sznpkg\unzip.exe -d C:\Users\user\AppData\Local\Temp\~006AA61F.00000DD4.sznpkg -o C:\Users\user\AppData\Roaming\Seznam.cz\install\cz.seznam.software.libfoxloader-3.2.7-win32.zip
Source: C:\Users\user\AppData\Local\Temp\~006A2DE2.00000DD4.sznpkg\UNZIP.EXE	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Roaming\Seznam.cz\sznsetup.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /S /C "install.bat C:\Users\user\AppData\Roaming\Seznam.cz"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Roaming\Seznam.cz\sznsetup.exe	Process created: C:\Users\user\AppData\Local\Temp\~006A2DE2.00000DD4.sznpkg\UNZIP.EXE C:\Users\user\AppData\Local\Temp\~006A2DE2.00000DD4.sznpkg\unzip.exe -d C:\Users\user\AppData\Local\Temp\~006AA7B6.00000DD4.sznpkg -o C:\Users\user\AppData\Local\Temp\~006A2DE2.00000DD4.sznpkg\download\cz.seznam.software.libfoxcub64-3.3.8-win32.zip
Source: C:\Users\user\AppData\Local\Temp\~006A2DE2.00000DD4.sznpkg\UNZIP.EXE	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Roaming\Seznam.cz\sznsetup.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /S /C "install.bat C:\Users\user\AppData\Roaming\Seznam.cz"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\~006A2DE2.00000DD4.sznpkg\CPY.EXE cpy libfoxcub-x64.dll "C:\Users\user\AppData\Roaming\Seznam.cz\bin"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\~006A2DE2.00000DD4.sznpkg\CPY.EXE cpy listicka-x64.exe "C:\Users\user\AppData\Roaming\Seznam.cz\bin"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\AppData\Roaming\Seznam.cz\bin\szndesktop.exe szndesktop.exe default restart
Source: C:\Users\user\AppData\Roaming\Seznam.cz\bin\szndesktop.exe	Process created: C:\Users\user\AppData\Roaming\Seznam.cz\bin\szndesktop.exe szndesktop.exe default restart
Source: C:\Users\user\AppData\Roaming\Seznam.cz\bin\szndesktop.exe	Process created: C:\Users\user\AppData\Roaming\Seznam.cz\bin\listicka-x64.exe "C:\Users\user\AppData\Roaming\Seznam.cz\bin\listicka-x64.exe"
Source: C:\Users\user\AppData\Roaming\Seznam.cz\bin\szndesktop.exe	Process created: C:\Users\user\AppData\Roaming\Seznam.cz\bin\sznpp.exe "C:\Users\user\AppData\Roaming\Seznam.cz\bin\sznpp.exe" report-startup
Source: C:\Users\user\AppData\Roaming\Seznam.cz\bin\listicka-x64.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Roaming\Seznam.cz\sznsetup.exe	Process created: C:\Users\user\AppData\Local\Temp\~006A2DE2.00000DD4.sznpkg\UNZIP.EXE C:\Users\user\AppData\Local\Temp\~006A2DE2.00000DD4.sznpkg\unzip.exe -d C:\Users\user\AppData\Local\Temp\~006AB17A.00000DD4.sznpkg -o C:\Users\user\AppData\Local\Temp\~006A2DE2.00000DD4.sznpkg\download\cz.seznam.software.ielisticka3-3.3.5-win32.zip
Source: C:\Users\user\AppData\Local\Temp\~006A2DE2.00000DD4.sznpkg\UNZIP.EXE	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Roaming\Seznam.cz\sznsetup.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /S /C "install.bat C:\Users\user\AppData\Roaming\Seznam.cz"
Source: C:\Users\user\AppData\Roaming\Seznam.cz\sznsetup.exe	Process created: C:\Users\user\AppData\Local\Temp\~006A2DE2.00000DD4.sznpkg\UNZIP.EXE C:\Users\user\AppData\Local\Temp\~006A2DE2.00000DD4.sznpkg\unzip.exe -d C:\Users\user\AppData\Local\Temp\~006AB2D1.00000DD4.sznpkg -o C:\Users\user\AppData\Local\Temp\~006A2DE2.00000DD4.sznpkg\download\szn-software-fflisticka-4.0.8-win32.zip
Source: C:\Users\user\AppData\Local\Temp\~006A2DE2.00000DD4.sznpkg\UNZIP.EXE	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Roaming\Seznam.cz\sznsetup.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /S /C "install.bat C:\Users\user\AppData\Roaming\Seznam.cz"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\AppData\Roaming\Seznam.cz\bin\sznpp.exe "C:\Users\user\AppData\Roaming\Seznam.cz\bin\sznpp.exe" install_ff "C:\Users\user\AppData\Roaming\Seznam.cz\data\fflisticka\seznam_doplnek_email-4.4.1-fx.xpi"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\AppData\Roaming\Seznam.cz\bin\sznpp.exe "C:\Users\user\AppData\Roaming\Seznam.cz\bin\sznpp.exe" install_ff "C:\Users\user\AppData\Roaming\Seznam.cz\data\fflisticka\sko-extension@firma.seznam.cz.xpi"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\AppData\Roaming\Seznam.cz\bin\sznpp.exe "C:\Users\user\AppData\Roaming\Seznam.cz\bin\sznpp.exe" install-firefox-nm
Source: C:\Users\user\AppData\Roaming\Seznam.cz\sznsetup.exe	Process created: C:\Users\user\AppData\Local\Temp\~006A2DE2.00000DD4.sznpkg\UNZIP.EXE C:\Users\user\AppData\Local\Temp\~006A2DE2.00000DD4.sznpkg\unzip.exe -d C:\Users\user\AppData\Local\Temp\~006AC669.00000DD4.sznpkg -o C:\Users\user\AppData\Roaming\Seznam.cz\install\cz.seznam.software.chromelisticka-2.0.4-win32.zip
Source: C:\Users\user\AppData\Local\Temp\~006A2DE2.00000DD4.sznpkg\UNZIP.EXE	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Roaming\Seznam.cz\sznsetup.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /S /C "install.bat C:\Users\user\AppData\Roaming\Seznam.cz"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\AppData\Roaming\Seznam.cz\bin\sznpp.exe "C:\Users\user\AppData\Roaming\Seznam.cz\bin\sznpp.exe" install-chrome all
Source: C:\Users\user\AppData\Roaming\Seznam.cz\bin\sznpp.exe	Process created: C:\Users\user\AppData\Roaming\Seznam.cz\bin\sznpp_64.exe "C:\Users\user\AppData\Roaming\Seznam.cz\bin\sznpp.exe" install-chrome all
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\AppData\Roaming\Seznam.cz\bin\sznpp.exe "C:\Users\user\AppData\Roaming\Seznam.cz\bin\sznpp.exe" install-chrome-nm
Source: C:\Users\user\AppData\Roaming\Seznam.cz\sznsetup.exe	Process created: C:\Users\user\AppData\Local\Temp\~006A2DE2.00000DD4.sznpkg\UNZIP.EXE C:\Users\user\AppData\Local\Temp\~006A2DE2.00000DD4.sznpkg\unzip.exe -d C:\Users\user\AppData\Local\Temp\~006AD463.00000DD4.sznpkg -o C:\Users\user\AppData\Roaming\Seznam.cz\install\com.microsoft.msdn.msvcr100-10.0.40219.325-win32.zip
Source: C:\Users\user\AppData\Local\Temp\~006A2DE2.00000DD4.sznpkg\UNZIP.EXE	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Roaming\Seznam.cz\sznsetup.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /S /C "install.bat C:\Users\user\AppData\Roaming\Seznam.cz"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\~006A2DE2.00000DD4.sznpkg\CPY.EXE cpy msvcp100.dll "C:\Users\user\AppData\Roaming\Seznam.cz\bin"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\~006A2DE2.00000DD4.sznpkg\CPY.EXE cpy msvcr100.dll "C:\Users\user\AppData\Roaming\Seznam.cz\bin"
Source: C:\Users\user\AppData\Roaming\Seznam.cz\sznsetup.exe	Process created: C:\Users\user\AppData\Local\Temp\~006A2DE2.00000DD4.sznpkg\UNZIP.EXE C:\Users\user\AppData\Local\Temp\~006A2DE2.00000DD4.sznpkg\unzip.exe -d C:\Users\user\AppData\Local\Temp\~006AD780.00000DD4.sznpkg -o C:\Users\user\AppData\Roaming\Seznam.cz\install\cz.seznam.software.pp-1.0.2-win32.zip
Source: C:\Users\user\AppData\Local\Temp\~006A2DE2.00000DD4.sznpkg\UNZIP.EXE	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Roaming\Seznam.cz\sznsetup.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /S /C "install.bat C:\Users\user\AppData\Roaming\Seznam.cz"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\~006A2DE2.00000DD4.sznpkg\CPY.EXE cpy unlockInstance.dll "C:\Users\user\AppData\Roaming\Seznam.cz\bin"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\~006A2DE2.00000DD4.sznpkg\CPY.EXE cpy unlockInstance.conf "C:\Users\user\AppData\Roaming\Seznam.cz\conf\szndesktop.d"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\AppData\Roaming\Seznam.cz\bin\szndesktop.exe szndesktop.exe default restart
Source: C:\Users\user\AppData\Roaming\Seznam.cz\bin\szndesktop.exe	Process created: C:\Users\user\AppData\Roaming\Seznam.cz\bin\szndesktop.exe szndesktop.exe default restart
Source: C:\Users\user\AppData\Roaming\Seznam.cz\bin\szndesktop.exe	Process created: C:\Users\user\AppData\Roaming\Seznam.cz\bin\sznpp.exe "C:\Users\user\AppData\Roaming\Seznam.cz\bin\sznpp.exe" install-chrome retry
Source: C:\Users\user\AppData\Roaming\Seznam.cz\bin\sznpp.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Roaming\Seznam.cz\bin\szndesktop.exe	Process created: C:\Users\user\AppData\Roaming\Seznam.cz\bin\listicka-x64.exe "C:\Users\user\AppData\Roaming\Seznam.cz\bin\listicka-x64.exe"
Source: C:\Users\user\AppData\Roaming\Seznam.cz\bin\szndesktop.exe	Process created: C:\Users\user\AppData\Roaming\Seznam.cz\bin\sznpp.exe "C:\Users\user\AppData\Roaming\Seznam.cz\bin\sznpp.exe" report-startup
Source: C:\Users\user\AppData\Roaming\Seznam.cz\bin\listicka-x64.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Roaming\Seznam.cz\bin\sznpp.exe	Process created: C:\Users\user\AppData\Roaming\Seznam.cz\bin\sznpp_64.exe "C:\Users\user\AppData\Roaming\Seznam.cz\bin\sznpp.exe" install-chrome retry
Source: C:\Users\user\AppData\Roaming\Seznam.cz\sznsetup.exe	Process created: C:\Users\user\AppData\Local\Temp\~006A2DE2.00000DD4.sznpkg\UNZIP.EXE C:\Users\user\AppData\Local\Temp\~006A2DE2.00000DD4.sznpkg\unzip.exe -d C:\Users\user\AppData\Local\Temp\~006AE03A.00000DD4.sznpkg -o C:\Users\user\AppData\Roaming\Seznam.cz\install\szn-software-listicka-3.0.0-win32.zip
Source: C:\Users\user\AppData\Local\Temp\~006A2DE2.00000DD4.sznpkg\UNZIP.EXE	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Roaming\Seznam.cz\bin\sznpp_64.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe chrome.exe --no-default-browser-check --new-window about:blank
Source: C:\Users\user\AppData\Roaming\Seznam.cz\sznsetup.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /S /C "install.bat C:\Users\user\AppData\Roaming\Seznam.cz"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\AppData\Roaming\Seznam.cz\sznsetup.exe "C:\Users\user\AppData\Roaming\Seznam.cz\sznsetup.exe" -A 49764 cd "C:\Users\user\AppData\Roaming\Seznam.cz"
Source: C:\Users\user\AppData\Roaming\Seznam.cz\szninstall.exe	Process created: C:\Users\user\AppData\Roaming\Seznam.cz\szninstall.exe "C:\Users\user\AppData\Roaming\Seznam.cz\szninstall.exe" -S 49764
Source: C:\Windows\System32\conhost.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2216 --field-trial-handle=1932,i,14273124409084968856,4101485093560783332,262144 /prefetch:8
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\AppData\Roaming\Seznam.cz\sznsetup.exe "C:\Users\user\AppData\Roaming\Seznam.cz\sznsetup.exe" -A 49764 "C:\Users\user\AppData\Local\Temp\~006AE03A.00000DD4.sznpkg\install.bat" ADMINPHASE . "C:\Program Files (x86)\Seznam.cz\distribution"
Source: C:\Users\user\AppData\Roaming\Seznam.cz\szninstall.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c C:\Users\user\AppData\Local\Temp\~006AE03A.00000DD4.sznpkg\install.bat ADMINPHASE . "C:\Program Files (x86)\Seznam.cz\distribution"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\AppData\Roaming\Seznam.cz\sznsetup.exe ".\sznsetup.exe" -T "C:\Program Files (x86)\Seznam.cz\distribution" -R "C:\Program Files (x86)\Seznam.cz\distribution\install"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\xcopy.exe xcopy /S /Y /G /I ".\install\." "C:\Program Files (x86)\Seznam.cz\distribution\install"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\~006A2DE2.00000DD4.sznpkg\REG.EXE REG ADD "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /f /v "seznam-listicka-distribuce" /d "\"C:\Program Files (x86)\Seznam.cz\distribution\szninstall.exe\" -s -d listicka 1 szn-software-listicka cz.seznam.software.autoupdate"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\~006A2DE2.00000DD4.sznpkg\REG.EXE REG ADD "HKEY_CURRENT_USER\SOFTWARE\Seznam.cz\distribution" /f /v "listicka" /t REG_DWORD /d 1
Source: C:\Users\user\AppData\Roaming\Seznam.cz\sznsetup.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /S /C "C:\Users\user\AppData\Roaming\Seznam.cz\uninstall\cz_seznam_software_libszndesktop_2_1_35.reconfigure.bat C:\Users\user\AppData\Roaming\Seznam.cz"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\AppData\Roaming\Seznam.cz\bin\szndesktop.exe "C:\Users\user\AppData\Roaming\Seznam.cz\bin\szndesktop.exe" default restart
Source: C:\Users\user\AppData\Roaming\Seznam.cz\bin\szndesktop.exe	Process created: C:\Users\user\AppData\Roaming\Seznam.cz\bin\szndesktop.exe "C:\Users\user\AppData\Roaming\Seznam.cz\bin\szndesktop.exe" default restart
Source: C:\Users\user\AppData\Roaming\Seznam.cz\bin\szndesktop.exe	Process created: C:\Users\user\AppData\Roaming\Seznam.cz\bin\sznpp.exe "C:\Users\user\AppData\Roaming\Seznam.cz\bin\sznpp.exe" install-chrome retry
Source: C:\Users\user\AppData\Roaming\Seznam.cz\bin\sznpp.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Roaming\Seznam.cz\bin\szndesktop.exe	Process created: C:\Users\user\AppData\Roaming\Seznam.cz\bin\listicka-x64.exe "C:\Users\user\AppData\Roaming\Seznam.cz\bin\listicka-x64.exe"
Source: C:\Users\user\AppData\Roaming\Seznam.cz\bin\szndesktop.exe	Process created: C:\Users\user\AppData\Roaming\Seznam.cz\bin\sznpp.exe "C:\Users\user\AppData\Roaming\Seznam.cz\bin\sznpp.exe" report-startup
Source: C:\Users\user\AppData\Roaming\Seznam.cz\bin\listicka-x64.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Roaming\Seznam.cz\szninstall.exe	Process created: C:\Users\user\AppData\Roaming\Seznam.cz\sznsetup.exe C:\Users\user\AppData\Roaming\Seznam.cz\sznsetup.exe -V
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-GB --service-sandbox-type=search_indexer --message-loop-type-ui --mojo-platform-channel-handle=6084 --field-trial-handle=2004,i,1639013666010223883,15040558206664522354,262144 /prefetch:8
Source: C:\Users\user\AppData\Roaming\Seznam.cz\sznsetup.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Roaming\Seznam.cz\bin\sznpp_64.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe chrome.exe --no-default-browser-check --new-window about:blank
Source: C:\Users\user\Desktop\1a4e5ccd35a56d84281a143f831563be.exe	Process created: C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe setuppicasa39-setup.exe	Jump to behavior
Source: C:\Users\user\Desktop\1a4e5ccd35a56d84281a143f831563be.exe	Process created: C:\Users\user\AppData\Local\Temp\nsm983C.tmp\listicka.exe listicka.exe /S	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe	Process created: C:\Windows\SysWOW64\GPhotos.scr "C:\Windows\system32\GPhotos.scr" /c /installcheck	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe	Process created: C:\Program Files (x86)\Google\Picasa3\Picasa3.exe "C:\Program Files (x86)\Google\Picasa3\Picasa3.exe" /register	Jump to behavior
Source: C:\Program Files (x86)\Google\Picasa3\Picasa3.exe	Process created: C:\Program Files (x86)\Google\Picasa3\PicasaPhotoViewer.exe /config	Jump to behavior
Source: C:\Program Files (x86)\Google\Picasa3\Picasa3.exe	Process created: C:\Program Files\Internet Explorer\iexplore.exe "C:\Program Files\Internet Explorer\iexplore.exe" -nohome "http://picasa.google.com/support/bin/answer.py?hl=en&answer=93773"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsm983C.tmp\listicka.exe	Process created: C:\Users\user\AppData\Roaming\Seznam.cz\sznsetup-lt.exe "C:\Users\user\AppData\Roaming\Seznam.cz\sznsetup-lt.exe" -T "C:\Users\user\AppData\Roaming\Seznam.cz" -R "$\install" http://download.seznam.cz/update
Source: C:\Users\user\AppData\Local\Temp\nsm983C.tmp\listicka.exe	Process created: C:\Users\user\AppData\Roaming\Seznam.cz\sznsetup-lt.exe "C:\Users\user\AppData\Roaming\Seznam.cz\sznsetup-lt.exe" -T "C:\Users\user\AppData\Roaming\Seznam.cz" -i cz.seznam.software.szninstall
Source: C:\Users\user\AppData\Local\Temp\nsm983C.tmp\listicka.exe	Process created: C:\Users\user\AppData\Roaming\Seznam.cz\szninstall.exe "C:\Users\user\AppData\Roaming\Seznam.cz\szninstall.exe" -s -u -i cz.seznam.software.autoupdate szn-software-listicka
Source: C:\Users\user\AppData\Roaming\Seznam.cz\sznsetup-lt.exe	Process created: C:\Users\user\AppData\Local\Temp\~0069FB97.00001B74.sznpkg\UNZIP.EXE C:\Users\user\AppData\Local\Temp\~0069FB97.00001B74.sznpkg\unzip.exe -d C:\Users\user\AppData\Local\Temp\~006A18C4.00001B74.sznpkg -o C:\Users\user\AppData\Local\Temp\~0069FB97.00001B74.sznpkg\download\cz.seznam.software.sznsetup-1.2.7-win32.zip
Source: C:\Users\user\AppData\Roaming\Seznam.cz\sznsetup-lt.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /S /C "install.bat C:\Users\user\AppData\Roaming\Seznam.cz"
Source: C:\Users\user\AppData\Roaming\Seznam.cz\sznsetup-lt.exe	Process created: C:\Users\user\AppData\Local\Temp\~0069FB97.00001B74.sznpkg\UNZIP.EXE C:\Users\user\AppData\Local\Temp\~0069FB97.00001B74.sznpkg\unzip.exe -d C:\Users\user\AppData\Local\Temp\~006A1AF6.00001B74.sznpkg -o C:\Users\user\AppData\Local\Temp\~0069FB97.00001B74.sznpkg\download\cz.seznam.software.szninstall-1.1.15-win32.zip
Source: C:\Users\user\AppData\Roaming\Seznam.cz\sznsetup-lt.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /S /C "install.bat C:\Users\user\AppData\Roaming\Seznam.cz"
Source: C:\Program Files\Internet Explorer\iexplore.exe	Process created: C:\Program Files (x86)\Internet Explorer\iexplore.exe "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3720 CREDAT:9474 /prefetch:2
Source: C:\Program Files\Internet Explorer\iexplore.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\BHO\ie_to_edge_stub.exe "C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\BHO\ie_to_edge_stub.exe" --from-ie-to-edge=3 --ie-frame-hwnd=602e8
Source: C:\Program Files\Internet Explorer\iexplore.exe	Process created: C:\Program Files (x86)\Java\jre-1.8\bin\ssvagent.exe "C:\PROGRA~2\Java\jre-1.8\bin\ssvagent.exe" -new
Source: C:\Program Files\Internet Explorer\iexplore.exe	Process created: C:\Program Files (x86)\Internet Explorer\iexplore.exe "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3720 CREDAT:202066 /prefetch:2
Source: C:\Program Files (x86)\Internet Explorer\iexplore.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\BHO\ie_to_edge_stub.exe "C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\BHO\ie_to_edge_stub.exe" --from-ie-to-edge=3 --ie-frame-hwnd=602e8
Source: C:\Program Files (x86)\Internet Explorer\iexplore.exe	Process created: C:\Program Files (x86)\Java\jre-1.8\bin\ssvagent.exe "C:\PROGRA~2\Java\jre-1.8\bin\ssvagent.exe" -new
Source: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\BHO\ie_to_edge_stub.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --from-ie-to-edge=3 --ie-frame-hwnd=602e8
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2244 --field-trial-handle=2004,i,1639013666010223883,15040558206664522354,262144 /prefetch:3
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=1724 --field-trial-handle=2004,i,1639013666010223883,15040558206664522354,262144 /prefetch:8
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=1724 --field-trial-handle=2004,i,1639013666010223883,15040558206664522354,262144 /prefetch:8
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Users\user\AppData\Local\Temp\~006A2DE2.00000DD4.sznpkg\CPY.EXE cpy speeddial.webpak "C:\Users\user\AppData\Roaming\Seznam.cz\data"
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /S /C "install.bat C:\Users\user\AppData\Roaming\Seznam.cz"
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Users\user\AppData\Local\Temp\~006A2DE2.00000DD4.sznpkg\REG.EXE REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "cz.seznam.software.szndesktop" /d "\"C:\Users\user\AppData\Roaming\Seznam.cz\bin\wszndesktop.exe\" -q"
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Users\user\AppData\Local\Temp\~0069FB97.00001B74.sznpkg\UNZIP.EXE C:\Users\user\AppData\Local\Temp\~0069FB97.00001B74.sznpkg\unzip.exe -d C:\Users\user\AppData\Local\Temp\~006A18C4.00001B74.sznpkg -o C:\Users\user\AppData\Local\Temp\~0069FB97.00001B74.sznpkg\download\cz.seznam.software.sznsetup-1.2.7-win32.zip
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=6596 --field-trial-handle=2004,i,1639013666010223883,15040558206664522354,262144 /prefetch:8
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-GB --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --mojo-platform-channel-handle=3720 --field-trial-handle=2004,i,1639013666010223883,15040558206664522354,262144 /prefetch:8
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Users\user\AppData\Local\Temp\~006A2DE2.00000DD4.sznpkg\CPY.EXE cpy "szndesktop.conf" "C:\Users\user\AppData\Roaming\Seznam.cz\conf"
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /S /C "install.bat C:\Users\user\AppData\Roaming\Seznam.cz"
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Users\user\AppData\Local\Temp\~006A2DE2.00000DD4.sznpkg\REG.EXE REG ADD "HKEY_CURRENT_USER\SOFTWARE\Seznam.cz\distribution" /f /v "listicka" /t REG_DWORD /d 1
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-GB --service-sandbox-type=audio --mojo-platform-channel-handle=4984 --field-trial-handle=2004,i,1639013666010223883,15040558206664522354,262144 /prefetch:8
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-GB --service-sandbox-type=search_indexer --message-loop-type-ui --mojo-platform-channel-handle=6084 --field-trial-handle=2004,i,1639013666010223883,15040558206664522354,262144 /prefetch:8
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\~0069FB97.00001B74.sznpkg\REG.EXE REG DELETE "HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall\SeznamInstall" /f /va
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\~0069FB97.00001B74.sznpkg\REG.EXE REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall\SeznamInstall" /f
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\~0069FB97.00001B74.sznpkg\REG.EXE REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall\SeznamInstall" /f /v "InstallLocation" /d C:\Users\user\AppData\Roaming\Seznam.cz
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\~0069FB97.00001B74.sznpkg\REG.EXE REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall\SeznamInstall" /f /v "DisplayName" /d "Seznam Software"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\~0069FB97.00001B74.sznpkg\REG.EXE REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall\SeznamInstall" /f /v "DisplayIcon" /d "C:\Users\user\AppData\Roaming\Seznam.cz\szninstall.exe,0"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\~0069FB97.00001B74.sznpkg\REG.EXE REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall\SeznamInstall" /f /v "UninstallString" /d "\"C:\Users\user\AppData\Roaming\Seznam.cz\szninstall.exe\" -X"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\~0069FB97.00001B74.sznpkg\REG.EXE REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall\SeznamInstall" /f /v "ModifyPath" /d "C:\Users\user\AppData\Roaming\Seznam.cz\szninstall.exe"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\~0069FB97.00001B74.sznpkg\REG.EXE REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall\SeznamInstall" /f /v "Publisher" /d "Seznam.cz"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\~0069FB97.00001B74.sznpkg\REG.EXE REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall\SeznamInstall" /f /v "URLInfoAbout" /d "http://software.seznam.cz"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\~0069FB97.00001B74.sznpkg\REG.EXE REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall\SeznamInstall" /f /v "InstallLocation" /d C:\Users\user\AppData\Roaming\Seznam.cz
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\~0069FB97.00001B74.sznpkg\REG.EXE REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall\SeznamInstall" /f /v "Comments" /d "Vsechny aplikace spolecnosti Seznam.cz a.s."
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\~0069FB97.00001B74.sznpkg\REG.EXE REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall\SeznamInstall" /f /v "NoRepair" /t REG_DWORD /d 1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\~0069FB97.00001B74.sznpkg\REG.EXE REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall\SeznamInstall" /f /v "NoModify" /t REG_DWORD /d 0
Source: C:\Users\user\AppData\Roaming\Seznam.cz\szninstall.exe	Process created: C:\Users\user\AppData\Roaming\Seznam.cz\sznsetup.exe C:\Users\user\AppData\Roaming\Seznam.cz\sznsetup.exe -V
Source: C:\Users\user\AppData\Roaming\Seznam.cz\szninstall.exe	Process created: C:\Users\user\AppData\Roaming\Seznam.cz\sznsetup.exe C:\Users\user\AppData\Roaming\Seznam.cz\sznsetup.exe -T C:\Users\user\AppData\Roaming\Seznam.cz -i -u cz.seznam.software.autoupdate szn-software-listicka -p
Source: C:\Users\user\AppData\Roaming\Seznam.cz\szninstall.exe	Process created: C:\Users\user\AppData\Roaming\Seznam.cz\szninstall.exe "C:\Users\user\AppData\Roaming\Seznam.cz\szninstall.exe" -S 49764
Source: C:\Users\user\AppData\Roaming\Seznam.cz\szninstall.exe	Process created: C:\Users\user\AppData\Roaming\Seznam.cz\sznsetup.exe C:\Users\user\AppData\Roaming\Seznam.cz\sznsetup.exe -V
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\cookie_exporter.exe cookie_exporter.exe --cookie-json=1188
Source: C:\Users\user\AppData\Roaming\Seznam.cz\sznsetup.exe	Process created: C:\Users\user\AppData\Local\Temp\~006A2DE2.00000DD4.sznpkg\UNZIP.EXE C:\Users\user\AppData\Local\Temp\~006A2DE2.00000DD4.sznpkg\unzip.exe -d C:\Users\user\AppData\Local\Temp\~006A81A0.00000DD4.sznpkg -o C:\Users\user\AppData\Roaming\Seznam.cz\install\cz.seznam.software.autoupdate-1.0.8-win32.zip
Source: C:\Users\user\AppData\Roaming\Seznam.cz\sznsetup.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /S /C "install.bat C:\Users\user\AppData\Roaming\Seznam.cz"
Source: C:\Users\user\AppData\Roaming\Seznam.cz\sznsetup.exe	Process created: C:\Users\user\AppData\Local\Temp\~006A2DE2.00000DD4.sznpkg\UNZIP.EXE C:\Users\user\AppData\Local\Temp\~006A2DE2.00000DD4.sznpkg\unzip.exe -d C:\Users\user\AppData\Local\Temp\~006A8374.00000DD4.sznpkg -o C:\Users\user\AppData\Roaming\Seznam.cz\install\szn-software-base-1.0.0-win32.zip
Source: C:\Users\user\AppData\Roaming\Seznam.cz\sznsetup.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /S /C "install.bat C:\Users\user\AppData\Roaming\Seznam.cz"
Source: C:\Users\user\AppData\Roaming\Seznam.cz\sznsetup.exe	Process created: C:\Users\user\AppData\Local\Temp\~006A2DE2.00000DD4.sznpkg\UNZIP.EXE C:\Users\user\AppData\Local\Temp\~006A2DE2.00000DD4.sznpkg\unzip.exe -d C:\Users\user\AppData\Local\Temp\~006A848E.00000DD4.sznpkg -o C:\Users\user\AppData\Roaming\Seznam.cz\install\com.microsoft.msdn.msvcr110-11.0.51106.1-win32.zip
Source: C:\Users\user\AppData\Roaming\Seznam.cz\sznsetup.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /S /C "install.bat C:\Users\user\AppData\Roaming\Seznam.cz"
Source: C:\Users\user\AppData\Roaming\Seznam.cz\sznsetup.exe	Process created: C:\Users\user\AppData\Local\Temp\~006A2DE2.00000DD4.sznpkg\UNZIP.EXE C:\Users\user\AppData\Local\Temp\~006A2DE2.00000DD4.sznpkg\unzip.exe -d C:\Users\user\AppData\Local\Temp\~006A8960.00000DD4.sznpkg -o C:\Users\user\AppData\Local\Temp\~006A2DE2.00000DD4.sznpkg\download\cz.seznam.software.lightspeed-1210-12.10.18-win32.zip
Source: C:\Users\user\AppData\Roaming\Seznam.cz\sznsetup.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /S /C "install.bat C:\Users\user\AppData\Roaming\Seznam.cz"
Source: C:\Users\user\AppData\Roaming\Seznam.cz\sznsetup.exe	Process created: C:\Users\user\AppData\Local\Temp\~006A2DE2.00000DD4.sznpkg\UNZIP.EXE C:\Users\user\AppData\Local\Temp\~006A2DE2.00000DD4.sznpkg\unzip.exe -d C:\Users\user\AppData\Local\Temp\~006A8B64.00000DD4.sznpkg -o C:\Users\user\AppData\Local\Temp\~006A2DE2.00000DD4.sznpkg\download\cz.seznam.software.libszndesktop-2.1.35-win32.zip
Source: C:\Users\user\AppData\Roaming\Seznam.cz\sznsetup.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /S /C "install.bat C:\Users\user\AppData\Roaming\Seznam.cz"
Source: C:\Users\user\AppData\Roaming\Seznam.cz\sznsetup.exe	Process created: C:\Users\user\AppData\Local\Temp\~006A2DE2.00000DD4.sznpkg\UNZIP.EXE C:\Users\user\AppData\Local\Temp\~006A2DE2.00000DD4.sznpkg\unzip.exe -d C:\Users\user\AppData\Local\Temp\~006A9140.00000DD4.sznpkg -o C:\Users\user\AppData\Local\Temp\~006A2DE2.00000DD4.sznpkg\download\cz.seznam.software.szndesktop-2.0.32-win32.zip
Source: C:\Users\user\AppData\Roaming\Seznam.cz\sznsetup.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /S /C "install.bat C:\Users\user\AppData\Roaming\Seznam.cz"
Source: C:\Users\user\AppData\Roaming\Seznam.cz\sznsetup.exe	Process created: C:\Users\user\AppData\Local\Temp\~006A2DE2.00000DD4.sznpkg\UNZIP.EXE C:\Users\user\AppData\Local\Temp\~006A2DE2.00000DD4.sznpkg\unzip.exe -d C:\Users\user\AppData\Local\Temp\~006A93FF.00000DD4.sznpkg -o C:\Users\user\AppData\Local\Temp\~006A2DE2.00000DD4.sznpkg\download\cz.seznam.software.libfoxcub-3.3.8-win32.zip
Source: C:\Users\user\AppData\Roaming\Seznam.cz\sznsetup.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /S /C "install.bat C:\Users\user\AppData\Roaming\Seznam.cz"
Source: C:\Users\user\AppData\Roaming\Seznam.cz\sznsetup.exe	Process created: C:\Users\user\AppData\Local\Temp\~006A2DE2.00000DD4.sznpkg\UNZIP.EXE C:\Users\user\AppData\Local\Temp\~006A2DE2.00000DD4.sznpkg\unzip.exe -d C:\Users\user\AppData\Local\Temp\~006AA61F.00000DD4.sznpkg -o C:\Users\user\AppData\Roaming\Seznam.cz\install\cz.seznam.software.libfoxloader-3.2.7-win32.zip
Source: C:\Users\user\AppData\Roaming\Seznam.cz\sznsetup.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /S /C "install.bat C:\Users\user\AppData\Roaming\Seznam.cz"
Source: C:\Users\user\AppData\Roaming\Seznam.cz\sznsetup.exe	Process created: C:\Users\user\AppData\Local\Temp\~006A2DE2.00000DD4.sznpkg\UNZIP.EXE C:\Users\user\AppData\Local\Temp\~006A2DE2.00000DD4.sznpkg\unzip.exe -d C:\Users\user\AppData\Local\Temp\~006AA7B6.00000DD4.sznpkg -o C:\Users\user\AppData\Local\Temp\~006A2DE2.00000DD4.sznpkg\download\cz.seznam.software.libfoxcub64-3.3.8-win32.zip
Source: C:\Users\user\AppData\Roaming\Seznam.cz\sznsetup.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /S /C "install.bat C:\Users\user\AppData\Roaming\Seznam.cz"
Source: C:\Users\user\AppData\Roaming\Seznam.cz\sznsetup.exe	Process created: C:\Users\user\AppData\Local\Temp\~006A2DE2.00000DD4.sznpkg\UNZIP.EXE C:\Users\user\AppData\Local\Temp\~006A2DE2.00000DD4.sznpkg\unzip.exe -d C:\Users\user\AppData\Local\Temp\~006AB17A.00000DD4.sznpkg -o C:\Users\user\AppData\Local\Temp\~006A2DE2.00000DD4.sznpkg\download\cz.seznam.software.ielisticka3-3.3.5-win32.zip
Source: C:\Users\user\AppData\Roaming\Seznam.cz\sznsetup.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /S /C "install.bat C:\Users\user\AppData\Roaming\Seznam.cz"
Source: C:\Users\user\AppData\Roaming\Seznam.cz\sznsetup.exe	Process created: C:\Users\user\AppData\Local\Temp\~006A2DE2.00000DD4.sznpkg\UNZIP.EXE C:\Users\user\AppData\Local\Temp\~006A2DE2.00000DD4.sznpkg\unzip.exe -d C:\Users\user\AppData\Local\Temp\~006AB2D1.00000DD4.sznpkg -o C:\Users\user\AppData\Local\Temp\~006A2DE2.00000DD4.sznpkg\download\szn-software-fflisticka-4.0.8-win32.zip
Source: C:\Users\user\AppData\Roaming\Seznam.cz\sznsetup.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /S /C "install.bat C:\Users\user\AppData\Roaming\Seznam.cz"
Source: C:\Users\user\AppData\Roaming\Seznam.cz\sznsetup.exe	Process created: C:\Users\user\AppData\Local\Temp\~006A2DE2.00000DD4.sznpkg\UNZIP.EXE C:\Users\user\AppData\Local\Temp\~006A2DE2.00000DD4.sznpkg\unzip.exe -d C:\Users\user\AppData\Local\Temp\~006AC669.00000DD4.sznpkg -o C:\Users\user\AppData\Roaming\Seznam.cz\install\cz.seznam.software.chromelisticka-2.0.4-win32.zip
Source: C:\Users\user\AppData\Roaming\Seznam.cz\sznsetup.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /S /C "install.bat C:\Users\user\AppData\Roaming\Seznam.cz"
Source: C:\Users\user\AppData\Roaming\Seznam.cz\sznsetup.exe	Process created: C:\Users\user\AppData\Local\Temp\~006A2DE2.00000DD4.sznpkg\UNZIP.EXE C:\Users\user\AppData\Local\Temp\~006A2DE2.00000DD4.sznpkg\unzip.exe -d C:\Users\user\AppData\Local\Temp\~006AD463.00000DD4.sznpkg -o C:\Users\user\AppData\Roaming\Seznam.cz\install\com.microsoft.msdn.msvcr100-10.0.40219.325-win32.zip
Source: C:\Users\user\AppData\Roaming\Seznam.cz\sznsetup.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /S /C "install.bat C:\Users\user\AppData\Roaming\Seznam.cz"
Source: C:\Users\user\AppData\Roaming\Seznam.cz\sznsetup.exe	Process created: C:\Users\user\AppData\Local\Temp\~006A2DE2.00000DD4.sznpkg\UNZIP.EXE C:\Users\user\AppData\Local\Temp\~006A2DE2.00000DD4.sznpkg\unzip.exe -d C:\Users\user\AppData\Local\Temp\~006AD780.00000DD4.sznpkg -o C:\Users\user\AppData\Roaming\Seznam.cz\install\cz.seznam.software.pp-1.0.2-win32.zip
Source: C:\Users\user\AppData\Roaming\Seznam.cz\sznsetup.exe	Process created: C:\Users\user\AppData\Local\Temp\~006A2DE2.00000DD4.sznpkg\CPY.EXE cpy libfoxcub.conf "C:\Users\user\AppData\Roaming\Seznam.cz\conf\szndesktop.d"
Source: C:\Users\user\AppData\Roaming\Seznam.cz\sznsetup.exe	Process created: C:\Users\user\AppData\Local\Temp\~006A2DE2.00000DD4.sznpkg\UNZIP.EXE C:\Users\user\AppData\Local\Temp\~006A2DE2.00000DD4.sznpkg\unzip.exe -d C:\Users\user\AppData\Local\Temp\~006AE03A.00000DD4.sznpkg -o C:\Users\user\AppData\Roaming\Seznam.cz\install\szn-software-listicka-3.0.0-win32.zip
Source: C:\Users\user\AppData\Roaming\Seznam.cz\sznsetup.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /S /C "install.bat C:\Users\user\AppData\Roaming\Seznam.cz"
Source: C:\Users\user\AppData\Roaming\Seznam.cz\sznsetup.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /S /C "C:\Users\user\AppData\Roaming\Seznam.cz\uninstall\cz_seznam_software_libszndesktop_2_1_35.reconfigure.bat C:\Users\user\AppData\Roaming\Seznam.cz"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\~006A2DE2.00000DD4.sznpkg\REG.EXE REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "cz.seznam.software.autoupdate" /d "\"C:\Users\user\AppData\Roaming\Seznam.cz\szninstall.exe\" -c"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\~006A2DE2.00000DD4.sznpkg\CPY.EXE cpy msvcp110.dll "C:\Users\user\AppData\Roaming\Seznam.cz\bin"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\~006A2DE2.00000DD4.sznpkg\CPY.EXE cpy msvcr110.dll "C:\Users\user\AppData\Roaming\Seznam.cz\bin"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\~006A2DE2.00000DD4.sznpkg\CPY.EXE cpy lightspeed.dll "C:\Users\user\AppData\Roaming\Seznam.cz\bin"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\~006A2DE2.00000DD4.sznpkg\CPY.EXE cpy "szndesktop.exe" "C:\Users\user\AppData\Roaming\Seznam.cz\bin"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\~006A2DE2.00000DD4.sznpkg\CPY.EXE cpy "szndesktop.conf" "C:\Users\user\AppData\Roaming\Seznam.cz\conf"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\~006A2DE2.00000DD4.sznpkg\CPY.EXE cpy "szndesktop.webpak" "C:\Users\user\AppData\Roaming\Seznam.cz\data"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\~006A2DE2.00000DD4.sznpkg\CPY.EXE cpy "sznpp.exe" "C:\Users\user\AppData\Roaming\Seznam.cz\bin"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\~006A2DE2.00000DD4.sznpkg\REG.EXE reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall\SeznamInstall" /v DisplayVersion /t REG_SZ /d "2.1.35" /f
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\~006A2DE2.00000DD4.sznpkg\CPY.EXE cpy "wszndesktop.exe" "C:\Users\user\AppData\Roaming\Seznam.cz\bin"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\~006A2DE2.00000DD4.sznpkg\REG.EXE REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "cz.seznam.software.szndesktop" /d "\"C:\Users\user\AppData\Roaming\Seznam.cz\bin\wszndesktop.exe\" -q"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\~006A2DE2.00000DD4.sznpkg\CPY.EXE cpy libfoxcub.dll "C:\Users\user\AppData\Roaming\Seznam.cz\bin"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\~006A2DE2.00000DD4.sznpkg\CPY.EXE cpy libfoxcub-x64.dll "C:\Users\user\AppData\Roaming\Seznam.cz\bin"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\~006A2DE2.00000DD4.sznpkg\CPY.EXE cpy libfoxcub.conf "C:\Users\user\AppData\Roaming\Seznam.cz\conf\szndesktop.d"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\~006A2DE2.00000DD4.sznpkg\CPY.EXE cpy foxcub.conf "C:\Users\user\AppData\Roaming\Seznam.cz\conf\libfoxcub"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\~006A2DE2.00000DD4.sznpkg\CPY.EXE cpy remote.conf "C:\Users\user\AppData\Roaming\Seznam.cz\conf\libfoxcub"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\~006A2DE2.00000DD4.sznpkg\CPY.EXE cpy listickaconfig.webpak "C:\Users\user\AppData\Roaming\Seznam.cz\data"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\~006A2DE2.00000DD4.sznpkg\CPY.EXE cpy listickanastaveni.webpak "C:\Users\user\AppData\Roaming\Seznam.cz\data"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\~006A2DE2.00000DD4.sznpkg\CPY.EXE cpy speeddial.webpak "C:\Users\user\AppData\Roaming\Seznam.cz\data"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe libfoxcub.dll,UpgradeListicka
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\~006A2DE2.00000DD4.sznpkg\REG.EXE REG QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\szn-software-listicka" /v "UninstallString"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\~006A2DE2.00000DD4.sznpkg\REG.EXE REG QUERY "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\szn-software-listicka" /v "UninstallString"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\~006A2DE2.00000DD4.sznpkg\REG.EXE REG DELETE "HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Explorer Bars\{EA837F48-5AD1-443E-AE34-FFE03CBF3099}" /F
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\AppData\Roaming\Seznam.cz\bin\sznpp.exe "C:\Users\user\AppData\Roaming\Seznam.cz\bin\sznpp.exe" -v report-ielisticka-install --status=0
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\~006A2DE2.00000DD4.sznpkg\CPY.EXE cpy libfoxcub-x64.dll "C:\Users\user\AppData\Roaming\Seznam.cz\bin"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\~006A2DE2.00000DD4.sznpkg\CPY.EXE cpy listicka-x64.exe "C:\Users\user\AppData\Roaming\Seznam.cz\bin"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\AppData\Roaming\Seznam.cz\bin\szndesktop.exe szndesktop.exe default restart
Source: C:\Users\user\AppData\Roaming\Seznam.cz\bin\szndesktop.exe	Process created: C:\Users\user\AppData\Roaming\Seznam.cz\bin\szndesktop.exe szndesktop.exe default restart

Source: C:\Users\user\Desktop\1a4e5ccd35a56d84281a143f831563be.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\1a4e5ccd35a56d84281a143f831563be.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\1a4e5ccd35a56d84281a143f831563be.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\1a4e5ccd35a56d84281a143f831563be.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\1a4e5ccd35a56d84281a143f831563be.exe	Section loaded: dwmapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\1a4e5ccd35a56d84281a143f831563be.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\1a4e5ccd35a56d84281a143f831563be.exe	Section loaded: oleacc.dll	Jump to behavior
Source: C:\Users\user\Desktop\1a4e5ccd35a56d84281a143f831563be.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\1a4e5ccd35a56d84281a143f831563be.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\1a4e5ccd35a56d84281a143f831563be.exe	Section loaded: shfolder.dll	Jump to behavior
Source: C:\Users\user\Desktop\1a4e5ccd35a56d84281a143f831563be.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\1a4e5ccd35a56d84281a143f831563be.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\1a4e5ccd35a56d84281a143f831563be.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\1a4e5ccd35a56d84281a143f831563be.exe	Section loaded: riched20.dll	Jump to behavior
Source: C:\Users\user\Desktop\1a4e5ccd35a56d84281a143f831563be.exe	Section loaded: usp10.dll	Jump to behavior
Source: C:\Users\user\Desktop\1a4e5ccd35a56d84281a143f831563be.exe	Section loaded: msls31.dll	Jump to behavior
Source: C:\Users\user\Desktop\1a4e5ccd35a56d84281a143f831563be.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\Desktop\1a4e5ccd35a56d84281a143f831563be.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\Desktop\1a4e5ccd35a56d84281a143f831563be.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\1a4e5ccd35a56d84281a143f831563be.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\1a4e5ccd35a56d84281a143f831563be.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\1a4e5ccd35a56d84281a143f831563be.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\1a4e5ccd35a56d84281a143f831563be.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe	Section loaded: shfolder.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe	Section loaded: riched20.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe	Section loaded: usp10.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe	Section loaded: msls31.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe	Section loaded: sti.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe	Section loaded: sti.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe	Section loaded: linkinfo.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe	Section loaded: ntshrui.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe	Section loaded: cscapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe	Section loaded: sti.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\GPhotos.scr	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\GPhotos.scr	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\GPhotos.scr	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\SysWOW64\GPhotos.scr	Section loaded: mscms.dll	Jump to behavior
Source: C:\Windows\SysWOW64\GPhotos.scr	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\SysWOW64\GPhotos.scr	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\GPhotos.scr	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\SysWOW64\GPhotos.scr	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\GPhotos.scr	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\GPhotos.scr	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\SysWOW64\GPhotos.scr	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\GPhotos.scr	Section loaded: coloradapterclient.dll	Jump to behavior
Source: C:\Windows\SysWOW64\GPhotos.scr	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\GPhotos.scr	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\GPhotos.scr	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\GPhotos.scr	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\GPhotos.scr	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\GPhotos.scr	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\GPhotos.scr	Section loaded: netprofm.dll	Jump to behavior
Source: C:\Windows\SysWOW64\GPhotos.scr	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\GPhotos.scr	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\SysWOW64\GPhotos.scr	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\GPhotos.scr	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\GPhotos.scr	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\SysWOW64\GPhotos.scr	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\GPhotos.scr	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\GPhotos.scr	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\GPhotos.scr	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Program Files (x86)\Google\Picasa3\Picasa3.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Program Files (x86)\Google\Picasa3\Picasa3.exe	Section loaded: ddraw.dll	Jump to behavior
Source: C:\Program Files (x86)\Google\Picasa3\Picasa3.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Program Files (x86)\Google\Picasa3\Picasa3.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Program Files (x86)\Google\Picasa3\Picasa3.exe	Section loaded: mscms.dll	Jump to behavior
Source: C:\Program Files (x86)\Google\Picasa3\Picasa3.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Program Files (x86)\Google\Picasa3\Picasa3.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Program Files (x86)\Google\Picasa3\Picasa3.exe	Section loaded: msvfw32.dll	Jump to behavior
Source: C:\Program Files (x86)\Google\Picasa3\Picasa3.exe	Section loaded: avifil32.dll	Jump to behavior
Source: C:\Program Files (x86)\Google\Picasa3\Picasa3.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Program Files (x86)\Google\Picasa3\Picasa3.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Program Files (x86)\Google\Picasa3\Picasa3.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Program Files (x86)\Google\Picasa3\Picasa3.exe	Section loaded: coloradapterclient.dll	Jump to behavior
Source: C:\Program Files (x86)\Google\Picasa3\Picasa3.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Program Files (x86)\Google\Picasa3\Picasa3.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Program Files (x86)\Google\Picasa3\Picasa3.exe	Section loaded: dxgi.dll	Jump to behavior
Source: C:\Program Files (x86)\Google\Picasa3\Picasa3.exe	Section loaded: dciman32.dll	Jump to behavior
Source: C:\Program Files (x86)\Google\Picasa3\Picasa3.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Program Files (x86)\Google\Picasa3\Picasa3.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Program Files (x86)\Google\Picasa3\Picasa3.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Program Files (x86)\Google\Picasa3\Picasa3.exe	Section loaded: msacm32.dll	Jump to behavior
Source: C:\Program Files (x86)\Google\Picasa3\Picasa3.exe	Section loaded: winmmbase.dll	Jump to behavior
Source: C:\Program Files (x86)\Google\Picasa3\Picasa3.exe	Section loaded: winmmbase.dll	Jump to behavior
Source: C:\Program Files (x86)\Google\Picasa3\Picasa3.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Program Files (x86)\Google\Picasa3\Picasa3.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Program Files (x86)\Google\Picasa3\Picasa3.exe	Section loaded: ddraw.dll	Jump to behavior
Source: C:\Program Files (x86)\Google\Picasa3\Picasa3.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Program Files (x86)\Google\Picasa3\Picasa3.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Program Files (x86)\Google\Picasa3\Picasa3.exe	Section loaded: mscms.dll	Jump to behavior
Source: C:\Program Files (x86)\Google\Picasa3\Picasa3.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Program Files (x86)\Google\Picasa3\Picasa3.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Program Files (x86)\Google\Picasa3\Picasa3.exe	Section loaded: msvfw32.dll	Jump to behavior
Source: C:\Program Files (x86)\Google\Picasa3\Picasa3.exe	Section loaded: avifil32.dll	Jump to behavior
Source: C:\Program Files (x86)\Google\Picasa3\Picasa3.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Program Files (x86)\Google\Picasa3\Picasa3.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Program Files (x86)\Google\Picasa3\Picasa3.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Program Files (x86)\Google\Picasa3\Picasa3.exe	Section loaded: dxgi.dll	Jump to behavior
Source: C:\Program Files (x86)\Google\Picasa3\Picasa3.exe	Section loaded: dciman32.dll	Jump to behavior
Source: C:\Program Files (x86)\Google\Picasa3\Picasa3.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Program Files (x86)\Google\Picasa3\Picasa3.exe	Section loaded: coloradapterclient.dll	Jump to behavior
Source: C:\Program Files (x86)\Google\Picasa3\Picasa3.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Program Files (x86)\Google\Picasa3\Picasa3.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Program Files (x86)\Google\Picasa3\Picasa3.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Program Files (x86)\Google\Picasa3\Picasa3.exe	Section loaded: msacm32.dll	Jump to behavior
Source: C:\Program Files (x86)\Google\Picasa3\Picasa3.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Program Files (x86)\Google\Picasa3\Picasa3.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Program Files (x86)\Google\Picasa3\Picasa3.exe	Section loaded: winmmbase.dll	Jump to behavior
Source: C:\Program Files (x86)\Google\Picasa3\Picasa3.exe	Section loaded: winmmbase.dll	Jump to behavior
Source: C:\Program Files (x86)\Google\Picasa3\Picasa3.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Program Files (x86)\Google\Picasa3\Picasa3.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Program Files (x86)\Google\Picasa3\Picasa3.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Program Files (x86)\Google\Picasa3\Picasa3.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Program Files (x86)\Google\Picasa3\Picasa3.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Program Files (x86)\Google\Picasa3\Picasa3.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Program Files (x86)\Google\Picasa3\Picasa3.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Program Files (x86)\Google\Picasa3\Picasa3.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Program Files (x86)\Google\Picasa3\Picasa3.exe	Section loaded: netprofm.dll	Jump to behavior
Source: C:\Program Files (x86)\Google\Picasa3\Picasa3.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Program Files (x86)\Google\Picasa3\Picasa3.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Program Files (x86)\Google\Picasa3\Picasa3.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Program Files (x86)\Google\Picasa3\Picasa3.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Program Files (x86)\Google\Picasa3\Picasa3.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Program Files (x86)\Google\Picasa3\Picasa3.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Program Files (x86)\Google\Picasa3\Picasa3.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Program Files (x86)\Google\Picasa3\Picasa3.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Program Files (x86)\Google\Picasa3\Picasa3.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Program Files (x86)\Google\Picasa3\Picasa3.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Program Files (x86)\Google\Picasa3\Picasa3.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Program Files (x86)\Google\Picasa3\Picasa3.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Program Files (x86)\Google\Picasa3\Picasa3.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Program Files (x86)\Google\Picasa3\Picasa3.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Program Files (x86)\Google\Picasa3\Picasa3.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Program Files (x86)\Google\Picasa3\Picasa3.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Program Files (x86)\Google\Picasa3\Picasa3.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Program Files (x86)\Google\Picasa3\Picasa3.exe	Section loaded: dataexchange.dll	Jump to behavior
Source: C:\Program Files (x86)\Google\Picasa3\Picasa3.exe	Section loaded: d3d11.dll	Jump to behavior
Source: C:\Program Files (x86)\Google\Picasa3\Picasa3.exe	Section loaded: dcomp.dll	Jump to behavior
Source: C:\Program Files (x86)\Google\Picasa3\Picasa3.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Program Files (x86)\Google\Picasa3\Picasa3.exe	Section loaded: devenum.dll	Jump to behavior
Source: C:\Program Files (x86)\Google\Picasa3\Picasa3.exe	Section loaded: devobj.dll	Jump to behavior
Source: C:\Program Files (x86)\Google\Picasa3\Picasa3.exe	Section loaded: msdmo.dll	Jump to behavior
Source: C:\Program Files (x86)\Google\Picasa3\Picasa3.exe	Section loaded: avicap32.dll	Jump to behavior
Source: C:\Program Files (x86)\Google\Picasa3\Picasa3.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Program Files (x86)\Google\Picasa3\Picasa3.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Program Files (x86)\Google\Picasa3\Picasa3.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Program Files (x86)\Google\Picasa3\Picasa3.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Program Files (x86)\Google\Picasa3\Picasa3.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Program Files (x86)\Google\Picasa3\Picasa3.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Program Files (x86)\Google\Picasa3\Picasa3.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Program Files (x86)\Google\Picasa3\Picasa3.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Program Files (x86)\Google\Picasa3\Picasa3.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Program Files (x86)\Google\Picasa3\Picasa3.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Program Files (x86)\Google\Picasa3\Picasa3.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Program Files (x86)\Google\Picasa3\Picasa3.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Program Files (x86)\Google\Picasa3\Picasa3.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Program Files (x86)\Google\Picasa3\PicasaPhotoViewer.exe	Section loaded: apphelp.dll
Source: C:\Program Files (x86)\Google\Picasa3\PicasaPhotoViewer.exe	Section loaded: wininet.dll
Source: C:\Program Files (x86)\Google\Picasa3\PicasaPhotoViewer.exe	Section loaded: mscms.dll
Source: C:\Program Files (x86)\Google\Picasa3\PicasaPhotoViewer.exe	Section loaded: urlmon.dll
Source: C:\Program Files (x86)\Google\Picasa3\PicasaPhotoViewer.exe	Section loaded: version.dll
Source: C:\Program Files (x86)\Google\Picasa3\PicasaPhotoViewer.exe	Section loaded: userenv.dll
Source: C:\Program Files (x86)\Google\Picasa3\PicasaPhotoViewer.exe	Section loaded: coloradapterclient.dll
Source: C:\Program Files (x86)\Google\Picasa3\PicasaPhotoViewer.exe	Section loaded: iertutil.dll
Source: C:\Program Files (x86)\Google\Picasa3\PicasaPhotoViewer.exe	Section loaded: srvcli.dll
Source: C:\Program Files (x86)\Google\Picasa3\PicasaPhotoViewer.exe	Section loaded: netutils.dll
Source: C:\Program Files (x86)\Google\Picasa3\PicasaPhotoViewer.exe	Section loaded: msasn1.dll
Source: C:\Program Files (x86)\Google\Picasa3\PicasaPhotoViewer.exe	Section loaded: uxtheme.dll
Source: C:\Program Files (x86)\Google\Picasa3\PicasaPhotoViewer.exe	Section loaded: windows.storage.dll
Source: C:\Program Files (x86)\Google\Picasa3\PicasaPhotoViewer.exe	Section loaded: wldp.dll
Source: C:\Program Files (x86)\Google\Picasa3\PicasaPhotoViewer.exe	Section loaded: profapi.dll
Source: C:\Program Files (x86)\Google\Picasa3\PicasaPhotoViewer.exe	Section loaded: kernel.appcore.dll
Source: C:\Program Files (x86)\Google\Picasa3\PicasaPhotoViewer.exe	Section loaded: propsys.dll
Source: C:\Program Files (x86)\Google\Picasa3\PicasaPhotoViewer.exe	Section loaded: mrmcorer.dll
Source: C:\Program Files (x86)\Google\Picasa3\PicasaPhotoViewer.exe	Section loaded: windows.staterepositorycore.dll
Source: C:\Program Files (x86)\Google\Picasa3\PicasaPhotoViewer.exe	Section loaded: appxdeploymentclient.dll
Source: C:\Program Files (x86)\Google\Picasa3\PicasaPhotoViewer.exe	Section loaded: bcp47mrm.dll
Source: C:\Program Files (x86)\Google\Picasa3\PicasaPhotoViewer.exe	Section loaded: windows.ui.dll
Source: C:\Program Files (x86)\Google\Picasa3\PicasaPhotoViewer.exe	Section loaded: windowmanagementapi.dll
Source: C:\Program Files (x86)\Google\Picasa3\PicasaPhotoViewer.exe	Section loaded: textinputframework.dll
Source: C:\Program Files (x86)\Google\Picasa3\PicasaPhotoViewer.exe	Section loaded: inputhost.dll
Source: C:\Program Files (x86)\Google\Picasa3\PicasaPhotoViewer.exe	Section loaded: wintypes.dll
Source: C:\Program Files (x86)\Google\Picasa3\PicasaPhotoViewer.exe	Section loaded: twinapi.appcore.dll
Source: C:\Program Files (x86)\Google\Picasa3\PicasaPhotoViewer.exe	Section loaded: coremessaging.dll
Source: C:\Program Files (x86)\Google\Picasa3\PicasaPhotoViewer.exe	Section loaded: twinapi.appcore.dll
Source: C:\Program Files (x86)\Google\Picasa3\PicasaPhotoViewer.exe	Section loaded: coreuicomponents.dll
Source: C:\Program Files (x86)\Google\Picasa3\PicasaPhotoViewer.exe	Section loaded: coremessaging.dll
Source: C:\Program Files (x86)\Google\Picasa3\PicasaPhotoViewer.exe	Section loaded: coremessaging.dll
Source: C:\Program Files (x86)\Google\Picasa3\PicasaPhotoViewer.exe	Section loaded: coreuicomponents.dll
Source: C:\Program Files (x86)\Google\Picasa3\PicasaPhotoViewer.exe	Section loaded: ntmarta.dll
Source: C:\Program Files (x86)\Google\Picasa3\PicasaPhotoViewer.exe	Section loaded: appxdeploymentclient.dll
Source: C:\Program Files (x86)\Google\Picasa3\PicasaPhotoViewer.exe	Section loaded: appxdeploymentclient.dll
Source: C:\Program Files (x86)\Google\Picasa3\PicasaPhotoViewer.exe	Section loaded: appxdeploymentclient.dll
Source: C:\Program Files (x86)\Google\Picasa3\PicasaPhotoViewer.exe	Section loaded: appxdeploymentclient.dll
Source: C:\Program Files (x86)\Google\Picasa3\PicasaPhotoViewer.exe	Section loaded: appxdeploymentclient.dll
Source: C:\Program Files (x86)\Google\Picasa3\PicasaPhotoViewer.exe	Section loaded: appxdeploymentclient.dll
Source: C:\Program Files (x86)\Google\Picasa3\PicasaPhotoViewer.exe	Section loaded: appxdeploymentclient.dll
Source: C:\Program Files (x86)\Google\Picasa3\PicasaPhotoViewer.exe	Section loaded: windows.staterepositoryps.dll
Source: C:\Program Files (x86)\Google\Picasa3\PicasaPhotoViewer.exe	Section loaded: appxdeploymentclient.dll
Source: C:\Program Files (x86)\Google\Picasa3\PicasaPhotoViewer.exe	Section loaded: appxdeploymentclient.dll
Source: C:\Program Files (x86)\Google\Picasa3\PicasaPhotoViewer.exe	Section loaded: appxdeploymentclient.dll
Source: C:\Program Files (x86)\Google\Picasa3\PicasaPhotoViewer.exe	Section loaded: appxdeploymentclient.dll
Source: C:\Program Files (x86)\Google\Picasa3\PicasaPhotoViewer.exe	Section loaded: appxdeploymentclient.dll
Source: C:\Program Files (x86)\Google\Picasa3\PicasaPhotoViewer.exe	Section loaded: appxdeploymentclient.dll
Source: C:\Program Files (x86)\Google\Picasa3\PicasaPhotoViewer.exe	Section loaded: appxdeploymentclient.dll
Source: C:\Program Files (x86)\Google\Picasa3\PicasaPhotoViewer.exe	Section loaded: appxdeploymentclient.dll
Source: C:\Program Files (x86)\Google\Picasa3\PicasaPhotoViewer.exe	Section loaded: appxdeploymentclient.dll
Source: C:\Program Files (x86)\Google\Picasa3\PicasaPhotoViewer.exe	Section loaded: appxdeploymentclient.dll
Source: C:\Program Files (x86)\Google\Picasa3\PicasaPhotoViewer.exe	Section loaded: appxdeploymentclient.dll
Source: C:\Program Files (x86)\Google\Picasa3\PicasaPhotoViewer.exe	Section loaded: appxdeploymentclient.dll
Source: C:\Program Files (x86)\Google\Picasa3\PicasaPhotoViewer.exe	Section loaded: cryptsp.dll
Source: C:\Program Files (x86)\Google\Picasa3\PicasaPhotoViewer.exe	Section loaded: rsaenh.dll
Source: C:\Program Files (x86)\Google\Picasa3\PicasaPhotoViewer.exe	Section loaded: cryptbase.dll
Source: C:\Program Files (x86)\Google\Picasa3\PicasaPhotoViewer.exe	Section loaded: gpapi.dll
Source: C:\Program Files (x86)\Google\Picasa3\PicasaPhotoViewer.exe	Section loaded: cryptnet.dll
Source: C:\Users\user\AppData\Local\Temp\nsm983C.tmp\listicka.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\nsm983C.tmp\listicka.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Local\Temp\nsm983C.tmp\listicka.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\nsm983C.tmp\listicka.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\nsm983C.tmp\listicka.exe	Section loaded: shfolder.dll
Source: C:\Users\user\AppData\Local\Temp\nsm983C.tmp\listicka.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\nsm983C.tmp\listicka.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\nsm983C.tmp\listicka.exe	Section loaded: propsys.dll
Source: C:\Users\user\AppData\Local\Temp\nsm983C.tmp\listicka.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\nsm983C.tmp\listicka.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Roaming\Seznam.cz\sznsetup-lt.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Roaming\Seznam.cz\sznsetup-lt.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Roaming\Seznam.cz\sznsetup-lt.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Roaming\Seznam.cz\sznsetup-lt.exe	Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Roaming\Seznam.cz\sznsetup-lt.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Roaming\Seznam.cz\sznsetup-lt.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Roaming\Seznam.cz\sznsetup-lt.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Roaming\Seznam.cz\sznsetup-lt.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Roaming\Seznam.cz\sznsetup-lt.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Roaming\Seznam.cz\sznsetup-lt.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Roaming\Seznam.cz\sznsetup-lt.exe	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Roaming\Seznam.cz\sznsetup-lt.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Roaming\Seznam.cz\sznsetup-lt.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Roaming\Seznam.cz\sznsetup-lt.exe	Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Roaming\Seznam.cz\sznsetup-lt.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Roaming\Seznam.cz\sznsetup-lt.exe	Section loaded: rasadhlp.dll
Source: C:\Users\user\AppData\Roaming\Seznam.cz\sznsetup-lt.exe	Section loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Roaming\Seznam.cz\sznsetup-lt.exe	Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Roaming\Seznam.cz\sznsetup-lt.exe	Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Roaming\Seznam.cz\sznsetup-lt.exe	Section loaded: netutils.dll
Source: C:\Users\user\AppData\Roaming\Seznam.cz\sznsetup-lt.exe	Section loaded: schannel.dll
Source: C:\Users\user\AppData\Roaming\Seznam.cz\sznsetup-lt.exe	Section loaded: mskeyprotect.dll
Source: C:\Users\user\AppData\Roaming\Seznam.cz\sznsetup-lt.exe	Section loaded: ntasn1.dll
Source: C:\Users\user\AppData\Roaming\Seznam.cz\sznsetup-lt.exe	Section loaded: msasn1.dll
Source: C:\Users\user\AppData\Roaming\Seznam.cz\sznsetup-lt.exe	Section loaded: dpapi.dll
Source: C:\Users\user\AppData\Roaming\Seznam.cz\sznsetup-lt.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Roaming\Seznam.cz\sznsetup-lt.exe	Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Roaming\Seznam.cz\sznsetup-lt.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Roaming\Seznam.cz\sznsetup-lt.exe	Section loaded: gpapi.dll
Source: C:\Users\user\AppData\Roaming\Seznam.cz\sznsetup-lt.exe	Section loaded: ncrypt.dll
Source: C:\Users\user\AppData\Roaming\Seznam.cz\sznsetup-lt.exe	Section loaded: ncryptsslp.dll
Source: C:\Users\user\AppData\Roaming\Seznam.cz\sznsetup-lt.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Roaming\Seznam.cz\sznsetup-lt.exe	Section loaded: ntmarta.dll
Source: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\BHO\ie_to_edge_stub.exe	Section loaded: wininet.dll
Source: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\BHO\ie_to_edge_stub.exe	Section loaded: urlmon.dll
Source: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\BHO\ie_to_edge_stub.exe	Section loaded: iertutil.dll
Source: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\BHO\ie_to_edge_stub.exe	Section loaded: srvcli.dll
Source: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\BHO\ie_to_edge_stub.exe	Section loaded: netutils.dll
Source: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\BHO\ie_to_edge_stub.exe	Section loaded: kernel.appcore.dll
Source: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\BHO\ie_to_edge_stub.exe	Section loaded: uxtheme.dll
Source: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\BHO\ie_to_edge_stub.exe	Section loaded: windows.storage.dll
Source: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\BHO\ie_to_edge_stub.exe	Section loaded: wldp.dll
Source: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\BHO\ie_to_edge_stub.exe	Section loaded: propsys.dll
Source: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\BHO\ie_to_edge_stub.exe	Section loaded: profapi.dll
Source: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\BHO\ie_to_edge_stub.exe	Section loaded: edputil.dll
Source: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\BHO\ie_to_edge_stub.exe	Section loaded: windows.staterepositoryps.dll
Source: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\BHO\ie_to_edge_stub.exe	Section loaded: sspicli.dll
Source: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\BHO\ie_to_edge_stub.exe	Section loaded: wintypes.dll
Source: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\BHO\ie_to_edge_stub.exe	Section loaded: appresolver.dll
Source: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\BHO\ie_to_edge_stub.exe	Section loaded: bcp47langs.dll
Source: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\BHO\ie_to_edge_stub.exe	Section loaded: slc.dll
Source: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\BHO\ie_to_edge_stub.exe	Section loaded: userenv.dll
Source: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\BHO\ie_to_edge_stub.exe	Section loaded: sppc.dll
Source: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\BHO\ie_to_edge_stub.exe	Section loaded: onecorecommonproxystub.dll
Source: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\BHO\ie_to_edge_stub.exe	Section loaded: onecoreuapcommonproxystub.dll
Source: C:\Program Files (x86)\Java\jre-1.8\bin\ssvagent.exe	Section loaded: vcruntime140.dll
Source: C:\Program Files (x86)\Java\jre-1.8\bin\ssvagent.exe	Section loaded: wininet.dll
Source: C:\Program Files (x86)\Java\jre-1.8\bin\ssvagent.exe	Section loaded: version.dll
Source: C:\Program Files (x86)\Java\jre-1.8\bin\ssvagent.exe	Section loaded: urlmon.dll
Source: C:\Program Files (x86)\Java\jre-1.8\bin\ssvagent.exe	Section loaded: msvcp140.dll
Source: C:\Program Files (x86)\Java\jre-1.8\bin\ssvagent.exe	Section loaded: iertutil.dll
Source: C:\Program Files (x86)\Java\jre-1.8\bin\ssvagent.exe	Section loaded: srvcli.dll
Source: C:\Program Files (x86)\Java\jre-1.8\bin\ssvagent.exe	Section loaded: netutils.dll
Source: C:\Program Files (x86)\Java\jre-1.8\bin\ssvagent.exe	Section loaded: kernel.appcore.dll
Source: C:\Program Files (x86)\Java\jre-1.8\bin\ssvagent.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\~0069FB97.00001B74.sznpkg\UNZIP.EXE	Section loaded: apphelp.dll
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: cmdext.dll
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: ntmarta.dll
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: cmdext.dll
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: ntmarta.dll
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\~0069FB97.00001B74.sznpkg\REG.EXE	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Roaming\Seznam.cz\szninstall.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Roaming\Seznam.cz\szninstall.exe	Section loaded: wtsapi32.dll
Source: C:\Users\user\AppData\Roaming\Seznam.cz\szninstall.exe	Section loaded: userenv.dll
Source: C:\Users\user\AppData\Roaming\Seznam.cz\szninstall.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Roaming\Seznam.cz\szninstall.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Roaming\Seznam.cz\szninstall.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Roaming\Seznam.cz\szninstall.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Roaming\Seznam.cz\szninstall.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Roaming\Seznam.cz\szninstall.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Roaming\Seznam.cz\szninstall.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Roaming\Seznam.cz\szninstall.exe	Section loaded: propsys.dll
Source: C:\Users\user\AppData\Roaming\Seznam.cz\szninstall.exe	Section loaded: edputil.dll
Source: C:\Users\user\AppData\Roaming\Seznam.cz\szninstall.exe	Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Roaming\Seznam.cz\szninstall.exe	Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Roaming\Seznam.cz\szninstall.exe	Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Roaming\Seznam.cz\szninstall.exe	Section loaded: netutils.dll
Source: C:\Users\user\AppData\Roaming\Seznam.cz\szninstall.exe	Section loaded: windows.staterepositoryps.dll
Source: C:\Users\user\AppData\Roaming\Seznam.cz\szninstall.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Roaming\Seznam.cz\szninstall.exe	Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Roaming\Seznam.cz\szninstall.exe	Section loaded: appresolver.dll
Source: C:\Users\user\AppData\Roaming\Seznam.cz\szninstall.exe	Section loaded: bcp47langs.dll
Source: C:\Users\user\AppData\Roaming\Seznam.cz\szninstall.exe	Section loaded: slc.dll
Source: C:\Users\user\AppData\Roaming\Seznam.cz\szninstall.exe	Section loaded: sppc.dll
Source: C:\Users\user\AppData\Roaming\Seznam.cz\szninstall.exe	Section loaded: onecorecommonproxystub.dll
Source: C:\Users\user\AppData\Roaming\Seznam.cz\szninstall.exe	Section loaded: onecoreuapcommonproxystub.dll
Source: C:\Users\user\AppData\Roaming\Seznam.cz\sznsetup.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Roaming\Seznam.cz\sznsetup.exe	Section loaded: wininet.dll
Source: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\cookie_exporter.exe	Section loaded: msedge.dll
Source: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\cookie_exporter.exe	Section loaded: winmm.dll
Source: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\cookie_exporter.exe	Section loaded: msedge_elf.dll
Source: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\cookie_exporter.exe	Section loaded: wininet.dll
Source: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\cookie_exporter.exe	Section loaded: iertutil.dll
Source: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\cookie_exporter.exe	Section loaded: sspicli.dll
Source: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\cookie_exporter.exe	Section loaded: windows.storage.dll
Source: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\cookie_exporter.exe	Section loaded: wldp.dll
Source: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\cookie_exporter.exe	Section loaded: profapi.dll
Source: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\cookie_exporter.exe	Section loaded: kernel.appcore.dll
Source: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\cookie_exporter.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\cookie_exporter.exe	Section loaded: winhttp.dll
Source: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\cookie_exporter.exe	Section loaded: mswsock.dll
Source: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\cookie_exporter.exe	Section loaded: iphlpapi.dll
Source: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\cookie_exporter.exe	Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Roaming\Seznam.cz\sznsetup.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Roaming\Seznam.cz\sznsetup.exe	Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Roaming\Seznam.cz\sznsetup.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Roaming\Seznam.cz\sznsetup.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Roaming\Seznam.cz\sznsetup.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Roaming\Seznam.cz\sznsetup.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Roaming\Seznam.cz\sznsetup.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Roaming\Seznam.cz\sznsetup.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Roaming\Seznam.cz\sznsetup.exe	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Roaming\Seznam.cz\sznsetup.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Roaming\Seznam.cz\sznsetup.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Roaming\Seznam.cz\sznsetup.exe	Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Roaming\Seznam.cz\sznsetup.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Roaming\Seznam.cz\sznsetup.exe	Section loaded: rasadhlp.dll
Source: C:\Users\user\AppData\Roaming\Seznam.cz\sznsetup.exe	Section loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Roaming\Seznam.cz\sznsetup.exe	Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Roaming\Seznam.cz\sznsetup.exe	Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Roaming\Seznam.cz\sznsetup.exe	Section loaded: netutils.dll
Source: C:\Users\user\AppData\Roaming\Seznam.cz\sznsetup.exe	Section loaded: schannel.dll
Source: C:\Users\user\AppData\Roaming\Seznam.cz\sznsetup.exe	Section loaded: mskeyprotect.dll
Source: C:\Users\user\AppData\Roaming\Seznam.cz\sznsetup.exe	Section loaded: ntasn1.dll
Source: C:\Users\user\AppData\Roaming\Seznam.cz\sznsetup.exe	Section loaded: msasn1.dll
Source: C:\Users\user\AppData\Roaming\Seznam.cz\sznsetup.exe	Section loaded: dpapi.dll
Source: C:\Users\user\AppData\Roaming\Seznam.cz\sznsetup.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Roaming\Seznam.cz\sznsetup.exe	Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Roaming\Seznam.cz\sznsetup.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Roaming\Seznam.cz\sznsetup.exe	Section loaded: gpapi.dll
Source: C:\Users\user\AppData\Roaming\Seznam.cz\sznsetup.exe	Section loaded: ncrypt.dll
Source: C:\Users\user\AppData\Roaming\Seznam.cz\sznsetup.exe	Section loaded: ncryptsslp.dll
Source: C:\Users\user\AppData\Roaming\Seznam.cz\sznsetup.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Roaming\Seznam.cz\sznsetup.exe	Section loaded: ntmarta.dll
Source: C:\Users\user\AppData\Local\Temp\~006A2DE2.00000DD4.sznpkg\UNZIP.EXE	Section loaded: apphelp.dll
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: cmdext.dll
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\~006A2DE2.00000DD4.sznpkg\REG.EXE	Section loaded: apphelp.dll
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: cmdext.dll
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: cmdext.dll
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\~006A2DE2.00000DD4.sznpkg\CPY.EXE	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\~006A2DE2.00000DD4.sznpkg\CPY.EXE	Section loaded: ntmarta.dll
Source: C:\Users\user\AppData\Local\Temp\~006A2DE2.00000DD4.sznpkg\CPY.EXE	Section loaded: ntmarta.dll
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: cmdext.dll
Source: C:\Users\user\AppData\Local\Temp\~006A2DE2.00000DD4.sznpkg\CPY.EXE	Section loaded: ntmarta.dll
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: cmdext.dll
Source: C:\Users\user\AppData\Local\Temp\~006A2DE2.00000DD4.sznpkg\CPY.EXE	Section loaded: ntmarta.dll
Source: C:\Users\user\AppData\Local\Temp\~006A2DE2.00000DD4.sznpkg\CPY.EXE	Section loaded: ntmarta.dll
Source: C:\Users\user\AppData\Local\Temp\~006A2DE2.00000DD4.sznpkg\CPY.EXE	Section loaded: ntmarta.dll
Source: C:\Users\user\AppData\Local\Temp\~006A2DE2.00000DD4.sznpkg\CPY.EXE	Section loaded: ntmarta.dll
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: cmdext.dll
Source: C:\Users\user\AppData\Local\Temp\~006A2DE2.00000DD4.sznpkg\CPY.EXE	Section loaded: ntmarta.dll
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: cmdext.dll
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\~006A2DE2.00000DD4.sznpkg\CPY.EXE	Section loaded: ntmarta.dll
Source: C:\Users\user\AppData\Local\Temp\~006A2DE2.00000DD4.sznpkg\CPY.EXE	Section loaded: ntmarta.dll
Source: C:\Users\user\AppData\Local\Temp\~006A2DE2.00000DD4.sznpkg\CPY.EXE	Section loaded: ntmarta.dll
Source: C:\Users\user\AppData\Local\Temp\~006A2DE2.00000DD4.sznpkg\CPY.EXE	Section loaded: ntmarta.dll
Source: C:\Users\user\AppData\Local\Temp\~006A2DE2.00000DD4.sznpkg\CPY.EXE	Section loaded: ntmarta.dll
Source: C:\Users\user\AppData\Local\Temp\~006A2DE2.00000DD4.sznpkg\CPY.EXE	Section loaded: ntmarta.dll
Source: C:\Users\user\AppData\Local\Temp\~006A2DE2.00000DD4.sznpkg\CPY.EXE	Section loaded: ntmarta.dll
Source: C:\Users\user\AppData\Roaming\Seznam.cz\bin\sznpp.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Roaming\Seznam.cz\bin\sznpp.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Roaming\Seznam.cz\bin\sznpp.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Roaming\Seznam.cz\bin\sznpp.exe	Section loaded: secur32.dll
Source: C:\Users\user\AppData\Roaming\Seznam.cz\bin\sznpp.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Roaming\Seznam.cz\bin\sznpp.exe	Section loaded: dbghelp.dll
Source: C:\Users\user\AppData\Roaming\Seznam.cz\bin\sznpp.exe	Section loaded: dbgcore.dll
Source: C:\Users\user\AppData\Roaming\Seznam.cz\bin\sznpp.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Roaming\Seznam.cz\bin\sznpp.exe	Section loaded: napinsp.dll
Source: C:\Users\user\AppData\Roaming\Seznam.cz\bin\sznpp.exe	Section loaded: pnrpnsp.dll
Source: C:\Users\user\AppData\Roaming\Seznam.cz\bin\sznpp.exe	Section loaded: wshbth.dll
Source: C:\Users\user\AppData\Roaming\Seznam.cz\bin\sznpp.exe	Section loaded: nlaapi.dll
Source: C:\Users\user\AppData\Roaming\Seznam.cz\bin\sznpp.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Roaming\Seznam.cz\bin\sznpp.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Roaming\Seznam.cz\bin\sznpp.exe	Section loaded: winrnr.dll
Source: C:\Users\user\AppData\Roaming\Seznam.cz\bin\sznpp.exe	Section loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Roaming\Seznam.cz\bin\sznpp.exe	Section loaded: rasadhlp.dll
Source: C:\Users\user\AppData\Roaming\Seznam.cz\bin\sznpp.exe	Section loaded: msasn1.dll
Source: C:\Users\user\AppData\Roaming\Seznam.cz\bin\sznpp.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Roaming\Seznam.cz\bin\sznpp.exe	Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Roaming\Seznam.cz\bin\sznpp.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Roaming\Seznam.cz\bin\sznpp.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Roaming\Seznam.cz\bin\sznpp.exe	Section loaded: dpapi.dll
Source: C:\Users\user\AppData\Roaming\Seznam.cz\bin\sznpp.exe	Section loaded: ncrypt.dll
Source: C:\Users\user\AppData\Roaming\Seznam.cz\bin\sznpp.exe	Section loaded: ntasn1.dll
Source: C:\Users\user\AppData\Roaming\Seznam.cz\bin\sznpp.exe	Section loaded: schannel.dll
Source: C:\Users\user\AppData\Roaming\Seznam.cz\bin\sznpp.exe	Section loaded: mskeyprotect.dll
Source: C:\Users\user\AppData\Roaming\Seznam.cz\bin\sznpp.exe	Section loaded: ncryptprov.dll
Source: C:\Users\user\AppData\Roaming\Seznam.cz\bin\sznpp.exe	Section loaded: ncryptsslp.dll
Source: C:\Users\user\AppData\Roaming\Seznam.cz\bin\sznpp.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: cmdext.dll
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: ntmarta.dll
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: cmdext.dll
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: ntmarta.dll
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\~006A2DE2.00000DD4.sznpkg\CPY.EXE	Section loaded: ntmarta.dll
Source: C:\Users\user\AppData\Local\Temp\~006A2DE2.00000DD4.sznpkg\CPY.EXE	Section loaded: ntmarta.dll
Source: C:\Users\user\AppData\Roaming\Seznam.cz\bin\szndesktop.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Roaming\Seznam.cz\bin\szndesktop.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Roaming\Seznam.cz\bin\szndesktop.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Roaming\Seznam.cz\bin\szndesktop.exe	Section loaded: lightspeed.dll
Source: C:\Users\user\AppData\Roaming\Seznam.cz\bin\szndesktop.exe	Section loaded: msvcp110.dll
Source: C:\Users\user\AppData\Roaming\Seznam.cz\bin\szndesktop.exe	Section loaded: msvcr110.dll
Source: C:\Users\user\AppData\Roaming\Seznam.cz\bin\szndesktop.exe	Section loaded: dbghelp.dll
Source: C:\Users\user\AppData\Roaming\Seznam.cz\bin\szndesktop.exe	Section loaded: dbgcore.dll
Source: C:\Users\user\AppData\Roaming\Seznam.cz\bin\szndesktop.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Roaming\Seznam.cz\bin\szndesktop.exe	Section loaded: mswsock.dll

Source: C:\Users\user\Desktop\1a4e5ccd35a56d84281a143f831563be.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f486a52-3cb1-48fd-8f50-b8dc300d9f9d}\InProcServer32

Jump to behavior

Source: Picasa 3.lnk.16.dr	LNK file: ..\..\..\..\..\..\Program Files (x86)\Google\Picasa3\Picasa3.exe
Source: Configure Picasa Photo Viewer.lnk.16.dr	LNK file: ..\..\..\..\..\..\Program Files (x86)\Google\Picasa3\PicasaPhotoViewer.exe
Source: Uninstall.lnk.16.dr	LNK file: ..\..\..\..\..\..\Program Files (x86)\Google\Picasa3\uninstall.exe
Source: Picasa 3.lnk0.16.dr	LNK file: ..\..\..\Program Files (x86)\Google\Picasa3\Picasa3.exe
Source: Picasa 3.lnk1.16.dr	LNK file: ..\..\..\..\..\..\..\Program Files (x86)\Google\Picasa3\Picasa3.exe

Source: C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe

File written: C:\Program Files (x86)\Google\Picasa3\web\templates\blackfrm\xLifescape.ini

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe

Source: C:\Program Files (x86)\Internet Explorer\iexplore.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\InternetRegistry\REGISTRY\USER\S-1-5-21-2246122658-3693405117-2476756634-1003\Software\Microsoft\Office\16.0\Lync

Source: C:\Users\user\AppData\Local\Temp\~0069FB97.00001B74.sznpkg\REG.EXE

Registry value created: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\SeznamInstall

Source: 563299efce875400a8d9b44b96597c8e-sample (1).zip

Static file information: File size 25085622 > 1048576

Source: C:\Users\user\AppData\Roaming\Seznam.cz\sznsetup.exe

File opened: C:\Users\user\AppData\Local\Temp\~006AD463.00000DD4.sznpkg\msvcr100.dll

Source:	Binary string: C:\Users\ondrej.novak\Documents\Visual Studio 2008\Projects\software-trunk\SeznamInstall\bin\debug\sznsetup-lt.pdbPV source: sznsetup-lt.exe, 00000017.00000000.1729394687.000000000052B000.00000002.00000001.01000000.0000001F.sdmp
Source:	Binary string: C:\Repository\listicka\ielisticka_new\bin-Release\pdb\listicka-x64.pdb source: UNZIP.EXE, 00000081.00000002.2178378406.0000000000428000.00000040.00000001.01000000.00000026.sdmp, CPY.EXE, 00000086.00000002.2185910879.000000000075A000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \plugins\CDVDR\*.pdb source: setuppicasa39-setup.exe, 00000010.00000003.1659418312.000000000067F000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \plugins\expwebsites\*.pdb source: setuppicasa39-setup.exe, 00000010.00000003.1659418312.000000000067F000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: p:\d\a\wpyh4-vm-6.hot\recipes\840394494\base\googleclient\picasa39-stable\build\Picasa3.pdb source: Picasa3.exe, 00000012.00000000.1603749985.0000000000C6A000.00000002.00000001.01000000.00000012.sdmp
Source:	Binary string: C:\playground\repos\listicka\sznpp\bin\symbols\Release_x86\sznpp_dll.pdb source: UNZIP.EXE, 0000005D.00000002.2105385323.0000000000428000.00000040.00000001.01000000.00000026.sdmp, CPY.EXE, 00000064.00000002.2115643669.0000000000ECA000.00000004.00000020.00020000.00000000.sdmp, sznpp.exe, 0000007C.00000000.2152804918.0000000000BFB000.00000002.00000001.01000000.0000002C.sdmp
Source:	Binary string: msvcp110.i386.pdb source: szndesktop.exe, szndesktop.exe, 00000087.00000002.2193190667.000000006C0E1000.00000020.00000001.01000000.0000002E.sdmp
Source:	Binary string: C:\Users\ondrej.novak\Documents\Visual Studio 2008\Projects\software-trunk\SeznamInstall\bin\debug\sznsetup.pdb source: sznsetup.exe, 00000039.00000000.1850844929.0000000000F0C000.00000002.00000001.01000000.00000023.sdmp
Source:	Binary string: msvcr110.i386.pdb source: UNZIP.EXE, 00000052.00000002.2089014833.0000000000428000.00000040.00000001.01000000.00000026.sdmp, CPY.EXE, 00000057.00000002.2096863979.0000000000B3A000.00000004.00000020.00020000.00000000.sdmp, szndesktop.exe, szndesktop.exe, 00000087.00000002.2195197650.000000006C221000.00000020.00000001.01000000.0000002B.sdmp
Source:	Binary string: C:\playground\repos\listicka\sznpp\bin\symbols\Release_x64\sznpp_64.pdb source: sznpp.exe, 0000007C.00000000.2152804918.0000000000B52000.00000002.00000001.01000000.0000002C.sdmp
Source:	Binary string: PhotoViewer.pdbGCTL source: PicasaPhotoViewer.exe, 00000015.00000003.1748748621.0000000003DBE000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\playground\repos\listicka\sznpp\bin\symbols\Release_x86\sznpp.pdb source: sznpp.exe, 0000007C.00000000.2152425887.0000000000B0C000.00000002.00000001.01000000.0000002C.sdmp
Source:	Binary string: C:\playground\repos\listicka\sznpp\bin\symbols\Release_x86\sznpp.pdb- source: sznpp.exe, 0000007C.00000000.2152425887.0000000000B0C000.00000002.00000001.01000000.0000002C.sdmp
Source:	Binary string: p:\d\a\wpyh4-vm-6.hot\recipes\840394494\base\googleclient\picasa39-stable\build\PicasaPhotoViewer.pdb source: setuppicasa39-setup.exe, 00000010.00000002.1664870898.00000000031AA000.00000004.00000020.00020000.00000000.sdmp, PicasaPhotoViewer.exe, 00000015.00000000.1692209976.000000000070D000.00000002.00000001.01000000.00000019.sdmp
Source:	Binary string: p:\d\a\wpyh4-vm-6.hot\recipes\840394494\base\googleclient\picasa39-stable\build\cdautorun\PicasaCD.pdb source: setuppicasa39-setup.exe, 00000010.00000002.1664870898.0000000004419000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: mi_exe_stub.pdb@;AL source: setuppicasa39-setup.exe, 00000010.00000002.1664870898.00000000029F6000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: p:\d\a\wpyh4-vm-6.hot\recipes\840394494\base\googleclient\picasa39-stable\build\plugins\CDVDR\CDVDR.pdb source: setuppicasa39-setup.exe, 00000010.00000002.1664870898.0000000003831000.00000004.00000020.00020000.00000000.sdmp, Picasa3.exe, 00000014.00000002.2497615129.00000000033F3000.00000002.00000001.01000000.00000015.sdmp
Source:	Binary string: p:\d\a\wpyh4-vm-6.hot\recipes\840394494\base\googleclient\picasa39-stable\build\npPicasa3.pdb source: setuppicasa39-setup.exe, 00000010.00000002.1664870898.0000000002E88000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: d:\Development\googleclient\picasa4\build\plugins\Red.pdb source: setuppicasa39-setup.exe, 00000010.00000002.1664870898.0000000003FAE000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Repository\listicka\ielisticka_new\bin-Release\pdb\szndesktop.pdb source: CPY.EXE, 00000061.00000002.2108099884.0000000000E09000.00000004.00000020.00020000.00000000.sdmp, szndesktop.exe, 00000087.00000000.2188348792.0000000000875000.00000002.00000001.01000000.0000002D.sdmp
Source:	Binary string: p:\d\a\wpyh4-vm-6.hot\recipes\840394494\base\googleclient\picasa39-stable\build\plugins\expwebsites\expwebsites.pdb source: setuppicasa39-setup.exe, 00000010.00000002.1664870898.0000000003DA5000.00000004.00000020.00020000.00000000.sdmp, Picasa3.exe, 00000014.00000002.2533437740.000000000488F000.00000002.00000001.01000000.00000016.sdmp
Source:	Binary string: C:\Users\ondrej.novak\Documents\Visual Studio 2008\Projects\software-trunk\SeznamInstall\bin\debug\sznsetup-lt.pdb source: listicka.exe, 00000016.00000002.2443085483.00000000029E3000.00000004.00000020.00020000.00000000.sdmp, sznsetup-lt.exe, 00000017.00000000.1729394687.000000000052B000.00000002.00000001.01000000.0000001F.sdmp
Source:	Binary string: C:\playground\repos\listicka\sznpp\bin\symbols\Release_x64\sznpp_dll.pdb source: CPY.EXE, 00000064.00000002.2115643669.0000000000ECA000.00000004.00000020.00020000.00000000.sdmp, sznpp.exe, 0000007C.00000000.2152804918.0000000000BFB000.00000002.00000001.01000000.0000002C.sdmp
Source:	Binary string: C:\playground\repos\listicka\sznpp\bin\symbols\Release_x64\sznpp_64.pdb( source: sznpp.exe, 0000007C.00000000.2152804918.0000000000B52000.00000002.00000001.01000000.0000002C.sdmp
Source:	Binary string: p:\d\a\wpyh4-vm-6.hot\recipes\840394494\base\googleclient\picasa39-stable\build\GPhotos.pdb source: setuppicasa39-setup.exe, 00000010.00000002.1664870898.00000000035FF000.00000004.00000020.00020000.00000000.sdmp, GPhotos.scr, 00000011.00000000.1542724484.000000000062E000.00000002.00000001.01000000.0000000F.sdmp
Source:	Binary string: C:\Repository\listicka\ielisticka_new\bin-Release\pdb\szndesktop.pdb44 source: CPY.EXE, 00000061.00000002.2108099884.0000000000E09000.00000004.00000020.00020000.00000000.sdmp, szndesktop.exe, 00000087.00000000.2188348792.0000000000875000.00000002.00000001.01000000.0000002D.sdmp
Source:	Binary string: C:\Repository\listicka-new\ielisticka_new\bin-Release\pdb\lightspeed.pdb source: CPY.EXE, 0000005C.00000002.2102179386.0000000000B00000.00000004.00000020.00020000.00000000.sdmp, szndesktop.exe, 00000087.00000002.2198970614.000000006C384000.00000002.00000001.01000000.0000002A.sdmp
Source:	Binary string: p:\d\a\wpyh4-vm-6.hot\recipes\840394494\base\googleclient\picasa39-stable\build\plugins\ytITivo.pdb source: setuppicasa39-setup.exe, 00000010.00000002.1664870898.0000000003F3F000.00000004.00000020.00020000.00000000.sdmp, Picasa3.exe, 00000014.00000002.2504208079.0000000004079000.00000002.00000001.01000000.00000017.sdmp
Source:	Binary string: C:\Repository\listicka-new\ielisticka_new\bin-Release\pdb\lightspeed.pdbQQ source: CPY.EXE, 0000005C.00000002.2102179386.0000000000B00000.00000004.00000020.00020000.00000000.sdmp, szndesktop.exe, 00000087.00000002.2198970614.000000006C384000.00000002.00000001.01000000.0000002A.sdmp
Source:	Binary string: p:\d\a\wpyh4-vm-6.hot\recipes\840394494\base\googleclient\picasa39-stable\build\cdautorun\PicasaRestore.pdb source: setuppicasa39-setup.exe, 00000010.00000002.1664870898.000000000459F000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Repository\listicka\ielisticka_new\bin-Release\pdb\libfoxloader.pdb source: UNZIP.EXE, 0000007D.00000002.2173171240.000000000042B000.00000040.00000001.01000000.00000026.sdmp, szndesktop.exe, 00000087.00000002.2200176289.000000006C489000.00000002.00000001.01000000.0000002F.sdmp
Source:	Binary string: Rg.pdbH source: listicka.exe, 00000016.00000002.2443085483.00000000029E3000.00000004.00000020.00020000.00000000.sdmp, sznsetup-lt.exe, 00000017.00000000.1730049584.0000000000571000.00000002.00000001.01000000.0000001F.sdmp, REG.EXE, 0000002A.00000000.1818569837.0000000001000000.00000002.00000001.01000000.00000021.sdmp, REG.EXE, 0000002A.00000000.1818621571.0000000001018000.00000080.00000001.01000000.00000021.sdmp, REG.EXE, 0000002A.00000002.1819878005.0000000001000000.00000002.00000001.01000000.00000021.sdmp, sznsetup.exe, 00000039.00000000.1851570101.0000000000F52000.00000002.00000001.01000000.00000023.sdmp
Source:	Binary string: C:\Users\petr.slivon\Documents\Visual Studio 2012\Projects\listicka-trunk\ielisticka_new\bin-Release\pdb\wszndesktop.pdb source: UNZIP.EXE, 00000066.00000002.2120076164.0000000000428000.00000040.00000001.01000000.00000026.sdmp, CPY.EXE, 0000006A.00000002.2122729835.0000000000629000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: msvcp110.i386.pdb0 source: szndesktop.exe, 00000087.00000002.2193190667.000000006C0E1000.00000020.00000001.01000000.0000002E.sdmp
Source:	Binary string: C:\Repository\listicka\ielisticka_new\bin-Release\pdb\listicka-x64.pdbhh source: UNZIP.EXE, 00000081.00000002.2178378406.0000000000428000.00000040.00000001.01000000.00000026.sdmp, CPY.EXE, 00000086.00000002.2185910879.000000000075A000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Repository\listicka\ielisticka_new\bin-Release\pdb\libfoxloader.pdb~{ source: UNZIP.EXE, 0000007D.00000002.2173171240.000000000042B000.00000040.00000001.01000000.00000026.sdmp, szndesktop.exe, 00000087.00000002.2200176289.000000006C489000.00000002.00000001.01000000.0000002F.sdmp
Source:	Binary string: C:\Users\ondrej.novak\Documents\Visual Studio 2008\Projects\software-trunk\SeznamInstall\bin\debug\szninstall.pdb source: szninstall.exe, 00000038.00000000.1847499306.0000000000571000.00000002.00000001.01000000.00000022.sdmp
Source:	Binary string: reg.pdb source: REG.EXE, REG.EXE, 0000002A.00000002.1819912483.0000000001001000.00000040.00000001.01000000.00000021.sdmp
Source:	Binary string: mi_exe_stub.pdb source: setuppicasa39-setup.exe, 00000010.00000002.1664870898.00000000029F6000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: PhotoViewer.pdb source: PicasaPhotoViewer.exe, 00000015.00000003.1748748621.0000000003DBE000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: d:\twbrown-picasa-1\googleclient\picasa4\NSIS_Unicode_v3\Plugins\x86-unicode\NSIS_Picasa_Unicode.pdb source: setuppicasa39-setup.exe, 00000010.00000002.1704699696.0000000004CA3000.00000002.00000001.01000000.0000000C.sdmp
Source:	Binary string: C:\Users\ondrej.novak\Documents\Visual Studio 2008\Projects\software-trunk\SeznamInstall\bin\debug\sznsetup-lt.pdbPP source: listicka.exe, 00000016.00000002.2443085483.00000000029E3000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: p:\d\a\wpyh4-vm-6.hot\recipes\840394494\base\googleclient\picasa39-stable\build\Picasa3i18n.pdb source: Picasa3.exe, 00000014.00000002.2599698862.0000000010008000.00000002.00000001.01000000.00000014.sdmp
Source:	Binary string: C:\Users\ondrej.novak\Documents\Visual Studio 2008\Projects\software-trunk\SeznamInstall\bin\debug\sznsetup.pdb` source: sznsetup.exe, 00000039.00000000.1850844929.0000000000F0C000.00000002.00000001.01000000.00000023.sdmp
Source:	Binary string: p:\d\a\wpyh4-vm-6.hot\recipes\840394494\base\googleclient\picasa39-stable\build\cdautorun\PicasaCD.pdblpW source: setuppicasa39-setup.exe, 00000010.00000002.1664870898.0000000004419000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\ondrej.novak\Documents\Visual Studio 2008\Projects\software-trunk\SeznamInstall\bin\debug\szninstall.pdb0Z source: szninstall.exe, 00000038.00000000.1847499306.0000000000571000.00000002.00000001.01000000.00000022.sdmp

Source: C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe

Code function: 16_2_04C92490 GetVersion,LoadLibraryW,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

16_2_04C92490

Source: C:\Users\user\Desktop\1a4e5ccd35a56d84281a143f831563be.exe	Code function: 15_2_73A33299 push ebx; mov dword ptr [esp], 00000001h	15_2_73A332D5
Source: C:\Users\user\Desktop\1a4e5ccd35a56d84281a143f831563be.exe	Code function: 15_2_73A314B4 push edx; mov dword ptr [esp], eax	15_2_73A31535
Source: C:\Users\user\Desktop\1a4e5ccd35a56d84281a143f831563be.exe	Code function: 15_2_73A34BE0 push dword ptr [eax+04h]; ret	15_2_73A34C0F
Source: C:\Users\user\Desktop\1a4e5ccd35a56d84281a143f831563be.exe	Code function: 15_2_73A32ACE push ecx; mov dword ptr [esp], 00000000h	15_2_73A32B06
Source: C:\Users\user\Desktop\1a4e5ccd35a56d84281a143f831563be.exe	Code function: 15_2_73A33A03 push edx; mov dword ptr [esp], eax	15_2_73A33A27
Source: C:\Users\user\Desktop\1a4e5ccd35a56d84281a143f831563be.exe	Code function: 15_2_73A31C11 push ecx; mov dword ptr [esp], ebx	15_2_73A31CC9
Source: C:\Users\user\Desktop\1a4e5ccd35a56d84281a143f831563be.exe	Code function: 15_2_73A3147E push edx; mov dword ptr [esp], eax	15_2_73A31471
Source: C:\Users\user\Desktop\1a4e5ccd35a56d84281a143f831563be.exe	Code function: 15_2_741C21CA push eax; mov dword ptr [esp], ebx	15_2_741C227B
Source: C:\Users\user\Desktop\1a4e5ccd35a56d84281a143f831563be.exe	Code function: 15_2_741C113F push eax; mov dword ptr [esp], ebx	15_2_741C11D9
Source: C:\Users\user\Desktop\1a4e5ccd35a56d84281a143f831563be.exe	Code function: 15_2_741C113F push edx; mov dword ptr [esp], 741C5000h	15_2_741C11EE
Source: C:\Users\user\Desktop\1a4e5ccd35a56d84281a143f831563be.exe	Code function: 15_2_741C113F push eax; mov dword ptr [esp], esi	15_2_741C1298
Source: C:\Users\user\Desktop\1a4e5ccd35a56d84281a143f831563be.exe	Code function: 15_2_741C113F push eax; mov dword ptr [esp], 741C4000h	15_2_741C12F6
Source: C:\Users\user\Desktop\1a4e5ccd35a56d84281a143f831563be.exe	Code function: 15_2_741C1038 push edx; mov dword ptr [esp], ebx	15_2_741C112D
Source: C:\Users\user\Desktop\1a4e5ccd35a56d84281a143f831563be.exe	Code function: 15_2_741C164A push edx; mov dword ptr [esp], eax	15_2_741C1685
Source: C:\Users\user\Desktop\1a4e5ccd35a56d84281a143f831563be.exe	Code function: 15_2_741C16C7 push edx; mov dword ptr [esp], eax	15_2_741C1743
Source: C:\Users\user\Desktop\1a4e5ccd35a56d84281a143f831563be.exe	Code function: 15_2_741C24EF push edx; mov dword ptr [esp], eax	15_2_741C2513
Source: C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe	Code function: 16_2_04C97CD1 push ecx; ret	16_2_04C97CE4
Source: C:\Program Files (x86)\Google\Picasa3\Picasa3.exe	Code function: 20_2_033DFD01 push ecx; ret	20_2_033DFD14
Source: C:\Program Files (x86)\Google\Picasa3\Picasa3.exe	Code function: 20_2_04065059 push ecx; ret	20_2_0406506C
Source: C:\Program Files (x86)\Google\Picasa3\Picasa3.exe	Code function: 20_2_0482E67A push esi; ret	20_2_0482E685
Source: C:\Program Files (x86)\Google\Picasa3\Picasa3.exe	Code function: 20_2_04877891 push ecx; ret	20_2_048778A4
Source: C:\Program Files (x86)\Google\Picasa3\Picasa3.exe	Code function: 20_2_100028CD push ecx; ret	20_2_100028E0
Source: C:\Users\user\AppData\Local\Temp\nsm983C.tmp\listicka.exe	Code function: 22_2_10002A10 push eax; ret	22_2_10002A3E
Source: C:\Users\user\AppData\Local\Temp\~0069FB97.00001B74.sznpkg\UNZIP.EXE	Code function: 38_2_0041B280 push eax; ret	38_2_0041B2AE
Source: C:\Users\user\AppData\Local\Temp\~0069FB97.00001B74.sznpkg\REG.EXE	Code function: 42_2_01006F30 push eax; ret	42_2_01006F44
Source: C:\Users\user\AppData\Local\Temp\~0069FB97.00001B74.sznpkg\REG.EXE	Code function: 42_2_01006F30 push eax; ret	42_2_01006F6C
Source: C:\Users\user\AppData\Local\Temp\~006A2DE2.00000DD4.sznpkg\UNZIP.EXE	Code function: 82_2_006120DB pushad ; ret	82_2_006120EA
Source: C:\Users\user\AppData\Roaming\Seznam.cz\bin\szndesktop.exe	Code function: 135_2_6C11AC05 push ecx; ret	135_2_6C11AC18
Source: C:\Users\user\AppData\Roaming\Seznam.cz\bin\szndesktop.exe	Code function: 135_2_6C0E7FFA push edi; iretd	135_2_6C0E8001
Source: C:\Users\user\AppData\Roaming\Seznam.cz\bin\szndesktop.exe	Code function: 135_2_6C0E3834 push ss; iretd	135_2_6C0E3CA1
Source: C:\Users\user\AppData\Roaming\Seznam.cz\bin\szndesktop.exe	Code function: 135_2_6C0E3BF6 push ss; iretd	135_2_6C0E3CA1

Persistence and Installation Behavior

Drops PE files with a suspicious file extension

Source: C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe

File created: C:\Windows\SysWOW64\GPhotos.scr

Jump to dropped file

Drops executables to the windows directory (C:\Windows) and starts them

Source: C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe

Executable created and started: C:\Windows\SysWOW64\GPhotos.scr

Jump to behavior

Uses cmd line tools excessively to alter registry or file data

Source: C:\Windows\SysWOW64\cmd.exe	Process created: reg.exe
Source: C:\Windows\SysWOW64\cmd.exe	Process created: reg.exe
Source: C:\Windows\SysWOW64\cmd.exe	Process created: reg.exe
Source: C:\Windows\SysWOW64\cmd.exe	Process created: reg.exe
Source: C:\Windows\SysWOW64\cmd.exe	Process created: reg.exe
Source: C:\Windows\SysWOW64\cmd.exe	Process created: reg.exe
Source: C:\Windows\SysWOW64\cmd.exe	Process created: reg.exe
Source: C:\Windows\SysWOW64\cmd.exe	Process created: reg.exe
Source: C:\Windows\SysWOW64\cmd.exe	Process created: reg.exe
Source: C:\Windows\SysWOW64\cmd.exe	Process created: reg.exe
Source: C:\Windows\SysWOW64\cmd.exe	Process created: reg.exe
Source: C:\Windows\SysWOW64\cmd.exe	Process created: reg.exe
Source: C:\Windows\SysWOW64\cmd.exe	Process created: reg.exe
Source: C:\Windows\SysWOW64\cmd.exe	Process created: reg.exe
Source: C:\Windows\SysWOW64\cmd.exe	Process created: reg.exe
Source: C:\Windows\SysWOW64\cmd.exe	Process created: reg.exe
Source: C:\Windows\SysWOW64\cmd.exe	Process created: reg.exe
Source: C:\Windows\SysWOW64\cmd.exe	Process created: reg.exe
Source: C:\Windows\SysWOW64\cmd.exe	Process created: reg.exe
Source: C:\Windows\SysWOW64\cmd.exe	Process created: reg.exe
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: reg.exe
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: reg.exe
Source: C:\Windows\SysWOW64\cmd.exe	Process created: reg.exe
Source: C:\Windows\SysWOW64\cmd.exe	Process created: reg.exe
Source: C:\Windows\SysWOW64\cmd.exe	Process created: reg.exe
Source: C:\Windows\SysWOW64\cmd.exe	Process created: reg.exe
Source: C:\Windows\SysWOW64\cmd.exe	Process created: reg.exe
Source: C:\Windows\SysWOW64\cmd.exe	Process created: reg.exe
Source: C:\Windows\SysWOW64\cmd.exe	Process created: reg.exe
Source: C:\Windows\SysWOW64\cmd.exe	Process created: reg.exe
Source: C:\Windows\SysWOW64\cmd.exe	Process created: reg.exe
Source: C:\Windows\SysWOW64\cmd.exe	Process created: reg.exe
Source: C:\Windows\SysWOW64\cmd.exe	Process created: reg.exe
Source: C:\Windows\SysWOW64\cmd.exe	Process created: reg.exe
Source: C:\Windows\SysWOW64\cmd.exe	Process created: reg.exe
Source: C:\Windows\SysWOW64\cmd.exe	Process created: reg.exe
Source: C:\Windows\SysWOW64\cmd.exe	Process created: reg.exe
Source: C:\Windows\SysWOW64\cmd.exe	Process created: reg.exe
Source: C:\Windows\SysWOW64\cmd.exe	Process created: reg.exe
Source: C:\Windows\SysWOW64\cmd.exe	Process created: reg.exe
Source: C:\Windows\SysWOW64\cmd.exe	Process created: reg.exe

Source: C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe	File created: C:\Users\user\AppData\Local\Temp\nst9CEF.tmp\NSIS_Picasa_Unicode.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe	File created: C:\Program Files (x86)\Google\Picasa3\npPicasa3.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\~006A2DE2.00000DD4.sznpkg\CPY.EXE	File created: C:\Users\user\AppData\Roaming\Seznam.cz\bin\listicka-x64.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe	File created: C:\Program Files (x86)\Google\Picasa3\MovieThumb.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe	File created: C:\Users\user\AppData\Local\Temp\nst9CEF.tmp\System.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\~006A2DE2.00000DD4.sznpkg\UNZIP.EXE	File created: C:\Users\user\AppData\Local\Temp\~006A8B64.00000DD4.sznpkg\sznpp.exe	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\Seznam.cz\sznsetup.exe	File created: C:\Users\user\AppData\Local\Temp\~006A2DE2.00000DD4.sznpkg\CPY.EXE	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe	File created: C:\Program Files (x86)\Google\Picasa3\qtsupport.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\~006A2DE2.00000DD4.sznpkg\UNZIP.EXE	File created: C:\Users\user\AppData\Local\Temp\~006A9140.00000DD4.sznpkg\wszndesktop.exe	Jump to dropped file
Source: C:\Users\user\Desktop\1a4e5ccd35a56d84281a143f831563be.exe	File created: C:\Users\user\AppData\Local\Temp\nsm983C.tmp\listicka.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe	File created: C:\Users\user\AppData\Local\Temp\nst9CEF.tmp\StdUtils.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\~006A2DE2.00000DD4.sznpkg\CPY.EXE	File created: C:\Users\user\AppData\Roaming\Seznam.cz\bin\lightspeed.dll	Jump to dropped file
Source: C:\Users\user\Desktop\1a4e5ccd35a56d84281a143f831563be.exe	File created: C:\Users\user\AppData\Local\Temp\nsu8781.tmp\ButtonEvent.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\~006A2DE2.00000DD4.sznpkg\UNZIP.EXE	File created: C:\Users\user\AppData\Local\Temp\~006AA7B6.00000DD4.sznpkg\libfoxloader-x64.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsm983C.tmp\listicka.exe	File created: C:\Users\user\AppData\Local\Temp\nsrF139.tmp\nsExec.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\~006A2DE2.00000DD4.sznpkg\CPY.EXE	File created: C:\Users\user\AppData\Roaming\Seznam.cz\bin\sznpp.exe	Jump to dropped file
Source: C:\Windows\SysWOW64\cmd.exe	File created: C:\Users\user\AppData\Roaming\Seznam.cz\bin\24557libfoxloader.dll	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\Seznam.cz\sznsetup.exe	File created: C:\Users\user\AppData\Local\Temp\~006A2DE2.00000DD4.sznpkg\UNZIP.EXE	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\~0069FB97.00001B74.sznpkg\UNZIP.EXE	File created: C:\Users\user\AppData\Local\Temp\~006A1AF6.00001B74.sznpkg\szninstall.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\~006A2DE2.00000DD4.sznpkg\UNZIP.EXE	File created: C:\Users\user\AppData\Local\Temp\~006A8960.00000DD4.sznpkg\lightspeed.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe	File created: C:\Windows\SysWOW64\GPhotos.scr	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsm983C.tmp\listicka.exe	File created: C:\Users\user\AppData\Roaming\Seznam.cz\sznsetup-lt.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\~006A2DE2.00000DD4.sznpkg\UNZIP.EXE	File created: C:\Users\user\AppData\Local\Temp\~006A93FF.00000DD4.sznpkg\libfoxcub.dll	Jump to dropped file
Source: C:\Users\user\Desktop\1a4e5ccd35a56d84281a143f831563be.exe	File created: C:\Users\user\AppData\Local\Temp\nsu8781.tmp\nsDialogs.dll	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\Seznam.cz\sznsetup-lt.exe	File created: C:\Users\user\AppData\Local\Temp\~0069FB97.00001B74.sznpkg\UNZIP.EXE	Jump to dropped file
Source: C:\Windows\SysWOW64\cmd.exe	File created: C:\Users\user\AppData\Roaming\Seznam.cz\sznsetup.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsm983C.tmp\listicka.exe	File created: C:\Users\user\AppData\Local\Temp\nsrF139.tmp\System.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\~006A2DE2.00000DD4.sznpkg\UNZIP.EXE	File created: C:\Users\user\AppData\Local\Temp\~006AA7B6.00000DD4.sznpkg\libfoxcub-x64.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe	File created: C:\Program Files (x86)\Google\Picasa3\Picasa3.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\~006A2DE2.00000DD4.sznpkg\UNZIP.EXE	File created: C:\Users\user\AppData\Local\Temp\~006A848E.00000DD4.sznpkg\msvcr110.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\cmd.exe	File created: C:\Users\user\AppData\Roaming\Seznam.cz\szninstall.exe	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\Seznam.cz\sznsetup.exe	File created: C:\Users\user\AppData\Local\Temp\~006A2DE2.00000DD4.sznpkg\RM.EXE	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe	File created: C:\Program Files (x86)\Google\Picasa3\cdautorun\PicasaRestore.exe	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\Seznam.cz\sznsetup.exe	File created: C:\Users\user\AppData\Local\Temp\~006A2DE2.00000DD4.sznpkg\REG.EXE	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\Seznam.cz\sznsetup-lt.exe	File created: C:\Users\user\AppData\Local\Temp\~0069FB97.00001B74.sznpkg\REG.EXE	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\Seznam.cz\sznsetup.exe	File created: C:\Users\user\AppData\Local\Temp\~006A2DE2.00000DD4.sznpkg\RUNBG.EXE	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\~006A2DE2.00000DD4.sznpkg\CPY.EXE	File created: C:\Users\user\AppData\Roaming\Seznam.cz\bin\msvcp110.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\~006A2DE2.00000DD4.sznpkg\UNZIP.EXE	File created: C:\Users\user\AppData\Local\Temp\~006A848E.00000DD4.sznpkg\msvcp110.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsm983C.tmp\listicka.exe	File created: C:\Users\user\AppData\Local\Temp\nsrF139.tmp\UserInfo.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\~006A2DE2.00000DD4.sznpkg\CPY.EXE	File created: C:\Users\user\AppData\Roaming\Seznam.cz\bin\msvcr110.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe	File created: C:\Program Files (x86)\Google\Picasa3\plugins\Red.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe	File created: C:\Program Files (x86)\Google\Picasa3\plugins\ytITivo.yti	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe	File created: C:\Program Files (x86)\Google\Picasa3\cdautorun\PicasaCD.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\~006A2DE2.00000DD4.sznpkg\UNZIP.EXE	File created: C:\Users\user\AppData\Local\Temp\~006A8B64.00000DD4.sznpkg\szndesktop.exe	Jump to dropped file
Source: C:\Users\user\Desktop\1a4e5ccd35a56d84281a143f831563be.exe	File created: C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\Seznam.cz\sznsetup.exe	File created: C:\Users\user\AppData\Local\Temp\~006A2DE2.00000DD4.sznpkg\MKLNK.EXE	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe	File created: C:\Program Files (x86)\Google\Picasa3\plugins\expwebsites\expwebsites.yti	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe	File created: C:\Program Files (x86)\Google\Picasa3\uninstall.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\~006A2DE2.00000DD4.sznpkg\CPY.EXE	File created: C:\Users\user\AppData\Roaming\Seznam.cz\bin\wszndesktop.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\~006A2DE2.00000DD4.sznpkg\UNZIP.EXE	File created: C:\Users\user\AppData\Local\Temp\~006AA61F.00000DD4.sznpkg\libfoxloader.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe	File created: C:\Program Files (x86)\Google\Picasa3\Picasa3i18n.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe	File created: C:\Program Files (x86)\Google\Picasa3\plugins\CDVDR\CDVDR.yti	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\~006A2DE2.00000DD4.sznpkg\CPY.EXE	File created: C:\Users\user\AppData\Roaming\Seznam.cz\bin\libfoxcub.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\~006A2DE2.00000DD4.sznpkg\UNZIP.EXE	File created: C:\Users\user\AppData\Local\Temp\~006AA7B6.00000DD4.sznpkg\listicka-x64.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe	File created: C:\Program Files (x86)\Google\Picasa3\PicasaPhotoViewer.exe	Jump to dropped file
Source: C:\Users\user\Desktop\1a4e5ccd35a56d84281a143f831563be.exe	File created: C:\Users\user\AppData\Local\Temp\nsu8781.tmp\System.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\cmd.exe	File created: C:\Users\user\AppData\Roaming\Seznam.cz\bin\24557libfoxloader-x64.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\~0069FB97.00001B74.sznpkg\UNZIP.EXE	File created: C:\Users\user\AppData\Local\Temp\~006A18C4.00001B74.sznpkg\sznsetup.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe	File created: C:\Users\user\AppData\Local\Temp\nst9CEF.tmp\nsDialogs.dll	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\Seznam.cz\sznsetup.exe	File created: C:\Users\user\AppData\Local\Temp\~006A2DE2.00000DD4.sznpkg\SHELLFLD.EXE	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\~006A2DE2.00000DD4.sznpkg\CPY.EXE	File created: C:\Users\user\AppData\Roaming\Seznam.cz\bin\libfoxcub-x64.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\~006A2DE2.00000DD4.sznpkg\CPY.EXE	File created: C:\Users\user\AppData\Roaming\Seznam.cz\bin\szndesktop.exe	Jump to dropped file

Source: C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe

File created: C:\Windows\SysWOW64\GPhotos.scr

Jump to dropped file

Source: C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe	File created: C:\Program Files (x86)\Google\Picasa3\plugins\CDVDR\CDVDR.yti	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe	File created: C:\Program Files (x86)\Google\Picasa3\plugins\expwebsites\expwebsites.yti	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe	File created: C:\Program Files (x86)\Google\Picasa3\plugins\ytITivo.yti	Jump to dropped file

Source: C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe

Code function: 16_2_04C910B0 lstrcpyW,lstrcatW,GetPrivateProfileStringW,

16_2_04C910B0

Source: C:\Users\user\AppData\Roaming\Seznam.cz\szninstall.exe	File created: C:\Users\user\AppData\Roaming\Seznam.cz\install.log.5868.log
Source: C:\Users\user\AppData\Roaming\Seznam.cz\szninstall.exe	File created: C:\Users\user\AppData\Roaming\Seznam.cz\install.log
Source: C:\Windows\SysWOW64\cmd.exe	File created: C:\Users\user\AppData\Roaming\Seznam.cz\install_packages.log

Boot Survival

Creates an undocumented autostart registry key

Source: C:\Windows\SysWOW64\GPhotos.scr

Key value created or modified: HKEY_USERS.DEFAULT\Control Panel\Desktop SCRNSAVE.EXE

Jump to behavior

Creates multiple autostart registry keys

Source: C:\Users\user\AppData\Local\Temp\~006A2DE2.00000DD4.sznpkg\REG.EXE	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run cz.seznam.software.szndesktop
Source: C:\Users\user\AppData\Local\Temp\~006A2DE2.00000DD4.sznpkg\REG.EXE	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run cz.seznam.software.autoupdate

Source: C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe

Registry key created: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\Application\Picasa3

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe	File created: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Picasa 3\Picasa 3.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe	File created: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Picasa 3\Configure Picasa Photo Viewer.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe	File created: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Picasa 3\Uninstall.lnk	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\~006A2DE2.00000DD4.sznpkg\REG.EXE	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run cz.seznam.software.autoupdate
Source: C:\Users\user\AppData\Local\Temp\~006A2DE2.00000DD4.sznpkg\REG.EXE	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run cz.seznam.software.autoupdate
Source: C:\Users\user\AppData\Local\Temp\~006A2DE2.00000DD4.sznpkg\REG.EXE	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run cz.seznam.software.szndesktop
Source: C:\Users\user\AppData\Local\Temp\~006A2DE2.00000DD4.sznpkg\REG.EXE	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run cz.seznam.software.szndesktop

Source: C:\Program Files (x86)\Google\Picasa3\Picasa3.exe	Code function: 20_2_04035CD0 IsWindowVisible,IsWindow,IsWindow,IsWindowVisible,GetCurrentThreadId,GetCurrentThreadId,EnumThreadWindows,IsWindowVisible,IsIconic,IsIconic,IsWindow,IsWindowVisible,IsWindowVisible,IsIconic,GetCurrentThreadId,SetWindowsHookExA,	20_2_04035CD0
Source: C:\Program Files (x86)\Google\Picasa3\Picasa3.exe	Code function: 20_2_04035CD0 IsWindowVisible,IsWindow,IsWindow,IsWindowVisible,GetCurrentThreadId,GetCurrentThreadId,EnumThreadWindows,IsWindowVisible,IsIconic,IsIconic,IsWindow,IsWindowVisible,IsWindowVisible,IsIconic,GetCurrentThreadId,SetWindowsHookExA,	20_2_04035CD0
Source: C:\Program Files (x86)\Google\Picasa3\Picasa3.exe	Code function: 20_2_04035CD0 IsWindowVisible,IsWindow,IsWindow,IsWindowVisible,GetCurrentThreadId,GetCurrentThreadId,EnumThreadWindows,IsWindowVisible,IsIconic,IsIconic,IsWindow,IsWindowVisible,IsWindowVisible,IsIconic,GetCurrentThreadId,SetWindowsHookExA,	20_2_04035CD0
Source: C:\Program Files (x86)\Google\Picasa3\Picasa3.exe	Code function: 20_2_04041930 IsIconic,ShowWindow,DialogBoxIndirectParamW,GlobalFree,	20_2_04041930
Source: C:\Program Files (x86)\Google\Picasa3\Picasa3.exe	Code function: 20_2_0483F400 IsIconic,ShowWindow,DialogBoxIndirectParamW,GlobalFree,	20_2_0483F400
Source: C:\Program Files (x86)\Google\Picasa3\Picasa3.exe	Code function: 20_2_0480E0E0 IsIconic,ShowWindow,DialogBoxIndirectParamW,GlobalFree,	20_2_0480E0E0
Source: C:\Program Files (x86)\Google\Picasa3\Picasa3.exe	Code function: 20_2_0480E060 ShowWindow,IsIconic,ShowWindow,CreateDialogIndirectParamA,GlobalFree,ShowWindow,	20_2_0480E060
Source: C:\Program Files (x86)\Google\Picasa3\Picasa3.exe	Code function: 20_2_0482DEC0 IsWindowVisible,GetCurrentThreadId,IsWindow,IsWindow,IsWindowVisible,GetCurrentThreadId,EnumThreadWindows,IsWindowVisible,IsIconic,IsIconic,IsWindow,IsWindowVisible,IsWindowVisible,IsIconic,GetCurrentThreadId,SetWindowsHookExA,	20_2_0482DEC0
Source: C:\Program Files (x86)\Google\Picasa3\Picasa3.exe	Code function: 20_2_0482DEC0 IsWindowVisible,GetCurrentThreadId,IsWindow,IsWindow,IsWindowVisible,GetCurrentThreadId,EnumThreadWindows,IsWindowVisible,IsIconic,IsIconic,IsWindow,IsWindowVisible,IsWindowVisible,IsIconic,GetCurrentThreadId,SetWindowsHookExA,	20_2_0482DEC0
Source: C:\Program Files (x86)\Google\Picasa3\Picasa3.exe	Code function: 20_2_0482DEC0 IsWindowVisible,GetCurrentThreadId,IsWindow,IsWindow,IsWindowVisible,GetCurrentThreadId,EnumThreadWindows,IsWindowVisible,IsIconic,IsIconic,IsWindow,IsWindowVisible,IsWindowVisible,IsIconic,GetCurrentThreadId,SetWindowsHookExA,	20_2_0482DEC0

Source: C:\Users\user\AppData\Roaming\Seznam.cz\bin\szndesktop.exe

Code function: 135_2_6C247216 EncodePointer,__initp_misc_winsig,GetModuleHandleW,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

135_2_6C247216

Source: C:\Program Files (x86)\Google\Picasa3\Picasa3.exe	Registry key monitored for changes: HKEY_CURRENT_USER_Classes	Jump to behavior
Source: C:\Program Files (x86)\Google\Picasa3\PicasaPhotoViewer.exe	Registry key monitored for changes: HKEY_CURRENT_USER_Classes
Source: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\BHO\ie_to_edge_stub.exe	Registry key monitored for changes: HKEY_CURRENT_USER_Classes

Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\1a4e5ccd35a56d84281a143f831563be.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\GPhotos.scr	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\GPhotos.scr	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\GPhotos.scr	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\GPhotos.scr	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\GPhotos.scr	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\GPhotos.scr	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\GPhotos.scr	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\GPhotos.scr	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\GPhotos.scr	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\GPhotos.scr	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\GPhotos.scr	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Google\Picasa3\Picasa3.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Google\Picasa3\Picasa3.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Google\Picasa3\Picasa3.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Google\Picasa3\Picasa3.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Google\Picasa3\Picasa3.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Google\Picasa3\Picasa3.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Google\Picasa3\Picasa3.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Google\Picasa3\Picasa3.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Google\Picasa3\Picasa3.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Google\Picasa3\Picasa3.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Google\Picasa3\Picasa3.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Google\Picasa3\Picasa3.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Google\Picasa3\Picasa3.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Google\Picasa3\Picasa3.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Google\Picasa3\Picasa3.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Google\Picasa3\Picasa3.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Google\Picasa3\Picasa3.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Google\Picasa3\Picasa3.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Google\Picasa3\Picasa3.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Google\Picasa3\Picasa3.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Google\Picasa3\Picasa3.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Google\Picasa3\Picasa3.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Google\Picasa3\Picasa3.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Google\Picasa3\Picasa3.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Google\Picasa3\Picasa3.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Google\Picasa3\Picasa3.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Google\Picasa3\Picasa3.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Google\Picasa3\Picasa3.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Google\Picasa3\Picasa3.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Google\Picasa3\Picasa3.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Google\Picasa3\PicasaPhotoViewer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Google\Picasa3\PicasaPhotoViewer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Google\Picasa3\PicasaPhotoViewer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Google\Picasa3\PicasaPhotoViewer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Google\Picasa3\PicasaPhotoViewer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Google\Picasa3\PicasaPhotoViewer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Google\Picasa3\PicasaPhotoViewer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Google\Picasa3\PicasaPhotoViewer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Google\Picasa3\PicasaPhotoViewer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Google\Picasa3\PicasaPhotoViewer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Google\Picasa3\PicasaPhotoViewer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Google\Picasa3\PicasaPhotoViewer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Google\Picasa3\PicasaPhotoViewer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Google\Picasa3\PicasaPhotoViewer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Google\Picasa3\PicasaPhotoViewer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Google\Picasa3\PicasaPhotoViewer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Google\Picasa3\PicasaPhotoViewer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Google\Picasa3\PicasaPhotoViewer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Google\Picasa3\PicasaPhotoViewer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Google\Picasa3\PicasaPhotoViewer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Google\Picasa3\PicasaPhotoViewer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Google\Picasa3\PicasaPhotoViewer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Google\Picasa3\PicasaPhotoViewer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Google\Picasa3\PicasaPhotoViewer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Google\Picasa3\PicasaPhotoViewer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Google\Picasa3\PicasaPhotoViewer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\nsm983C.tmp\listicka.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\conhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Seznam.cz\sznsetup-lt.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Seznam.cz\sznsetup-lt.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Seznam.cz\sznsetup-lt.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Seznam.cz\sznsetup-lt.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Seznam.cz\sznsetup-lt.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Seznam.cz\sznsetup-lt.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Seznam.cz\sznsetup-lt.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Seznam.cz\sznsetup-lt.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Seznam.cz\sznsetup-lt.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Seznam.cz\sznsetup-lt.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\conhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\BHO\ie_to_edge_stub.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Java\jre-1.8\bin\ssvagent.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Java\jre-1.8\bin\ssvagent.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\~0069FB97.00001B74.sznpkg\UNZIP.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\~0069FB97.00001B74.sznpkg\UNZIP.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\~0069FB97.00001B74.sznpkg\UNZIP.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\~0069FB97.00001B74.sznpkg\UNZIP.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\~0069FB97.00001B74.sznpkg\UNZIP.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\~0069FB97.00001B74.sznpkg\UNZIP.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\cmd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\cmd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\cmd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\cmd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\cmd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\cmd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\cmd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\cmd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\cmd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\cmd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\cmd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\cmd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\cmd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\cmd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\cmd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\cmd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\cmd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\cmd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\cmd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\cmd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\cmd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\cmd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\~0069FB97.00001B74.sznpkg\REG.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\~0069FB97.00001B74.sznpkg\REG.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\~0069FB97.00001B74.sznpkg\REG.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\~0069FB97.00001B74.sznpkg\REG.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\~0069FB97.00001B74.sznpkg\REG.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\~0069FB97.00001B74.sznpkg\REG.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Seznam.cz\szninstall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Seznam.cz\szninstall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Seznam.cz\szninstall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Seznam.cz\szninstall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Seznam.cz\szninstall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Seznam.cz\szninstall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Seznam.cz\szninstall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Seznam.cz\szninstall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\conhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\cookie_exporter.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\cookie_exporter.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\cookie_exporter.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Seznam.cz\sznsetup.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Seznam.cz\sznsetup.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Seznam.cz\sznsetup.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Seznam.cz\sznsetup.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Seznam.cz\sznsetup.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Seznam.cz\sznsetup.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Seznam.cz\sznsetup.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Seznam.cz\sznsetup.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Seznam.cz\sznsetup.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Seznam.cz\sznsetup.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\conhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\~006A2DE2.00000DD4.sznpkg\UNZIP.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\~006A2DE2.00000DD4.sznpkg\UNZIP.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\~006A2DE2.00000DD4.sznpkg\UNZIP.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\~006A2DE2.00000DD4.sznpkg\UNZIP.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\~006A2DE2.00000DD4.sznpkg\UNZIP.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\~006A2DE2.00000DD4.sznpkg\UNZIP.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\conhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\cmd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\cmd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\cmd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\cmd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\cmd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\cmd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\cmd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\cmd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\cmd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\cmd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\cmd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\cmd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\conhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\~006A2DE2.00000DD4.sznpkg\REG.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\~006A2DE2.00000DD4.sznpkg\REG.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\~006A2DE2.00000DD4.sznpkg\REG.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\~006A2DE2.00000DD4.sznpkg\REG.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\~006A2DE2.00000DD4.sznpkg\REG.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\~006A2DE2.00000DD4.sznpkg\REG.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\conhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\cmd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\cmd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\cmd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\cmd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\conhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\conhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\cmd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\cmd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\cmd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\cmd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\cmd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\cmd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\cmd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\cmd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\cmd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\cmd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\cmd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\cmd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\conhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\~006A2DE2.00000DD4.sznpkg\CPY.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\~006A2DE2.00000DD4.sznpkg\CPY.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\~006A2DE2.00000DD4.sznpkg\CPY.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\~006A2DE2.00000DD4.sznpkg\CPY.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\~006A2DE2.00000DD4.sznpkg\CPY.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\~006A2DE2.00000DD4.sznpkg\CPY.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\conhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\cmd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\cmd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\cmd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\cmd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\cmd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\cmd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\cmd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\cmd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\cmd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\cmd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\conhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\conhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\cmd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\cmd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\cmd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\cmd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\cmd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\cmd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\cmd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\cmd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\cmd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\cmd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\conhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\conhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\cmd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\cmd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\cmd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\cmd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\cmd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\cmd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\cmd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\cmd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\cmd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\cmd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\conhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\conhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\cmd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\cmd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\cmd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\cmd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\cmd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\cmd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\cmd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\cmd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\cmd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\cmd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\cmd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\cmd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\cmd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\cmd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\cmd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\conhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Seznam.cz\bin\sznpp.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Seznam.cz\bin\sznpp.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\conhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\cmd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\cmd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\cmd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\cmd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\cmd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\cmd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\cmd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\conhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\conhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\cmd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\cmd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\cmd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\cmd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\cmd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\cmd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\cmd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\cmd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\cmd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\cmd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\cmd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\cmd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\cmd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\conhost.exe	Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Source: setuppicasa39-setup.exe, 00000010.00000002.1664870898.00000000031AA000.00000004.00000020.00020000.00000000.sdmp, PicasaPhotoViewer.exe, 00000015.00000000.1692209976.000000000070D000.00000002.00000001.01000000.00000019.sdmp	Binary or memory string: LROOTEDITSOFTWARE\GOOGLE\%SGOOGLE\%SRASENUMENTRIESARASAPI32.DLLJPEG FILESYTAPP::JPEGFILTER.JPG;.JPEGGETFILESINFOYTAPP::INFOTITLEEXPLORER/SELECT,"%S"SOFTWARE\CLIENTS\STARTMENUINTERNET%S\%S\SHELL\OPEN\COMMAND.EXEIEXPLORE-NOHOME RUNTIME\DISTRO.INIDISTROWINELINUX_%SLINUX_UNKNOWNWINEWINDOWSWINDOWS_%D_%DWINE_GET_UNIX_FILE_NAMEKERNEL32
Source: Picasa3.exe, Picasa3.exe, 00000014.00000002.2533437740.000000000488F000.00000002.00000001.01000000.00000016.sdmp, Picasa3.exe, 00000014.00000002.2504208079.0000000004079000.00000002.00000001.01000000.00000017.sdmp, PicasaPhotoViewer.exe, 00000015.00000000.1692209976.000000000070D000.00000002.00000001.01000000.00000019.sdmp	Binary or memory string: WINE_GET_UNIX_FILE_NAME
Source: setuppicasa39-setup.exe, 00000010.00000002.1664870898.00000000035FF000.00000004.00000020.00020000.00000000.sdmp, GPhotos.scr, 00000011.00000000.1542724484.000000000062E000.00000002.00000001.01000000.0000000F.sdmp	Binary or memory string: W RK0RKSOFTWARE\GOOGLE\%SGOOGLE\%SRASENUMENTRIESARASAPI32.DLLTAHOMAWJPEG FILESYTAPP::JPEGFILTER.JPG;.JPEGGETFILESINFOYTAPP::INFOTITLEEXPLORER/E,/SELECT,"%S"SOFTWARE\CLIENTS\STARTMENUINTERNET%S\%S\SHELL\OPEN\COMMANDIEXPLORE.EXE.EXEIEXPLORE-NOHOME RUNTIME\DISTRO.INIDISTROWINELINUX_%SLINUX_UNKNOWNWINEWINDOWSWINDOWS_%D_%DWINE_GET_UNIX_FILE_NAMEKERNEL32
Source: setuppicasa39-setup.exe, 00000010.00000002.1664870898.0000000003DA5000.00000004.00000020.00020000.00000000.sdmp, Picasa3.exe, 00000014.00000002.2533437740.000000000488F000.00000002.00000001.01000000.00000016.sdmp	Binary or memory string: SOFTWARE\GOOGLE\%SGOOGLE\%SRASENUMENTRIESARASAPI32.DLLJPEG FILESYTAPP::JPEGFILTER.JPG;.JPEGGETFILESYTAPP::ERRORTITLEINFOYTAPP::INFOTITLE"%S"SOFTWARE\CLIENTS\STARTMENUINTERNET%S\%S\SHELL\OPEN\COMMANDIEXPLORE.EXE.EXE.EXEIEXPLORE-NOHOME WINE_GET_UNIX_FILE_NAMEKERNEL32LW
Source: setuppicasa39-setup.exe, 00000010.00000002.1664870898.000000000459F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: EHELPCLOSENOYESIGNORERETRYABORTCANCELOK%S/%S_BSOFTWARE\GOOGLE\%SGOOGLE\%SRASENUMENTRIESARASAPI32.DLLTAHOMAJPEG FILESYTAPP::JPEGFILTER.JPG;.JPEGGETFILESYTAPP::ERRORTITLEOPENEXPLORER/SELECT,"%S"WINE_GET_UNIX_FILE_NAMEKERNEL32
Source: Picasa3.exe, 00000012.00000000.1603749985.0000000000C6A000.00000002.00000001.01000000.00000012.sdmp	Binary or memory string: WINE_GET_UNIX_REAL_NAMEKERNEL32WINE_GET_UNIX_FILE_NAMERUNTIME\WINEDISABLE.TXTSUPPORTHTTP%S_PAUTOINFOCHECKSHOWTOOLTIPSPRINTERQUALITYPRINTRESAMPLERQUALITYPRINTPROXYPREVIEWLOOPSLIDESHOWPLAYMP3TRACKSARIAL UNICODE MSWEB_ALBUMS_TABCGENERALPREFSPAGE::WEBALBUMSTABESENABLEFRUPLOADSTAGS_GROUPUPLOADCONTACTPHOTOSUSAGESTATSPRIVACYAUTOUPDATEIMPORTDESTEMAILSINGLEPICTUREEMAILMOVIEUSEHTMLMAILEREMAILPREPTYPEDONOTPROMPTFOREMAILPREFEMAILEXPORTSIZEMAILPROGPICSIZEDEFAULTMAILIDS_EMAILCLIENTRADIOPRINT%DPROXYUSERPROXYPASSCONN:PROXYMETHODAUTOPROXYLOGLEVELLOGLEVELLOG ALL (INSECURE)NETWORKPREFS::LOGINSECURELOGPWASTARREDPWASYNCORDERPWASTRIPEDPWAUSEHIQUALITYJPEGPWADEFAULTSIZEORIGINAL SIZE (SLOWEST UPLOAD)CGENERALPREFSPAGE::ORIGINALBEST FOR WEB SHARING (2048PX)CGENERALPREFSPAGE::2048RECOMMENDED: 1600 PIXELS (FOR PRINTS, SCREENSAVERS, AND SHARING)CGENERALPREFSPAGE::1600MEDIUM: 1024 PIXELS (FOR SHARING)CGENERALPREFSPAGE::1024SMALL: 800 PIXELS (FOR BLOGS AND WEBPAGES)CGENERALPREFSPAGE::800HASWATERMARKPWAWATERMARKENABLEFACEDETECTIONENABLEFACESUGGESTIONSPERSISTFACETOFILEFACETHRESH0FACETHRESH1CHANGE THE LANGUAGE PICASA USES?
Source: setuppicasa39-setup.exe, 00000010.00000002.1664870898.0000000003F3F000.00000004.00000020.00020000.00000000.sdmp, Picasa3.exe, 00000014.00000002.2504208079.0000000004079000.00000002.00000001.01000000.00000017.sdmp	Binary or memory string: \PREFERENCESSOFTWARE\GOOGLE\%SGOOGLE\%SRASENUMENTRIESARASAPI32.DLLTAHOMAERRORYTAPP::ERRORTITLEOPENEXPLORER/SELECT,"%S"WINE_GET_UNIX_FILE_NAMEKERNEL32
Source: setuppicasa39-setup.exe, 00000010.00000002.1664870898.0000000004419000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: BSOFTWARE\GOOGLE\%SGOOGLE\%SRASENUMENTRIESARASAPI32.DLLTAHOMAJPEG FILESYTAPP::JPEGFILTER.JPG;.JPEGGETFILESERRORYTAPP::ERRORTITLEINFOYTAPP::INFOTITLEEXPLORER/SELECT,"%S""%S"SOFTWARE\CLIENTS\STARTMENUINTERNET%S\%S\SHELL\OPEN\COMMANDIEXPLORE.EXE.EXE.EXEIEXPLORE-NOHOME RUNTIME\DISTRO.INIDISTROWINELINUX_%SLINUX_UNKNOWNWINDOWS_%D_%DWINE_GET_UNIX_FILE_NAMEKERNEL32

Source: C:\Program Files (x86)\Google\Picasa3\Picasa3.exe	Window / User API: threadDelayed 1344			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsm983C.tmp\listicka.exe	Window / User API: threadDelayed 1044

Source: C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nst9CEF.tmp\NSIS_Picasa_Unicode.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Google\Picasa3\npPicasa3.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\~006A2DE2.00000DD4.sznpkg\UNZIP.EXE	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\~006AA7B6.00000DD4.sznpkg\libfoxcub-x64.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsm983C.tmp\listicka.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsrF139.tmp\System.dll	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\Seznam.cz\sznsetup.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\~006A2DE2.00000DD4.sznpkg\RM.EXE	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Google\Picasa3\MovieThumb.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Google\Picasa3\cdautorun\PicasaRestore.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nst9CEF.tmp\System.dll	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\Seznam.cz\sznsetup.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\~006A2DE2.00000DD4.sznpkg\RUNBG.EXE	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Google\Picasa3\qtsupport.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsm983C.tmp\listicka.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsrF139.tmp\UserInfo.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Google\Picasa3\plugins\Red.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\~006A2DE2.00000DD4.sznpkg\UNZIP.EXE	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\~006A9140.00000DD4.sznpkg\wszndesktop.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Google\Picasa3\cdautorun\PicasaCD.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Google\Picasa3\plugins\ytITivo.yti	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nst9CEF.tmp\StdUtils.dll	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\Seznam.cz\sznsetup.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\~006A2DE2.00000DD4.sznpkg\MKLNK.EXE	Jump to dropped file
Source: C:\Users\user\Desktop\1a4e5ccd35a56d84281a143f831563be.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsu8781.tmp\ButtonEvent.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Google\Picasa3\plugins\expwebsites\expwebsites.yti	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\~006A2DE2.00000DD4.sznpkg\UNZIP.EXE	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\~006AA7B6.00000DD4.sznpkg\libfoxloader-x64.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\~006A2DE2.00000DD4.sznpkg\CPY.EXE	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Seznam.cz\bin\wszndesktop.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Google\Picasa3\uninstall.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsm983C.tmp\listicka.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsrF139.tmp\nsExec.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\cmd.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Seznam.cz\bin\24557libfoxloader.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\~006A2DE2.00000DD4.sznpkg\UNZIP.EXE	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\~006AA61F.00000DD4.sznpkg\libfoxloader.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Google\Picasa3\Picasa3i18n.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Google\Picasa3\plugins\CDVDR\CDVDR.yti	Jump to dropped file
Source: C:\Windows\SysWOW64\cmd.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Seznam.cz\bin\24557libfoxloader-x64.dll	Jump to dropped file
Source: C:\Users\user\Desktop\1a4e5ccd35a56d84281a143f831563be.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsu8781.tmp\System.dll	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\Seznam.cz\sznsetup.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\~006A2DE2.00000DD4.sznpkg\SHELLFLD.EXE	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nst9CEF.tmp\nsDialogs.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\~006A2DE2.00000DD4.sznpkg\CPY.EXE	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Seznam.cz\bin\libfoxcub-x64.dll	Jump to dropped file
Source: C:\Users\user\Desktop\1a4e5ccd35a56d84281a143f831563be.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsu8781.tmp\nsDialogs.dll	Jump to dropped file

Source: C:\Users\user\AppData\Local\Temp\~0069FB97.00001B74.sznpkg\UNZIP.EXE

Evasive API call chain: GetSystemTime,DecisionNodes

Source: C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe

Evasive API call chain: GetModuleFileName,DecisionNodes,ExitProcess

graph_16-9132

Source: C:\Users\user\Desktop\1a4e5ccd35a56d84281a143f831563be.exe	API coverage: 8.0 %
Source: C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe	API coverage: 1.3 %
Source: C:\Program Files (x86)\Google\Picasa3\Picasa3.exe	API coverage: 1.6 %
Source: C:\Users\user\AppData\Local\Temp\~0069FB97.00001B74.sznpkg\REG.EXE	API coverage: 5.2 %
Source: C:\Users\user\AppData\Roaming\Seznam.cz\bin\szndesktop.exe	API coverage: 2.1 %

Source: C:\Users\user\AppData\Local\Temp\nsm983C.tmp\listicka.exe TID: 5972	Thread sleep count: 1044 > 30
Source: C:\Users\user\AppData\Local\Temp\nsm983C.tmp\listicka.exe TID: 5972	Thread sleep time: -104400s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\nsm983C.tmp\listicka.exe TID: 5972	Thread sleep count: 51 > 30

Source: C:\Users\user\AppData\Local\Temp\~006A2DE2.00000DD4.sznpkg\CPY.EXE	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BIOS
Source: C:\Users\user\AppData\Local\Temp\~006A2DE2.00000DD4.sznpkg\CPY.EXE	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BIOS

Source: C:\Users\user\AppData\Local\Temp\~006A2DE2.00000DD4.sznpkg\CPY.EXE	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_ComputerSystem
Source: C:\Users\user\AppData\Local\Temp\~006A2DE2.00000DD4.sznpkg\CPY.EXE	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_ComputerSystem

Source: C:\Program Files (x86)\Google\Picasa3\Picasa3.exe	Last function: Thread delayed
Source: C:\Users\user\AppData\Local\Temp\nsm983C.tmp\listicka.exe	Last function: Thread delayed
Source: C:\Users\user\AppData\Local\Temp\nsm983C.tmp\listicka.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Program Files (x86)\Google\Picasa3\Picasa3.exe

Thread sleep count: Count: 1344 delay: -20

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe	File Volume queried: C:\Program Files (x86)\Google FullSizeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe	File Volume queried: C:\Program Files (x86)\Google FullSizeInformation	Jump to behavior
Source: C:\Program Files (x86)\Google\Picasa3\Picasa3.exe	File Volume queried: C:\Windows\SysWOW64 FullSizeInformation	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe	Code function: 16_2_04C91B90 lstrcpyW,GlobalAlloc,FindFirstFileW,GetLastError,FindNextFileW,FindClose,	16_2_04C91B90
Source: C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe	Code function: 16_2_04C91F30 lstrcpyW,FindFirstFileW,GetLastError,GetFileAttributesW,FindNextFileW,FindClose,	16_2_04C91F30
Source: C:\Program Files (x86)\Google\Picasa3\Picasa3.exe	Code function: 20_2_033BB710 MultiByteToWideChar,MultiByteToWideChar,MultiByteToWideChar,MultiByteToWideChar,_memset,FindFirstFileW,WideCharToMultiByte,WideCharToMultiByte,WideCharToMultiByte,	20_2_033BB710
Source: C:\Program Files (x86)\Google\Picasa3\Picasa3.exe	Code function: 20_2_033F0600 GetVersion,FindFirstFileExA,	20_2_033F0600
Source: C:\Program Files (x86)\Google\Picasa3\Picasa3.exe	Code function: 20_2_033F05C0 GetVersion,FindFirstFileA,	20_2_033F05C0
Source: C:\Program Files (x86)\Google\Picasa3\Picasa3.exe	Code function: 20_2_033BB850 MultiByteToWideChar,MultiByteToWideChar,MultiByteToWideChar,MultiByteToWideChar,_memset,FindFirstFileExW,WideCharToMultiByte,WideCharToMultiByte,WideCharToMultiByte,	20_2_033BB850
Source: C:\Program Files (x86)\Google\Picasa3\Picasa3.exe	Code function: 20_2_040386D0 MultiByteToWideChar,MultiByteToWideChar,MultiByteToWideChar,MultiByteToWideChar,_memset,FindFirstFileW,WideCharToMultiByte,WideCharToMultiByte,WideCharToMultiByte,	20_2_040386D0
Source: C:\Program Files (x86)\Google\Picasa3\Picasa3.exe	Code function: 20_2_04038810 MultiByteToWideChar,MultiByteToWideChar,MultiByteToWideChar,MultiByteToWideChar,_memset,FindFirstFileExW,WideCharToMultiByte,WideCharToMultiByte,WideCharToMultiByte,	20_2_04038810
Source: C:\Program Files (x86)\Google\Picasa3\Picasa3.exe	Code function: 20_2_04076930 GetVersion,FindFirstFileA,	20_2_04076930
Source: C:\Program Files (x86)\Google\Picasa3\Picasa3.exe	Code function: 20_2_04076970 GetVersion,FindFirstFileExA,	20_2_04076970
Source: C:\Program Files (x86)\Google\Picasa3\Picasa3.exe	Code function: 20_2_048336A0 MultiByteToWideChar,MultiByteToWideChar,MultiByteToWideChar,MultiByteToWideChar,_memset,FindFirstFileW,WideCharToMultiByte,WideCharToMultiByte,WideCharToMultiByte,	20_2_048336A0
Source: C:\Program Files (x86)\Google\Picasa3\Picasa3.exe	Code function: 20_2_048337E0 MultiByteToWideChar,MultiByteToWideChar,MultiByteToWideChar,MultiByteToWideChar,_memset,FindFirstFileExW,WideCharToMultiByte,WideCharToMultiByte,WideCharToMultiByte,	20_2_048337E0
Source: C:\Users\user\AppData\Local\Temp\~0069FB97.00001B74.sznpkg\UNZIP.EXE	Code function: 38_2_0041C29C FindFirstFileA,GetDriveTypeA,FileTimeToLocalFileTime,FileTimeToSystemTime,FileTimeToLocalFileTime,FileTimeToSystemTime,FileTimeToLocalFileTime,FileTimeToSystemTime,FindClose,GetLastError,FindClose,	38_2_0041C29C
Source: C:\Users\user\AppData\Local\Temp\~0069FB97.00001B74.sznpkg\UNZIP.EXE	Code function: 38_2_004107A0 FindFirstFileA,	38_2_004107A0
Source: C:\Users\user\AppData\Roaming\Seznam.cz\bin\szndesktop.exe	Code function: 135_2_6C10D6BF ?_Open_dir@sys@tr2@std@@YAPAXPA_WPB_WAAHAAW4file_type@123@@Z,__EH_prolog3_GS,wcslen,FindFirstFileExW,std::tr2::sys::_Read_dir,FindClose,std::tr2::sys::_Strcpy,	135_2_6C10D6BF
Source: C:\Users\user\AppData\Roaming\Seznam.cz\bin\szndesktop.exe	Code function: 135_2_6C29AAA4 _wstat32i64,__doserrno,_errno,_invalid_parameter_noinfo,_wcspbrk,_errno,__doserrno,_errno,__doserrno,towlower,_getdrive,FindFirstFileExW,_wcspbrk,wcslen,GetDriveTypeW,free,___loctotime32_t,free,_wsopen_s,__fstat32i64,_close,FileTimeToLocalFileTime,FileTimeToSystemTime,___loctotime32_t,FileTimeToLocalFileTime,FileTimeToSystemTime,___loctotime32_t,FileTimeToLocalFileTime,FileTimeToSystemTime,___loctotime32_t,FindClose,GetLastError,__dosmaperr,FindClose,GetLastError,__dosmaperr,FindClose,	135_2_6C29AAA4
Source: C:\Users\user\AppData\Roaming\Seznam.cz\bin\szndesktop.exe	Code function: 135_2_6C298B4F _findfirst64i32,_errno,_invalid_parameter_noinfo,FindFirstFileExA,GetLastError,_errno,_errno,_errno,___time64_t_from_ft,___time64_t_from_ft,___time64_t_from_ft,strcpy_s,_invoke_watson,_findnext64i32,_errno,_invalid_parameter_noinfo,FindNextFileA,GetLastError,_errno,_errno,_errno,___time64_t_from_ft,___time64_t_from_ft,___time64_t_from_ft,strcpy_s,_invoke_watson,_findfirst32i64,_errno,_invalid_parameter_noinfo,FindFirstFileExA,GetLastError,_errno,_errno,_errno,___time64_t_from_ft,___time64_t_from_ft,___time64_t_from_ft,strcpy_s,_invoke_watson,_findnext32i64,_errno,_invalid_parameter_noinfo,FindNextFileA,GetLastError,_errno,_errno,_errno,___time64_t_from_ft,___time64_t_from_ft,___time64_t_from_ft,strcpy_s,_invoke_watson,_seterrormode,SetErrorMode,	135_2_6C298B4F
Source: C:\Users\user\AppData\Roaming\Seznam.cz\bin\szndesktop.exe	Code function: 135_2_6C29A625 _wstat64,__doserrno,_errno,_invalid_parameter_noinfo,_wcspbrk,_errno,__doserrno,_errno,__doserrno,towlower,_getdrive,FindFirstFileExW,_wcspbrk,wcslen,GetDriveTypeW,free,free,_wsopen_s,__fstat64,_close,FileTimeToLocalFileTime,FileTimeToSystemTime,FileTimeToLocalFileTime,FileTimeToSystemTime,FileTimeToLocalFileTime,FileTimeToSystemTime,FindClose,GetLastError,__dosmaperr,FindClose,GetLastError,__dosmaperr,FindClose,	135_2_6C29A625
Source: C:\Users\user\AppData\Roaming\Seznam.cz\bin\szndesktop.exe	Code function: 135_2_6C298653 _findfirst32,_errno,_invalid_parameter_noinfo,FindFirstFileExA,GetLastError,_errno,_errno,_errno,___time64_t_from_ft,___time64_t_from_ft,___time64_t_from_ft,strcpy_s,_invoke_watson,_findnext32,_errno,_invalid_parameter_noinfo,FindNextFileA,GetLastError,_errno,_errno,_errno,___time64_t_from_ft,___time64_t_from_ft,___time64_t_from_ft,strcpy_s,_invoke_watson,_findfirst64,_errno,_invalid_parameter_noinfo,FindFirstFileExA,GetLastError,_errno,_errno,_errno,___time64_t_from_ft,___time64_t_from_ft,___time64_t_from_ft,strcpy_s,_invoke_watson,_findnext64,_errno,_invalid_parameter_noinfo,FindNextFileA,GetLastError,_errno,_errno,_errno,___time64_t_from_ft,___time64_t_from_ft,___time64_t_from_ft,strcpy_s,_invoke_watson,	135_2_6C298653
Source: C:\Users\user\AppData\Roaming\Seznam.cz\bin\szndesktop.exe	Code function: 135_2_6C29A1C7 _wstat32,__doserrno,_errno,_invalid_parameter_noinfo,_wcspbrk,_errno,__doserrno,towlower,_getdrive,FindFirstFileExW,_wcspbrk,wcslen,GetDriveTypeW,free,___loctotime32_t,free,_wsopen_s,__fstat32,_close,FileTimeToLocalFileTime,FileTimeToSystemTime,___loctotime32_t,FileTimeToLocalFileTime,FileTimeToSystemTime,___loctotime32_t,FileTimeToLocalFileTime,FileTimeToSystemTime,___loctotime32_t,FindClose,_errno,GetLastError,__dosmaperr,FindClose,GetLastError,__dosmaperr,FindClose,	135_2_6C29A1C7
Source: C:\Users\user\AppData\Roaming\Seznam.cz\bin\szndesktop.exe	Code function: 135_2_6C297921 _malloc_crt,FindClose,FindFirstFileExA,FindNextFileA,FindClose,	135_2_6C297921
Source: C:\Users\user\AppData\Roaming\Seznam.cz\bin\szndesktop.exe	Code function: 135_2_6C297B8B _malloc_crt,FindClose,FindFirstFileExW,FindNextFileW,FindClose,	135_2_6C297B8B
Source: C:\Users\user\AppData\Roaming\Seznam.cz\bin\szndesktop.exe	Code function: 135_2_6C2377AA _wstat64i32,_wcspbrk,towlower,FindFirstFileExW,FileTimeToLocalFileTime,FileTimeToSystemTime,FileTimeToLocalFileTime,FileTimeToSystemTime,FileTimeToLocalFileTime,FileTimeToSystemTime,FindClose,_errno,__doserrno,_getdrive,GetLastError,GetLastError,_wcspbrk,wcslen,__doserrno,_errno,_invalid_parameter_noinfo,GetDriveTypeW,free,free,_wsopen_s,__fstat64i32,_close,_errno,__dosmaperr,FindClose,__dosmaperr,FindClose,	135_2_6C2377AA
Source: C:\Users\user\AppData\Roaming\Seznam.cz\bin\szndesktop.exe	Code function: 135_2_6C299002 _wfindfirst32,_errno,_invalid_parameter_noinfo,FindFirstFileExW,GetLastError,_errno,_errno,_errno,___time64_t_from_ft,___time64_t_from_ft,___time64_t_from_ft,wcscpy_s,_invoke_watson,_wfindnext32,_errno,_invalid_parameter_noinfo,FindNextFileW,GetLastError,_errno,_errno,_errno,___time64_t_from_ft,___time64_t_from_ft,___time64_t_from_ft,wcscpy_s,_invoke_watson,_wfindfirst64,_errno,_invalid_parameter_noinfo,FindFirstFileExW,GetLastError,_errno,_errno,_errno,___time64_t_from_ft,___time64_t_from_ft,___time64_t_from_ft,wcscpy_s,_invoke_watson,_wfindnext64,_errno,_invalid_parameter_noinfo,FindNextFileW,GetLastError,_errno,_errno,_errno,___time64_t_from_ft,___time64_t_from_ft,___time64_t_from_ft,wcscpy_s,_invoke_watson,_wfindfirst64i32,_errno,_invalid_parameter_noinfo,FindFirstFileExW,GetLastError,_errno,_errno,_errno,___time64_t_from_ft,___time64_t_from_ft,___time64_t_from_ft,wcscpy_s,_invoke_watson,_wfindnext64i32,_errno,_invalid_parameter_noinfo,FindNextFileW,GetLastError,_errno,_errno,_errno,___time64_t_from_ft,___time64_t_from_ft,___time64_t_from_ft,wcscpy_s,_invoke_watson,_wfindfirst32i64,_errno,_invalid_parameter_noinfo,FindFirstFileExW,GetLastError,_errno,_errno,_errno,___time64_t_from_ft,___time64_t_from_ft,___time64_t_from_ft,wcscpy_s,_invoke_watson,_wfindnext32i64,_errno,_invalid_parameter_noinfo,FindNextFileW,GetLastError,_errno,_errno,_errno,___time64_t_from_ft,___time64_t_from_ft,___time64_t_from_ft,wcscpy_s,_invoke_watson,_access,_access_s,	135_2_6C299002
Source: C:\Users\user\AppData\Roaming\Seznam.cz\bin\szndesktop.exe	Code function: 135_2_6C35DBA0 FindFirstFileW,#210,FindNextFileW,FindClose,	135_2_6C35DBA0
Source: C:\Users\user\AppData\Roaming\Seznam.cz\bin\szndesktop.exe	Code function: 135_2_6C35EB00 #210,DeleteFileW,GetLastError,_CxxThrowException,#210,MoveFileExW,GetLastError,_CxxThrowException,#210,MoveFileExW,GetLastError,_CxxThrowException,#210,FindFirstFileW,FindClose,CopyFileW,GetLastError,_CxxThrowException,	135_2_6C35EB00

Source: C:\Program Files (x86)\Google\Picasa3\Picasa3.exe

Code function: 20_2_033F18F0 GetSystemInfo,

20_2_033F18F0

Source: C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe	File opened: C:\Users\user	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe	File opened: C:\Users\user\Desktop\desktop.ini	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe	File opened: C:\Users\user\Documents\desktop.ini	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe	File opened: C:\Users\user\AppData\Local\Temp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe	File opened: C:\Users\user\AppData	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe	File opened: C:\Users\user\AppData\Local	Jump to behavior

Source: sznsetup.exe, 0000003E.00000002.2385836381.0000000000A48000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWP0
Source: sznsetup.exe, 0000003E.00000002.2385836381.0000000000A84000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWx
Source: 1a4e5ccd35a56d84281a143f831563be.exe, 0000000F.00000002.2419971867.0000000000107000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\\?\Volume{a33c736e-61ca-11ee-8c18-806e6f6e6963}\
Source: GPhotos.scr, 00000011.00000003.1552747031.0000000000B6A000.00000004.00000020.00020000.00000000.sdmp, GPhotos.scr, 00000011.00000002.1554743880.0000000000B6F000.00000004.00000020.00020000.00000000.sdmp, GPhotos.scr, 00000011.00000003.1552747031.0000000000B20000.00000004.00000020.00020000.00000000.sdmp, GPhotos.scr, 00000011.00000003.1552747031.0000000000B45000.00000004.00000020.00020000.00000000.sdmp, Picasa3.exe, 00000014.00000002.2467205779.00000000011B6000.00000004.00000020.00020000.00000000.sdmp, Picasa3.exe, 00000014.00000003.2141243034.0000000001221000.00000004.00000020.00020000.00000000.sdmp, sznsetup-lt.exe, 00000019.00000002.1841305644.0000000000A88000.00000004.00000020.00020000.00000000.sdmp, sznsetup-lt.exe, 00000019.00000002.1841305644.0000000000AE4000.00000004.00000020.00020000.00000000.sdmp, sznsetup-lt.exe, 00000019.00000003.1808801224.0000000000ACB000.00000004.00000020.00020000.00000000.sdmp, sznsetup.exe, 0000003E.00000002.2385836381.0000000000A84000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: Picasa3.exe, 00000014.00000003.2144975853.000000000123E000.00000004.00000020.00020000.00000000.sdmp, Picasa3.exe, 00000014.00000003.2141243034.0000000001221000.00000004.00000020.00020000.00000000.sdmp, Picasa3.exe, 00000014.00000002.2467205779.000000000123E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWen-GBn
Source: szndesktop.exe, 00000087.00000002.2191704797.0000000000F6E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll_
Source: szninstall.exe, 00000038.00000003.2400647328.0000000001295000.00000004.00000020.00020000.00000000.sdmp, cookie_exporter.exe, 0000003D.00000002.1866617987.000001CC03C45000.00000004.00000020.00020000.00000000.sdmp, sznpp.exe, 0000007C.00000003.2168700578.0000000000861000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll

Source: C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe	API call chain: ExitProcess graph end node	graph_16-9134
Source: C:\Program Files (x86)\Google\Picasa3\Picasa3.exe	API call chain: ExitProcess graph end node	graph_20-120831
Source: C:\Users\user\AppData\Local\Temp\~0069FB97.00001B74.sznpkg\UNZIP.EXE	API call chain: ExitProcess graph end node
Source: C:\Users\user\AppData\Roaming\Seznam.cz\bin\szndesktop.exe	API call chain: ExitProcess graph end node
Source: C:\Users\user\AppData\Roaming\Seznam.cz\bin\szndesktop.exe	API call chain: ExitProcess graph end node

Source: C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe

Code function: 16_2_04C9680C _memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,

16_2_04C9680C

Source: C:\Users\user\AppData\Local\Temp\~0069FB97.00001B74.sznpkg\REG.EXE

Code function: 42_2_01006900 SearchPathW,CreateFileW,GetFileSize,ReadFile,SetFilePointer,CharNextW,wcstoul,IsCharAlphaNumericW,wcstoul,IsCharAlphaNumericW,wcstoul,CharNextW,GetLastError,wsprintfW,OutputDebugStringW,CloseHandle,

42_2_01006900

Source: C:\Users\user\AppData\Roaming\Seznam.cz\bin\szndesktop.exe

Code function: 135_2_6C2BBD84 VirtualProtect ?,-00000001,00000104,?,?,?,0000001C

135_2_6C2BBD84

Source: C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe

Code function: 16_2_04C92490 GetVersion,LoadLibraryW,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

16_2_04C92490

Source: C:\Users\user\Desktop\1a4e5ccd35a56d84281a143f831563be.exe

Code function: 15_2_741C1A8C Create,GetDlgItem,GetWindowRect,MapWindowPoints,CreateDialogParamW,SetWindowPos,SetWindowLongW,GetProcessHeap,HeapAlloc,

15_2_741C1A8C

Source: C:\Users\user\AppData\Roaming\Seznam.cz\sznsetup-lt.exe

Process created: C:\Windows\SysWOW64\cmd.exe cmd /S /C "install.bat C:\Users\user\AppData\Roaming\Seznam.cz"

Source: C:\Users\user\Desktop\1a4e5ccd35a56d84281a143f831563be.exe	Code function: 15_2_73A3400C SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,abort,	15_2_73A3400C
Source: C:\Users\user\Desktop\1a4e5ccd35a56d84281a143f831563be.exe	Code function: 15_2_73A34010 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,abort,	15_2_73A34010
Source: C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe	Code function: 16_2_04C9680C _memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	16_2_04C9680C
Source: C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe	Code function: 16_2_04C9519A IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	16_2_04C9519A
Source: C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe	Code function: 16_2_04CA1FEE _raise,_memset,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	16_2_04CA1FEE
Source: C:\Program Files (x86)\Google\Picasa3\Picasa3.exe	Code function: 20_2_033E00B8 _raise,_memset,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	20_2_033E00B8
Source: C:\Program Files (x86)\Google\Picasa3\Picasa3.exe	Code function: 20_2_033DC711 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	20_2_033DC711
Source: C:\Program Files (x86)\Google\Picasa3\Picasa3.exe	Code function: 20_2_033E2C6A _memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	20_2_033E2C6A
Source: C:\Program Files (x86)\Google\Picasa3\Picasa3.exe	Code function: 20_2_040610AC IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	20_2_040610AC
Source: C:\Program Files (x86)\Google\Picasa3\Picasa3.exe	Code function: 20_2_04065E06 _memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	20_2_04065E06
Source: C:\Program Files (x86)\Google\Picasa3\Picasa3.exe	Code function: 20_2_04065F26 _raise,_memset,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	20_2_04065F26
Source: C:\Program Files (x86)\Google\Picasa3\Picasa3.exe	Code function: 20_2_04877CA4 _memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	20_2_04877CA4
Source: C:\Program Files (x86)\Google\Picasa3\Picasa3.exe	Code function: 20_2_0487A82B _raise,_memset,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	20_2_0487A82B
Source: C:\Program Files (x86)\Google\Picasa3\Picasa3.exe	Code function: 20_2_04872924 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	20_2_04872924
Source: C:\Program Files (x86)\Google\Picasa3\Picasa3.exe	Code function: 20_2_1000102A IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	20_2_1000102A
Source: C:\Users\user\AppData\Local\Temp\~0069FB97.00001B74.sznpkg\REG.EXE	Code function: 42_2_01006C92 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	42_2_01006C92
Source: C:\Users\user\AppData\Roaming\Seznam.cz\bin\szndesktop.exe	Code function: 135_2_6C2C00DD __crtUnhandledException,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	135_2_6C2C00DD
Source: C:\Users\user\AppData\Roaming\Seznam.cz\bin\szndesktop.exe	Code function: 135_2_6C247B39 __crtSetUnhandledExceptionFilter,SetUnhandledExceptionFilter,	135_2_6C247B39

Source: C:\Program Files (x86)\Google\Picasa3\Picasa3.exe	Process created: C:\Program Files\Internet Explorer\iexplore.exe "C:\Program Files\Internet Explorer\iexplore.exe" -nohome "http://picasa.google.com/support/bin/answer.py?hl=en&answer=93773"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsm983C.tmp\listicka.exe	Process created: C:\Users\user\AppData\Roaming\Seznam.cz\sznsetup-lt.exe "C:\Users\user\AppData\Roaming\Seznam.cz\sznsetup-lt.exe" -T "C:\Users\user\AppData\Roaming\Seznam.cz" -R "$\install" http://download.seznam.cz/update
Source: C:\Users\user\AppData\Local\Temp\nsm983C.tmp\listicka.exe	Process created: C:\Users\user\AppData\Roaming\Seznam.cz\sznsetup-lt.exe "C:\Users\user\AppData\Roaming\Seznam.cz\sznsetup-lt.exe" -T "C:\Users\user\AppData\Roaming\Seznam.cz" -i cz.seznam.software.szninstall
Source: C:\Users\user\AppData\Local\Temp\nsm983C.tmp\listicka.exe	Process created: C:\Users\user\AppData\Roaming\Seznam.cz\szninstall.exe "C:\Users\user\AppData\Roaming\Seznam.cz\szninstall.exe" -s -u -i cz.seznam.software.autoupdate szn-software-listicka
Source: C:\Users\user\AppData\Roaming\Seznam.cz\sznsetup-lt.exe	Process created: C:\Users\user\AppData\Local\Temp\~0069FB97.00001B74.sznpkg\UNZIP.EXE C:\Users\user\AppData\Local\Temp\~0069FB97.00001B74.sznpkg\unzip.exe -d C:\Users\user\AppData\Local\Temp\~006A18C4.00001B74.sznpkg -o C:\Users\user\AppData\Local\Temp\~0069FB97.00001B74.sznpkg\download\cz.seznam.software.sznsetup-1.2.7-win32.zip
Source: C:\Users\user\AppData\Roaming\Seznam.cz\sznsetup-lt.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /S /C "install.bat C:\Users\user\AppData\Roaming\Seznam.cz"
Source: C:\Users\user\AppData\Roaming\Seznam.cz\sznsetup-lt.exe	Process created: C:\Users\user\AppData\Local\Temp\~0069FB97.00001B74.sznpkg\UNZIP.EXE C:\Users\user\AppData\Local\Temp\~0069FB97.00001B74.sznpkg\unzip.exe -d C:\Users\user\AppData\Local\Temp\~006A1AF6.00001B74.sznpkg -o C:\Users\user\AppData\Local\Temp\~0069FB97.00001B74.sznpkg\download\cz.seznam.software.szninstall-1.1.15-win32.zip
Source: C:\Users\user\AppData\Roaming\Seznam.cz\sznsetup-lt.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /S /C "install.bat C:\Users\user\AppData\Roaming\Seznam.cz"
Source: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\BHO\ie_to_edge_stub.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --from-ie-to-edge=3 --ie-frame-hwnd=602e8
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\~0069FB97.00001B74.sznpkg\REG.EXE REG DELETE "HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall\SeznamInstall" /f /va
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\~0069FB97.00001B74.sznpkg\REG.EXE REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall\SeznamInstall" /f
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\~0069FB97.00001B74.sznpkg\REG.EXE REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall\SeznamInstall" /f /v "InstallLocation" /d C:\Users\user\AppData\Roaming\Seznam.cz
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\~0069FB97.00001B74.sznpkg\REG.EXE REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall\SeznamInstall" /f /v "DisplayName" /d "Seznam Software"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\~0069FB97.00001B74.sznpkg\REG.EXE REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall\SeznamInstall" /f /v "DisplayIcon" /d "C:\Users\user\AppData\Roaming\Seznam.cz\szninstall.exe,0"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\~0069FB97.00001B74.sznpkg\REG.EXE REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall\SeznamInstall" /f /v "UninstallString" /d "\"C:\Users\user\AppData\Roaming\Seznam.cz\szninstall.exe\" -X"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\~0069FB97.00001B74.sznpkg\REG.EXE REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall\SeznamInstall" /f /v "ModifyPath" /d "C:\Users\user\AppData\Roaming\Seznam.cz\szninstall.exe"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\~0069FB97.00001B74.sznpkg\REG.EXE REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall\SeznamInstall" /f /v "Publisher" /d "Seznam.cz"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\~0069FB97.00001B74.sznpkg\REG.EXE REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall\SeznamInstall" /f /v "URLInfoAbout" /d "http://software.seznam.cz"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\~0069FB97.00001B74.sznpkg\REG.EXE REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall\SeznamInstall" /f /v "InstallLocation" /d C:\Users\user\AppData\Roaming\Seznam.cz
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\~0069FB97.00001B74.sznpkg\REG.EXE REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall\SeznamInstall" /f /v "Comments" /d "Vsechny aplikace spolecnosti Seznam.cz a.s."
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\~0069FB97.00001B74.sznpkg\REG.EXE REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall\SeznamInstall" /f /v "NoRepair" /t REG_DWORD /d 1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\~0069FB97.00001B74.sznpkg\REG.EXE REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall\SeznamInstall" /f /v "NoModify" /t REG_DWORD /d 0
Source: C:\Users\user\AppData\Roaming\Seznam.cz\szninstall.exe	Process created: C:\Users\user\AppData\Roaming\Seznam.cz\sznsetup.exe C:\Users\user\AppData\Roaming\Seznam.cz\sznsetup.exe -V
Source: C:\Users\user\AppData\Roaming\Seznam.cz\szninstall.exe	Process created: C:\Users\user\AppData\Roaming\Seznam.cz\sznsetup.exe C:\Users\user\AppData\Roaming\Seznam.cz\sznsetup.exe -T C:\Users\user\AppData\Roaming\Seznam.cz -i -u cz.seznam.software.autoupdate szn-software-listicka -p
Source: C:\Users\user\AppData\Roaming\Seznam.cz\szninstall.exe	Process created: C:\Users\user\AppData\Roaming\Seznam.cz\szninstall.exe "C:\Users\user\AppData\Roaming\Seznam.cz\szninstall.exe" -S 49764
Source: C:\Users\user\AppData\Roaming\Seznam.cz\szninstall.exe	Process created: C:\Users\user\AppData\Roaming\Seznam.cz\sznsetup.exe C:\Users\user\AppData\Roaming\Seznam.cz\sznsetup.exe -V
Source: C:\Users\user\AppData\Roaming\Seznam.cz\sznsetup.exe	Process created: C:\Users\user\AppData\Local\Temp\~006A2DE2.00000DD4.sznpkg\UNZIP.EXE C:\Users\user\AppData\Local\Temp\~006A2DE2.00000DD4.sznpkg\unzip.exe -d C:\Users\user\AppData\Local\Temp\~006A81A0.00000DD4.sznpkg -o C:\Users\user\AppData\Roaming\Seznam.cz\install\cz.seznam.software.autoupdate-1.0.8-win32.zip
Source: C:\Users\user\AppData\Roaming\Seznam.cz\sznsetup.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /S /C "install.bat C:\Users\user\AppData\Roaming\Seznam.cz"
Source: C:\Users\user\AppData\Roaming\Seznam.cz\sznsetup.exe	Process created: C:\Users\user\AppData\Local\Temp\~006A2DE2.00000DD4.sznpkg\UNZIP.EXE C:\Users\user\AppData\Local\Temp\~006A2DE2.00000DD4.sznpkg\unzip.exe -d C:\Users\user\AppData\Local\Temp\~006A8374.00000DD4.sznpkg -o C:\Users\user\AppData\Roaming\Seznam.cz\install\szn-software-base-1.0.0-win32.zip
Source: C:\Users\user\AppData\Roaming\Seznam.cz\sznsetup.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /S /C "install.bat C:\Users\user\AppData\Roaming\Seznam.cz"
Source: C:\Users\user\AppData\Roaming\Seznam.cz\sznsetup.exe	Process created: C:\Users\user\AppData\Local\Temp\~006A2DE2.00000DD4.sznpkg\UNZIP.EXE C:\Users\user\AppData\Local\Temp\~006A2DE2.00000DD4.sznpkg\unzip.exe -d C:\Users\user\AppData\Local\Temp\~006A848E.00000DD4.sznpkg -o C:\Users\user\AppData\Roaming\Seznam.cz\install\com.microsoft.msdn.msvcr110-11.0.51106.1-win32.zip
Source: C:\Users\user\AppData\Roaming\Seznam.cz\sznsetup.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /S /C "install.bat C:\Users\user\AppData\Roaming\Seznam.cz"
Source: C:\Users\user\AppData\Roaming\Seznam.cz\sznsetup.exe	Process created: C:\Users\user\AppData\Local\Temp\~006A2DE2.00000DD4.sznpkg\UNZIP.EXE C:\Users\user\AppData\Local\Temp\~006A2DE2.00000DD4.sznpkg\unzip.exe -d C:\Users\user\AppData\Local\Temp\~006A8960.00000DD4.sznpkg -o C:\Users\user\AppData\Local\Temp\~006A2DE2.00000DD4.sznpkg\download\cz.seznam.software.lightspeed-1210-12.10.18-win32.zip
Source: C:\Users\user\AppData\Roaming\Seznam.cz\sznsetup.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /S /C "install.bat C:\Users\user\AppData\Roaming\Seznam.cz"
Source: C:\Users\user\AppData\Roaming\Seznam.cz\sznsetup.exe	Process created: C:\Users\user\AppData\Local\Temp\~006A2DE2.00000DD4.sznpkg\UNZIP.EXE C:\Users\user\AppData\Local\Temp\~006A2DE2.00000DD4.sznpkg\unzip.exe -d C:\Users\user\AppData\Local\Temp\~006A8B64.00000DD4.sznpkg -o C:\Users\user\AppData\Local\Temp\~006A2DE2.00000DD4.sznpkg\download\cz.seznam.software.libszndesktop-2.1.35-win32.zip
Source: C:\Users\user\AppData\Roaming\Seznam.cz\sznsetup.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /S /C "install.bat C:\Users\user\AppData\Roaming\Seznam.cz"
Source: C:\Users\user\AppData\Roaming\Seznam.cz\sznsetup.exe	Process created: C:\Users\user\AppData\Local\Temp\~006A2DE2.00000DD4.sznpkg\UNZIP.EXE C:\Users\user\AppData\Local\Temp\~006A2DE2.00000DD4.sznpkg\unzip.exe -d C:\Users\user\AppData\Local\Temp\~006A9140.00000DD4.sznpkg -o C:\Users\user\AppData\Local\Temp\~006A2DE2.00000DD4.sznpkg\download\cz.seznam.software.szndesktop-2.0.32-win32.zip
Source: C:\Users\user\AppData\Roaming\Seznam.cz\sznsetup.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /S /C "install.bat C:\Users\user\AppData\Roaming\Seznam.cz"
Source: C:\Users\user\AppData\Roaming\Seznam.cz\sznsetup.exe	Process created: C:\Users\user\AppData\Local\Temp\~006A2DE2.00000DD4.sznpkg\UNZIP.EXE C:\Users\user\AppData\Local\Temp\~006A2DE2.00000DD4.sznpkg\unzip.exe -d C:\Users\user\AppData\Local\Temp\~006A93FF.00000DD4.sznpkg -o C:\Users\user\AppData\Local\Temp\~006A2DE2.00000DD4.sznpkg\download\cz.seznam.software.libfoxcub-3.3.8-win32.zip
Source: C:\Users\user\AppData\Roaming\Seznam.cz\sznsetup.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /S /C "install.bat C:\Users\user\AppData\Roaming\Seznam.cz"
Source: C:\Users\user\AppData\Roaming\Seznam.cz\sznsetup.exe	Process created: C:\Users\user\AppData\Local\Temp\~006A2DE2.00000DD4.sznpkg\UNZIP.EXE C:\Users\user\AppData\Local\Temp\~006A2DE2.00000DD4.sznpkg\unzip.exe -d C:\Users\user\AppData\Local\Temp\~006AA61F.00000DD4.sznpkg -o C:\Users\user\AppData\Roaming\Seznam.cz\install\cz.seznam.software.libfoxloader-3.2.7-win32.zip
Source: C:\Users\user\AppData\Roaming\Seznam.cz\sznsetup.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /S /C "install.bat C:\Users\user\AppData\Roaming\Seznam.cz"
Source: C:\Users\user\AppData\Roaming\Seznam.cz\sznsetup.exe	Process created: C:\Users\user\AppData\Local\Temp\~006A2DE2.00000DD4.sznpkg\UNZIP.EXE C:\Users\user\AppData\Local\Temp\~006A2DE2.00000DD4.sznpkg\unzip.exe -d C:\Users\user\AppData\Local\Temp\~006AA7B6.00000DD4.sznpkg -o C:\Users\user\AppData\Local\Temp\~006A2DE2.00000DD4.sznpkg\download\cz.seznam.software.libfoxcub64-3.3.8-win32.zip
Source: C:\Users\user\AppData\Roaming\Seznam.cz\sznsetup.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /S /C "install.bat C:\Users\user\AppData\Roaming\Seznam.cz"
Source: C:\Users\user\AppData\Roaming\Seznam.cz\sznsetup.exe	Process created: C:\Users\user\AppData\Local\Temp\~006A2DE2.00000DD4.sznpkg\UNZIP.EXE C:\Users\user\AppData\Local\Temp\~006A2DE2.00000DD4.sznpkg\unzip.exe -d C:\Users\user\AppData\Local\Temp\~006AB17A.00000DD4.sznpkg -o C:\Users\user\AppData\Local\Temp\~006A2DE2.00000DD4.sznpkg\download\cz.seznam.software.ielisticka3-3.3.5-win32.zip
Source: C:\Users\user\AppData\Roaming\Seznam.cz\sznsetup.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /S /C "install.bat C:\Users\user\AppData\Roaming\Seznam.cz"
Source: C:\Users\user\AppData\Roaming\Seznam.cz\sznsetup.exe	Process created: C:\Users\user\AppData\Local\Temp\~006A2DE2.00000DD4.sznpkg\UNZIP.EXE C:\Users\user\AppData\Local\Temp\~006A2DE2.00000DD4.sznpkg\unzip.exe -d C:\Users\user\AppData\Local\Temp\~006AB2D1.00000DD4.sznpkg -o C:\Users\user\AppData\Local\Temp\~006A2DE2.00000DD4.sznpkg\download\szn-software-fflisticka-4.0.8-win32.zip
Source: C:\Users\user\AppData\Roaming\Seznam.cz\sznsetup.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /S /C "install.bat C:\Users\user\AppData\Roaming\Seznam.cz"
Source: C:\Users\user\AppData\Roaming\Seznam.cz\sznsetup.exe	Process created: C:\Users\user\AppData\Local\Temp\~006A2DE2.00000DD4.sznpkg\UNZIP.EXE C:\Users\user\AppData\Local\Temp\~006A2DE2.00000DD4.sznpkg\unzip.exe -d C:\Users\user\AppData\Local\Temp\~006AC669.00000DD4.sznpkg -o C:\Users\user\AppData\Roaming\Seznam.cz\install\cz.seznam.software.chromelisticka-2.0.4-win32.zip
Source: C:\Users\user\AppData\Roaming\Seznam.cz\sznsetup.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /S /C "install.bat C:\Users\user\AppData\Roaming\Seznam.cz"
Source: C:\Users\user\AppData\Roaming\Seznam.cz\sznsetup.exe	Process created: C:\Users\user\AppData\Local\Temp\~006A2DE2.00000DD4.sznpkg\UNZIP.EXE C:\Users\user\AppData\Local\Temp\~006A2DE2.00000DD4.sznpkg\unzip.exe -d C:\Users\user\AppData\Local\Temp\~006AD463.00000DD4.sznpkg -o C:\Users\user\AppData\Roaming\Seznam.cz\install\com.microsoft.msdn.msvcr100-10.0.40219.325-win32.zip
Source: C:\Users\user\AppData\Roaming\Seznam.cz\sznsetup.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /S /C "install.bat C:\Users\user\AppData\Roaming\Seznam.cz"
Source: C:\Users\user\AppData\Roaming\Seznam.cz\sznsetup.exe	Process created: C:\Users\user\AppData\Local\Temp\~006A2DE2.00000DD4.sznpkg\UNZIP.EXE C:\Users\user\AppData\Local\Temp\~006A2DE2.00000DD4.sznpkg\unzip.exe -d C:\Users\user\AppData\Local\Temp\~006AD780.00000DD4.sznpkg -o C:\Users\user\AppData\Roaming\Seznam.cz\install\cz.seznam.software.pp-1.0.2-win32.zip
Source: C:\Users\user\AppData\Roaming\Seznam.cz\sznsetup.exe	Process created: C:\Users\user\AppData\Local\Temp\~006A2DE2.00000DD4.sznpkg\CPY.EXE cpy libfoxcub.conf "C:\Users\user\AppData\Roaming\Seznam.cz\conf\szndesktop.d"
Source: C:\Users\user\AppData\Roaming\Seznam.cz\sznsetup.exe	Process created: C:\Users\user\AppData\Local\Temp\~006A2DE2.00000DD4.sznpkg\UNZIP.EXE C:\Users\user\AppData\Local\Temp\~006A2DE2.00000DD4.sznpkg\unzip.exe -d C:\Users\user\AppData\Local\Temp\~006AE03A.00000DD4.sznpkg -o C:\Users\user\AppData\Roaming\Seznam.cz\install\szn-software-listicka-3.0.0-win32.zip
Source: C:\Users\user\AppData\Roaming\Seznam.cz\sznsetup.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /S /C "install.bat C:\Users\user\AppData\Roaming\Seznam.cz"
Source: C:\Users\user\AppData\Roaming\Seznam.cz\sznsetup.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /S /C "C:\Users\user\AppData\Roaming\Seznam.cz\uninstall\cz_seznam_software_libszndesktop_2_1_35.reconfigure.bat C:\Users\user\AppData\Roaming\Seznam.cz"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\~006A2DE2.00000DD4.sznpkg\REG.EXE REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "cz.seznam.software.autoupdate" /d "\"C:\Users\user\AppData\Roaming\Seznam.cz\szninstall.exe\" -c"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\~006A2DE2.00000DD4.sznpkg\CPY.EXE cpy msvcp110.dll "C:\Users\user\AppData\Roaming\Seznam.cz\bin"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\~006A2DE2.00000DD4.sznpkg\CPY.EXE cpy msvcr110.dll "C:\Users\user\AppData\Roaming\Seznam.cz\bin"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\~006A2DE2.00000DD4.sznpkg\CPY.EXE cpy lightspeed.dll "C:\Users\user\AppData\Roaming\Seznam.cz\bin"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\~006A2DE2.00000DD4.sznpkg\CPY.EXE cpy "szndesktop.exe" "C:\Users\user\AppData\Roaming\Seznam.cz\bin"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\~006A2DE2.00000DD4.sznpkg\CPY.EXE cpy "szndesktop.conf" "C:\Users\user\AppData\Roaming\Seznam.cz\conf"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\~006A2DE2.00000DD4.sznpkg\CPY.EXE cpy "szndesktop.webpak" "C:\Users\user\AppData\Roaming\Seznam.cz\data"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\~006A2DE2.00000DD4.sznpkg\CPY.EXE cpy "sznpp.exe" "C:\Users\user\AppData\Roaming\Seznam.cz\bin"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\~006A2DE2.00000DD4.sznpkg\REG.EXE reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall\SeznamInstall" /v DisplayVersion /t REG_SZ /d "2.1.35" /f
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\~006A2DE2.00000DD4.sznpkg\CPY.EXE cpy "wszndesktop.exe" "C:\Users\user\AppData\Roaming\Seznam.cz\bin"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\~006A2DE2.00000DD4.sznpkg\REG.EXE REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "cz.seznam.software.szndesktop" /d "\"C:\Users\user\AppData\Roaming\Seznam.cz\bin\wszndesktop.exe\" -q"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\~006A2DE2.00000DD4.sznpkg\CPY.EXE cpy libfoxcub.dll "C:\Users\user\AppData\Roaming\Seznam.cz\bin"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\~006A2DE2.00000DD4.sznpkg\CPY.EXE cpy libfoxcub-x64.dll "C:\Users\user\AppData\Roaming\Seznam.cz\bin"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\~006A2DE2.00000DD4.sznpkg\CPY.EXE cpy libfoxcub.conf "C:\Users\user\AppData\Roaming\Seznam.cz\conf\szndesktop.d"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\~006A2DE2.00000DD4.sznpkg\CPY.EXE cpy foxcub.conf "C:\Users\user\AppData\Roaming\Seznam.cz\conf\libfoxcub"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\~006A2DE2.00000DD4.sznpkg\CPY.EXE cpy remote.conf "C:\Users\user\AppData\Roaming\Seznam.cz\conf\libfoxcub"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\~006A2DE2.00000DD4.sznpkg\CPY.EXE cpy listickaconfig.webpak "C:\Users\user\AppData\Roaming\Seznam.cz\data"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\~006A2DE2.00000DD4.sznpkg\CPY.EXE cpy listickanastaveni.webpak "C:\Users\user\AppData\Roaming\Seznam.cz\data"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\~006A2DE2.00000DD4.sznpkg\CPY.EXE cpy speeddial.webpak "C:\Users\user\AppData\Roaming\Seznam.cz\data"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe libfoxcub.dll,UpgradeListicka
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\~006A2DE2.00000DD4.sznpkg\REG.EXE REG QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\szn-software-listicka" /v "UninstallString"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\~006A2DE2.00000DD4.sznpkg\REG.EXE REG QUERY "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\szn-software-listicka" /v "UninstallString"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\~006A2DE2.00000DD4.sznpkg\REG.EXE REG DELETE "HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Explorer Bars\{EA837F48-5AD1-443E-AE34-FFE03CBF3099}" /F
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\AppData\Roaming\Seznam.cz\bin\sznpp.exe "C:\Users\user\AppData\Roaming\Seznam.cz\bin\sznpp.exe" -v report-ielisticka-install --status=0
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\~006A2DE2.00000DD4.sznpkg\CPY.EXE cpy libfoxcub-x64.dll "C:\Users\user\AppData\Roaming\Seznam.cz\bin"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\~006A2DE2.00000DD4.sznpkg\CPY.EXE cpy listicka-x64.exe "C:\Users\user\AppData\Roaming\Seznam.cz\bin"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\AppData\Roaming\Seznam.cz\bin\szndesktop.exe szndesktop.exe default restart

Source: C:\Users\user\AppData\Roaming\Seznam.cz\sznsetup.exe	Process created: C:\Users\user\AppData\Local\Temp\~006A2DE2.00000DD4.sznpkg\UNZIP.EXE c:\users\user\appdata\local\temp\~006a2de2.00000dd4.sznpkg\unzip.exe -d c:\users\user\appdata\local\temp\~006a8960.00000dd4.sznpkg -o c:\users\user\appdata\local\temp\~006a2de2.00000dd4.sznpkg\download\cz.seznam.software.lightspeed-1210-12.10.18-win32.zip
Source: C:\Users\user\AppData\Roaming\Seznam.cz\sznsetup.exe	Process created: C:\Users\user\AppData\Local\Temp\~006A2DE2.00000DD4.sznpkg\UNZIP.EXE c:\users\user\appdata\local\temp\~006a2de2.00000dd4.sznpkg\unzip.exe -d c:\users\user\appdata\local\temp\~006a8b64.00000dd4.sznpkg -o c:\users\user\appdata\local\temp\~006a2de2.00000dd4.sznpkg\download\cz.seznam.software.libszndesktop-2.1.35-win32.zip
Source: C:\Users\user\AppData\Roaming\Seznam.cz\sznsetup.exe	Process created: C:\Users\user\AppData\Local\Temp\~006A2DE2.00000DD4.sznpkg\UNZIP.EXE c:\users\user\appdata\local\temp\~006a2de2.00000dd4.sznpkg\unzip.exe -d c:\users\user\appdata\local\temp\~006a8960.00000dd4.sznpkg -o c:\users\user\appdata\local\temp\~006a2de2.00000dd4.sznpkg\download\cz.seznam.software.lightspeed-1210-12.10.18-win32.zip
Source: C:\Users\user\AppData\Roaming\Seznam.cz\sznsetup.exe	Process created: C:\Users\user\AppData\Local\Temp\~006A2DE2.00000DD4.sznpkg\UNZIP.EXE c:\users\user\appdata\local\temp\~006a2de2.00000dd4.sznpkg\unzip.exe -d c:\users\user\appdata\local\temp\~006a8b64.00000dd4.sznpkg -o c:\users\user\appdata\local\temp\~006a2de2.00000dd4.sznpkg\download\cz.seznam.software.libszndesktop-2.1.35-win32.zip

Source: C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe

Code function: 16_2_04C9EC23 cpuid

16_2_04C9EC23

Source: C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe	Code function: getlicenselangco,GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,wsprintfW,wsprintfW,wsprintfW,GlobalAlloc,GlobalAlloc,lstrcpynW,lstrcpynW,GlobalAlloc,lstrcpynW,GlobalAlloc,lstrcpynW,	16_2_04C92CA0
Source: C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe	Code function: GlobalAlloc,lstrcpyW,GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,ShellExecuteW,	16_2_04C915F0
Source: C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe	Code function: GetLocaleInfoA,	16_2_04CA0540
Source: C:\Program Files (x86)\Google\Picasa3\Picasa3.exe	Code function: GetThreadLocale,GetLocaleInfoA,GetACP,	20_2_033DC431
Source: C:\Program Files (x86)\Google\Picasa3\Picasa3.exe	Code function: GetLocaleInfoA,	20_2_033E79B0
Source: C:\Program Files (x86)\Google\Picasa3\Picasa3.exe	Code function: InterlockedIncrement,InterlockedIncrement,GetLocaleInfoA,GetLocaleInfoA,GetLocaleInfoA,GetLocaleInfoA,InterlockedIncrement,InterlockedIncrement,GetLocaleInfoA,InterlockedIncrement,InterlockedIncrement,InterlockedIncrement,InterlockedIncrement,	20_2_04043450
Source: C:\Program Files (x86)\Google\Picasa3\Picasa3.exe	Code function: GetLocaleInfoA,	20_2_0406F48A
Source: C:\Program Files (x86)\Google\Picasa3\Picasa3.exe	Code function: GetCPInfo,GetLocaleInfoA,GetCPInfo,MultiByteToWideChar,GetCPInfo,_strlen,MultiByteToWideChar,_malloc,_memset,MultiByteToWideChar,WideCharToMultiByte,WideCharToMultiByte,WideCharToMultiByte,__calloc_crt,WideCharToMultiByte,__freea,	20_2_0406F4D1
Source: C:\Program Files (x86)\Google\Picasa3\Picasa3.exe	Code function: GetLocaleInfoA,_LocaleUpdate::_LocaleUpdate,__isleadbyte_l,___crtGetStringTypeA,	20_2_0406907B
Source: C:\Program Files (x86)\Google\Picasa3\Picasa3.exe	Code function: _LocaleUpdate::_LocaleUpdate,GetLocaleInfoA,__isctype_l,	20_2_0406A342
Source: C:\Program Files (x86)\Google\Picasa3\Picasa3.exe	Code function: GetStringTypeW,GetLastError,MultiByteToWideChar,MultiByteToWideChar,_malloc,_memset,MultiByteToWideChar,GetStringTypeW,__freea,___ansicp,GetLocaleInfoA,___convertcp,GetStringTypeA,	20_2_0406EC96
Source: C:\Program Files (x86)\Google\Picasa3\Picasa3.exe	Code function: GetLocaleInfoA,	20_2_04042FD0
Source: C:\Program Files (x86)\Google\Picasa3\Picasa3.exe	Code function: InterlockedIncrement,InterlockedIncrement,GetLocaleInfoA,GetLocaleInfoA,GetLocaleInfoA,GetLocaleInfoA,InterlockedIncrement,InterlockedIncrement,GetLocaleInfoA,InterlockedIncrement,InterlockedIncrement,InterlockedIncrement,	20_2_04838D40
Source: C:\Program Files (x86)\Google\Picasa3\Picasa3.exe	Code function: GetThreadLocale,GetLocaleInfoA,GetACP,	20_2_048724AB
Source: C:\Program Files (x86)\Google\Picasa3\Picasa3.exe	Code function: GetLocaleInfoA,	20_2_04885422
Source: C:\Program Files (x86)\Google\Picasa3\Picasa3.exe	Code function: GetLocaleInfoA,	20_2_04837CF0
Source: C:\Program Files (x86)\Google\Picasa3\Picasa3.exe	Code function: GetLocaleInfoA,GetLocaleInfoA,GetLocaleInfoA,GetNumberFormatA,InterlockedIncrement,	20_2_04839830
Source: C:\Program Files (x86)\Google\Picasa3\Picasa3.exe	Code function: GetLocaleInfoA,	20_2_04839B90
Source: C:\Users\user\AppData\Local\Temp\~0069FB97.00001B74.sznpkg\UNZIP.EXE	Code function: GetLocaleInfoA,	38_2_0041713F
Source: C:\Users\user\AppData\Local\Temp\~0069FB97.00001B74.sznpkg\UNZIP.EXE	Code function: GetLocaleInfoA,IsValidCodePage,IsValidLocale,GetLocaleInfoA,GetLocaleInfoA,	38_2_00416AF5
Source: C:\Users\user\AppData\Local\Temp\~0069FB97.00001B74.sznpkg\UNZIP.EXE	Code function: GetLocaleInfoW,GetLocaleInfoA,GetLocaleInfoA,GetLocaleInfoW,GetLocaleInfoW,WideCharToMultiByte,	38_2_0041BC50
Source: C:\Users\user\AppData\Local\Temp\~0069FB97.00001B74.sznpkg\UNZIP.EXE	Code function: EnumSystemLocalesA,	38_2_00417068
Source: C:\Users\user\AppData\Local\Temp\~0069FB97.00001B74.sznpkg\UNZIP.EXE	Code function: EnumSystemLocalesA,	38_2_00416CCA
Source: C:\Users\user\AppData\Local\Temp\~0069FB97.00001B74.sznpkg\UNZIP.EXE	Code function: GetLocaleInfoA,	38_2_00411CF0
Source: C:\Users\user\AppData\Local\Temp\~0069FB97.00001B74.sznpkg\UNZIP.EXE	Code function: GetLocaleInfoA,	38_2_0041709F
Source: C:\Users\user\AppData\Local\Temp\~0069FB97.00001B74.sznpkg\UNZIP.EXE	Code function: GetLocaleInfoA,	38_2_00411CB0
Source: C:\Users\user\AppData\Local\Temp\~0069FB97.00001B74.sznpkg\UNZIP.EXE	Code function: GetLocaleInfoA,GetLocaleInfoA,GetLocaleInfoA,	38_2_00416D51
Source: C:\Users\user\AppData\Local\Temp\~0069FB97.00001B74.sznpkg\UNZIP.EXE	Code function: GetLocaleInfoW,WideCharToMultiByte,	38_2_0041BD13
Source: C:\Users\user\AppData\Local\Temp\~0069FB97.00001B74.sznpkg\UNZIP.EXE	Code function: GetLocaleInfoA,	38_2_004171C4
Source: C:\Users\user\AppData\Local\Temp\~0069FB97.00001B74.sznpkg\UNZIP.EXE	Code function: GetLocaleInfoA,	38_2_0041725C
Source: C:\Users\user\AppData\Local\Temp\~0069FB97.00001B74.sznpkg\UNZIP.EXE	Code function: EnumSystemLocalesA,	38_2_00416F55
Source: C:\Users\user\AppData\Local\Temp\~0069FB97.00001B74.sznpkg\UNZIP.EXE	Code function: GetLocaleInfoW,GetLocaleInfoA,GetLocaleInfoW,GetLocaleInfoA,GetLocaleInfoA,MultiByteToWideChar,	38_2_0041BB3D
Source: C:\Users\user\AppData\Local\Temp\~0069FB97.00001B74.sznpkg\UNZIP.EXE	Code function: GetLocaleInfoA,MultiByteToWideChar,	38_2_0041BBFA
Source: C:\Users\user\AppData\Local\Temp\~0069FB97.00001B74.sznpkg\UNZIP.EXE	Code function: GetLocaleInfoA,	38_2_00416FAB
Source: C:\Users\user\AppData\Roaming\Seznam.cz\bin\szndesktop.exe	Code function: _Getdateorder,___lc_locale_name_func,__crtGetLocaleInfoEx,	135_2_6C10F5AD
Source: C:\Users\user\AppData\Roaming\Seznam.cz\bin\szndesktop.exe	Code function: wcscmp,wcscmp,_wtol,__crtGetLocaleInfoEx,__crtGetLocaleInfoEx,GetACP,	135_2_6C23EC5A
Source: C:\Users\user\AppData\Roaming\Seznam.cz\bin\szndesktop.exe	Code function: _getptd,IsValidCodePage,wcslen,wcsncpy_s,__crtGetLocaleInfoEx,_GetLocaleNameFromLanguage,_GetLocaleNameFromLanguage,__crtGetLocaleInfoEx,_invoke_watson,	135_2_6C23ECA7
Source: C:\Users\user\AppData\Roaming\Seznam.cz\bin\szndesktop.exe	Code function: __crtGetLocaleInfoEx,wcsncmp,	135_2_6C2C4CA0
Source: C:\Users\user\AppData\Roaming\Seznam.cz\bin\szndesktop.exe	Code function: _getptd,_getptd,GetLocaleInfoW,_wcsicmp,	135_2_6C2C4CEA
Source: C:\Users\user\AppData\Roaming\Seznam.cz\bin\szndesktop.exe	Code function: wcschr,wcschr,_itow_s,__crtGetLocaleInfoEx,	135_2_6C23EDA0
Source: C:\Users\user\AppData\Roaming\Seznam.cz\bin\szndesktop.exe	Code function: _getptd,wcslen,EnumSystemLocalesW,	135_2_6C2C4D98
Source: C:\Users\user\AppData\Roaming\Seznam.cz\bin\szndesktop.exe	Code function: _getptd,wcslen,wcslen,_GetPrimaryLen,EnumSystemLocalesW,	135_2_6C2C4DD8
Source: C:\Users\user\AppData\Roaming\Seznam.cz\bin\szndesktop.exe	Code function: _getptd,wcslen,_GetPrimaryLen,EnumSystemLocalesW,	135_2_6C2C4E55
Source: C:\Users\user\AppData\Roaming\Seznam.cz\bin\szndesktop.exe	Code function: _getptd,_getptd,GetLocaleInfoW,_wcsicmp,GetLocaleInfoW,_wcsicmp,_wcsnicmp,wcslen,GetLocaleInfoW,_wcsicmp,wcslen,_wcsicmp,	135_2_6C2C4ED8
Source: C:\Users\user\AppData\Roaming\Seznam.cz\bin\szndesktop.exe	Code function: __crtGetUserDefaultLocaleName,wcslen,wcsncpy_s,_invoke_watson,__crtEnumSystemLocalesEx,	135_2_6C23EF84
Source: C:\Users\user\AppData\Roaming\Seznam.cz\bin\szndesktop.exe	Code function: wcslen,__crtEnumSystemLocalesEx,	135_2_6C2C4BA5
Source: C:\Users\user\AppData\Roaming\Seznam.cz\bin\szndesktop.exe	Code function: _getptd,__crtGetLocaleInfoEx,_wcsicmp,wcslen,wcsncpy_s,_invoke_watson,	135_2_6C2C4BEF
Source: C:\Users\user\AppData\Roaming\Seznam.cz\bin\szndesktop.exe	Code function: _getptd,wcsncpy_s,wcslen,wcscmp,wcscmp,memcpy,wcscpy_s,wcscpy_s,wcslen,wcsncpy_s,wcsncpy_s,__crtIsValidLocaleName,__crtGetLocaleInfoEx,GetACP,wcsncpy_s,wcsncpy_s,wcsncpy_s,wcslen,wcsncpy_s,_invoke_watson,_errno,	135_2_6C23418F
Source: C:\Users\user\AppData\Roaming\Seznam.cz\bin\szndesktop.exe	Code function: __crtEnumSystemLocalesEx,EnumSystemLocalesW,	135_2_6C2C1C7E
Source: C:\Users\user\AppData\Roaming\Seznam.cz\bin\szndesktop.exe	Code function: __crtGetLocaleInfoEx,GetLocaleInfoW,	135_2_6C2C1D04
Source: C:\Users\user\AppData\Roaming\Seznam.cz\bin\szndesktop.exe	Code function: __crtGetLocaleInfoEx,__crtGetLocaleInfoEx,WideCharToMultiByte,_freea_s,malloc,	135_2_6C23DD7B
Source: C:\Users\user\AppData\Roaming\Seznam.cz\bin\szndesktop.exe	Code function: __crtGetLocaleInfoEx,free,_calloc_crt,strncpy_s,__crtGetLocaleInfoEx,_calloc_crt,__crtGetLocaleInfoEx,GetLastError,_calloc_crt,free,free,_invoke_watson,_malloc_crt,memcpy,_siglookup,	135_2_6C23DEF1
Source: C:\Users\user\AppData\Roaming\Seznam.cz\bin\szndesktop.exe	Code function: _getptd,__crtGetLocaleInfoEx,	135_2_6C245941
Source: C:\Users\user\AppData\Roaming\Seznam.cz\bin\szndesktop.exe	Code function: __crtGetLocaleInfoEx,_wcsicmp,wcslen,wcsncpy_s,_getptd,__crtGetLocaleInfoEx,_wcsicmp,__crtGetLocaleInfoEx,_wcsicmp,_wcsnicmp,_TestDefaultCountry,wcslen,wcsncpy_s,wcslen,_TestDefaultCountry,wcslen,_invoke_watson,__crtGetLocaleInfoEx,	135_2_6C245942
Source: C:\Users\user\AppData\Roaming\Seznam.cz\bin\szndesktop.exe	Code function: wcslen,wcslen,__crtEnumSystemLocalesEx,	135_2_6C245B73
Source: C:\Users\user\AppData\Roaming\Seznam.cz\bin\szndesktop.exe	Code function: _getptd,_getptd,GetLocaleInfoW,_wcsicmp,_wcsicmp,	135_2_6C2C50CB
Source: C:\Users\user\AppData\Roaming\Seznam.cz\bin\szndesktop.exe	Code function: wcscmp,wcscmp,GetLocaleInfoW,_wtol,GetLocaleInfoW,GetACP,	135_2_6C2C51F3
Source: C:\Users\user\AppData\Roaming\Seznam.cz\bin\szndesktop.exe	Code function: _getptd,GetLocaleInfoW,_GetPrimaryLen,wcslen,	135_2_6C2C52B4
Source: C:\Users\user\AppData\Roaming\Seznam.cz\bin\szndesktop.exe	Code function: wcschr,wcslen,_calloc_crt,wcslen,wcscpy_s,SetEnvironmentVariableW,free,_errno,_errno,_invalid_parameter_noinfo,___crtGetEnvironmentStringsW,___mbtow_environ,_malloc_crt,_malloc_crt,free,__recalloc_crt,__recalloc_crt,_errno,free,free,_invoke_watson,_invoke_watson,__crtEnumSystemLocalesEx,	135_2_6C24B2F1
Source: C:\Users\user\AppData\Roaming\Seznam.cz\bin\szndesktop.exe	Code function: _getptd,memset,_getptd,_GetLcidFromCountry,GetUserDefaultLCID,IsValidCodePage,IsValidLocale,GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,_itow_s,	135_2_6C2C531C

Source: C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Google\Picasa3\Picasa3.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Google\Picasa3\Picasa3.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Google\Picasa3\Picasa3.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Google\Picasa3\Picasa3.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Google\Picasa3\Picasa3.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Google\Picasa3\Picasa3.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Google\Picasa3\PicasaPhotoViewer.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-PhotoBasic-PictureTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation
Source: C:\Program Files (x86)\Google\Picasa3\PicasaPhotoViewer.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-PhotoBasic-PictureTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\~0069FB97.00001B74.sznpkg\UNZIP.EXE	Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\~0069FB97.00001B74.sznpkg\UNZIP.EXE	Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\~006A2DE2.00000DD4.sznpkg\UNZIP.EXE	Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\~006A2DE2.00000DD4.sznpkg\UNZIP.EXE	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\SysWOW64\cmd.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\~006A2DE2.00000DD4.sznpkg\UNZIP.EXE	Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\~006A2DE2.00000DD4.sznpkg\UNZIP.EXE	Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\~006A2DE2.00000DD4.sznpkg\UNZIP.EXE	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\SysWOW64\cmd.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\~006A2DE2.00000DD4.sznpkg\UNZIP.EXE	Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\~006A2DE2.00000DD4.sznpkg\UNZIP.EXE	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\SysWOW64\cmd.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\SysWOW64\cmd.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\SysWOW64\cmd.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\SysWOW64\cmd.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\~006A2DE2.00000DD4.sznpkg\UNZIP.EXE	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\SysWOW64\cmd.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\SysWOW64\cmd.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\~006A2DE2.00000DD4.sznpkg\UNZIP.EXE	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\SysWOW64\cmd.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\SysWOW64\cmd.exe	Queries volume information: C:\ VolumeInformation

Source: C:\Users\user\Desktop\1a4e5ccd35a56d84281a143f831563be.exe

Code function: 15_2_73A33F50 GetSystemTimeAsFileTime,GetCurrentProcessId,GetCurrentThreadId,GetTickCount,QueryPerformanceCounter,

15_2_73A33F50

Source: C:\Program Files (x86)\Google\Picasa3\Picasa3.exe

Code function: 20_2_04820580 __time64,GetTimeZoneInformation,

20_2_04820580

Source: C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe

Code function: 16_2_04C920F0 GlobalAlloc,MessageBoxW,GetVersion,GetFileAttributesW,SHGetSpecialFolderPathW,SHGetSpecialFolderPathW,SHGetSpecialFolderPathW,_wcsrchr,

16_2_04C920F0

Source: C:\Users\user\AppData\Roaming\Seznam.cz\bin\sznpp.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Source: C:\Users\user\AppData\Roaming\Seznam.cz\bin\szndesktop.exe	Code function: 135_2_6C28859A ??0exception@std@@QAE@XZ,??0exception@std@@QAE@XZ,_CxxThrowException,Concurrency::details::WorkItem::BindTo,Concurrency::details::SchedulerBase::ReleaseInternalContext,Concurrency::details::SchedulerBase::ReleaseInternalContext,	135_2_6C28859A
Source: C:\Users\user\AppData\Roaming\Seznam.cz\bin\szndesktop.exe	Code function: 135_2_6C28839B Concurrency::details::WorkItem::BindTo,Concurrency::details::SchedulerBase::ReleaseInternalContext,	135_2_6C28839B
Source: C:\Users\user\AppData\Roaming\Seznam.cz\bin\szndesktop.exe	Code function: 135_2_6C375110 InterlockedIncrement,__RTDynamicCast,InterlockedIncrement,_CxxThrowException,InterlockedIncrement,_CxxThrowException,socket,htons,WSAGetLastError,_CxxThrowException,SetHandleInformation,setsockopt,setsockopt,ioctlsocket,setsockopt,bind,WSAGetLastError,_CxxThrowException,listen,WSAGetLastError,_CxxThrowException,	135_2_6C375110
Source: C:\Users\user\AppData\Roaming\Seznam.cz\bin\szndesktop.exe	Code function: 135_2_6C376830 getaddrinfo,#74,WSAGetLastError,_CxxThrowException,freeaddrinfo,socket,WSAGetLastError,_CxxThrowException,bind,WSAGetLastError,_CxxThrowException,ioctlsocket,setsockopt,socket,WSAGetLastError,_CxxThrowException,	135_2_6C376830

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	1 Scripting	1 Replication Through Removable Media	2 Windows Management Instrumentation	1 Scripting	1 DLL Side-Loading	2 Disable or Modify Tools	OS Credential Dumping	2 System Time Discovery	Remote Services	1 Archive Collected Data	6 Ingress Tool Transfer	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	3 Native API	1 DLL Side-Loading	1 Access Token Manipulation	1 Deobfuscate/Decode Files or Information	LSASS Memory	1 Peripheral Device Discovery	Remote Desktop Protocol	Data from Removable Media	21 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Exploitation for Client Execution	11 Windows Service	11 Windows Service	2 Obfuscated Files or Information	Security Account Manager	4 File and Directory Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	5 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	112 Command and Scripting Interpreter	211 Registry Run Keys / Startup Folder	11 Process Injection	1 DLL Side-Loading	NTDS	59 System Information Discovery	Distributed Component Object Model	Input Capture	6 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	211 Registry Run Keys / Startup Folder	232 Masquerading	LSA Secrets	1 Query Registry	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 Modify Registry	Cached Domain Credentials	141 Security Software Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	3 Virtualization/Sandbox Evasion	DCSync	3 Virtualization/Sandbox Evasion	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	1 Access Token Manipulation	Proc Filesystem	1 Process Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	11 Process Injection	/etc/passwd and /etc/shadow	11 Application Window Discovery	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement
IP Addresses	Compromise Infrastructure	Supply Chain Compromise	PowerShell	Cron	Cron	1 Rundll32	Network Sniffing	Network Service Discovery	Shared Webroot	Local Data Staging	File Transfer Protocols	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	External Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Link
C:\Program Files (x86)\Google\Picasa3\MovieThumb.exe	0%	ReversingLabs
C:\Program Files (x86)\Google\Picasa3\MovieThumb.exe	0%	Virustotal	Browse
C:\Program Files (x86)\Google\Picasa3\Picasa3.exe	0%	ReversingLabs
C:\Program Files (x86)\Google\Picasa3\Picasa3.exe	0%	Virustotal	Browse
C:\Program Files (x86)\Google\Picasa3\Picasa3i18n.dll	0%	ReversingLabs
C:\Program Files (x86)\Google\Picasa3\Picasa3i18n.dll	0%	Virustotal	Browse
C:\Program Files (x86)\Google\Picasa3\PicasaPhotoViewer.exe	0%	ReversingLabs
C:\Program Files (x86)\Google\Picasa3\PicasaPhotoViewer.exe	1%	Virustotal	Browse
C:\Program Files (x86)\Google\Picasa3\cdautorun\Picasa CD Slideshow.app\Contents\Frameworks\GoogleBreakpad.framework\Versions\A\Resources\Inspector	0%	ReversingLabs
C:\Program Files (x86)\Google\Picasa3\cdautorun\Picasa CD Slideshow.app\Contents\Frameworks\GoogleBreakpad.framework\Versions\A\Resources\Inspector	0%	Virustotal	Browse
C:\Program Files (x86)\Google\Picasa3\cdautorun\Picasa CD Slideshow.app\Contents\Frameworks\GoogleBreakpad.framework\Versions\A\Resources\Reporter.app\Contents\MacOS\Reporter	0%	ReversingLabs
C:\Program Files (x86)\Google\Picasa3\cdautorun\Picasa CD Slideshow.app\Contents\Frameworks\GoogleBreakpad.framework\Versions\A\Resources\Reporter.app\Contents\MacOS\Reporter	0%	Virustotal	Browse
C:\Program Files (x86)\Google\Picasa3\cdautorun\Picasa CD Slideshow.app\Contents\MacOS\Picasa CD Slideshow	0%	ReversingLabs
C:\Program Files (x86)\Google\Picasa3\cdautorun\Picasa CD Slideshow.app\Contents\MacOS\Picasa CD Slideshow	0%	Virustotal	Browse
C:\Program Files (x86)\Google\Picasa3\cdautorun\Picasa Restore.app\Contents\Frameworks\GoogleBreakpad.framework\Versions\A\Resources\Inspector	0%	ReversingLabs
C:\Program Files (x86)\Google\Picasa3\cdautorun\Picasa Restore.app\Contents\Frameworks\GoogleBreakpad.framework\Versions\A\Resources\Inspector	0%	Virustotal	Browse
C:\Program Files (x86)\Google\Picasa3\cdautorun\Picasa Restore.app\Contents\Frameworks\GoogleBreakpad.framework\Versions\A\Resources\Reporter.app\Contents\MacOS\Reporter	0%	ReversingLabs
C:\Program Files (x86)\Google\Picasa3\cdautorun\Picasa Restore.app\Contents\Frameworks\GoogleBreakpad.framework\Versions\A\Resources\Reporter.app\Contents\MacOS\Reporter	0%	Virustotal	Browse
C:\Program Files (x86)\Google\Picasa3\cdautorun\Picasa Restore.app\Contents\MacOS\Picasa Restore	0%	ReversingLabs
C:\Program Files (x86)\Google\Picasa3\cdautorun\Picasa Restore.app\Contents\MacOS\Picasa Restore	0%	Virustotal	Browse
C:\Program Files (x86)\Google\Picasa3\cdautorun\PicasaCD.exe	0%	ReversingLabs
C:\Program Files (x86)\Google\Picasa3\cdautorun\PicasaCD.exe	0%	Virustotal	Browse
C:\Program Files (x86)\Google\Picasa3\cdautorun\PicasaRestore.exe	0%	ReversingLabs
C:\Program Files (x86)\Google\Picasa3\cdautorun\PicasaRestore.exe	0%	Virustotal	Browse
C:\Program Files (x86)\Google\Picasa3\npPicasa3.dll	0%	ReversingLabs
C:\Program Files (x86)\Google\Picasa3\npPicasa3.dll	0%	Virustotal	Browse
C:\Program Files (x86)\Google\Picasa3\plugins\CDVDR\CDVDR.yti	2%	ReversingLabs
C:\Program Files (x86)\Google\Picasa3\plugins\CDVDR\CDVDR.yti	0%	Virustotal	Browse
C:\Program Files (x86)\Google\Picasa3\plugins\Red.dll	0%	ReversingLabs
C:\Program Files (x86)\Google\Picasa3\plugins\Red.dll	0%	Virustotal	Browse
C:\Program Files (x86)\Google\Picasa3\plugins\expwebsites\expwebsites.yti	0%	ReversingLabs
C:\Program Files (x86)\Google\Picasa3\plugins\expwebsites\expwebsites.yti	0%	Virustotal	Browse
C:\Program Files (x86)\Google\Picasa3\plugins\ytITivo.yti	2%	ReversingLabs
C:\Program Files (x86)\Google\Picasa3\plugins\ytITivo.yti	0%	Virustotal	Browse

Name	IP	Active	Malicious
chrome.cloudflare-dns.com	172.64.41.3	true	false
api.software.seznam.cz	77.75.77.161	true	false
plus.l.google.com	142.250.185.174	true	false
blogspot.l.googleusercontent.com	142.250.185.161	true	false
support.google.com	172.217.23.110	true	false
h.seznam.cz	77.75.78.30	true	false
sni1gl.wpc.nucdn.net	152.199.21.175	true	false
download.seznam.cz	77.75.76.70	true	false
www3.l.google.com	142.250.186.174	true	false
www2.l.google.com	142.250.185.228	true	false
www.google.com	216.58.206.36	true	false
googlehosted.l.googleusercontent.com	172.217.23.97	true	false
h.imedia.cz	77.75.78.30	true	false
software.seznam.cz	unknown	unknown	false
sentry.sklik.cz	unknown	unknown	false
lh3.googleusercontent.com	unknown	unknown	false
picasa-readme.blogspot.com	unknown	unknown	false
picasa.google.com	unknown	unknown	false
clients2.googleusercontent.com	unknown	unknown	false
pack.google.com	unknown	unknown	true
chrome.google.com	unknown	unknown	false
apis.google.com	unknown	unknown	false

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://download.seznam.cz/update/cz.seznam.software.libfoxcub-3.3.8-win32.zip	false
https://download.seznam.cz/update/cz.seznam.software.libszndesktop-2.1.35-win32.zip	false
https://download.seznam.cz/update/cz.seznam.software.szninstall-1.1.15-win32.zip	false
https://download.seznam.cz/update/cz.seznam.software.ielisticka3-3.3.5-win32.zip	false
https://bzib.nelreports.net/api/report?cat=bingbusiness	false
https://px.ads.linkedin.com/wa/	false
https://download.seznam.cz/update/cz.seznam.software.sznsetup-1.2.7-win32.zip	false
http://picasa.google.com/support/bin/answer.py?hl=en&answer=93773	false
https://h.imedia.cz/hit/?a=event&d=%7B%22action%22%3A%22startup%22%2C%22application%22%3A%22szndesktop%22%2C%22signedhash%22%3A%220%22%2C%22chrv%22%3A48%2C%22che%22%3A48%2C%22chs%22%3A16%2C%22ches%22%3A16%2C%22ie%22%3A1%2C%22osbuild%22%3A19045%2C%22osarch%22%3A9%2C%22chver%22%3A%22117.0.5938.132%22%2C%22ffver%22%3A%22118.0.1%22%2C%22iever%22%3A%2211.00.19041.1%20%28WinBuild.160101.0800%29%22%7D&s=partprog&v=2.1.35&r=-1794028113&u=http://www.seznam.cz&h=B0B7C794-8699-4634-B6F9-24DA47BBD8EF&lsid=1727871011238&lses=1727871002951	false

URLs from Memory and Binaries

Name	Source	Malicious
http://internet.e-mail	setuppicasa39-setup.exe, 00000010.00000002.1664870898.0000000003831000.00000004.00000020.00020000.00000000.sdmp	false
https://photos.google.com/apps	Picasa3.exe, 00000012.00000000.1603749985.0000000000C6A000.00000002.00000001.01000000.00000012.sdmp	false
http://%s/%s/rssalbum%d.rss	Picasa3.exe, 00000012.00000000.1603749985.0000000000C6A000.00000002.00000001.01000000.00000012.sdmp	false
http://picasa.smo/buttons	Picasa3.exe, 00000012.00000000.1603749985.0000000000C6A000.00000002.00000001.01000000.00000012.sdmp	false
http://picasa-readme.blogspot.com/2012/04/picasa-3.html	Picasa3.exe, 00000014.00000002.2593399186.0000000007223000.00000004.00000020.00020000.00000000.sdmp	false
http://iptc.org/std/Iptc4xmpCore/1.0/xmlns/em#	Picasa3.exe, 00000014.00000002.2482072226.0000000002EAA000.00000004.00000020.00020000.00000000.sdmp	false
http://picasa.google.com/support/bin/answer.py?hl=pt-BR&answer=93773	Picasa3.exe, 00000014.00000002.2599824731.0000000010A0C000.00000002.00000001.01000000.00000014.sdmp	false
http://picasa.google.com/intl/pt-BR/#utm_source=gph-et-en&utm_medium=et&utm_campaign=en-scre	setuppicasa39-setup.exe, 00000010.00000002.1664870898.000000000369C000.00000004.00000020.00020000.00000000.sdmp, GPhotos.scr, 00000011.00000000.1542961815.00000000006EF000.00000002.00000001.01000000.0000000F.sdmp, Picasa3.exe, 00000014.00000002.2599824731.0000000010A0C000.00000002.00000001.01000000.00000014.sdmp	false
http://dl.google.com/picasa/picasa3-setup.exe	Picasa3.exe, 00000014.00000002.2563942835.0000000006D99000.00000004.00000020.00020000.00000000.sdmp, Picasa3.exe, 00000014.00000002.2586100840.0000000006F6F000.00000004.00000020.00020000.00000000.sdmp	false
http://www.blogger.com/feeds/1456569655786168306/posts/default	Picasa3.exe, 00000014.00000002.2506191744.0000000004241000.00000004.00000020.00020000.00000000.sdmp	false
http://www.google.ro/policies/terms/	Picasa3.exe, 00000014.00000002.2599824731.0000000010A0C000.00000002.00000001.01000000.00000014.sdmp	false
https://support.google.com/photos/?p=storage	setuppicasa39-setup.exe, 00000010.00000002.1664870898.0000000003831000.00000004.00000020.00020000.00000000.sdmp, Picasa3.exe, 00000014.00000002.2599824731.000000001000C000.00000002.00000001.01000000.00000014.sdmp	false
http://picasa.google.dk/intl/da/#utm_source=gph-et-en&utm_medium=et&utm_campaign=da-screensa	setuppicasa39-setup.exe, 00000010.00000002.1664870898.000000000369C000.00000004.00000020.00020000.00000000.sdmp, GPhotos.scr, 00000011.00000000.1542961815.00000000006EF000.00000002.00000001.01000000.0000000F.sdmp, Picasa3.exe, 00000014.00000002.2599824731.000000001000C000.00000002.00000001.01000000.00000014.sdmp	false
https://www.google.com/accounts/ServiceLogin?hl=zh_CN&continue=http%3A%2F%2Fpicasaweb.google.com	setuppicasa39-setup.exe, 00000010.00000002.1664870898.00000000032A7000.00000004.00000020.00020000.00000000.sdmp, Picasa3.exe, 00000014.00000002.2599824731.000000001140C000.00000002.00000001.01000000.00000014.sdmp, PicasaPhotoViewer.exe, 00000015.00000000.1697683801.0000000000864000.00000002.00000001.01000000.00000019.sdmp	false
http://schemas.google.com/g/2005	setuppicasa39-setup.exe, 00000010.00000002.1664870898.00000000031AA000.00000004.00000020.00020000.00000000.sdmp, Picasa3.exe, 00000012.00000000.1603749985.0000000000C6A000.00000002.00000001.01000000.00000012.sdmp, PicasaPhotoViewer.exe, 00000015.00000000.1692209976.000000000070D000.00000002.00000001.01000000.00000019.sdmp	false
https://uploader.picasa.com/froogle.php?q=%sthumbui/mainuipanelthumbui/acquirepanelthumbui/infowellt	Picasa3.exe, 00000012.00000000.1603749985.0000000000C6A000.00000002.00000001.01000000.00000012.sdmp	false
http://www.google.com/support/forum/p/Picasa">our	Picasa3.exe, 00000014.00000002.2593399186.0000000007223000.00000004.00000020.00020000.00000000.sdmp	false
http://picasa-readme.blogspot.com/2008/10/picasa-30-out-of-beta-build-xxxx.html	Picasa3.exe, 00000014.00000002.2593399186.0000000007223000.00000004.00000020.00020000.00000000.sdmp, Picasa3.exe, 00000014.00000002.2589400232.0000000007039000.00000004.00000020.00020000.00000000.sdmp	false
http://picasa.google.com/support/bin/answer.py?hl=hi&answer=93773	Picasa3.exe, 00000014.00000002.2599824731.0000000010A0C000.00000002.00000001.01000000.00000014.sdmp	false
http://support.google.com/plus/bin/answer.py?answer=2370124"><span	Picasa3.exe, 00000014.00000002.2593399186.0000000007223000.00000004.00000020.00020000.00000000.sdmp	false
http://picasa.google.com/support/bin/answer.py?answer=141059iPhotoError::HelpURL	Picasa3.exe, 00000012.00000000.1603749985.0000000000C6A000.00000002.00000001.01000000.00000012.sdmp	false
http://www.blogger.com/feeds/1456569655786168306/posts/default/1237605142260003533	Picasa3.exe, 00000014.00000002.2593399186.0000000007223000.00000004.00000020.00020000.00000000.sdmp, Picasa3.exe, 00000014.00000002.2589400232.0000000007039000.00000004.00000020.00020000.00000000.sdmp	false
http://picasa.google.com/support/bin/answer.py?hl=sk&answer=93773	Picasa3.exe, 00000014.00000002.2599824731.0000000010A0C000.00000002.00000001.01000000.00000014.sdmp	false
http://ericorth.kir.corp.google.com:8888/gphotos?action=retrconfig&email=/gphotos?action=postconfigr	setuppicasa39-setup.exe, 00000010.00000002.1664870898.00000000035FF000.00000004.00000020.00020000.00000000.sdmp, GPhotos.scr, 00000011.00000000.1542724484.000000000062E000.00000002.00000001.01000000.0000000F.sdmp	false
http://forums.picasa.com/	Picasa3.exe, 00000012.00000000.1604678624.0000000000DF8000.00000002.00000001.01000000.00000012.sdmp, Picasa3.exe, 00000014.00000003.1626531844.00000000040E2000.00000004.00000020.00020000.00000000.sdmp, Picasa3.exe, 00000014.00000002.2599824731.000000001140C000.00000002.00000001.01000000.00000014.sdmp, Picasa3.exe, 00000014.00000002.2599824731.0000000010A0C000.00000002.00000001.01000000.00000014.sdmp, Picasa3.exe, 00000014.00000002.2482072226.0000000002EAA000.00000004.00000020.00020000.00000000.sdmp, Picasa3.exe, 00000014.00000003.1626203204.0000000003FB3000.00000004.00000020.00020000.00000000.sdmp, Picasa3.exe, 00000014.00000002.2599824731.000000001000C000.00000002.00000001.01000000.00000014.sdmp	false
http://picasa.google.com/support/bin/answer.py?hl=en&answer=15625	setuppicasa39-setup.exe, 00000010.00000002.1664870898.0000000003831000.00000004.00000020.00020000.00000000.sdmp, Picasa3.exe, 00000014.00000002.2599824731.000000001000C000.00000002.00000001.01000000.00000014.sdmp	false
http://picasa.google.com/intl/fr/#utm_source=gph-et-fr&utm_medium=et&utm_campaign=fr-screens	setuppicasa39-setup.exe, 00000010.00000002.1664870898.000000000369C000.00000004.00000020.00020000.00000000.sdmp, GPhotos.scr, 00000011.00000000.1542961815.00000000006EF000.00000002.00000001.01000000.0000000F.sdmp, Picasa3.exe, 00000014.00000002.2599824731.0000000010A0C000.00000002.00000001.01000000.00000014.sdmp	false
http://picasa.google.com/support/bin/answer.py?answer=139492&hl=%sSplashThreadruntime	Picasa3.exe, 00000012.00000000.1603749985.0000000000C6A000.00000002.00000001.01000000.00000012.sdmp	false
http://picasa.google.com/support/bin/answer.py?hl=fi&answer=93773	Picasa3.exe, 00000014.00000002.2599824731.0000000010A0C000.00000002.00000001.01000000.00000014.sdmp	false
https://photos.google.com/appslistboxcaptionpopuplistOriginal	Picasa3.exe, 00000012.00000000.1603749985.0000000000C6A000.00000002.00000001.01000000.00000012.sdmp	false
http://photos.hello.com/interface/boxes/S32.gif	Picasa3.exe, 00000012.00000000.1603749985.0000000000C6A000.00000002.00000001.01000000.00000012.sdmp	false
http://googlephotos.blogspot.com/">Google	Picasa3.exe, 00000014.00000002.2593399186.0000000007223000.00000004.00000020.00020000.00000000.sdmp	false
http://picasa.google.com/support/bin/answer.py?answer=11139	Picasa3.exe, 00000012.00000000.1603749985.0000000000C6A000.00000002.00000001.01000000.00000012.sdmp, Picasa3.exe, 00000014.00000003.1626531844.00000000040E2000.00000004.00000020.00020000.00000000.sdmp, Picasa3.exe, 00000014.00000002.2599824731.0000000010A0C000.00000002.00000001.01000000.00000014.sdmp, Picasa3.exe, 00000014.00000003.1626203204.0000000003FB3000.00000004.00000020.00020000.00000000.sdmp, Picasa3.exe, 00000014.00000002.2599824731.000000001000C000.00000002.00000001.01000000.00000014.sdmp, Picasa3.exe, 00000014.00000002.2482072226.0000000002E7B000.00000004.00000020.00020000.00000000.sdmp	false
http://video.google.com/googleplayer.swf?videoUrl=%s	Picasa3.exe, 00000012.00000000.1603749985.0000000000C6A000.00000002.00000001.01000000.00000012.sdmp	false
http://picasa.google.com/support/bin/answer.py?hl=ja&answer=93773	Picasa3.exe, 00000014.00000002.2599824731.0000000010A0C000.00000002.00000001.01000000.00000014.sdmp	false
http://picasa.google.com/support/bin/answer.py?hl=zh-TW&answer=11139	Picasa3.exe, 00000014.00000002.2599824731.000000001140C000.00000002.00000001.01000000.00000014.sdmp	false
http://support.google.com/plus/bin/answer.py?answer=2370124	Picasa3.exe, 00000014.00000002.2506191744.000000000417F000.00000004.00000020.00020000.00000000.sdmp, Picasa3.exe, 00000014.00000002.2593399186.000000000716B000.00000004.00000020.00020000.00000000.sdmp	false
https://uploader.picasa.com/providers/php/generate.xml.php?prID=%s&country=%sclientlanguagehttp://lo	Picasa3.exe, 00000012.00000000.1603749985.0000000000C6A000.00000002.00000001.01000000.00000012.sdmp	false
http://photos.hello.com/interface/boxes/B33.gif	Picasa3.exe, 00000012.00000000.1603749985.0000000000C6A000.00000002.00000001.01000000.00000012.sdmp	false
http://googlephotos.blogspot.com/	Picasa3.exe, 00000014.00000002.2506191744.0000000004241000.00000004.00000020.00020000.00000000.sdmp, Picasa3.exe, 00000014.00000002.2599824731.000000001140C000.00000002.00000001.01000000.00000014.sdmp, Picasa3.exe, 00000014.00000002.2599824731.0000000010A0C000.00000002.00000001.01000000.00000014.sdmp, Picasa3.exe, 00000014.00000003.1626203204.0000000003FB3000.00000004.00000020.00020000.00000000.sdmp, Picasa3.exe, 00000014.00000002.2599824731.000000001000C000.00000002.00000001.01000000.00000014.sdmp, Picasa3.exe, 00000014.00000002.2586100840.0000000006F6F000.00000004.00000020.00020000.00000000.sdmp, Picasa3.exe, 00000014.00000002.2593399186.000000000716B000.00000004.00000020.00020000.00000000.sdmp	false
http://schemas.google.com/g/2008/ordering#comesAfter	Picasa3.exe, 00000012.00000000.1603749985.0000000000C6A000.00000002.00000001.01000000.00000012.sdmp	false
https://www.google.com/accounts/ServiceLogin?hl=hu_HU&continue=http%3A%2F%2Fpicasaweb.google.com	setuppicasa39-setup.exe, 00000010.00000002.1664870898.00000000032A7000.00000004.00000020.00020000.00000000.sdmp, Picasa3.exe, 00000014.00000002.2599824731.0000000010A0C000.00000002.00000001.01000000.00000014.sdmp, PicasaPhotoViewer.exe, 00000015.00000000.1697683801.0000000000864000.00000002.00000001.01000000.00000019.sdmp	false
http://picasa.google.com/support/bin/answer.py?hl=zh_CN&answer=141059	Picasa3.exe, 00000014.00000002.2599824731.000000001140C000.00000002.00000001.01000000.00000014.sdmp	false
http://picasa.google.com/support/bin/topic.py?topic=16056il_BurnPanel::imapierrorlinkError	Picasa3.exe, 00000012.00000000.1603749985.0000000000C6A000.00000002.00000001.01000000.00000012.sdmp	false
http://picasa.google.nl/support/bin/answer.py?answer=139492	Picasa3.exe, 00000014.00000002.2599824731.0000000010A0C000.00000002.00000001.01000000.00000014.sdmp, Picasa3.exe, 00000014.00000002.2599824731.000000001000C000.00000002.00000001.01000000.00000014.sdmp	false
https://www.google.com/accounts/ServiceLogin?hl=sl_SI&continue=http%3A%2F%2Fpicasaweb.google.com	setuppicasa39-setup.exe, 00000010.00000002.1664870898.00000000032A7000.00000004.00000020.00020000.00000000.sdmp, Picasa3.exe, 00000014.00000002.2599824731.0000000010A0C000.00000002.00000001.01000000.00000014.sdmp, PicasaPhotoViewer.exe, 00000015.00000000.1697683801.0000000000864000.00000002.00000001.01000000.00000019.sdmp	false
https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhdYMorlhvaoU2vdx-Au0-wABULVhkz6vqRku4godi	Picasa3.exe, 00000014.00000002.2593399186.0000000007223000.00000004.00000020.00020000.00000000.sdmp, Picasa3.exe, 00000014.00000002.2593399186.000000000716B000.00000004.00000020.00020000.00000000.sdmp	false
http://schemas.google.com/g/2005#kind	Picasa3.exe, 00000012.00000000.1603749985.0000000000C6A000.00000002.00000001.01000000.00000012.sdmp, PicasaPhotoViewer.exe, 00000015.00000000.1692209976.000000000070D000.00000002.00000001.01000000.00000019.sdmp	false
http://picasa.google.com/support/bin/answer.py?hl=zh_CN&answer=53209	Picasa3.exe, 00000014.00000002.2599824731.000000001140C000.00000002.00000001.01000000.00000014.sdmp	false
http://photos.hello.com/interface/AppsBtn-hello.gif	Picasa3.exe, 00000012.00000000.1603749985.0000000000C6A000.00000002.00000001.01000000.00000012.sdmp	false
http://pack.google.com/feeds.	Picasa3.exe, 00000014.00000002.2599824731.0000000010A0C000.00000002.00000001.01000000.00000014.sdmp, Picasa3.exe, 00000014.00000003.1626203204.0000000003FB3000.00000004.00000020.00020000.00000000.sdmp, Picasa3.exe, 00000014.00000002.2599824731.000000001000C000.00000002.00000001.01000000.00000014.sdmp, Picasa3.exe, 00000014.00000002.2482072226.0000000002E7B000.00000004.00000020.00020000.00000000.sdmp	false
http://picasa.google.co.kr/support?ctx=picasa	Picasa3.exe, 00000014.00000002.2599824731.0000000010A0C000.00000002.00000001.01000000.00000014.sdmp	false
http://pack.google.com/feeds.MetadataNode::TipDiscoverMeasure	setuppicasa39-setup.exe, 00000010.00000002.1664870898.00000000035FF000.00000004.00000020.00020000.00000000.sdmp, GPhotos.scr, 00000011.00000000.1542724484.000000000062E000.00000002.00000001.01000000.0000000F.sdmp	false
http://picasa.google.com/support/bin/answer.py?hl=se&answer=141059	Picasa3.exe, 00000014.00000002.2599824731.000000001140C000.00000002.00000001.01000000.00000014.sdmp	false
http://maps.google.com/maps?file=api&v=2&client=google-picasa-client&sensor=false	setuppicasa39-setup.exe, 00000010.00000002.1664870898.00000000032A7000.00000004.00000020.00020000.00000000.sdmp	false
https://photos.blogger.com/picasa-post.g	Picasa3.exe, 00000014.00000002.2482072226.0000000002E92000.00000004.00000020.00020000.00000000.sdmp, Picasa3.exe, 00000014.00000002.2506191744.0000000004241000.00000004.00000020.00020000.00000000.sdmp	false
https://www.google.com/m8/feeds/	setuppicasa39-setup.exe, 00000010.00000002.1664870898.00000000031AA000.00000004.00000020.00020000.00000000.sdmp, setuppicasa39-setup.exe, 00000010.00000002.1664870898.00000000035FF000.00000004.00000020.00020000.00000000.sdmp, GPhotos.scr, 00000011.00000000.1542724484.000000000062E000.00000002.00000001.01000000.0000000F.sdmp, Picasa3.exe, 00000012.00000000.1603749985.0000000000C6A000.00000002.00000001.01000000.00000012.sdmp, PicasaPhotoViewer.exe, 00000015.00000000.1692209976.000000000070D000.00000002.00000001.01000000.00000019.sdmp	false
https://support.google.com/plus/answer/1647509#cost	setuppicasa39-setup.exe, 00000010.00000002.1664870898.0000000003831000.00000004.00000020.00020000.00000000.sdmp	false
http://picasa.google.rs/support?ctx=picasa	Picasa3.exe, 00000014.00000002.2599824731.0000000010A0C000.00000002.00000001.01000000.00000014.sdmp	false
https://www.google.com/accounts/ServiceLogin?hl=el&continue=http%3A%2F%2Fpicasaweb.google.com%2F	setuppicasa39-setup.exe, 00000010.00000002.1664870898.00000000032A7000.00000004.00000020.00020000.00000000.sdmp, Picasa3.exe, 00000014.00000002.2599824731.000000001000C000.00000002.00000001.01000000.00000014.sdmp, PicasaPhotoViewer.exe, 00000015.00000000.1697683801.0000000000864000.00000002.00000001.01000000.00000019.sdmp	false
http://picasa.google.com/intl/cs/#utm_source=gph-et-en&utm_medium=et&utm_campaign=cs-screens	setuppicasa39-setup.exe, 00000010.00000002.1664870898.000000000369C000.00000004.00000020.00020000.00000000.sdmp, GPhotos.scr, 00000011.00000000.1542961815.00000000006EF000.00000002.00000001.01000000.0000000F.sdmp, Picasa3.exe, 00000014.00000002.2599824731.000000001000C000.00000002.00000001.01000000.00000014.sdmp	false
https://www.google.com/accounts/ServiceLogin?hl=th&	setuppicasa39-setup.exe, 00000010.00000002.1664870898.00000000032A7000.00000004.00000020.00020000.00000000.sdmp, Picasa3.exe, 00000014.00000002.2599824731.000000001140C000.00000002.00000001.01000000.00000014.sdmp, PicasaPhotoViewer.exe, 00000015.00000000.1697683801.0000000000864000.00000002.00000001.01000000.00000019.sdmp	false
http://picasa.google.com/intl/pt_PT/#utm_source=gph-et-pt_PT&utm_medium=et&utm_campaign=pt_P	setuppicasa39-setup.exe, 00000010.00000002.1664870898.000000000369C000.00000004.00000020.00020000.00000000.sdmp, GPhotos.scr, 00000011.00000000.1542961815.00000000006EF000.00000002.00000001.01000000.0000000F.sdmp, Picasa3.exe, 00000014.00000002.2599824731.0000000010A0C000.00000002.00000001.01000000.00000014.sdmp	false
http://www.google.com/support/forum/p/picasa?hl=pt_PT	Picasa3.exe, 00000014.00000002.2599824731.0000000010A0C000.00000002.00000001.01000000.00000014.sdmp	false
http://picasaweb.google.com/lh/nameTagOpt	Picasa3.exe, 00000012.00000000.1603749985.0000000000C6A000.00000002.00000001.01000000.00000012.sdmp	false
http://gdata.youtube.com/schemas/2007/categories.cat	Picasa3.exe, 00000012.00000000.1603749985.0000000000C6A000.00000002.00000001.01000000.00000012.sdmp	false
http://picasa.google.com/intl/fi/#utm_source=gph-et-fi&utm_medium=et&utm_campaign=fi-screens	setuppicasa39-setup.exe, 00000010.00000002.1664870898.000000000369C000.00000004.00000020.00020000.00000000.sdmp, GPhotos.scr, 00000011.00000000.1542961815.00000000006EF000.00000002.00000001.01000000.0000000F.sdmp, Picasa3.exe, 00000014.00000002.2599824731.0000000010A0C000.00000002.00000001.01000000.00000014.sdmp	false
http://www.google.com/You	Picasa3.exe, 00000012.00000000.1603749985.0000000000C6A000.00000002.00000001.01000000.00000012.sdmp	false
http://picasa.google.nl/support/bin/answer.py?answer=53209	Picasa3.exe, 00000014.00000002.2599824731.0000000010A0C000.00000002.00000001.01000000.00000014.sdmp	false
https://www.google.rs/accounts/ServiceLogin?hl=sr&continue=http%3A%2F%2Fpicasaweb.google.rs%2Fho	setuppicasa39-setup.exe, 00000010.00000002.1664870898.00000000032A7000.00000004.00000020.00020000.00000000.sdmp, Picasa3.exe, 00000014.00000002.2599824731.0000000010A0C000.00000002.00000001.01000000.00000014.sdmp, PicasaPhotoViewer.exe, 00000015.00000000.1697683801.0000000000864000.00000002.00000001.01000000.00000019.sdmp	false
http://picasa-readme.blogspot.com/update2	Picasa3.exe, 00000014.00000002.2482072226.0000000002E92000.00000004.00000020.00020000.00000000.sdmp	false
http://picasa.google.com.tr/support/bin/answer.py?answer=11139	Picasa3.exe, 00000014.00000002.2599824731.000000001140C000.00000002.00000001.01000000.00000014.sdmp	false
http://picasa.google.com/intl/ar/#utm_source=gph-et-ar&utm_medium=et&utm_campaign=ar-screens	setuppicasa39-setup.exe, 00000010.00000002.1664870898.000000000369C000.00000004.00000020.00020000.00000000.sdmp, GPhotos.scr, 00000011.00000000.1542961815.00000000006EF000.00000002.00000001.01000000.0000000F.sdmp, Picasa3.exe, 00000014.00000002.2599824731.000000001000C000.00000002.00000001.01000000.00000014.sdmp	false
http://picasa.google.com/support/bin/answer.py?hl=zh-TW&answer=93773	Picasa3.exe, 00000014.00000002.2599824731.000000001140C000.00000002.00000001.01000000.00000014.sdmp	false
http://picasa.google.com/intl/de/#utm_source=gph-et-de&utm_medium=et&utm_campaign=de-screens	setuppicasa39-setup.exe, 00000010.00000002.1664870898.000000000369C000.00000004.00000020.00020000.00000000.sdmp, GPhotos.scr, 00000011.00000000.1542961815.00000000006EF000.00000002.00000001.01000000.0000000F.sdmp, Picasa3.exe, 00000014.00000002.2599824731.000000001000C000.00000002.00000001.01000000.00000014.sdmp	false
http://cs-g2-crl.thawte.com/ThawteCSG2.crl0	setuppicasa39-setup.exe, 00000010.00000002.1664870898.00000000029F6000.00000004.00000020.00020000.00000000.sdmp	false
http://picasa.google.com/	Picasa3.exe, 00000014.00000002.2482072226.0000000002EAA000.00000004.00000020.00020000.00000000.sdmp, Picasa3.exe, 00000014.00000002.2589400232.0000000007039000.00000004.00000020.00020000.00000000.sdmp, Picasa3.exe, 00000014.00000003.1626203204.0000000003FB3000.00000004.00000020.00020000.00000000.sdmp, Picasa3.exe, 00000014.00000002.2599824731.000000001000C000.00000002.00000001.01000000.00000014.sdmp, Picasa3.exe, 00000014.00000002.2586100840.0000000006F6F000.00000004.00000020.00020000.00000000.sdmp, Picasa3.exe, 00000014.00000002.2482072226.0000000002E7B000.00000004.00000020.00020000.00000000.sdmp, Picasa3.exe, 00000014.00000002.2593399186.000000000716B000.00000004.00000020.00020000.00000000.sdmp	false
http://picasaweb.google.com/lh/favorites	setuppicasa39-setup.exe, 00000010.00000002.1664870898.00000000035FF000.00000004.00000020.00020000.00000000.sdmp, GPhotos.scr, 00000011.00000000.1542724484.000000000062E000.00000002.00000001.01000000.0000000F.sdmp	false
http://picasa.google.com/support/bin/answer.py?answer=93773&ctx=readme	Picasa3.exe, 00000014.00000002.2506191744.0000000004241000.00000004.00000020.00020000.00000000.sdmp, Picasa3.exe, 00000014.00000002.2586100840.0000000006F6F000.00000004.00000020.00020000.00000000.sdmp	false
http://localhost:%d/%s/thumb/%s.jpg	Picasa3.exe, 00000012.00000000.1603749985.0000000000C6A000.00000002.00000001.01000000.00000012.sdmp	false
http://www.aiim.org/pdfa/ns/type#ty#	GPhotos.scr, 00000011.00000002.1554998935.0000000002750000.00000004.00000020.00020000.00000000.sdmp	false
http://schemas.google.com/g/2005#thumbnail	Picasa3.exe, 00000014.00000002.2593399186.0000000007223000.00000004.00000020.00020000.00000000.sdmp	false
http://support.google.com/picasa/bin/answer.py?hl=en&amp;answer=39500&amp;topic=1751920&quot	Picasa3.exe, 00000014.00000002.2593399186.0000000007223000.00000004.00000020.00020000.00000000.sdmp	false
https://plus.google.com/photos/%s/albums/%sNot	Picasa3.exe, 00000012.00000000.1603749985.0000000000C6A000.00000002.00000001.01000000.00000012.sdmp	false
https://www.google.com/accounts/ServiceLogin?hl=de_DE&continue=http%3A%2F%2Fpicasaweb.google.com	setuppicasa39-setup.exe, 00000010.00000002.1664870898.00000000032A7000.00000004.00000020.00020000.00000000.sdmp, Picasa3.exe, 00000014.00000002.2599824731.000000001000C000.00000002.00000001.01000000.00000014.sdmp, PicasaPhotoViewer.exe, 00000015.00000000.1697683801.0000000000864000.00000002.00000001.01000000.00000019.sdmp	false
https://www.google.com/accounts/ServiceLogin?hl=fr_FR&continue=http%3A%2F%2Fpicasaweb.google.com	setuppicasa39-setup.exe, 00000010.00000002.1664870898.00000000032A7000.00000004.00000020.00020000.00000000.sdmp, Picasa3.exe, 00000014.00000002.2599824731.0000000010A0C000.00000002.00000001.01000000.00000014.sdmp, PicasaPhotoViewer.exe, 00000015.00000000.1697683801.0000000000864000.00000002.00000001.01000000.00000019.sdmp	false
http://picasa.google.nl/support/bin/topic.py?topic=14609	Picasa3.exe, 00000014.00000002.2599824731.0000000010A0C000.00000002.00000001.01000000.00000014.sdmp	false
http://picasa.google.com/support?ctx=picasaHELPID_DEFAULTi18n	Picasa3.exe, 00000012.00000000.1603749985.0000000000C6A000.00000002.00000001.01000000.00000012.sdmp	false
https://www.google.com/accounts/ServiceLogin?hl=en_GB&continue=http%3A%2F%2Fpicasaweb.google.com	setuppicasa39-setup.exe, 00000010.00000002.1664870898.00000000032A7000.00000004.00000020.00020000.00000000.sdmp, Picasa3.exe, 00000014.00000002.2599824731.000000001000C000.00000002.00000001.01000000.00000014.sdmp, PicasaPhotoViewer.exe, 00000015.00000000.1697683801.0000000000864000.00000002.00000001.01000000.00000019.sdmp	false
http://picasa.google.com/support/bin/answer.py?hl=en&answer=93773CThumbUI::showfeatureslinkSaverUpgr	Picasa3.exe, 00000012.00000000.1603749985.0000000000C6A000.00000002.00000001.01000000.00000012.sdmp	false
http://picasa.google.com/support/bin/answer.py?hl=id&answer=93773	Picasa3.exe, 00000014.00000002.2599824731.0000000010A0C000.00000002.00000001.01000000.00000014.sdmp	false

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
142.250.185.228	www2.l.google.com	United States	15169	GOOGLEUS	false
13.107.246.40	unknown	United States	8068	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
104.118.10.106	unknown	United States	16625	AKAMAI-ASUS	false
104.18.187.31	unknown	United States	13335	CLOUDFLARENETUS	false
52.240.245.67	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
157.240.241.35	unknown	United States	32934	FACEBOOKUS	false
20.114.189.70	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
162.159.61.3	unknown	United States	13335	CLOUDFLARENETUS	false
23.200.0.9	unknown	United States	20940	AKAMAI-ASN1EU	false
157.240.241.1	unknown	United States	32934	FACEBOOKUS	false
20.110.205.119	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
13.107.21.237	unknown	United States	8068	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
77.75.78.30	h.seznam.cz	Czech Republic	43037	SEZNAM-CZ	false
13.107.42.14	unknown	United States	8068	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
172.217.23.100	unknown	United States	15169	GOOGLEUS	false
23.57.90.111	unknown	United States	35994	AKAMAI-ASUS	false
152.195.19.97	unknown	United States	15133	EDGECASTUS	false
72.21.81.200	unknown	United States	15133	EDGECASTUS	false
216.58.206.36	www.google.com	United States	15169	GOOGLEUS	false
172.217.23.110	support.google.com	United States	15169	GOOGLEUS	false
172.217.23.97	googlehosted.l.googleusercontent.com	United States	15169	GOOGLEUS	false
142.250.185.161	blogspot.l.googleusercontent.com	United States	15169	GOOGLEUS	false
150.171.28.10	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
77.75.76.70	download.seznam.cz	Czech Republic	43037	SEZNAM-CZ	false
172.64.41.3	chrome.cloudflare-dns.com	United States	13335	CLOUDFLARENETUS	false
104.118.10.2	unknown	United States	16625	AKAMAI-ASUS	false
68.67.160.114	unknown	United States	29990	ASN-APPNEXUS	false
151.101.1.108	unknown	United States	54113	FASTLYUS	false
20.42.73.30	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
104.118.9.224	unknown	United States	16625	AKAMAI-ASUS	false
104.70.121.218	unknown	United States	20940	AKAMAI-ASN1EU	false
104.118.8.10	unknown	United States	16625	AKAMAI-ASUS	false
142.250.185.174	plus.l.google.com	United States	15169	GOOGLEUS	false
20.190.152.20	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
20.190.152.22	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
142.250.186.65	unknown	United States	15169	GOOGLEUS	false

Private

IP
192.168.2.16

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1524026
Start date and time:	2024-10-02 12:14:51 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 15m 55s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultwindowsinteractivecookbook.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	206
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	1
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	563299efce875400a8d9b44b96597c8e-sample (1).zip
Detection:	MAL
Classification:	mal72.rans.evad.winZIP@317/1031@40/38
EGA Information:	Successful, ratio: 77.8%
HCA Information:	Successful, ratio: 95% Number of executed functions: 32 Number of non-executed functions: 399
Cookbook Comments:	Found application associated with file extension: .zip

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, audiodg.exe, consent.exe, RuntimeBroker.exe, ShellExperienceHost.exe, SIHClient.exe, SgrmBroker.exe, backgroundTaskHost.exe, conhost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 217.20.57.34, 13.85.23.86, 13.95.31.18, 20.12.23.50, 20.3.187.198, 142.250.184.238, 184.28.89.167, 13.107.42.16, 204.79.197.239, 13.107.21.239, 142.250.181.238, 172.217.16.206, 216.58.206.40, 142.250.186.131, 216.58.206.67, 142.250.185.227, 2.23.209.185, 2.23.209.182, 2.23.209.186, 2.23.209.176, 2.23.209.183, 2.23.209.181, 2.23.209.188, 2.23.209.178, 2.23.209.179, 172.217.23.106, 142.250.185.74, 142.250.185.202, 172.217.18.10, 216.58.206.42, 142.250.186.170, 142.250.184.202, 142.250.186.106, 142.250.185.234, 142.250.181.234, 142.250.74.202, 142.250.186.42, 142.250.185.138, 142.250.185.170, 142.250.185.106, 142.250.184.234, 204.79.197.200, 13.107.6.158, 2.18.97.227, 142.250.185.238, 74.125.133.84, 34.104.35.123, 142.250.186.67, 172.217.18.14, 108.177.15.84, 216.58.212.170, 216.58.212.138, 172.217.16.138, 142.250.186.74, 172.217.16.202, 216.58.206.74, 142.250.186.138, 172.217.18.106, 142.250.184.195, 199.232.210.172, 142.250.186.78, 142.251.40.227, 142.250.80.3, 142.250
Excluded domains from analysis (whitelisted): cdp-f-ssl-tlu-net.trafficmanager.net, ssl.gstatic.com, slscr.update.microsoft.com, clientservices.googleapis.com, star.sf.tlu.dl.delivery.mp.microsoft.com.delivery.microsoft.com, e11290.dspg.akamaiedge.net, clients2.google.com, e86303.dscx.akamaiedge.net, login.live.com, config-edge-skype.l-0007.l-msedge.net, update.googleapis.com, www.gstatic.com, l-0007.l-msedge.net, ieonline.microsoft.com, www.google-analytics.com, www.bing.com, fs.microsoft.com, ogads-pa.googleapis.com, www.googleapis.com, www-www.bing.com.trafficmanager.net, business-bing-com.b-0005.b-msedge.net, wildcardtlu-ssl.azureedge.net, edgedl.me.gvt1.com, clients.l.google.com, config.edge.skype.com.trafficmanager.net, go.microsoft.com, www.bing.com.edgekey.net, www.googletagmanager.com, msedge.b.tlu.dl.delivery.mp.microsoft.com, glb.cws.prod.dcat.dsp.trafficmanager.net, sls.update.microsoft.com, config.edge.skype.com, glb.sls.prod.dcat.dsp.trafficmanager.net, optimizationguide-pa.googleapis.com, edge-
Execution Graph export aborted for target GPhotos.scr, PID 5508 because there are no executed function
Execution Graph export aborted for target UNZIP.EXE, PID 7180 because there are no executed function
HTTPS sessions have been limited to 150. Please view the PCAPs for the complete data.
Not all processes where analyzed, report is missing behavior information
Report creation exceeded maximum time and may have missing behavior and disassembly information.
Report creation exceeded maximum time and may have missing disassembly code information.
Report size exceeded maximum capacity and may have missing behavior information.
Report size exceeded maximum capacity and may have missing disassembly code.
Report size exceeded maximum capacity and may have missing network information.
Report size getting too big, too many NtAllocateVirtualMemory calls found.
Report size getting too big, too many NtCreateFile calls found.
Report size getting too big, too many NtCreateKey calls found.
Report size getting too big, too many NtEnumerateKey calls found.
Report size getting too big, too many NtEnumerateValueKey calls found.
Report size getting too big, too many NtOpenFile calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryAttributesFile calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtSetInformationFile calls found.
Report size getting too big, too many NtSetValueKey calls found.
Report size getting too big, too many NtWriteVirtualMemory calls found.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
06:16:33	API Interceptor	526x Sleep call for process: szninstall.exe modified
06:16:54	API Interceptor	744x Sleep call for process: listicka.exe modified
06:17:05	API Interceptor	389x Sleep call for process: szndesktop.exe modified
06:17:14	API Interceptor	547x Sleep call for process: Picasa3.exe modified
06:17:18	API Interceptor	1x Sleep call for process: sznpp_64.exe modified

Process:	C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	715080
Entropy (8bit):	6.562836179683468
Encrypted:	false
SSDEEP:	6144:v7VRQ6qrhkVdsv1Qf4F5uIJ3ZtJr+lKWK7sAx9lyPiAf4Xw5tyFtV25qNMDp7sfG:1sOQdZtJ6lfBPiCnXyFt1NpElDL
MD5:	3436235E704354AA6374BF689E7078AA
SHA1:	D822EE85D9C9EBB7EA041F6C5C9D7280857C2610
SHA-256:	86EC3A8B305BFD4A63DC1CA9BD8319EC508A63966954E6FDCC4152E9D399B829
SHA-512:	7058511CF68F7D6964D1C6F26E9A7A6493ECC9D639A91C31993301E727E19AEE02EB8FB3272C23C481471FB56042739C3BF7B5ED18002AE2074217E20D2A21DF
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........._.............o......o......o..[.........>.......'...............>..........>....o..y....o.......o......Rich....................PE..L......V.................@..........[........P....@.......................... ..........................................................................H............V..............................p...@............P...............................text...;.......@.................. ..`.rdata......P.......P..............@..@.data...............................@....rsrc...............................@..@........................................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Google\Picasa3\Picasa3.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	10160456
Entropy (8bit):	6.601479599252052
Encrypted:	false
SSDEEP:	98304:HaqI8i+KtvpruYTi8cg7V0E+wAXbKkCmryKBOCdERqRLts1moR/TZDSYOPMeaC9R:HQ8i+CvRHAgBVkvmKBtdO0sELn
MD5:	6AD50A491F52B1CBECE23B603037FBDF
SHA1:	4ACFB5F57A464610483A7D652CC5F4D1C5F427CC
SHA-256:	B4684FB49917BD97741802848A8B7EAC189A178DF56B7FCF5D0B078D892502A4
SHA-512:	CCAA8A1300ADA8C777D32AB51B6C1687B120CFA638FF0C20F1BED78D63FA1020AFC69717E8DEE7414CC139A7CB5F6871C96568BF85190EE74289F1D1F363FEA0
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........jd..jd..jd..M...$d..M...d......nd..M.../d..jd..!d..k..kd..G..hd..M...Ed..jd..f..M....g..M...kd..M...kd..M...kd..Richjd..........................PE..L...d..V.....................p........~...........@..........................p......!B..............................`>............... ..0G.............H............................................g..@............................................text.............................. ..`.rdata..N?.......@..................@..@.data........@...`...@..............@....rsrc...0G... ...P..................@..@........................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Google\Picasa3\Picasa3i18n.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	26904904
Entropy (8bit):	5.751316639194912
Encrypted:	false
SSDEEP:	786432:C6MeKCjUAb1Olphfd7hbvTTyQ6MneaivIsXHPTqO2D8CYjzyGJDYBCZW0C+8k7sz:y
MD5:	A7B28EFE1C5D15F3A3F99756AADCEA0E
SHA1:	D60C036E436D570EF62A71157A37173DEB036B26
SHA-256:	05B40C68BA874537A76A3C03CE094884E288A2C7055FB99329BAD3BC2104CF04
SHA-512:	7BD42AC92B2F5C67C9C24F5ADCC136D342F92C48DDC07DFF31F44827C57BDF621DEABF890FEE0DD19DADD7EEEE7C9E16CFAD630DA538A24B1EF7849498F57972
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........h...............{.......h.......k....9.[..............w.......\|.......z.......~.....Rich....................PE..L......V...........!.....p........................................................................................ ...N.......(........h...........p..H....0......0...............................@...@............................................text....d.......p.................. ..`.rdata..n........ ..................@..@.data...\|...........................@....rsrc....h.......p..................@..@.reloc...H...0...P... ..............@..B........................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Google\Picasa3\PicasaPhotoViewer.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	4806984
Entropy (8bit):	6.7214276234114925
Encrypted:	false
SSDEEP:	98304:u0dPlpKnp1hil+Pd/GNUvx7sHw6dSXXahK9aZQ+3QuNR6RbXx7vI9PR:umpWp1hVvetdSXXahKMZQ+3QuNR6h9K5
MD5:	69B20702DEBC005CD1DA0906B4A3C4F5
SHA1:	3194EC345ED795B0E86D46EE88BFB8781C681C82
SHA-256:	4BD5F244C5EE6ADAB8D3F20654EB4D3B418CD214A8ABDF8FD4392310927C1413
SHA-512:	0696B0EBF05CA8D3A6E2BD1FEFEACA8D507D54D2398A05BF13FDA2CF516206258D0D4973625A21088EB27FC332B4EC3F44E363FD63B4CB3ECF1EA4B093C039B7
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 1%, Browse
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........S..2D..2D..2D..2D..2D...9..2D...).`2D....2D..=...2D.A.:..2D..=...2D..2E.0D...6.0D...>..2D...8..2D...<..2D.Rich.2D.........................PE..L......V...................... .....l.+...........@...........................N.......I...............................6......`6.T....`=..:...........@I.H............................................Q5.@............................................text............................... ..`.rdata..............................@..@.data.........6..p....6.............@....rsrc....:...`=..@....8.............@..@................................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Google\Picasa3\buttons\core-lh2.pbz

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe
File Type:	Zip archive data, at least v2.0 to extract, compression method=deflate
Category:	dropped
Size (bytes):	3503
Entropy (8bit):	7.278701477888558
Encrypted:	false
SSDEEP:	96:ThMEv63A4EGkvyQrJwUlLy7HjBecx3nln:T54xzQyj7DH3nln
MD5:	A306FD2CB1F4A18102F02D404C37C17A
SHA1:	CE21B7960D44BBC75665F8F87A84E99A6D990E03
SHA-256:	7D10126097B52ABC9EB146A9F6853F7A471315A27C639E12786289A8A97B7F3D
SHA-512:	D84982C36E6ABD4EA3E067DCF7C608F3F38981E4F9CDAE660F417C514CCEAB64C20B3947BBA64E6A2D4F81FFBEEE8EE2F0F130AA5427CF1A0230B3086BF19C66
Malicious:	false
Reputation:	unknown
Preview:	PK........4rS7T.8............{0B3F3356-4FA1-48ca-B972-2B7D20AC6FBF}.pbfM....0.E...0.....I.-1...E2)....;.s...W.R]....`.J..'.F.rGX.....(..6. ....a'.......F^.=.6ym.h.h.c%IN....Ke..$n.....}<....U..PK........r.m5...`...........{1FC0FA62-3412-4466-B485-B7CB97D3714B}.pbfM.K..0.D.H....b..g...".............+x.h-.E..aD.h...Sa..rG...$..9..KZ.....8.p..T9W.foAP/.x...ag...@..m.........G,..PK........`q'8.F.q...........{3C09A978-42C4-4437-85CA-D326872B424D}.pbfM.A..0.E.&.a2{).4i..k......:U..UHt......kbx.\|...U.@....w.Y......n.H....LN......`g...c.9.....F.... .L..8..f..]Klo.....~..u4Q.{.j.~......{{L..PK........r.m5{.............{45EF212C-84AB-46c5-A42E-95023ED50C76}.pbfM.... .D.&..f.Z.y..-....XR.../.&z.I..._)...8k../...........h..55...f^.........^#7)M.]{..4...z.Y.i.b%...^..Q.,..P.~W.m.sb...PK........r.m5.+..........*...{4D139EF7-47A3-4da4-9A00-AF35AAEC17D1}.pbfM....0.E...0....E.~KL...fR...MAww...WN..a.....^....M..O.....a..\|T...,i......6..`...S.\....{..{&...;.feo

C:\Program Files (x86)\Google\Picasa3\buttons\geotag.pbz

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe
File Type:	Zip archive data, at least v2.0 to extract, compression method=deflate
Category:	dropped
Size (bytes):	8907
Entropy (8bit):	7.963544731364328
Encrypted:	false
SSDEEP:	192:4ZOs+YH5SdRsTJK37e0NtchwemEskJuKfp95nvPvpSh:4Z3+1dRgK37+JsIlbtvPvIh
MD5:	5034B7B3289FA1E53FA83D6CFDDE2EC9
SHA1:	4DE41B594D977406EDCCC119FE5591B947FA8DC2
SHA-256:	A345B36CB926592E5C69EB8152151C08E186EAB5DAF20AA45726636F68CF3905
SHA-512:	5CB7D1BDAAF230D7B267192A75ACD6DB0BDEA3CD18A5ACF7C23F0724EBCD1838B79BF7A3846BC240A9BCD0B65C12909E9AFE3FE1C157A3A52272D6235D5C07E8
Malicious:	false
Reputation:	unknown
Preview:	PK.........vS7...............{9A42861F-B5F4-4577-9228-EA2A782BD906}.pbfM.Ko.0.....V{'......(.k..W...K.E.TM....A....f...j........E.@..m.........}I.A......Z...a......%C3.....b.F.!.../.F..L..[....H...0U.y6X.s=..m...ut....2X.6.`..Ip,.b....6\...>F...L.m...'.Nl......F..z.K.Fpf...q...qI.z.s..%..L...U.8k..e....y.CV.>U.....g...PK........3[88....o ../~.....{9A42861F-B5F4-4577-9228-EA2A782BD906}.psd.<.t[.O..%..=.".`.d..-_..b[.l..e.M..\|.J$}U.Nl..&..B...0ii.t...@ighOg...v.!.4@Y2YX.....i.l.I...!...W......}.......Z...@.W.\4.C..k.....b1!r......&.Rk.mK~...'...\|.G.o&..Xd\|.jY_.....R7...V..........U.....5..f.nnvzn..1xe.L.U}.@(...i_......e./.f.0.l.LJT...Z,....H.\..j).G..I5.J..1.J..sA..uK)..V..)M.).Q...Af.\..v...k.'P........7WnVWr.n%e0..ZI...PD....O....$.X.'...>p.i....e..i....}.QO.H%Yi...(.DIU..I..<......AnY...R..Wo......_..F $.V..3^.vb.\3fb....].o.k.u.....u..Fe....j..c.&..V.GK.t4r<.!X/W.5j.....*.i....`..a...l.X.".".&XM..`-.d.A'.P..b.!8.a..cl..&:.-`...l.X..S...`

C:\Program Files (x86)\Google\Picasa3\cdautorun\Download Picasa.url

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe
File Type:	MS Windows 95 Internet shortcut text (URL=<http://www.google.com/picasa>), ASCII text
Category:	dropped
Size (bytes):	52
Entropy (8bit):	4.574875775583768
Encrypted:	false
SSDEEP:	3:HRAbABGQF6F0S4IzMG/Gn:HRYF7Fr4IgXn
MD5:	CB16622BB664586DDA57F073FEF23116
SHA1:	B2F464DB05F7163AAA5503C14EF488A4A7613875
SHA-256:	806974D5A03A6C57DBE4694219F4B0C0540574D2A4CEF3EB5EF11D1A78AA6782
SHA-512:	6270A2D76D0038FBDE1A5AA746EFA1B049039099A9DF4F19B35D76E1C2EF9250CC7C300604816502C447F1532C550B9CF63FDB8F0BB7A78E1DC8ADE37D6E237D
Malicious:	false
Reputation:	unknown
Preview:	[InternetShortcut].URL=http://www.google.com/picasa.

C:\Program Files (x86)\Google\Picasa3\cdautorun\Picasa CD Slideshow.app\Contents\Frameworks\GoogleBreakpad.framework\GoogleBreakpad

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	33
Entropy (8bit):	4.173033892020167
Encrypted:	false
SSDEEP:	3:RleRTCOnXh61vn:STCOnX6n
MD5:	5E8BFD7B4BE898A079400EB222235B0C
SHA1:	C64DC4A06CBC40C59FF6E725EF1716402DA799A9
SHA-256:	BCEDCF539F7BE07352FEAC52B47205B6D0ADE8C80ADF002861863CADCEC75C26
SHA-512:	381E2947D3240F0C6C597DF8EAD268CC08C25A6644984D489DD1B44A523CA10048673594E462EEC58CB6F18DF61E72F1877C8488F6239A677EACF4BCA276CF17
Malicious:	false
Reputation:	unknown
Preview:	Versions/Current/GoogleBreakpad..

C:\Program Files (x86)\Google\Picasa3\cdautorun\Picasa CD Slideshow.app\Contents\Frameworks\GoogleBreakpad.framework\Resources

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	28
Entropy (8bit):	3.6644977792004614
Encrypted:	false
SSDEEP:	3:RleRhWKCnn:SA7
MD5:	6A917155B381121118E116E3A723C1CF
SHA1:	A0664DDAC90014F23792A2670358EC61066D0A6E
SHA-256:	7D28787340ECAB581791AEA2E3484A4903ECE6F3F777E4363E3A95D6882D9E26
SHA-512:	45B8F904D3DCA60249F2822F989A9F66DED4EF93FCFAFFCECD6D6CECCFBEEAA93C5F2599040458E7076EC4D9D6246440B528DAE5B190C500A8D96E7BC2892049
Malicious:	false
Reputation:	unknown
Preview:	Versions/Current/Resources..

C:\Program Files (x86)\Google\Picasa3\cdautorun\Picasa CD Slideshow.app\Contents\Frameworks\GoogleBreakpad.framework\Versions\A\GoogleBreakpad

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe
File Type:	Mach-O universal binary with 2 architectures: [i386:Mach-O i386 dynamically linked shared library, flags:<NOUNDEFS\|DYLDLINK\|TWOLEVEL\|WEAK_DEFINES\|BINDS_TO_WEAK\|NO_REEXPORTED_DYLIBS>] [ppc:Mach-O ppc dynamically linked shared library, flags:<NOUNDEFS\|DYLDLINK\|TWOLEVEL\|WEAK_DEFINES\|BINDS_TO_WEAK\|NO_REEXPORTED_DYLIBS>]
Category:	dropped
Size (bytes):	212748
Entropy (8bit):	5.685361196810867
Encrypted:	false
SSDEEP:	3072:RsZsV0i1mxv6vsChZuzRP0/wbqCxZmmgb4n2wgGhqri7:uJxv6vsChZuz17bNOcn2hi7
MD5:	BCE705A493BDEED0E41899EDEBDA9461
SHA1:	2A460D1CFB2968D4AF76B61C253DD6EE761BAB6D
SHA-256:	46086C563E59AD200C248F5017D0023FF1C7A430C467CB43C1F0AA6CC72D6F47
SHA-512:	31F99ACA72439BEEA17EBEEED7EA843FCBA5F7AD54856B9E6B69459E5D4D633559E984502C22DDCBDF500E4167F3109D3646B18EFDD76D38924669F3701F3FB1
Malicious:	false
Reputation:	unknown
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Google\Picasa3\cdautorun\Picasa CD Slideshow.app\Contents\Frameworks\GoogleBreakpad.framework\Versions\A\Resources\Info.plist

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 text
Category:	dropped
Size (bytes):	994
Entropy (8bit):	5.258898328747738
Encrypted:	false
SSDEEP:	24:2dfyiwl6Nxxx6Ax6Y5gRGMa6rx642ReS0YIhi:cfyyx+VY5AGcsjMS0Nhi
MD5:	BDBC6E7FF6EFAEC8FB9A3CBF1EB1F691
SHA1:	BDC2B5476B5CFE4AE849D3A0FB3E7D213BCACA4C
SHA-256:	530873E051816CCDA4EDF00D61F766051CCB2BA5138037EC42F3412DBD46E7C7
SHA-512:	975B9D32F2F85AF7940655300631048D300BE0857FE347606B9738F01DFB5B2649E208E1606CE802949D1F79AE866B0C08696F5D148C4AB0AC20CD506E609C26
Malicious:	false
Reputation:	unknown
Preview:	<?xml version="1.0" encoding="UTF-8"?>.<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">.<plist version="1.0">.<dict>..<key>CFBundleDevelopmentRegion</key>..<string>English</string>..<key>CFBundleDisplayName</key>..<string>GoogleBreakpad</string>..<key>CFBundleExecutable</key>..<string>GoogleBreakpad</string>..<key>CFBundleGetInfoString</key>..<string>Google Breakpad 1.1.0.1138, . 2005-2009 Google Inc.</string>..<key>CFBundleIdentifier</key>..<string>com.Google.BreakpadFramework</string>..<key>CFBundleInfoDictionaryVersion</key>..<string>6.0</string>..<key>CFBundleName</key>..<string>GoogleBreakpad</string>..<key>CFBundlePackageType</key>..<string>FMWK</string>..<key>CFBundleShortVersionString</key>..<string>1.1.0</string>..<key>CFBundleSignature</key>..<string>????</string>..<key>CFBundleVersion</key>..<string>1.1.0.1138</string>..<key>NSHumanReadableCopyright</key>..<string>. 2005-2009 Google Inc.</string>.</dict>.</plist>.

C:\Program Files (x86)\Google\Picasa3\cdautorun\Picasa CD Slideshow.app\Contents\Frameworks\GoogleBreakpad.framework\Versions\A\Resources\Inspector

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe
File Type:	Mach-O universal binary with 2 architectures: [i386:\012- Mach-O i386 executable, flags:<NOUNDEFS\|DYLDLINK\|TWOLEVEL\|BINDS_TO_WEAK>] [ppc:\012- Mach-O ppc executable, flags:<NOUNDEFS\|DYLDLINK\|TWOLEVEL\|BINDS_TO_WEAK>]
Category:	dropped
Size (bytes):	123720
Entropy (8bit):	4.9365892176779465
Encrypted:	false
SSDEEP:	1536:z5BbaTOV0iKSd2JNGfYWB7P6mzh5CWzpf/cjOVYXzLDSPD0vvpN:z5BbyOV0iKSMNU9CycIYXnD4DmBN
MD5:	CE34CF0E6DBA7E4E003E20BD076E4F21
SHA1:	60DF0D3F38D36C83C13EC1D89EC142373A96538E
SHA-256:	B046837030FE7CF858B856F2AD53C1FD8C5E65B362FFD43954A498434153E989
SHA-512:	A669C9B5AB788371B35BD08C5A9EA344181FFF4AEA501D7C248C5668182F579AD523C0035A72A04D8FCBB14B0CDBD0C09E4F85F18FD9E27E36EA783A675D4060
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Reputation:	unknown
Preview:	.......................$...................H............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Google\Picasa3\cdautorun\Picasa CD Slideshow.app\Contents\Frameworks\GoogleBreakpad.framework\Versions\A\Resources\Reporter.app\Contents\Info.plist

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 text
Category:	dropped
Size (bytes):	1262
Entropy (8bit):	5.2120676261719225
Encrypted:	false
SSDEEP:	24:2dfyiwl6NxcHY5hOMa6m4oReS0YIhdorGuqFqI:cfyyxcHY5hOcm1MS0NhiSTFqI
MD5:	F53DCB8CB1A85F20015D6761BC685648
SHA1:	E30CB41435D6819765ABA81FF2E437C057414C2C
SHA-256:	586BEB3C678337E9E6E68579237CE70DD64052E58B4225774EBA2B66991C86B9
SHA-512:	245DC2195FE312193FE8C12908F6C09AA2C2AB2A26C729E7EF956C3788E8B8287F309CCB57779B318DCAE82C6DB64503167DD2877EAA116D7ACA0F8A49AFB549
Malicious:	false
Reputation:	unknown
Preview:	<?xml version="1.0" encoding="UTF-8"?>.<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">.<plist version="1.0">.<dict>..<key>CFBundleDevelopmentRegion</key>..<string>English</string>..<key>CFBundleDisplayName</key>..<string>Reporter</string>..<key>CFBundleExecutable</key>..<string>Reporter</string>..<key>CFBundleGetInfoString</key>..<string>Google Breakpad 1.1.0.1138, . 2005-2009 Google Inc.</string>..<key>CFBundleIconFile</key>..<string>ReporterIcon</string>..<key>CFBundleIdentifier</key>..<string>com.google.Reporter</string>..<key>CFBundleInfoDictionaryVersion</key>..<string>6.0</string>..<key>CFBundleName</key>..<string>Reporter</string>..<key>CFBundlePackageType</key>..<string>APPL</string>..<key>CFBundleShortVersionString</key>..<string>1.1.0</string>..<key>CFBundleSignature</key>..<string>????</string>..<key>CFBundleVersion</key>..<string>1.1.0.1138</string>..<key>LSUIElement</key>..<true/>..<key>NSHumanReadableCopyright</key>.

C:\Program Files (x86)\Google\Picasa3\cdautorun\Picasa CD Slideshow.app\Contents\Frameworks\GoogleBreakpad.framework\Versions\A\Resources\Reporter.app\Contents\MacOS\Reporter

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe
File Type:	Mach-O universal binary with 2 architectures: [i386:\012- Mach-O i386 executable, flags:<NOUNDEFS\|DYLDLINK\|TWOLEVEL>] [ppc:\012- Mach-O ppc executable, flags:<NOUNDEFS\|DYLDLINK\|TWOLEVEL>]
Category:	dropped
Size (bytes):	91380
Entropy (8bit):	4.567705123184215
Encrypted:	false
SSDEEP:	768:f3AM5SGsUB0M+DWn7d8qze8FNJrEWniUfIkhLQPbocdHB6jbZIb4N09:fBqW7qpG/nzhLQP1vJb4W9
MD5:	DF5A8247B6A561ECD330BCDC0644A674
SHA1:	EA83636BC0AF94F179DD9884650131529AA3E69F
SHA-256:	20CA80F33EC6ADB69AD3F2FA721DFAB4E848C3BAF6ADA434C040228BC2F46A6C
SHA-512:	0503E22366EC17FF522CCB83649873E8A162AEA720BAA3615784C162FBC617E81D3833B35C93685EED27A750BC60BF13B1778681D076D61DFB24413AD3B5C019
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Reputation:	unknown
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Google\Picasa3\cdautorun\Picasa CD Slideshow.app\Contents\Frameworks\GoogleBreakpad.framework\Versions\A\Resources\Reporter.app\Contents\PkgInfo

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	8
Entropy (8bit):	1.75
Encrypted:	false
SSDEEP:	3:k0Ra:f8
MD5:	23B7D7D024ABB0F558420E098800BF27
SHA1:	9F9EEA0CFE2D65F2C3D6B092E375B40782D08F31
SHA-256:	82502191C9484B04D685374F9879A0066069C49B8ACAE7A04B01D38D07E8ECA0
SHA-512:	F77D501528DD0CED155C80406CFBEE38D5D3649B64D2A9324F3D6CEE39491EB8F54CDEBAE49C6E21A20D2309D8FAE1B01C41631224811E73483DB25A2695738C
Malicious:	false
Reputation:	unknown
Preview:	APPL????

C:\Program Files (x86)\Google\Picasa3\cdautorun\Picasa CD Slideshow.app\Contents\Frameworks\GoogleBreakpad.framework\Versions\A\Resources\Reporter.app\Contents\Resources\English.lproj\Breakpad.nib

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe
File Type:	Apple binary property list
Category:	dropped
Size (bytes):	12664
Entropy (8bit):	6.721701305933168
Encrypted:	false
SSDEEP:	384:fAV87I27ddddddddddG5w5orhVPdpc4isN5mBdddddddddd4ddddddddddq/nLA0:oV806ddddddddddSjBxN56dddddddddP
MD5:	21ACEF5A8CC8A907050FC02AE1C79943
SHA1:	F71EDD449D7F386C82BCF8FF806E735F53CDD33E
SHA-256:	2F48F0E2D76FBBA92C2B4168398E301A1C42303384243C4E9515F16E38A5AF30
SHA-512:	5E29C2D081F86210C200F70A23E92FA527F47CCADA6669DDB9E9F8854F73E152B24710EFDDDEDE5AF8370A214D4967F3C12D739D9C62A7E435B8D00D762F176D
Malicious:	false
Reputation:	unknown
Preview:	bplist00.................X$versionT$topY$archiverX$objects..........]IB.objectdata.._..NSKeyedArchiver........1.5.6.<.=.A.E.Z.b.u.v.w...........................................................................#./.8.9.:.;.<.=.>.?.J.O.P.Q.T.W.Z.a.b.i.j.r.s.z.{....................................................................... .#.'.(....+.../.4.5.:.;.@.A.D.I.J.O.P.U.Z.[.`.e.f.k.u.v.w.x.{.............t...........................................(.G.H.I.J.K.L.M.N.O.P.Q.R.S.T.U.V.W.X.Y.Z.[.\.].^._.`.a.b.c.h.m....................................................................................................U$null.......................................... .!.".#.$.%.&.'.(.)..+.,.-.../.0VNSRootV$class]NSObjectsKeys_..NSClassesValues_..NSAccessibilityOidsValues]NSConnections[NSNamesKeys[NSFramework]NSClassesKeysZNSOidsKeys]NSNamesValues_..NSAccessibilityConnectors]NSFontManager_..NSVisibleWindows_..NSObjectsValues_..NSAccessibilityOidsKeysYNSNextOid\NSOidsValues..........................

C:\Program Files (x86)\Google\Picasa3\cdautorun\Picasa CD Slideshow.app\Contents\Frameworks\GoogleBreakpad.framework\Versions\A\Resources\Reporter.app\Contents\Resources\English.lproj\Louserzable.strings

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe
File Type:	Unicode text, UTF-16, little-endian text
Category:	dropped
Size (bytes):	1936
Entropy (8bit):	3.362092900968226
Encrypted:	false
SSDEEP:	48:cUAheJeteUWIJk3JeJe3D1JeUWIJTQWvM3I66l28GcwGDS5:cUdrUNJ0QK1QUNJs4u/0I
MD5:	CE2BD91D9C7CBD1BF13A1BA737F575A5
SHA1:	4CED7AE2221E28B519DDC34AF96CC5461783E2BB
SHA-256:	66D3DAE87F035F74F2F52231A2BE923125D4CF48741415415313171CCAF7BD19
SHA-512:	F626A6ABA33A27458F2D67358F1168C4493B07228EB9C4B36E38890E56BDBE4C765BAE89F388658D68F770D489B6DBFA73C1EB7AA6D90804066D35F98CC0DBEE
Malicious:	false
Reputation:	unknown
Preview:	../.. .S.t.r.i.n.g.s. .f.o.r. .U.s.e.r. .N.o.t.i.f.i.c.a.t.i.o.n. .o.f. .a. .c.r.a.s.h. ../...".c.r.a.s.h.D.i.a.l.o.g.H.e.a.d.e.r.". .=. .".T.h.e. .G.o.o.g.l.e. .p.r.o.g.r.a.m. .%.@. .h.a.s. .u.n.e.x.p.e.c.t.e.d.l.y. .q.u.i.t...".;...".c.r.a.s.h.D.i.a.l.o.g.M.s.g.". .=. .".T.h.e. .s.y.s.t.e.m. .a.n.d. .o.t.h.e.r. .a.p.p.l.i.c.a.t.i.o.n.s. .h.a.v.e. .n.o.t. .b.e.e.n. .a.f.f.e.c.t.e.d... .A. .r.e.p.o.r.t. .h.a.s. .b.e.e.n. .c.r.e.a.t.e.d. .t.h.a.t. .y.o.u. .c.a.n. .s.e.n.d. .t.o. .G.o.o.g.l.e. .t.o. .h.e.l.p. .i.d.e.n.t.i.f.y. .t.h.e. .p.r.o.b.l.e.m...".;.....".n.o.C.r.a.s.h.D.i.a.l.o.g.H.e.a.d.e.r.". .=. .".T.h.e. .G.o.o.g.l.e. .p.r.o.g.r.a.m. .%.@. .n.e.e.d.s. .t.o. .s.e.n.d. .i.n.f.o.r.m.a.t.i.o.n. .t.o. .G.o.o.g.l.e...".;...".n.o.C.r.a.s.h.D.i.a.l.o.g.M.s.g.". .=. .".T.h.e. .s.y.s.t.e.m. .a.n.d. .o.t.h.e.r. .a.p.p.l.i.c.a.t.i.o.n.s. .h.a.v.e. .n.o.t. .b.e.e.n. .a.f.f.e.c.t.e.d... .A. .r.e.p.o.r.t. .h.a.s. .b.e.e.n. .c.r.e.a.t.e.d. .t.h.a.t. .y.o.u. .c.a.n. .s.e.n.d. .t.o. .h.e.l.p.

C:\Program Files (x86)\Google\Picasa3\cdautorun\Picasa CD Slideshow.app\Contents\Frameworks\GoogleBreakpad.framework\Versions\A\Resources\Reporter.app\Contents\Resources\de.lproj\Louserzable.strings

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe
File Type:	Unicode text, UTF-8 text
Category:	dropped
Size (bytes):	462
Entropy (8bit):	4.662323393979104
Encrypted:	false
SSDEEP:	12:Ub1ipq78kpLEjr+JDmm8kpLU695YJqJNU:FpTkRHN+kRU6/YYNU
MD5:	C30CD9D64A4CB3C5A94C613912784D12
SHA1:	A8A343D4E6F6F39FBC454B10C52F0AE526926071
SHA-256:	B80A61609F31DB2ED34EA3CD8F032D4B743E6EEDA1B70F6D45DAD41573E6123B
SHA-512:	3436E1AF91253A3D6D86F5ABE5AADB9D3E73D8D8B54C9E5C6CCE0087842CEE7C393E2A6288036410E977B3EBA66C0C84EB920E16720577FD3AA5809AD0597DE7
Malicious:	false
Reputation:	unknown
Preview:	/* Strings for User Notification of a crash */."headerFmt" = "Das Google-Programm %@ wurde unerwartet geschlossen.";."msg" = "Das System und andere Anwendungen sind nicht betroffen. Es wurde ein Bericht erstellt, den Sie an Google senden k.nnen, um die Erkennung des Problems zu erleichtern.";."msgNoSend" = "Das System und andere Anwendungen sind nicht betroffen.";.."sendReportButton" = "Bericht senden";."cancelButton" = "Abbrechen";."noSendButton" = "OK";.

C:\Program Files (x86)\Google\Picasa3\cdautorun\Picasa CD Slideshow.app\Contents\Frameworks\GoogleBreakpad.framework\Versions\A\Resources\Reporter.app\Contents\Resources\en_GB.lproj\Louserzable.strings

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	425
Entropy (8bit):	4.6055553679336825
Encrypted:	false
SSDEEP:	6:Uk8pHsoiBzHGaKqRXAujVJMw362A+j91FrKkKt2NTRjTjVJMw362AE390Ctve/bV:Ub1ipPp1fvkD4z9SC6SNU
MD5:	D01FAF3470E3DFE8B6213ED4C555A5D4
SHA1:	1BDE0EE53A1B832A98D306E4DDE4210323A35416
SHA-256:	17B78790EFB08EAD6839806513F404EAB7FECA0013BAC756D32A8340D6864D8A
SHA-512:	FE802A393FA0EC6FEFF34DEF767DE9F92A56286603F1ED15717E9D88F835EF9DEB4B737F2E5D175D503EBF6B9E115A5F20C6A1F6BEC524779CA47DD1976B5790
Malicious:	false
Reputation:	unknown
Preview:	/* Strings for User Notification of a crash */."headerFmt" = "The Google program %@ has unexpectedly quit.";."msg" = "The system and other applications have not been affected. A report has been created that you can send to Google to help identify the problem.";."msgNoSend" = "The system and other applications have not been affected.";.."sendReportButton" = "Send Report";."cancelButton" = "Cancel";."noSendButton" = "OK";.

C:\Program Files (x86)\Google\Picasa3\cdautorun\Picasa CD Slideshow.app\Contents\Frameworks\GoogleBreakpad.framework\Versions\A\Resources\Reporter.app\Contents\Resources\es.lproj\Louserzable.strings

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe
File Type:	Unicode text, UTF-8 text
Category:	dropped
Size (bytes):	458
Entropy (8bit):	4.576332223071282
Encrypted:	false
SSDEEP:	12:Ub1ipr84Wz7lKjbTU2HQLCKjbTU2vUnxNw:FplWNKVHK1UnxNw
MD5:	B2B424C6706B9E1F760487493EA6B7DC
SHA1:	7F3223CE0B8AC3E315AF9FE2739CFCB6254E8BF3
SHA-256:	2A9F5E32A39C59EEA3543483BEE74786B02DBB583A7BEFB59AF961DC34761D38
SHA-512:	D2AFB7291CE32A8A832BC1AFAF98E13A2F3531695D0FAE4493E497C2B65FBAD3B2C223B818802D87A52CD822C79F16F02A6EE6394FD2D32EA34F886AD2A78C16
Malicious:	false
Reputation:	unknown
Preview:	/* Strings for User Notification of a crash */."headerFmt" = "El programa de Google %@ se ha cerrado inesperadamente.";."msg" = "El sistema y otras aplicaciones no se han visto afectados. Se ha creado un informe que podr.s enviar a Google y que ayudar. a identificar el problema.";."msgNoSend" = "El sistema y otras aplicaciones no se han visto afectados.";.."sendReportButton" = "Enviar informe";."cancelButton" = "Cancelar";."noSendButton" = "Aceptar";.

C:\Program Files (x86)\Google\Picasa3\cdautorun\Picasa CD Slideshow.app\Contents\Frameworks\GoogleBreakpad.framework\Versions\A\Resources\Reporter.app\Contents\Resources\fr.lproj\Louserzable.strings

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe
File Type:	Unicode text, UTF-8 text
Category:	dropped
Size (bytes):	467
Entropy (8bit):	4.702829299841821
Encrypted:	false
SSDEEP:	12:Ub1ipuiYtpTTsnQatVqiRCFLpTTUFc1ppNU:FpuiYttd6wtQi1ppNU
MD5:	152D60497AEC1F61EF5EDCD12E1D7D25
SHA1:	80D61A9AD96DB44D2EFC262B77896C63357EA86E
SHA-256:	ED2A38DB87BB001690D9895BDAC82CC13BF9A4280B0AA9F1EDA4793D854F4211
SHA-512:	00C9572B5691BAAFC048704B8301288189A32F8324A1B2CC983EC973F2D3FDB52D4B18FD82EFE8653AAA5DE9D139C795567461ED7B6EAD0B75E8ED0053BA7E7D
Malicious:	false
Reputation:	unknown
Preview:	/* Strings for User Notification of a crash */."headerFmt" = "Le programme Google %@ s'est arr.t. de fa.on inattendue.";."msg" = "Le syst.me et les autres applications ne sont pas concern.s. Vous pouvez envoyer le rapport g.n.r. . Google pour permettre d'identifier le probl.me.";."msgNoSend" = "Le syst.me et les autres applications ne sont pas concern.s.";.."sendReportButton" = "Envoyer un rapport";."cancelButton" = "Annuler";."noSendButton" = "OK";.

C:\Program Files (x86)\Google\Picasa3\cdautorun\Picasa CD Slideshow.app\Contents\Frameworks\GoogleBreakpad.framework\Versions\A\Resources\Reporter.app\Contents\Resources\it.lproj\Louserzable.strings

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe
File Type:	Unicode text, UTF-8 text
Category:	dropped
Size (bytes):	435
Entropy (8bit):	4.535173396873331
Encrypted:	false
SSDEEP:	6:Uk8pHsoiBzH7IUV6Zh2qKQLAyLeej5FkLUFlfm5qKQLAyLeemHH90afIlsae/nG7:Ub1ipNwOiAy6a5FEZiAy6jCaPZnNU
MD5:	9992802DFE6571EF59EB1EEE23F3F6D8
SHA1:	B9B6056360B3EC7D80B553030E312B5559E026BE
SHA-256:	AF9B0E13AB67DC5EF498BD949E4326D434ABDEB88A12D955D881FE0C4A0645B7
SHA-512:	ECC0637DB3DA9FC6CFFF90FCFA8B9BB65633BBE907EA76A4A27F76B544C019D987B6BD0E24B2A12024E0836DF3A6EE5A1ACA39DBEE222BD9CD61804D26EF6337
Malicious:	false
Reputation:	unknown
Preview:	/* Strings for User Notification of a crash */."headerFmt" = "Il programma Google %@ si . chiuso inaspettatamente.";."msg" = "Il sistema e le altre applicazioni non ne hanno risentito. Puoi inviare la segnalazione creata per aiutarci a individuare il problema.";."msgNoSend" = "Il sistema e le altre applicazioni non ne hanno risentito.";.."sendReportButton" = "Invia segnalazione";."cancelButton" = "Annulla";."noSendButton" = "OK";.

C:\Program Files (x86)\Google\Picasa3\cdautorun\Picasa CD Slideshow.app\Contents\Frameworks\GoogleBreakpad.framework\Versions\A\Resources\Reporter.app\Contents\Resources\ja.lproj\Louserzable.strings

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe
File Type:	Unicode text, UTF-8 text
Category:	dropped
Size (bytes):	531
Entropy (8bit):	5.3298294267774
Encrypted:	false
SSDEEP:	12:Ub1ipUOxRA7QiEolfJX9XQiV+sknujDRNU:FpUcA8demWrknujVNU
MD5:	BC7F046A4CC02EA73891F2A7AAF275BA
SHA1:	97680A2E1567D714D3DEC3688C726E8469765AC0
SHA-256:	C4A80B1F17483122A273005FD022A17D1F4CECB6C2DF52CAA89953E9F7DDEE07
SHA-512:	DDC8DA80B9D7683A1D58AC4EAAB2003D49919467ECFC55CB986EF2101BDB1E01BF3E0D72BDB6A8BC6BDF4CBC60201D09566D8F8A6DA4286305547B0F4132C5FC
Malicious:	false
Reputation:	unknown
Preview:	/* Strings for User Notification of a crash */."headerFmt" = "Google ..... %@ ............";."msg" = "............................ ......... Google .....................";."msgNoSend" = "............................";.."sendReportButton" = ".......";."cancelButton" = ".....";."noSendButton" = "OK";.

C:\Program Files (x86)\Google\Picasa3\cdautorun\Picasa CD Slideshow.app\Contents\Frameworks\GoogleBreakpad.framework\Versions\A\Resources\Reporter.app\Contents\Resources\nl.lproj\Louserzable.strings

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	442
Entropy (8bit):	4.601760172921549
Encrypted:	false
SSDEEP:	6:Uk8pHsoiBzHNhIUGWVQESHA+FFQVzpmXQMIyLx/LESHA+HQ90uURM4e/8f+2GCU:Ub1ipt7GIQFQVzoXBPCAuI24JNU
MD5:	CE1CD9A5FAAE0DC2551D37D2157629EF
SHA1:	CA77AEFD6A850B4092EE986C7B0737AC9C9B1409
SHA-256:	103FAB7A3EAE8721C235B9C0973ECC425EED7A004618DDDA52115C47CE3E1727
SHA-512:	53D004416C3FA4F4CF92018E4471C77C6500E317E4FC3A0A7D6313F83A099B02622FBF88025838D13063DA3466150D3C4117D7C25C0D51D62ED771D02D270786
Malicious:	false
Reputation:	unknown
Preview:	/* Strings for User Notification of a crash */."headerFmt" = "Het programma Google %@ is onverwachts afgesloten.";."msg" = "Het systeem en andere toepassingen zijn niet gewijzigd. Er is een rapport gemaakt dat u naar Google kunt sturen om het probleem te identificeren.";."msgNoSend" = "Het systeem en andere toepassingen zijn niet gewijzigd.";.."sendReportButton" = "Rapport verzenden";."cancelButton" = "Annuleren";."noSendButton" = "OK";.

C:\Program Files (x86)\Google\Picasa3\cdautorun\Picasa CD Slideshow.app\Contents\Frameworks\GoogleBreakpad.framework\Versions\A\Resources\Reporter.app\Contents\Resources\zh_CN.lproj\Louserzable.strings

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe
File Type:	Unicode text, UTF-8 text
Category:	dropped
Size (bytes):	373
Entropy (8bit):	5.743464962192476
Encrypted:	false
SSDEEP:	6:Uk8pHsoiBzH0OL6qROpKknqUEzbXAky6w9baKknqUEw90n8GfYe/mGC/:Ub1ipUOLBEqUEfXDe90qUE7JvmN/
MD5:	28D06BEF66C56E8EC0773E33F8FD819B
SHA1:	E3C159553B2A171721D0E760A1A5EAD0EFCD3F80
SHA-256:	0C1FCE894DA1D21DDD6B7DEB8086653FD78D38CA3C15363575A72D42C92309A1
SHA-512:	B056575BD3880061B2E63ACF4D3AD3273EBD32558714F400C92FDE8E6503D28B057E4602CCCC8FA0DA2D0F5080631A1EA246809F7078A9298E691DD28B014E87
Malicious:	false
Reputation:	unknown
Preview:	/* Strings for User Notification of a crash */."headerFmt" = "Google .. %@ .....";."msg" = ".......................... Google.........";."msgNoSend" = "..............";.."sendReportButton" = "....";."cancelButton" = "..";."noSendButton" = "..";.

C:\Program Files (x86)\Google\Picasa3\cdautorun\Picasa CD Slideshow.app\Contents\Frameworks\GoogleBreakpad.framework\Versions\A\Resources\Reporter.app\Contents\Resources\zh_TW.lproj\Louserzable.strings

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe
File Type:	Unicode text, UTF-8 text
Category:	dropped
Size (bytes):	376
Entropy (8bit):	5.846645183876584
Encrypted:	false
SSDEEP:	6:Uk8pHsoiBzH0OL8T2yGJL+2RUaTkRcJAjtCG6Eb9pAy+OfGJL+2RUaw90aPre/ms:Ub1ipUOL8ZolRUa4R0mCO7AsolRUa7Es
MD5:	4C479A4F9C5B0473A73CF24256B9BD34
SHA1:	787456F8508F2780BF55A3993B526318AF29BC65
SHA-256:	9F7803835507BB3AD887A91338D99EB53EA2F05F3B721FE345E5B928D6098303
SHA-512:	05433545454985E3ECA8C8757051CE20483F4A7C4A34E531E4C00FA782FA0A3D651048646C1722D29F02A46D5A4B14C99867699B7266F5FFE3646FF462C1C54F
Malicious:	false
Reputation:	unknown
Preview:	/* Strings for User Notification of a crash */."headerFmt" = "Google .. %@ .....";."msg" = "............... ........... Google ........";."msgNoSend" = "...............";.."sendReportButton" = "....";."cancelButton" = "..";."noSendButton" = "..";.

C:\Program Files (x86)\Google\Picasa3\cdautorun\Picasa CD Slideshow.app\Contents\Frameworks\GoogleBreakpad.framework\Versions\Current

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	3
Entropy (8bit):	1.584962500721156
Encrypted:	false
SSDEEP:	3:5n:5n
MD5:	A5C8CE6978E46813E453D0277E47EA53
SHA1:	77CE5F28ACA6C1D3D0506F4124C446009BA65F16
SHA-256:	26FFD5886253906A36A7EA0F6E26056FC36472626CB4894BCB100A34DC69D1DB
SHA-512:	31FE80C8ECFC334B35B2D67F04BA40B303FEFE903D40BAC7644251D443610D205B5DFCBC35B5003FC8725AC0FB9BDA6AE22AA8B13338ECB65FF36B2FE1EA8ACC
Malicious:	false
Reputation:	unknown
Preview:	A..

C:\Program Files (x86)\Google\Picasa3\cdautorun\Picasa CD Slideshow.app\Contents\Info.plist

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 text
Category:	dropped
Size (bytes):	1241
Entropy (8bit):	5.220840869667568
Encrypted:	false
SSDEEP:	24:2dfyiwl6NBGYlB1JMa64oRD0Yx6323ePG3cH3bkH3ux6s:cfyyBGYlB1Jc1V0O6muPGsHIHQ6s
MD5:	95DB48F67CD8656124A85B289D2504D2
SHA1:	25B27F0D6040ACDF9BA521EEF04F3A3EE8D15A8C
SHA-256:	E79DAEBCDFBC6E37DAEA9D4EBF902D2099F5C0E952B6391AB68DF6F8EC2AAD06
SHA-512:	CE950DB6DE6BB5A60C7590919CDF1B1B6A02BCD602F5E629D1815C8C9C7A56AD58BB67DFE0E4DF7653C56875B9C000257ACDBBB33CBF00BE61332564566A83E0
Malicious:	false
Reputation:	unknown
Preview:	<?xml version="1.0" encoding="UTF-8"?>.<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">.<plist version="1.0">.<dict>..<key>CFBundleDevelopmentRegion</key>..<string>English</string>..<key>CFBundleExecutable</key>..<string>Picasa CD Slideshow</string>..<key>CFBundleGetInfoString</key>..<string>Picasa 2.0.2.322, . 2007-2009 Google Inc.</string>..<key>CFBundleIconFile</key>..<string>PicasaCD</string>..<key>CFBundleIdentifier</key>..<string>com.google.PicasaCD</string>..<key>CFBundleInfoDictionaryVersion</key>..<string>6.0</string>..<key>CFBundlePackageType</key>..<string>APPL</string>..<key>CFBundleShortVersionString</key>..<string>2.0.2</string>..<key>CFBundleSignature</key>..<string>????</string>..<key>CFBundleVersion</key>..<string>2.0.2.322</string>..<key>GoogleBreakpadProduct</key>..<string>Picasa_Mac_CDGo</string>..<key>GoogleBreakpadProductDisplay</key>..<string>Picasa CD Slideshow</string>..<key>GoogleBreakpadRequestComments</k

C:\Program Files (x86)\Google\Picasa3\cdautorun\Picasa CD Slideshow.app\Contents\MacOS\Picasa CD Slideshow

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe
File Type:	Mach-O i386 executable, flags:<NOUNDEFS\|DYLDLINK\|TWOLEVEL\|WEAK_DEFINES\|BINDS_TO_WEAK>
Category:	dropped
Size (bytes):	1911464
Entropy (8bit):	6.255944797550135
Encrypted:	false
SSDEEP:	49152:u3TxLATxLTBzpgHppICpf7Ne+X0jA7zBaXwvbTTCnfR:uyBzpgHppICpfxe+kjrXwvOfR
MD5:	FF9F157A8CF48E7E5E287C7A6B7757C1
SHA1:	244404B50A4B14EC4E7C6D93924DB62DE0E63198
SHA-256:	AF33060F5FFC26FDAF643DF1A4CB53A53756194CE551DB37E9B33B5C2C68A709
SHA-512:	56AB69AC160BB06CDC9D9ECC459B06C8EC853DB3C7898B961D0DD58AE598DED5B83519371BB8A918145A5BB6DD0262476E307B25F68D490E3C576CDD2591A4E0
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Reputation:	unknown
Preview:	................................8...__PAGEZERO..........................................X...__TEXT...............0.......0..................__text..........__TEXT...........$...O..............................__cstring.......__TEXT..........Tt..a[..Td..........................__literal8......__TEXT..............................................__eh_frame......__TEXT....................................`........__const.........__TEXT...........r..>....b..........................__const_coal....__TEXT...........%..................................__literal4......__TEXT..........\|+......\|...........................__StaticInit....__TEXT..........h,......h...................................__DATA...........@...@...0......................__data..........__DATA...........@..t....0..........................__dyld..........__DATA..........t.......t...........................__gcc_except_tab__DATA..........\|.......\|...........................__const.........__DATA..........@....%..@...............

C:\Program Files (x86)\Google\Picasa3\cdautorun\Picasa CD Slideshow.app\Contents\PkgInfo

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	8
Entropy (8bit):	1.75
Encrypted:	false
SSDEEP:	3:k0Ra:f8
MD5:	23B7D7D024ABB0F558420E098800BF27
SHA1:	9F9EEA0CFE2D65F2C3D6B092E375B40782D08F31
SHA-256:	82502191C9484B04D685374F9879A0066069C49B8ACAE7A04B01D38D07E8ECA0
SHA-512:	F77D501528DD0CED155C80406CFBEE38D5D3649B64D2A9324F3D6CEE39491EB8F54CDEBAE49C6E21A20D2309D8FAE1B01C41631224811E73483DB25A2695738C
Malicious:	false
Reputation:	unknown
Preview:	APPL????

C:\Program Files (x86)\Google\Picasa3\cdautorun\Picasa CD Slideshow.app\Contents\Resources\Dialogs.nib\classes.nib

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe
File Type:	XML 1.0 document, ASCII text
Category:	dropped
Size (bytes):	230
Entropy (8bit):	5.26503811379087
Encrypted:	false
SSDEEP:	6:TMVBd/4o+tJCc4EyfdUdBRECcgVvrwq/0+Wi:TMHdgo+tJVEdQiCXF7s+n
MD5:	2F1B2B5CD12C21A001010397CF51243A
SHA1:	84777223DDE086138889A96DFA7F77A209E538AE
SHA-256:	9291F75703542BDE84EBDC3105709B6C28A0BB63AB38D8475B093614E2EF651F
SHA-512:	09B41E62C85EFF2C3D83540F4CFF5768ED452D00FF224149F5470604ECF322A95790110DE35456F728E909BDB044D231EB9F7E50FF50FFB39BEAE36292252FDC
Malicious:	false
Reputation:	unknown
Preview:	<?xml version="1.0" encoding="UTF-8"?>.<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">.<plist version="1.0">.<dict>..<key>IBVersion</key>..<string>1</string>.</dict>.</plist>.

C:\Program Files (x86)\Google\Picasa3\cdautorun\Picasa CD Slideshow.app\Contents\Resources\Dialogs.nib\info.nib

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe
File Type:	XML 1.0 document, ASCII text
Category:	dropped
Size (bytes):	524
Entropy (8bit):	5.265223044243065
Encrypted:	false
SSDEEP:	12:TMHdgo+tJVEdQiCXFbfNIr2w0QmefzJ3Rbn:2dfyiwFfNIr2efzJBb
MD5:	D46E2E25732C2B9FEC8302D86419B830
SHA1:	74B9303A6D315CF5C10CA0B96FE4EBCB70E3E432
SHA-256:	080CF8D2B0EC83CA530C5D8B68B0F19075B1B52D57C4FBB678CECD24AA81D060
SHA-512:	A79637447C32220A44BC226A2CE00D5AA483FF7CEEA350B660CCB60EAF0AB94F4B0F6F2785BBEE3E7796E1ECBD81DF65A957F69AFFBA1A3B83EEA1F39587AAD8
Malicious:	false
Reputation:	unknown
Preview:	<?xml version="1.0" encoding="UTF-8"?>.<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">.<plist version="1.0">.<dict>..<key>IBFramework Version</key>..<string>677</string>..<key>IBLastKnownRelativeProjectPath</key>..<string>../Mac/Picasa.xcodeproj</string>..<key>IBOldestOS</key>..<integer>5</integer>..<key>IBOpenObjects</key>..<array/>..<key>IBSystem Version</key>..<string>9J61</string>..<key>targetFramework</key>..<string>IBCarbonFramework</string>.</dict>.</plist>.

C:\Program Files (x86)\Google\Picasa3\cdautorun\Picasa CD Slideshow.app\Contents\Resources\Dialogs.nib\objects.xib

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 text
Category:	dropped
Size (bytes):	7152
Entropy (8bit):	4.755571392798211
Encrypted:	false
SSDEEP:	96:OWo/yQIKWQeQU7eH9bLczfGo9KN3XbpOQKWQB/QvuX7f:q/yQIKWQHc8WQNnbpOQKWQBYq7f
MD5:	31028F3DD66991DE55C800108E40CA7F
SHA1:	958E66437C021F1B7349E3F3722D438F492B7DF6
SHA-256:	B241745711EC70E62A08B0468289DED90D31417C250445D2739052274CF209E4
SHA-512:	AF14C2EAC63F44B167FE95838A0AB08C485594ABE93412330BCD1FA8B6EEF97818007086250624738ECF5D2917ECDF5619689F3AB9EB43ACAB609B68534197D1
Malicious:	false
Reputation:	unknown
Preview:	<?xml version="1.0" standalone="yes"?>.<object class="NSIBObjectData">. <object name="rootObject" class="NSCustomObject" id="1">. </object>. <array count="14" name="allObjects">. <object class="IBCarbonStaticText" id="357">. <int name="controlID">5</int>. <int name="fontStyle">-2</int>. <string name="title">All other product, service names, brands, or trademarks are the property of their respective owners.</string>. <int name="justification">1</int>. <string name="viewFrame">20 164 267 40 </string>. <string name="bounds">164 20 204 287 </string>. </object>. <object class="IBCarbonWindow" id="351">. <boolean name="receiveUpdates">FALSE</boolean>. <boolean name="hasCollapseBox">FALSE</boolean>. <boolean name="hasHorizontalZoom">FALSE</boolean>. <boolean name="isResizable">FALSE</boolean>. <boolean name="hasVerticalZoom">FALSE</boolean>. <boolean name="liveResize">TRUE</boolean>. <boolean name="compositing">T

C:\Program Files (x86)\Google\Picasa3\cdautorun\Picasa CD Slideshow.app\Contents\Resources\NESW.png

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe
File Type:	PNG image data, 20 x 20, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	634
Entropy (8bit):	7.561003047752328
Encrypted:	false
SSDEEP:	12:6v/7or5srQWKPwP/nGSe4bU5W0/nNJUsoUc8ZjYSju+dvvSYoBxxHDjdXbxPnTw4:1yrFK6nbUNJ1oUTjruqiYkxx3thEybN
MD5:	F7D7AB40B7662A4C675E2D6EAF684C43
SHA1:	00AC5F739D690A415E5194992CBB967F0ED4DF28
SHA-256:	D3698A13E72E79C3DB0F394DB4A038C328673457C31F067553729F99B078881F
SHA-512:	E8D97B85CCD11D142F96361BBCDA4ED4B435002F8C2B92121A00A8C70532555F82FBE543F60F57DF1C3C939A6238F11DEE5968B8AA02EC84D18062A67F44701B
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR.....................tEXtSoftware.Adobe ImageReadyq.e<....IDATx..AK.A..7..qimK.h+.hK.A..P.V.E.1'....~..c.P..@ .j.=........@ .I$.........X.;.;.g...o....U...%.B>k.._.g..f....:....1.X:.h..T.T.....H$.vtO.\|....."..R..I.e.+.)%....?...F..h.....i...J......dr.QU...........C.p....Qm.Zk....i..;....j....^ .x<.U......3.,..}.. ..~A..7........yU,..)~A.w..+......b..3p].2.E...J..N.c.~.....g..y.2.e.D....&.u...ht.A.%.-..R.g.....n......=..-..l.u.B<.ski\|...Bh^8-....b...r?.3.&..FJ:.V...^&..=.H.\|^....Y.:.B-qP\|.z..1.(.C.z.l..V..../?...u.#....!W:H..']....6.d....{j4.O]5t..b.....F.9#..`.*..` ......IEND.B`.

C:\Program Files (x86)\Google\Picasa3\cdautorun\Picasa CD Slideshow.app\Contents\Resources\NWSE.png

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe
File Type:	PNG image data, 20 x 20, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	629
Entropy (8bit):	7.547853339737818
Encrypted:	false
SSDEEP:	12:6v/7ormaNyhJFdDL9v6WIG2fZLct0RUhAfyIyv9lE+GsjaCRRpugm/tF:1R+FdX9gG2RLc6GhAfyZWseC5k
MD5:	15581CB32E9A3CB5452E84927FAAEC69
SHA1:	48CF110EBC9974D6CCF61B46B870276F61743715
SHA-256:	D83B94714C0C4F41C1009E90AD7D0777C9DC55B071ACE77389D77DE80F0A5F8C
SHA-512:	C69F4D8F15F61239509DD64E03E40DD5777CB40C049CC30112B3905037C4DAC769F71D956114DEE033E575590F0D349A32415EA10CD2068F71783EB4831C6EE3
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR.....................tEXtSoftware.Adobe ImageReadyq.e<....IDATx.UKk.a...I"I..@........".$!.l\...O./....Ap#4........+nta..`$N..\|=g.S..........\|w".....g.5...S.V.h.`Y.`.n...k........ ...D".z...................b.........+.e..4MU..U..........E....}2..3l4....I....Y&3.w.v:...OD......Z...{I1.o...H9.H..\|...7I.r..W.....Rf..Dk...d2..g....+..4..m.\|>..T._/.......-Q.....Eg..._...D.n..A:.V...'~.....G".......;?R..>..).:.R...i.$...s%...L.i.p8.v...!.\....9.../.J'..w4.%.........`e2..x<~.J...x...1.(....g...Tr..U*...t..[k2..%.v.t..L....m........9...}.~.........zh..>.wr..y.%..u\|.O...0....IEND.B`.

C:\Program Files (x86)\Google\Picasa3\cdautorun\Picasa CD Slideshow.app\Contents\Resources\PicasaCD.icns

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe
File Type:	Mac OS X icon, 289087 bytes, "is32" type
Category:	dropped
Size (bytes):	289087
Entropy (8bit):	7.850930240328432
Encrypted:	false
SSDEEP:	6144:xf9Zwb1IIoVEP7eEsbd4PPHYwWuh9cqMzNkK+/Emr/w5:xfo12VE7et5cfY0bMzAY5
MD5:	C8CE7681C09DA3D0034283EAAD66DDA8
SHA1:	9FD8436ADCC1620823831B36B3E0732BA582C641
SHA-256:	C2A5069782D6AF57815405675EEB155EEBAA5547446BA7298E92126EAF4A2792
SHA-512:	551EC856AD1F472014D37A12396AFF6ADFA0A44AA009E48ACC74E3FE1A3897C45C9E26E0B5ACB80CF8761A48C84C84444C577B1E9EFF3E6462FB9B552452911D
Malicious:	false
Reputation:	unknown
Preview:	icns..i?is32...........=NB..........j............l..............Lns.............\|i}............5.y..@8d....H...C........T...9.\|.g,.3..6...!....P..a...q;..Z..Z.89.........M.....L8........Oz..z........\|....Q.d........Z..............6....C..J)............[)....3]..........6D@..........h.far..............]S........Rt}............kW...........3p`..F9`..D...An........L...8.........}1.....x.......u8.^.j......v`\|............]4.0`...F.......L;,<.}..........M,..zb...........p.;....<..E%............X&.....V..........2A?..........P.X[n............}~VL..n......t.......w2q.............y.j'...6....F6\..?=A...D........'C...;.....gNl.**.......zCI\|...m1.^.u...]Z.jIt.........`T.J...G...=.....0& #mu...\|......3...o[...........e.5....4..:.............N ....'N...s8mk..........NdP....................................................................!...P....gQ.....Y...f..........q...T...........Y... ............R..................................V...........................

C:\Program Files (x86)\Google\Picasa3\cdautorun\Picasa CD Slideshow.app\Contents\Resources\bg.lproj\i18n\cdgo.xml

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 text
Category:	dropped
Size (bytes):	874
Entropy (8bit):	5.09822447007944
Encrypted:	false
SSDEEP:	24:2dRTcwtYXKzYpo1KzYVo1JzYJodC0nz8HPDUqz8Hjcl+XqVC8:cuwtYEIL0SQSBzi7yq+XW
MD5:	D0E7CA15272C653D9AEC988C10B7AD26
SHA1:	AFB13301ACADD8F4749C3D2EA5A86E0831A4FE41
SHA-256:	61785E9C5FD38689F60AF1D4590BD10E22EA60523055C047D236456FE549BC75
SHA-512:	358E30243AFA64F94FB607F7B9D50F1B9C4D1A12F2BA4BDCB16C6DCFC8850D1590956D2987D1CA7D9834C31B7C28D810AC2F93C28C688C4A4B48154FF738654F
Malicious:	false
Reputation:	unknown
Preview:	<?xml version="1.0" encoding="utf-8" ?>.<tooltips>. <action type="Label" target="cdgo/copytohd" xmbdesc="Label(cdgo/copytohd)">. <xmbtext>......... .. .....</xmbtext>. </action>. <action type="Label" target="cdgo/eject" xmbdesc="Label(cdgo/eject)">. <xmbtext>......... .. ............</xmbtext>. </action>. <action type="Label" target="cdgo/exit" xmbdesc="Label(cdgo/exit)">. <xmbtext>.....</xmbtext>. </action>. <action type="Label" target="cdgo/topicasa" xmbdesc="Label(cdgo/topicasa)">. <xmbtext>........... . Picasa</xmbtext>. </action>. <action type="Text" target="cdgo/loading" xmbdesc="Text(cdgo/loading)">. <xmbtext>....... ..</xmbtext>. </action>. <action type="Text" target="cdgo/tpslabel" xmbdesc="Text(cdgo/tpslabel)">. <xmbtext>..... .. ......</xmbtext>. </action>.</tooltips>.

C:\Program Files (x86)\Google\Picasa3\cdautorun\Picasa CD Slideshow.app\Contents\Resources\bg.lproj\i18n\cdgo_resexport.xml

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe
File Type:	XML 1.0 document, ASCII text
Category:	dropped
Size (bytes):	52
Entropy (8bit):	4.849196208400893
Encrypted:	false
SSDEEP:	3:vFWWMNHU8LdgCzLZfOO:TMVBdTtfOO
MD5:	4BE3304509673D14428BD2FFC3070EF8
SHA1:	269C46096236A213905C8F2987CD0C422389D300
SHA-256:	CC678E75294007E177344FB3D841B23E1AA9877B4F5E22AACF93A8FE15FA5B4C
SHA-512:	96E17A55395AA231D5FDB5103A4A5C8D89074E3806909F6BDA2D275A614F01555549DB7280F9E48515AF472E4D0AABB5568D2589EBC1310218A970C3B09BCB1B
Malicious:	false
Reputation:	unknown
Preview:	<?xml version="1.0" encoding="utf-8" ?>.<Win32Res/>.

C:\Program Files (x86)\Google\Picasa3\cdautorun\Picasa CD Slideshow.app\Contents\Resources\bg.lproj\i18n\cdgo_stringres.xml

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 text
Category:	dropped
Size (bytes):	7674
Entropy (8bit):	5.152807824689818
Encrypted:	false
SSDEEP:	192:9SFL3kd+teXertEeyeTxznMVmcilooZqDSFL3kd+teXertEeyeTxznMVmcilooZm:22UENo2UEN2ta5FL3
MD5:	EF8BD52C77EF9C7682E4FBB4602869DE
SHA1:	326B0A4D472931598EE308479E6C14B32B09FA37
SHA-256:	24360AF55D42BF8085C1E879CD013D5680A74C25D0DE4CA2E54B7C9CD9A41D8A
SHA-512:	3DD655DFB457A7038594E25C19690C3BFE71AFFB36CCC4117A3CB1ECF012A8D89D58E26A50ECC4A1E3A8014DB0A7FB014E5484C3CF41C68AA2B65FB0CBB2DD0F
Malicious:	false
Reputation:	unknown
Preview:	<?xml version="1.0" encoding="utf-8" ?>.<resources>. <stringres id="February">. <xmbtext>........</xmbtext>. </stringres>. <stringres id="March">. <xmbtext>....</xmbtext>. </stringres>. <stringres id="April">. <xmbtext>.....</xmbtext>. </stringres>. <stringres id="May">. <xmbtext>...</xmbtext>. </stringres>. <stringres id="June">. <xmbtext>...</xmbtext>. </stringres>. <stringres id="July">. <xmbtext>...</xmbtext>. </stringres>. <stringres id="August">. <xmbtext>......</xmbtext>. </stringres>. <stringres id="September">. <xmbtext>.........</xmbtext>. </stringres>. <stringres id="October">. <xmbtext>........</xmbtext>. </stringres>. <stringres id="November">. <xmbtext>.......</xmbtext>. </stringres>. <stringres id="December">. <xmbtext>........</xmbtext>. </stringres>. <stringres id="Jan">. <xmbtext>..</xmbtext>. </stringres>. <stringres id="Feb">. <xmbtext>...</xmbtext>. </stringres>. <stringres id="Mar">.

C:\Program Files (x86)\Google\Picasa3\cdautorun\Picasa CD Slideshow.app\Contents\Resources\ca.lproj\i18n\cdgo.xml

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 text
Category:	dropped
Size (bytes):	793
Entropy (8bit):	4.880626979922786
Encrypted:	false
SSDEEP:	24:2dRTcwtI6qzYppzYVm6zYJJxsF0nz8HPD2IKz8Hjcl+LIIC8:cuwt6I50mEQ02ziL0yq+8+
MD5:	00523159F63234B3A4FBDD55E4DA495A
SHA1:	F809DE3E6E9C320DFBFF808230A7591648EB913C
SHA-256:	8782B7E786BA628CAE7A3ACCEB22464D362C091608F73E8F0CF715F66F4BEB12
SHA-512:	30ECAFF15C45ED75DE2F431E286359FB68B84C374B66ADF59F2F7D73DCE80C99EC01034D5D1E2EE3D2A81714815C676FB136AA6DD16D577DED95719CB0DDE85B
Malicious:	false
Reputation:	unknown
Preview:	<?xml version="1.0" encoding="utf-8" ?>.<tooltips>. <action type="Label" target="cdgo/copytohd" xmbdesc="Label(cdgo/copytohd)">. <xmbtext>Desa al disc</xmbtext>. </action>. <action type="Label" target="cdgo/eject" xmbdesc="Label(cdgo/eject)">. <xmbtext>Expulsa el CD</xmbtext>. </action>. <action type="Label" target="cdgo/exit" xmbdesc="Label(cdgo/exit)">. <xmbtext>Surt</xmbtext>. </action>. <action type="Label" target="cdgo/topicasa" xmbdesc="Label(cdgo/topicasa)">. <xmbtext>Importa a Picasa</xmbtext>. </action>. <action type="Text" target="cdgo/loading" xmbdesc="Text(cdgo/loading)">. <xmbtext>S'EST. CARREGANT</xmbtext>. </action>. <action type="Text" target="cdgo/tpslabel" xmbdesc="Text(cdgo/tpslabel)">. <xmbtext>Temps de visualitzaci.</xmbtext>. </action>.</tooltips>.

C:\Program Files (x86)\Google\Picasa3\cdautorun\Picasa CD Slideshow.app\Contents\Resources\ca.lproj\i18n\cdgo_resexport.xml

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe
File Type:	XML 1.0 document, ASCII text
Category:	dropped
Size (bytes):	52
Entropy (8bit):	4.849196208400893
Encrypted:	false
SSDEEP:	3:vFWWMNHU8LdgCzLZfOO:TMVBdTtfOO
MD5:	4BE3304509673D14428BD2FFC3070EF8
SHA1:	269C46096236A213905C8F2987CD0C422389D300
SHA-256:	CC678E75294007E177344FB3D841B23E1AA9877B4F5E22AACF93A8FE15FA5B4C
SHA-512:	96E17A55395AA231D5FDB5103A4A5C8D89074E3806909F6BDA2D275A614F01555549DB7280F9E48515AF472E4D0AABB5568D2589EBC1310218A970C3B09BCB1B
Malicious:	false
Reputation:	unknown
Preview:	<?xml version="1.0" encoding="utf-8" ?>.<Win32Res/>.

C:\Program Files (x86)\Google\Picasa3\cdautorun\Picasa CD Slideshow.app\Contents\Resources\ca.lproj\i18n\cdgo_stringres.xml

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 text
Category:	dropped
Size (bytes):	6970
Entropy (8bit):	4.815371103768121
Encrypted:	false
SSDEEP:	192:9YdB4x5FBHepeltEebevu8+BHWanBqV/oedUYdB4x5FBHepeltEebevu8+BHWan9:aYHkME8LJyYHkME8LJEIqJXIH
MD5:	2751770D90547786954163CCC0C6D008
SHA1:	0D2810AD2017E9F3BA3B56D42D7EB898F053BD22
SHA-256:	783FFAA5A0077552198A0D7442D875FB436ADC6CB39FA525D2A590487CE53AE1
SHA-512:	8DEEF11DBCC8C1645326805D8173EF4C0F95688EFD906E08015D6C3A8DC1401AD82EB5BF72868B127B83425FB762974BCFB2EA5923C80D45F8DF00203E8F4592
Malicious:	false
Reputation:	unknown
Preview:	<?xml version="1.0" encoding="utf-8" ?>.<resources>. <stringres id="February">. <xmbtext>Febrer</xmbtext>. </stringres>. <stringres id="March">. <xmbtext>Mar.</xmbtext>. </stringres>. <stringres id="April">. <xmbtext>Abril</xmbtext>. </stringres>. <stringres id="May">. <xmbtext>Maig</xmbtext>. </stringres>. <stringres id="June">. <xmbtext>Juny</xmbtext>. </stringres>. <stringres id="July">. <xmbtext>Juliol</xmbtext>. </stringres>. <stringres id="August">. <xmbtext>Agost</xmbtext>. </stringres>. <stringres id="September">. <xmbtext>Setembre</xmbtext>. </stringres>. <stringres id="October">. <xmbtext>Octubre</xmbtext>. </stringres>. <stringres id="November">. <xmbtext>Novembre</xmbtext>. </stringres>. <stringres id="December">. <xmbtext>Desembre</xmbtext>. </stringres>. <stringres id="Jan">. <xmbtext>Gen</xmbtext>. </stringres>. <stringres id="Feb">. <xmbtext>Feb</xmbtext>. </stringres>. <stringres id="Mar">. <xmbtext>Mar.</xmbtext>. </stringres>. <stringres id="Apr">. <

C:\Program Files (x86)\Google\Picasa3\cdautorun\Picasa CD Slideshow.app\Contents\Resources\cdgo.tre

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	5877
Entropy (8bit):	4.8316640081993185
Encrypted:	false
SSDEEP:	96:fvClZi6000bjIOQMhJM6or1ICRtrmWDR40:fvoZb1QSMhJM6orKCRtrmWDz
MD5:	AA68131599E73CFA3BD45F168988543B
SHA1:	43B1FC7F337F7D739CB9A148DD4E6230858FD807
SHA-256:	409AAAE1B188F303C9DE32DD16702957E5F364184E765F8E1893C9D3A3961A72
SHA-512:	E621A7D41B13A06F89A06ACB45CDA7A4B27B00FF8ABEDBC07C1EF533932190D99874BD0A266179CEFF040A83F6F04A42833F6C6C5636EC917F4B6B06F9A35D55
Malicious:	false
Reputation:	unknown
Preview:	#-----------------------------------------------------------.# Macros .#-----------------------------------------------------------..#define m_scaleX.XConstraint 0, 0, 0.XConstraint 1, 1, 0..#define m_offsetLT.MaintainOffset left.MaintainOffset top ..#define m_offsetLB.MaintainOffset left.MaintainOffset bottom..#define m_offsetRB.MaintainOffset right.MaintainOffset bottom..#define m_offsetRT.MaintainOffset right.MaintainOffset top..#define m_hidden.Property setvisible 0..#define m_centerX.XConstraint 0.5, 0.5, 0..#define m_offsetT.MaintainOffset top..#define m_disabled.Property disable 1..#define m_displayfont12.Property fonttrack -1.Property fontsize 12..#----------------------------------------------------------- ..cdgo/grad: root.Property sethiquality 1.XConstraint 0, -0.1, 0.YConstraint 0, -0.1, 0.XConstraint 1, 1.1, 0.YConstraint 1, 1.1, 0..cdgo/top: root.MaintainOffset top.XConstraint 0, 0, 0.XConstraint 1, 1, 0..cdgo/picasa: root.m_offsetLT..cdgo/google: root.m_offsetRT..#i18n--

C:\Program Files (x86)\Google\Picasa3\cdautorun\Picasa CD Slideshow.app\Contents\Resources\cdgo.ui

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe
File Type:	Adobe Photoshop Image, 800 x 600, RGB, 3x 8-bit channels
Category:	dropped
Size (bytes):	268503
Entropy (8bit):	5.385549457615012
Encrypted:	false
SSDEEP:	3072:/ddZeZCfn6xxp036LpffEw3CVII10ozOW3V4:1dZeZC+465cw3CT0ozN3V4
MD5:	FD5A138B5C1F8711D2F2382EAE37A4A5
SHA1:	E7844C29EA688F3AD3C032690B6884519E3AA361
SHA-256:	CB20F2A39E8AE2A1706D8BC38F6D5DC9088D2F04C5C6A5BE838D46D11835262A
SHA-512:	637CDA6B420EA19DF36AEFEF93277A83203E5AB11C400BE4CA2BD6BA9A3E1F1EE2C0D903708B5084A10C3ABE1F6995D73CD7EAD948C40EB0D50EC03EEDE908D2
Malicious:	false
Reputation:	unknown
Preview:	8BPS.............X... ..........*(8BIM................8BIM.%......F..&.V.......w8BIM.$.....3<?xpacket begin='.' id='W5M0MpCehiHzreSzNTczkc9d'?>.<x:xmpmeta xmlns:x='adobe:ns:meta/' x:xmptk='XMP toolkit 3.0-28, framework 1.6'>.<rdf:RDF xmlns:rdf='http://www.w3.org/1999/02/22-rdf-syntax-ns#' xmlns:iX='http://ns.adobe.com/iX/1.0/'>.. <rdf:Description rdf:about='uuid:eab203c8-7505-11db-9e7a-c1060aa41081'. xmlns:exif='http://ns.adobe.com/exif/1.0/'>. <exif:ColorSpace>4294967295</exif:ColorSpace>. <exif:PixelXDimension>800</exif:PixelXDimension>. <exif:PixelYDimension>600</exif:PixelYDimension>. </rdf:Description>.. <rdf:Description rdf:about='uuid:eab203c8-7505-11db-9e7a-c1060aa41081'. xmlns:pdf='http://ns.adobe.com/pdf/1.3/'>. </rdf:Description>.. <rdf:Description rdf:about='uuid:eab203c8-7505-11db-9e7a-c1060aa41081'. xmlns:photoshop='http://ns.adobe.com/photoshop/1.0/'>. <photoshop:History></photoshop:History>. </rdf:Description>.. <rdf:Description rdf:about='uuid:eab203c8-7505-

C:\Program Files (x86)\Google\Picasa3\cdautorun\Picasa CD Slideshow.app\Contents\Resources\crosshairthin.png

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe
File Type:	PNG image data, 17 x 17, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	211
Entropy (8bit):	5.886593545622666
Encrypted:	false
SSDEEP:	6:6v/lhP6+ksRfC19s/6TNyNlVQuW72p1edu97bvbp:6v/7tf2s/6TgNcRK1UQv1
MD5:	DA6E7763804323DADA8B2728C4913D61
SHA1:	6EAEC91D04BD610FAB689BB2D76637C8845D4479
SHA-256:	A9D38FDD66B6AD737CDD3A13C9F8B1959A730297BC2D0BEAAE0E4757DE96BC09
SHA-512:	41E3479B5C6FD3993AAA8006B3A3B8064427A899A6F7EFE2128E0242E46868CA927235DE96404CFD6DC0C238BDAA4F2B69FD7C44A06C4FD914F9768DB52BDE3E
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR.............;mG.....sRGB.........bKGD..............pHYs.................tIME......,......SIDAT8.c`.........7.S..@.0x.!..1.....}.....4a...h8...Q.zX.....e..Y....5.!.(K'#4...k.(..{x.....IEND.B`.

C:\Program Files (x86)\Google\Picasa3\cdautorun\Picasa CD Slideshow.app\Contents\Resources\cs.lproj\i18n\cdgo.xml

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 text
Category:	dropped
Size (bytes):	793
Entropy (8bit):	4.875143488856594
Encrypted:	false
SSDEEP:	24:2dRTcwtI0FzYpmyzYVuTzYJJxtP0nz8HPD90z8Hjcl+6C8:cuwtFIR0YQlczi9yyq+Y
MD5:	9DF41E542ABDBBA7D8E389A8CAA2DF48
SHA1:	B9FC692A27F647859E3428ABB25498D707DFDFA2
SHA-256:	49A98E896A941656A5C324683144E8DAEFE8995F69BF4AE33F1CEA1416C57E4C
SHA-512:	A7B36343C4C7E863F69326CACE8F4E2DC556C77EFE102A586DB3B5366553F32E333F732EDCF791B90C4B8D1C214681C010031C4AD2A7673685971A32C7573C66
Malicious:	false
Reputation:	unknown
Preview:	<?xml version="1.0" encoding="utf-8" ?>.<tooltips>. <action type="Label" target="cdgo/copytohd" xmbdesc="Label(cdgo/copytohd)">. <xmbtext>Ulo.it na disk</xmbtext>. </action>. <action type="Label" target="cdgo/eject" xmbdesc="Label(cdgo/eject)">. <xmbtext>Vysunout CD</xmbtext>. </action>. <action type="Label" target="cdgo/exit" xmbdesc="Label(cdgo/exit)">. <xmbtext>Ukon.it</xmbtext>. </action>. <action type="Label" target="cdgo/topicasa" xmbdesc="Label(cdgo/topicasa)">. <xmbtext>Importovat do aplikace Picasa</xmbtext>. </action>. <action type="Text" target="cdgo/loading" xmbdesc="Text(cdgo/loading)">. <xmbtext>NA..T.N.</xmbtext>. </action>. <action type="Text" target="cdgo/tpslabel" xmbdesc="Text(cdgo/tpslabel)">. <xmbtext>.as zobrazen.</xmbtext>. </action>.</tooltips>.

C:\Program Files (x86)\Google\Picasa3\cdautorun\Picasa CD Slideshow.app\Contents\Resources\cs.lproj\i18n\cdgo_resexport.xml

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe
File Type:	XML 1.0 document, ASCII text
Category:	dropped
Size (bytes):	52
Entropy (8bit):	4.849196208400893
Encrypted:	false
SSDEEP:	3:vFWWMNHU8LdgCzLZfOO:TMVBdTtfOO
MD5:	4BE3304509673D14428BD2FFC3070EF8
SHA1:	269C46096236A213905C8F2987CD0C422389D300
SHA-256:	CC678E75294007E177344FB3D841B23E1AA9877B4F5E22AACF93A8FE15FA5B4C
SHA-512:	96E17A55395AA231D5FDB5103A4A5C8D89074E3806909F6BDA2D275A614F01555549DB7280F9E48515AF472E4D0AABB5568D2589EBC1310218A970C3B09BCB1B
Malicious:	false
Reputation:	unknown
Preview:	<?xml version="1.0" encoding="utf-8" ?>.<Win32Res/>.

C:\Program Files (x86)\Google\Picasa3\cdautorun\Picasa CD Slideshow.app\Contents\Resources\cs.lproj\i18n\cdgo_stringres.xml

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 text
Category:	dropped
Size (bytes):	6925
Entropy (8bit):	4.891635150122721
Encrypted:	false
SSDEEP:	192:9uXcchIneue/tEe9e5+PIcdiuLd/ohc3uXcchIneue/tEe9e5+PIcdiuLd/ohwUf:19KECR9KECHxkhr
MD5:	FF6B35B839101ED6B60B1DA7C9924A2D
SHA1:	79F4766677F69993797714A6105F0FF5520AB668
SHA-256:	96E63BD96E8BFB50E1AED5E078EF65A3CAEB580D1BA63F8C456FD32ECDDE5EAB
SHA-512:	CA2C5AD9A5221769D36F4D69865B7AC571CAE6F2C3EB1F29BC2F1120BFEBD1C9D67BC6CACA1539850D2540CEF04304FD94C2F368D87E1CBE80C68B001AE2498A
Malicious:	false
Reputation:	unknown
Preview:	<?xml version="1.0" encoding="utf-8" ?>.<resources>. <stringres id="February">. <xmbtext>.nor</xmbtext>. </stringres>. <stringres id="March">. <xmbtext>B.ezen</xmbtext>. </stringres>. <stringres id="April">. <xmbtext>Duben</xmbtext>. </stringres>. <stringres id="May">. <xmbtext>Kv.ten</xmbtext>. </stringres>. <stringres id="June">. <xmbtext>.erven</xmbtext>. </stringres>. <stringres id="July">. <xmbtext>.ervenec</xmbtext>. </stringres>. <stringres id="August">. <xmbtext>Srpen</xmbtext>. </stringres>. <stringres id="September">. <xmbtext>Z...</xmbtext>. </stringres>. <stringres id="October">. <xmbtext>..jen</xmbtext>. </stringres>. <stringres id="November">. <xmbtext>Listopad</xmbtext>. </stringres>. <stringres id="December">. <xmbtext>Prosinec</xmbtext>. </stringres>. <stringres id="Jan">. <xmbtext>Leden</xmbtext>. </stringres>. <stringres id="Feb">. <xmbtext>.nor</xmbtext>. </stringres>. <stringres id="Mar">. <xmbtext>B.ezen</xmbtext>. </stringres>. <stringre

C:\Program Files (x86)\Google\Picasa3\cdautorun\Picasa CD Slideshow.app\Contents\Resources\da.lproj\i18n\cdgo.xml

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 text
Category:	dropped
Size (bytes):	770
Entropy (8bit):	4.813497860816478
Encrypted:	false
SSDEEP:	24:2dRTcwtQIzYpIzYVB+zYJJxO0nz8HPDJhz8Hjcl+9nC8:cuwtPIG0B4QVzi7yq+P
MD5:	123B88FE5C60EA9A93B6705A51DF462B
SHA1:	D6A60928827496C9AFDB149FC64D958AFD7198DC
SHA-256:	C1042AB6B76696EE91E2BA876F5AC1DA5C519ED2E4FE5BF2720706AE8FE42CA0
SHA-512:	217D63F33731201AE785807D192B7E6EC4DBEE11ECFBC88F23CB96B97E3BAC65D5253FE16482BC35C464BA26E997E351B47320FADB37300A2CA5F62FFEA4A196
Malicious:	false
Reputation:	unknown
Preview:	<?xml version="1.0" encoding="utf-8" ?>.<tooltips>. <action type="Label" target="cdgo/copytohd" xmbdesc="Label(cdgo/copytohd)">. <xmbtext>Gem p. disk</xmbtext>. </action>. <action type="Label" target="cdgo/eject" xmbdesc="Label(cdgo/eject)">. <xmbtext>Skub cd ud</xmbtext>. </action>. <action type="Label" target="cdgo/exit" xmbdesc="Label(cdgo/exit)">. <xmbtext>Afslut</xmbtext>. </action>. <action type="Label" target="cdgo/topicasa" xmbdesc="Label(cdgo/topicasa)">. <xmbtext>Importer til Picasa</xmbtext>. </action>. <action type="Text" target="cdgo/loading" xmbdesc="Text(cdgo/loading)">. <xmbtext>INDL.SER</xmbtext>. </action>. <action type="Text" target="cdgo/tpslabel" xmbdesc="Text(cdgo/tpslabel)">. <xmbtext>Visningstid</xmbtext>. </action>.</tooltips>.

C:\Program Files (x86)\Google\Picasa3\cdautorun\Picasa CD Slideshow.app\Contents\Resources\da.lproj\i18n\cdgo_resexport.xml

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe
File Type:	XML 1.0 document, ASCII text
Category:	dropped
Size (bytes):	52
Entropy (8bit):	4.849196208400893
Encrypted:	false
SSDEEP:	3:vFWWMNHU8LdgCzLZfOO:TMVBdTtfOO
MD5:	4BE3304509673D14428BD2FFC3070EF8
SHA1:	269C46096236A213905C8F2987CD0C422389D300
SHA-256:	CC678E75294007E177344FB3D841B23E1AA9877B4F5E22AACF93A8FE15FA5B4C
SHA-512:	96E17A55395AA231D5FDB5103A4A5C8D89074E3806909F6BDA2D275A614F01555549DB7280F9E48515AF472E4D0AABB5568D2589EBC1310218A970C3B09BCB1B
Malicious:	false
Reputation:	unknown
Preview:	<?xml version="1.0" encoding="utf-8" ?>.<Win32Res/>.

C:\Program Files (x86)\Google\Picasa3\cdautorun\Picasa CD Slideshow.app\Contents\Resources\da.lproj\i18n\cdgo_stringres.xml

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 text
Category:	dropped
Size (bytes):	6914
Entropy (8bit):	4.820213278766305
Encrypted:	false
SSDEEP:	192:93ABSjpmBCeTe5tEehe9joOB9sFTBsTZoqbS3ABSjpmBCeTe5tEehe9joOB9sFT+:GDCA4ECWc0DCA4ECWcOCCr
MD5:	802CE8AF73210C71150512C0F8A56A82
SHA1:	DA50587ACBEEEBEB34AE0F2112B038FC7DC6CE6A
SHA-256:	3E27CEF0B3DFBCDF7EBC7966D20C72431380A9016497E12D5547CE7DF792AD6F
SHA-512:	9872E82AD7472B708298157E1CC4751260A210BBEB0A312E417F3EC5615F55C77087CAC3060451381AED2EFD99724C64019FFA50EEA98012D29F202FD5967BAF
Malicious:	false
Reputation:	unknown
Preview:	<?xml version="1.0" encoding="utf-8" ?>.<resources>. <stringres id="February">. <xmbtext>Februar</xmbtext>. </stringres>. <stringres id="March">. <xmbtext>Marts</xmbtext>. </stringres>. <stringres id="April">. <xmbtext>April</xmbtext>. </stringres>. <stringres id="May">. <xmbtext>Maj</xmbtext>. </stringres>. <stringres id="June">. <xmbtext>Juni</xmbtext>. </stringres>. <stringres id="July">. <xmbtext>Juli</xmbtext>. </stringres>. <stringres id="August">. <xmbtext>August</xmbtext>. </stringres>. <stringres id="September">. <xmbtext>September</xmbtext>. </stringres>. <stringres id="October">. <xmbtext>Oktober</xmbtext>. </stringres>. <stringres id="November">. <xmbtext>November</xmbtext>. </stringres>. <stringres id="December">. <xmbtext>December</xmbtext>. </stringres>. <stringres id="Jan">. <xmbtext>Jan.</xmbtext>. </stringres>. <stringres id="Feb">. <xmbtext>Feb.</xmbtext>. </stringres>. <stringres id="Mar">. <xmbtext>Mar.</xmbtext>. </stringres>. <stringres id="Apr">.

C:\Program Files (x86)\Google\Picasa3\cdautorun\Picasa CD Slideshow.app\Contents\Resources\de.lproj\i18n\cdgo.xml

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 text
Category:	dropped
Size (bytes):	795
Entropy (8bit):	4.787799741704249
Encrypted:	false
SSDEEP:	24:2dRTcwtBbzYpizYVgzYJJAoz8HPDKyz8Hjcl+BCC8:cuwtBHIc0uQ9i9yq+Bw
MD5:	ED77D3A3971468CCF4C364BCEF039BF8
SHA1:	BF6399B66E1940A15D9B970BDE7014E1EE6CE126
SHA-256:	C04623B241EDFBD16E7E2C8C937822238137B4CDEEC0854B4EAB8404CAEF2C8F
SHA-512:	BDE0740BFCB742BE9A68FE9D72C71815DB831FF148F4E70F9ECFF39D9389D8124B42B05BD055D87E7063797364626B2DE135FB6B8A8A46C7650AC94154009BA5
Malicious:	false
Reputation:	unknown
Preview:	<?xml version="1.0" encoding="utf-8" ?>.<tooltips>. <action type="Label" target="cdgo/copytohd" xmbdesc="Label(cdgo/copytohd)">. <xmbtext>Auf Datentr.ger speichern</xmbtext>. </action>. <action type="Label" target="cdgo/eject" xmbdesc="Label(cdgo/eject)">. <xmbtext>CD auswerfen</xmbtext>. </action>. <action type="Label" target="cdgo/exit" xmbdesc="Label(cdgo/exit)">. <xmbtext>Beenden</xmbtext>. </action>. <action type="Label" target="cdgo/topicasa" xmbdesc="Label(cdgo/topicasa)">. <xmbtext>In Picasa importieren</xmbtext>. </action>. <action type="Text" target="cdgo/loading" xmbdesc="Text(cdgo/loading)">. <xmbtext>Wird geladen...</xmbtext>. </action>. <action type="Text" target="cdgo/tpslabel" xmbdesc="Text(cdgo/tpslabel)">. <xmbtext>Anzeigezeit</xmbtext>. </action>.</tooltips>.

C:\Program Files (x86)\Google\Picasa3\cdautorun\Picasa CD Slideshow.app\Contents\Resources\de.lproj\i18n\cdgo_resexport.xml

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe
File Type:	XML 1.0 document, ASCII text
Category:	dropped
Size (bytes):	52
Entropy (8bit):	4.849196208400893
Encrypted:	false
SSDEEP:	3:vFWWMNHU8LdgCzLZfOO:TMVBdTtfOO
MD5:	4BE3304509673D14428BD2FFC3070EF8
SHA1:	269C46096236A213905C8F2987CD0C422389D300
SHA-256:	CC678E75294007E177344FB3D841B23E1AA9877B4F5E22AACF93A8FE15FA5B4C
SHA-512:	96E17A55395AA231D5FDB5103A4A5C8D89074E3806909F6BDA2D275A614F01555549DB7280F9E48515AF472E4D0AABB5568D2589EBC1310218A970C3B09BCB1B
Malicious:	false
Reputation:	unknown
Preview:	<?xml version="1.0" encoding="utf-8" ?>.<Win32Res/>.

C:\Program Files (x86)\Google\Picasa3\cdautorun\Picasa CD Slideshow.app\Contents\Resources\de.lproj\i18n\cdgo_stringres.xml

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 text
Category:	dropped
Size (bytes):	7019
Entropy (8bit):	4.838791837139387
Encrypted:	false
SSDEEP:	192:93DBSapmBCeTe5tEehefejoMB9vKUBsTZoqES3DBSapmBCeTe5tEehefejoMB9vl:nMCA4ECcmliMCA4ECcml8T9NR2PX
MD5:	7868C9879DE50B3086A857C3A4739966
SHA1:	02FC816EA87D7A2924286CFE83D14EE545E4BA75
SHA-256:	2F57FF88B7B5A465B626815F66E9AAA6D13000D2D306864421525F069B734CBB
SHA-512:	6774A55F15F05F25C3E5D473E119417BAA77A00EB4B76412F864235432B1D18D5F1AC92F9081F43291C252EAA9F6382E98265938FD75BD2215B69BCE92C4A1C7
Malicious:	false
Reputation:	unknown
Preview:	<?xml version="1.0" encoding="utf-8" ?>.<resources>. <stringres id="February">. <xmbtext>Februar</xmbtext>. </stringres>. <stringres id="March">. <xmbtext>M.rz</xmbtext>. </stringres>. <stringres id="April">. <xmbtext>April</xmbtext>. </stringres>. <stringres id="May">. <xmbtext>Mai</xmbtext>. </stringres>. <stringres id="June">. <xmbtext>Juni</xmbtext>. </stringres>. <stringres id="July">. <xmbtext>Juli</xmbtext>. </stringres>. <stringres id="August">. <xmbtext>August</xmbtext>. </stringres>. <stringres id="September">. <xmbtext>September</xmbtext>. </stringres>. <stringres id="October">. <xmbtext>Oktober</xmbtext>. </stringres>. <stringres id="November">. <xmbtext>November</xmbtext>. </stringres>. <stringres id="December">. <xmbtext>Dezember</xmbtext>. </stringres>. <stringres id="Jan">. <xmbtext>Jan.</xmbtext>. </stringres>. <stringres id="Feb">. <xmbtext>Feb.</xmbtext>. </stringres>. <stringres id="Mar">. <xmbtext>M.rz</xmbtext>. </stringres>. <stringres id="Apr">.

C:\Program Files (x86)\Google\Picasa3\cdautorun\Picasa CD Slideshow.app\Contents\Resources\deletecursor.png

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe
File Type:	PNG image data, 19 x 19, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	3457
Entropy (8bit):	7.8958807928478745
Encrypted:	false
SSDEEP:	96:p7SDZ/I09Da01l+gmkyTt6Hk8nTjuEDFdtIEA:9SDS0tKg9E05TjuEJdtIEA
MD5:	B5AFBA48A6BD95039D539777D1D36344
SHA1:	EABC446055BB6996AB5FF031EC7018C9FBE69FE3
SHA-256:	84DFFAC37DAC7664C0B9D865893371A6047A83247FBD3A496D1E9D764FCE9E0C
SHA-512:	DCB1544CBCAF9E2DC3D5363E52C52E3CAC63B72974B7F9825A442CC1BAB159FE1CD104427097B71CFA0CD7CE5BF6E7FD39C15262D90E6A4493C76B5027492CCB
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR.............rP6.....pHYs................OiCCPPhotoshop ICC profile..x.SgTS..=...BK...KoR.. RB....&!..J.!...Q..EE..........Q,......!.........{.k.......>........H3Q5...B..........@..$p....d!s.#...~<<+".....x.....M..0.....B.\.....t.8K....@z.B..@F....&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH.............0Q..)..{.`.##x.....F.W<.+.....x..<.$9E.[.-q.WW..(.I.+.6a.a.@..y..2.4..............x.....6..._-..."bb....p@...t~..,/...;..m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<.....$.2].G......L.....b..G.......".Ib.X..Q.q.D...2.".B.).%..d..,..>.5..j>.{.-.]c..K'.Xt......o..(...h...w..?.G.%..fI.q..^D$.T.?....D...A....,.........`6.B$..B.B.d..r`)..B(...*`/.@.4.Qh..p...U..=p..a...(....A...a!..b.X#......!.H...$ ..Q"K.5H1R.T UH..=r.9.\F..;..2....G1...Q=...C..7..F...dt1......r..=.6...h..>C.0....3.l0...B.8,..c."......V.....c.w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.XH,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,

C:\Program Files (x86)\Google\Picasa3\cdautorun\Picasa CD Slideshow.app\Contents\Resources\dropper.png

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe
File Type:	PNG image data, 17 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	2987
Entropy (8bit):	7.876247509918229
Encrypted:	false
SSDEEP:	48:8/6DocieftI9G9f6A+FIDOWu0lDl+gm7QyTtctIInQSy6IVpqlnBcODO:8SDZ/I09Da01l+gmkyTt6Hk8nTO
MD5:	48859A55C1D756532482B621CCCF44E3
SHA1:	26E6AD14429CD5781CBB0C9E02ECC701CE4FCCD7
SHA-256:	51D304EAEB883B0CF864897D3AAFA0999CF2EC7FD7C4B7D1D37EC4E0D99967B9
SHA-512:	25BC88305A19FA2AAC7FE334C9596759F1294C552CFF68E8A0767ED13CE90001D1461BC6938B6F026D99878DE8F16F543470BBBCD5B333964572E6ACFC5E8868
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR..............1._....pHYs................OiCCPPhotoshop ICC profile..x.SgTS..=...BK...KoR.. RB....&!..J.!...Q..EE..........Q,......!.........{.k.......>........H3Q5...B..........@..$p....d!s.#...~<<+".....x.....M..0.....B.\.....t.8K....@z.B..@F....&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH.............0Q..)..{.`.##x.....F.W<.+.....x..<.$9E.[.-q.WW..(.I.+.6a.a.@..y..2.4..............x.....6..._-..."bb....p@...t~..,/...;..m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<.....$.2].G......L.....b..G.......".Ib.X..Q.q.D...2.".B.).%..d..,..>.5..j>.{.-.]c..K'.Xt......o..(...h...w..?.G.%..fI.q..^D$.T.?....D...A....,.........`6.B$..B.B.d..r`)..B(...*`/.@.4.Qh..p...U..=p..a...(....A...a!..b.X#......!.H...$ ..Q"K.5H1R.T UH..=r.9.\F..;..2....G1...Q=...C..7..F...dt1......r..=.6...h..>C.0....3.l0...B.8,..c."......V.....c.w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.XH,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,

C:\Program Files (x86)\Google\Picasa3\cdautorun\Picasa CD Slideshow.app\Contents\Resources\el.lproj\i18n\cdgo.xml

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 text
Category:	dropped
Size (bytes):	839
Entropy (8bit):	5.142432611333771
Encrypted:	false
SSDEEP:	24:2dRTcwtJ7zYp7zYVAzYJxE0nz8HPDjBKz8Hjcl+oEC8:cuwtJnIn0OQx/zijB0yq+oq
MD5:	D471389D97256CF1BC7DC666E022A7E6
SHA1:	0AA147F9E4D1E03F7A82C7AEA467FF5226434435
SHA-256:	D59152ECE50C6B68B1E8FCBE770DE6EF7D0A2C563108087F830ACFC0AD1B1E00
SHA-512:	E47ECA3487A33E3BEBA76C4668420B08ED3EDB01CC72930D66CE1B6A758C5E76212B0A503B318120253462DDE4E51D7F75E11B7E862F099E9A974E5D26596397
Malicious:	false
Reputation:	unknown
Preview:	<?xml version="1.0" encoding="utf-8" ?>.<tooltips>. <action type="Label" target="cdgo/copytohd" xmbdesc="Label(cdgo/copytohd)">. <xmbtext>.......... .... .....</xmbtext>. </action>. <action type="Label" target="cdgo/eject" xmbdesc="Label(cdgo/eject)">. <xmbtext>...... CD</xmbtext>. </action>. <action type="Label" target="cdgo/exit" xmbdesc="Label(cdgo/exit)">. <xmbtext>......</xmbtext>. </action>. <action type="Label" target="cdgo/topicasa" xmbdesc="Label(cdgo/topicasa)">. <xmbtext>........ ... Picasa</xmbtext>. </action>. <action type="Text" target="cdgo/loading" xmbdesc="Text(cdgo/loading)">. <xmbtext>.......</xmbtext>. </action>. <action type="Text" target="cdgo/tpslabel" xmbdesc="Text(cdgo/tpslabel)">. <xmbtext>........ ....</xmbtext>. </action>.</tooltips>.

C:\Program Files (x86)\Google\Picasa3\cdautorun\Picasa CD Slideshow.app\Contents\Resources\el.lproj\i18n\cdgo_resexport.xml

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe
File Type:	XML 1.0 document, ASCII text
Category:	dropped
Size (bytes):	52
Entropy (8bit):	4.849196208400893
Encrypted:	false
SSDEEP:	3:vFWWMNHU8LdgCzLZfOO:TMVBdTtfOO
MD5:	4BE3304509673D14428BD2FFC3070EF8
SHA1:	269C46096236A213905C8F2987CD0C422389D300
SHA-256:	CC678E75294007E177344FB3D841B23E1AA9877B4F5E22AACF93A8FE15FA5B4C
SHA-512:	96E17A55395AA231D5FDB5103A4A5C8D89074E3806909F6BDA2D275A614F01555549DB7280F9E48515AF472E4D0AABB5568D2589EBC1310218A970C3B09BCB1B
Malicious:	false
Reputation:	unknown
Preview:	<?xml version="1.0" encoding="utf-8" ?>.<Win32Res/>.

C:\Program Files (x86)\Google\Picasa3\cdautorun\Picasa CD Slideshow.app\Contents\Resources\el.lproj\i18n\cdgo_stringres.xml

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 text
Category:	dropped
Size (bytes):	7945
Entropy (8bit):	5.254207006443731
Encrypted:	false
SSDEEP:	192:9HbPYNaleQe7tEeJeJ7wyIpPFfhHo08CHbPYNaleQe7tEeJeJ7wyIpPFfhHo0QU5:bZYE2dZYE2TsGRQ5QJh
MD5:	E29BEA293109069FB8672820A93DF4A0
SHA1:	870EF4207F35474A8CC98BBFCE894D53096BB029
SHA-256:	12F711CB7970691242E5AE390A4FE071404F1D87F9B2A2960A06E32AFBFACA46
SHA-512:	68AA2765C524FF3EE5090053C167E83C48328FF8087D37EDCE5C3533DA3A183CBD9C94DC729A8259CAB97105B53FB0C43A312B39865BE1438384277412204D50
Malicious:	false
Reputation:	unknown
Preview:	<?xml version="1.0" encoding="utf-8" ?>.<resources>. <stringres id="February">. <xmbtext>...........</xmbtext>. </stringres>. <stringres id="March">. <xmbtext>.......</xmbtext>. </stringres>. <stringres id="April">. <xmbtext>........</xmbtext>. </stringres>. <stringres id="May">. <xmbtext>.....</xmbtext>. </stringres>. <stringres id="June">. <xmbtext>.......</xmbtext>. </stringres>. <stringres id="July">. <xmbtext>.......</xmbtext>. </stringres>. <stringres id="August">. <xmbtext>.........</xmbtext>. </stringres>. <stringres id="September">. <xmbtext>...........</xmbtext>. </stringres>. <stringres id="October">. <xmbtext>.........</xmbtext>. </stringres>. <stringres id="November">. <xmbtext>.........</xmbtext>. </stringres>. <stringres id="December">. <xmbtext>..........</xmbtext>. </stringres>. <stringres id="Jan">. <xmbtext>....</xmbtext>. </stringres>. <stringres id="Feb">. <

C:\Program Files (x86)\Google\Picasa3\cdautorun\Picasa CD Slideshow.app\Contents\Resources\en_GB.lproj\i18n\cdgo.xml

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe
File Type:	XML 1.0 document, ASCII text
Category:	dropped
Size (bytes):	762
Entropy (8bit):	4.779350508375538
Encrypted:	false
SSDEEP:	12:TMHdRWaD4w8MAv7d9dBaDFAgL/d9dBaDSHYTAgOCdrd9dBaDFAsx70Fd9dBKH2KL:2dRTcwtuZzYpdVzYVM6zYJJx70nz8HPL
MD5:	8D717340BA04AF7587787B44FCAAE4CC
SHA1:	609A6310FDD857839B3794B0E5E40128E8D7E59F
SHA-256:	BB6563EF8A2CEEBD80E570DF991787D96C4FFD925709377317AC817B0F9FCD79
SHA-512:	9E8A86EDA5A2518A8161152AD861FB97217445B467C5D24B71E1525780FCD5414DDACF461689CB692B2CB355BEFF3F096B343C92E813A0C7FF4DE949AFFF64FA
Malicious:	false
Reputation:	unknown
Preview:	<?xml version="1.0" encoding="utf-8" ?>.<tooltips>. <action type="Label" target="cdgo/copytohd" xmbdesc="Label(cdgo/copytohd)">. <xmbtext>Save to Disk</xmbtext>. </action>. <action type="Label" target="cdgo/eject" xmbdesc="Label(cdgo/eject)">. <xmbtext>Eject CD</xmbtext>. </action>. <action type="Label" target="cdgo/exit" xmbdesc="Label(cdgo/exit)">. <xmbtext>Exit</xmbtext>. </action>. <action type="Label" target="cdgo/topicasa" xmbdesc="Label(cdgo/topicasa)">. <xmbtext>Import To Picasa</xmbtext>. </action>. <action type="Text" target="cdgo/loading" xmbdesc="Text(cdgo/loading)">. <xmbtext>LOADING</xmbtext>. </action>. <action type="Text" target="cdgo/tpslabel" xmbdesc="Text(cdgo/tpslabel)">. <xmbtext>Display Time</xmbtext>. </action>.</tooltips>.

C:\Program Files (x86)\Google\Picasa3\cdautorun\Picasa CD Slideshow.app\Contents\Resources\en_GB.lproj\i18n\cdgo_resexport.xml

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe
File Type:	XML 1.0 document, ASCII text
Category:	dropped
Size (bytes):	52
Entropy (8bit):	4.849196208400893
Encrypted:	false
SSDEEP:	3:vFWWMNHU8LdgCzLZfOO:TMVBdTtfOO
MD5:	4BE3304509673D14428BD2FFC3070EF8
SHA1:	269C46096236A213905C8F2987CD0C422389D300
SHA-256:	CC678E75294007E177344FB3D841B23E1AA9877B4F5E22AACF93A8FE15FA5B4C
SHA-512:	96E17A55395AA231D5FDB5103A4A5C8D89074E3806909F6BDA2D275A614F01555549DB7280F9E48515AF472E4D0AABB5568D2589EBC1310218A970C3B09BCB1B
Malicious:	false
Reputation:	unknown
Preview:	<?xml version="1.0" encoding="utf-8" ?>.<Win32Res/>.

C:\Program Files (x86)\Google\Picasa3\cdautorun\Picasa CD Slideshow.app\Contents\Resources\en_GB.lproj\i18n\cdgo_stringres.xml

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe
File Type:	XML 1.0 document, ASCII text
Category:	dropped
Size (bytes):	6814
Entropy (8bit):	4.784219849613369
Encrypted:	false
SSDEEP:	192:9w6BSKl2BCeTehtEehe9/8YBZ/BnBg5/oeNHw6BSKl2BCeTehtEehe9/8YBZ/Bna:3oCAAECwZ6oCAAECwZwnvd
MD5:	CF88E10EEC7F7928B42B97D8F2C54C8D
SHA1:	DBE90398F8AD81567E1E6B2490DE5D7D8F921E29
SHA-256:	56851C251EC72E7D5199B4DA6358BDAB6503F752433AD84C7AAE823FF42D2BE0
SHA-512:	74A8C05FF2CF9D13B4FF110CCF08364E958A3D67777A40C9B850370D8144F46083D8D9A30CBBC2551A3993B9E751F16FE87991B9BAFAADE432D9FD290BFAED15
Malicious:	false
Reputation:	unknown
Preview:	<?xml version="1.0" encoding="utf-8" ?>.<resources>. <stringres id="February">. <xmbtext>February</xmbtext>. </stringres>. <stringres id="March">. <xmbtext>March</xmbtext>. </stringres>. <stringres id="April">. <xmbtext>April</xmbtext>. </stringres>. <stringres id="May">. <xmbtext>May</xmbtext>. </stringres>. <stringres id="June">. <xmbtext>June</xmbtext>. </stringres>. <stringres id="July">. <xmbtext>July</xmbtext>. </stringres>. <stringres id="August">. <xmbtext>August</xmbtext>. </stringres>. <stringres id="September">. <xmbtext>September</xmbtext>. </stringres>. <stringres id="October">. <xmbtext>October</xmbtext>. </stringres>. <stringres id="November">. <xmbtext>November</xmbtext>. </stringres>. <stringres id="December">. <xmbtext>December</xmbtext>. </stringres>. <stringres id="Jan">. <xmbtext>Jan</xmbtext>. </stringres>. <stringres id="Feb">. <xmbtext>Feb</xmbtext>. </stringres>. <stringres id="Mar">. <xmbtext>Mar</xmbtext>. </stringres>. <stringres id="Apr">. <x

C:\Program Files (x86)\Google\Picasa3\cdautorun\Picasa CD Slideshow.app\Contents\Resources\es.lproj\i18n\cdgo.xml

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 text
Category:	dropped
Size (bytes):	781
Entropy (8bit):	4.819084254128611
Encrypted:	false
SSDEEP:	24:2dRTcwt6zYpmzYVuzYJJx80nz8HPDcz8Hjcl+vZnC8:cuwtEIQ0IQfziKyq+n
MD5:	35928A518F26AC56CA37D6274294E8A7
SHA1:	018399099FE5FF850D5A9F82FABA06DDD59C5956
SHA-256:	BA86747270D6F9DA6F0D3C9717F7A2297D3B0B64ABA01813DECC42FDB40503DB
SHA-512:	926CF6074739C37EC35D24D810BFED7ADC8A01BFE3E110E80BC65CA394130EAC599F603EA4B46D883705CD1501BE79C3615969F5C8891158EF182E6CEB8AF855
Malicious:	false
Reputation:	unknown
Preview:	<?xml version="1.0" encoding="utf-8" ?>.<tooltips>. <action type="Label" target="cdgo/copytohd" xmbdesc="Label(cdgo/copytohd)">. <xmbtext>Guardar en disco</xmbtext>. </action>. <action type="Label" target="cdgo/eject" xmbdesc="Label(cdgo/eject)">. <xmbtext>Expulsar CD</xmbtext>. </action>. <action type="Label" target="cdgo/exit" xmbdesc="Label(cdgo/exit)">. <xmbtext>Salir</xmbtext>. </action>. <action type="Label" target="cdgo/topicasa" xmbdesc="Label(cdgo/topicasa)">. <xmbtext>Importar a Picasa</xmbtext>. </action>. <action type="Text" target="cdgo/loading" xmbdesc="Text(cdgo/loading)">. <xmbtext>CARGANDO</xmbtext>. </action>. <action type="Text" target="cdgo/tpslabel" xmbdesc="Text(cdgo/tpslabel)">. <xmbtext>Tiempo visualizaci.n</xmbtext>. </action>.</tooltips>.

C:\Program Files (x86)\Google\Picasa3\cdautorun\Picasa CD Slideshow.app\Contents\Resources\es.lproj\i18n\cdgo_resexport.xml

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe
File Type:	XML 1.0 document, ASCII text
Category:	dropped
Size (bytes):	52
Entropy (8bit):	4.849196208400893
Encrypted:	false
SSDEEP:	3:vFWWMNHU8LdgCzLZfOO:TMVBdTtfOO
MD5:	4BE3304509673D14428BD2FFC3070EF8
SHA1:	269C46096236A213905C8F2987CD0C422389D300
SHA-256:	CC678E75294007E177344FB3D841B23E1AA9877B4F5E22AACF93A8FE15FA5B4C
SHA-512:	96E17A55395AA231D5FDB5103A4A5C8D89074E3806909F6BDA2D275A614F01555549DB7280F9E48515AF472E4D0AABB5568D2589EBC1310218A970C3B09BCB1B
Malicious:	false
Reputation:	unknown
Preview:	<?xml version="1.0" encoding="utf-8" ?>.<Win32Res/>.

C:\Program Files (x86)\Google\Picasa3\cdautorun\Picasa CD Slideshow.app\Contents\Resources\es.lproj\i18n\cdgo_stringres.xml

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 text
Category:	dropped
Size (bytes):	6961
Entropy (8bit):	4.795338911251756
Encrypted:	false
SSDEEP:	192:9PqB4pI/BgeOeltEewekW8YBHeBnBq5/oeBv8PqB4pI/BgeOeltEewekW8YBHeBn:MpgPMEtUAE3pgPMEtUAQTM
MD5:	7FA101071E9C503DDA29A74AE6F2D176
SHA1:	E18A06C8B39526B7EACEB89B68C93DCCA0EC52C3
SHA-256:	1BC104F58D1AC0117A14973D2D5DBA9EA5826A56B173C861AC5251690C4CABF5
SHA-512:	FE2DE9759A462214BD5040D0E34E6D63F6B25494743634DDC1FC1A613EEF568E70D397C662D985604F99E325326FBABBB9A9BF44F3DBD116EC326E55E14A65EC
Malicious:	false
Reputation:	unknown
Preview:	<?xml version="1.0" encoding="utf-8" ?>.<resources>. <stringres id="February">. <xmbtext>Febrero</xmbtext>. </stringres>. <stringres id="March">. <xmbtext>Marzo</xmbtext>. </stringres>. <stringres id="April">. <xmbtext>Abril</xmbtext>. </stringres>. <stringres id="May">. <xmbtext>Mayo</xmbtext>. </stringres>. <stringres id="June">. <xmbtext>Junio</xmbtext>. </stringres>. <stringres id="July">. <xmbtext>Julio</xmbtext>. </stringres>. <stringres id="August">. <xmbtext>Agosto</xmbtext>. </stringres>. <stringres id="September">. <xmbtext>Septiembre</xmbtext>. </stringres>. <stringres id="October">. <xmbtext>Octubre</xmbtext>. </stringres>. <stringres id="November">. <xmbtext>Noviembre</xmbtext>. </stringres>. <stringres id="December">. <xmbtext>Diciembre</xmbtext>. </stringres>. <stringres id="Jan">. <xmbtext>Ene</xmbtext>. </stringres>. <stringres id="Feb">. <xmbtext>Feb</xmbtext>. </stringres>. <stringres id="Mar">. <xmbtext>Mar</xmbtext>. </stringres>. <stringres id="Apr">

C:\Program Files (x86)\Google\Picasa3\cdautorun\Picasa CD Slideshow.app\Contents\Resources\fi.lproj\i18n\cdgo.xml

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 text
Category:	dropped
Size (bytes):	780
Entropy (8bit):	4.79433324933398
Encrypted:	false
SSDEEP:	24:2dRTcwt3PzYpnZMzYVhzYJF9z8HPD3z8Hjcl+mC8:cuwtbInQ0BQbijyq+k
MD5:	1C257953C7AB2F052FE095E4840DF0FC
SHA1:	D1B8B5082C5D0DB8633C4E5C3225493EA3695A84
SHA-256:	0E90426CF2DBCB2AD65DC1D53B1028C8339C3B73B25A2582840C69E1BDBA8DD9
SHA-512:	EF2BDEC1A7715A94F6AE59B9DD816AE997F387F30198139A94E04C1BB0D52C2EA23FA8C79B7A3436EDBE8FDBFB66C255A2F9AA481B7C974F917DE7D526EC63BB
Malicious:	false
Reputation:	unknown
Preview:	<?xml version="1.0" encoding="utf-8" ?>.<tooltips>. <action type="Label" target="cdgo/copytohd" xmbdesc="Label(cdgo/copytohd)">. <xmbtext>Tallenna levylle</xmbtext>. </action>. <action type="Label" target="cdgo/eject" xmbdesc="Label(cdgo/eject)">. <xmbtext>Poista CD-levy asemasta</xmbtext>. </action>. <action type="Label" target="cdgo/exit" xmbdesc="Label(cdgo/exit)">. <xmbtext>Poistu</xmbtext>. </action>. <action type="Label" target="cdgo/topicasa" xmbdesc="Label(cdgo/topicasa)">. <xmbtext>Tuo Picasaan</xmbtext>. </action>. <action type="Text" target="cdgo/loading" xmbdesc="Text(cdgo/loading)">. <xmbtext>LADATAAN</xmbtext>. </action>. <action type="Text" target="cdgo/tpslabel" xmbdesc="Text(cdgo/tpslabel)">. <xmbtext>N.yt. aika</xmbtext>. </action>.</tooltips>.

C:\Program Files (x86)\Google\Picasa3\cdautorun\Picasa CD Slideshow.app\Contents\Resources\fi.lproj\i18n\cdgo_resexport.xml

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe
File Type:	XML 1.0 document, ASCII text
Category:	dropped
Size (bytes):	52
Entropy (8bit):	4.849196208400893
Encrypted:	false
SSDEEP:	3:vFWWMNHU8LdgCzLZfOO:TMVBdTtfOO
MD5:	4BE3304509673D14428BD2FFC3070EF8
SHA1:	269C46096236A213905C8F2987CD0C422389D300
SHA-256:	CC678E75294007E177344FB3D841B23E1AA9877B4F5E22AACF93A8FE15FA5B4C
SHA-512:	96E17A55395AA231D5FDB5103A4A5C8D89074E3806909F6BDA2D275A614F01555549DB7280F9E48515AF472E4D0AABB5568D2589EBC1310218A970C3B09BCB1B
Malicious:	false
Reputation:	unknown
Preview:	<?xml version="1.0" encoding="utf-8" ?>.<Win32Res/>.

C:\Program Files (x86)\Google\Picasa3\cdautorun\Picasa CD Slideshow.app\Contents\Resources\fi.lproj\i18n\cdgo_stringres.xml

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 text
Category:	dropped
Size (bytes):	6905
Entropy (8bit):	4.845944701581684
Encrypted:	false
SSDEEP:	192:9EpLtEq8eTettEe2eI64LfSxU9smob7uEpLtEq8eTettEe2eI64LfSxU9smobLU3:rcoE3ncoE3xqWB7b
MD5:	EAE66073F77B2CA96CB270F9490F7CB9
SHA1:	EEE18611696A976043A68A28262C57C7BE61D9E9
SHA-256:	38EF664D77777F82657EDBE14669CC54D8AD326753530B6B88A98AF74154C443
SHA-512:	9DF3FE80E470D9905BC7D1AFF0473E483DE294F2A5C379FBDBFA28E69D48B6F8D1714A805258E4CF6F18C580705C69FA311EA15F76A502CD444BD77BD0DB63F9
Malicious:	false
Reputation:	unknown
Preview:	<?xml version="1.0" encoding="utf-8" ?>.<resources>. <stringres id="February">. <xmbtext>Helmikuu</xmbtext>. </stringres>. <stringres id="March">. <xmbtext>Maaliskuu</xmbtext>. </stringres>. <stringres id="April">. <xmbtext>Huhtikuu</xmbtext>. </stringres>. <stringres id="May">. <xmbtext>Touko</xmbtext>. </stringres>. <stringres id="June">. <xmbtext>Kes.kuu</xmbtext>. </stringres>. <stringres id="July">. <xmbtext>Hein.kuu</xmbtext>. </stringres>. <stringres id="August">. <xmbtext>Elokuu</xmbtext>. </stringres>. <stringres id="September">. <xmbtext>Syyskuu</xmbtext>. </stringres>. <stringres id="October">. <xmbtext>Lokakuu</xmbtext>. </stringres>. <stringres id="November">. <xmbtext>Marraskuu</xmbtext>. </stringres>. <stringres id="December">. <xmbtext>Joulukuu</xmbtext>. </stringres>. <stringres id="Jan">. <xmbtext>Tam</xmbtext>. </stringres>. <stringres id="Feb">. <xmbtext>Hel</xmbtext>. </stringres>. <stringres id="Mar">. <xmbtext>Maa</xmbtext>. </stringres>. <stringr

C:\Program Files (x86)\Google\Picasa3\cdautorun\Picasa CD Slideshow.app\Contents\Resources\fil.lproj\i18n\cdgo.xml

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe
File Type:	XML 1.0 document, ASCII text
Category:	dropped
Size (bytes):	781
Entropy (8bit):	4.814194045266143
Encrypted:	false
SSDEEP:	24:2dRTcwtJXPzYpJoIzYVM6zYJJF/M0nz8HPDNz8Hjcl+JyC8:cuwtBId0MEQbzi9yq+W
MD5:	2A6599215282F275F9C542C802DC2F1F
SHA1:	6007211F45C2C5C41ED7F5EB5D3EE4B10D52119F
SHA-256:	DDC709715EA8EC4EADC62E24A2029EB6A7CCBB8CBF75FA4656F0D11E2A1F0284
SHA-512:	2230B30382C809ADBF2DE6A12ECEFB6AE791A90B5418BE80F1222632CB27FEF35015F602CBC44E2E8934B53C023DFCFA60172E5364FE4D8244BD39128FE3214F
Malicious:	false
Reputation:	unknown
Preview:	<?xml version="1.0" encoding="utf-8" ?>.<tooltips>. <action type="Label" target="cdgo/copytohd" xmbdesc="Label(cdgo/copytohd)">. <xmbtext>I-save sa Disk</xmbtext>. </action>. <action type="Label" target="cdgo/eject" xmbdesc="Label(cdgo/eject)">. <xmbtext>I-eject ang CD</xmbtext>. </action>. <action type="Label" target="cdgo/exit" xmbdesc="Label(cdgo/exit)">. <xmbtext>Exit</xmbtext>. </action>. <action type="Label" target="cdgo/topicasa" xmbdesc="Label(cdgo/topicasa)">. <xmbtext>I-import Sa Picasa</xmbtext>. </action>. <action type="Text" target="cdgo/loading" xmbdesc="Text(cdgo/loading)">. <xmbtext>NAGLO-LOAD</xmbtext>. </action>. <action type="Text" target="cdgo/tpslabel" xmbdesc="Text(cdgo/tpslabel)">. <xmbtext>I-display ang Oras</xmbtext>. </action>.</tooltips>.

C:\Program Files (x86)\Google\Picasa3\cdautorun\Picasa CD Slideshow.app\Contents\Resources\fil.lproj\i18n\cdgo_resexport.xml

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe
File Type:	XML 1.0 document, ASCII text
Category:	dropped
Size (bytes):	52
Entropy (8bit):	4.849196208400893
Encrypted:	false
SSDEEP:	3:vFWWMNHU8LdgCzLZfOO:TMVBdTtfOO
MD5:	4BE3304509673D14428BD2FFC3070EF8
SHA1:	269C46096236A213905C8F2987CD0C422389D300
SHA-256:	CC678E75294007E177344FB3D841B23E1AA9877B4F5E22AACF93A8FE15FA5B4C
SHA-512:	96E17A55395AA231D5FDB5103A4A5C8D89074E3806909F6BDA2D275A614F01555549DB7280F9E48515AF472E4D0AABB5568D2589EBC1310218A970C3B09BCB1B
Malicious:	false
Reputation:	unknown
Preview:	<?xml version="1.0" encoding="utf-8" ?>.<Win32Res/>.

C:\Program Files (x86)\Google\Picasa3\cdautorun\Picasa CD Slideshow.app\Contents\Resources\fil.lproj\i18n\cdgo_stringres.xml

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe
File Type:	XML 1.0 document, ASCII text
Category:	dropped
Size (bytes):	6920
Entropy (8bit):	4.796882116099494
Encrypted:	false
SSDEEP:	192:91VB4p6hBgeGettEe8eEWiYBHeLVBqVHoyxv81VB4p6hBgeGettEe8eEWiYBHeLz:3VgR0ERaE8kVgR0ERaEEuaXKb
MD5:	4D8735F18982CD39BB276B95D3F25B11
SHA1:	B0DD645EE2F61E06721C384F14198475F8C6531E
SHA-256:	2F86A2A92A8AA50595B460FC2F7B7A5529F578E7A2847E344DC628C7578B38F8
SHA-512:	154D943BF643B18B35095B0F8CEB677F029F1CC71D7D463032D769BFD2013A7D7E265EE5DB92B4B8DBD9B12EB69D56A8B675D093C219CFD284DC59D35441BEB6
Malicious:	false
Reputation:	unknown
Preview:	<?xml version="1.0" encoding="utf-8" ?>.<resources>. <stringres id="February">. <xmbtext>Pebrero</xmbtext>. </stringres>. <stringres id="March">. <xmbtext>Marso</xmbtext>. </stringres>. <stringres id="April">. <xmbtext>Abril</xmbtext>. </stringres>. <stringres id="May">. <xmbtext>Mayo</xmbtext>. </stringres>. <stringres id="June">. <xmbtext>Hunyo</xmbtext>. </stringres>. <stringres id="July">. <xmbtext>Hulyo</xmbtext>. </stringres>. <stringres id="August">. <xmbtext>Agosto</xmbtext>. </stringres>. <stringres id="September">. <xmbtext>Setyembre</xmbtext>. </stringres>. <stringres id="October">. <xmbtext>Oktubre</xmbtext>. </stringres>. <stringres id="November">. <xmbtext>Nobyembre</xmbtext>. </stringres>. <stringres id="December">. <xmbtext>Disyembre</xmbtext>. </stringres>. <stringres id="Jan">. <xmbtext>Ene</xmbtext>. </stringres>. <stringres id="Feb">. <xmbtext>Peb</xmbtext>. </stringres>. <stringres id="Mar">. <xmbtext>Mar</xmbtext>. </stringres>. <stringres id="Apr">.

C:\Program Files (x86)\Google\Picasa3\cdautorun\Picasa CD Slideshow.app\Contents\Resources\fr.lproj\i18n\cdgo.xml

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 text
Category:	dropped
Size (bytes):	802
Entropy (8bit):	4.885944460690214
Encrypted:	false
SSDEEP:	24:2dRTcwtPzYpRszYVRLzYJJx2U0nz8HPDzz8Hjcl+oz6C8:cuwtrIR60RXQIzivyq+os
MD5:	56E43F65C7CA3401DC17D5E828CC87BD
SHA1:	91F92E48CC615E962A9F96CFFAF11919CE37A346
SHA-256:	2B5C8CFC2FEE75932ADFAB5B6FB6081A4726EE38A101C41DC96F113809B88519
SHA-512:	5868B1417AD08F9892A21A3D38D99A44701692706F4820064F5512F87F0A5A9436D10CF1249FD687F2BB2EA12DF87A3EF4E0BC7DA08452F3CF0BA6889CA4513B
Malicious:	false
Reputation:	unknown
Preview:	<?xml version="1.0" encoding="utf-8" ?>.<tooltips>. <action type="Label" target="cdgo/copytohd" xmbdesc="Label(cdgo/copytohd)">. <xmbtext>Enregistrer sur le disque</xmbtext>. </action>. <action type="Label" target="cdgo/eject" xmbdesc="Label(cdgo/eject)">. <xmbtext>.jecter le CD</xmbtext>. </action>. <action type="Label" target="cdgo/exit" xmbdesc="Label(cdgo/exit)">. <xmbtext>Quitter</xmbtext>. </action>. <action type="Label" target="cdgo/topicasa" xmbdesc="Label(cdgo/topicasa)">. <xmbtext>Importer dans Picasa</xmbtext>. </action>. <action type="Text" target="cdgo/loading" xmbdesc="Text(cdgo/loading)">. <xmbtext>CHARGEMENT</xmbtext>. </action>. <action type="Text" target="cdgo/tpslabel" xmbdesc="Text(cdgo/tpslabel)">. <xmbtext>Dur.e d'affichage</xmbtext>. </action>.</tooltips>.

C:\Program Files (x86)\Google\Picasa3\cdautorun\Picasa CD Slideshow.app\Contents\Resources\fr.lproj\i18n\cdgo_resexport.xml

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe
File Type:	XML 1.0 document, ASCII text
Category:	dropped
Size (bytes):	52
Entropy (8bit):	4.849196208400893
Encrypted:	false
SSDEEP:	3:vFWWMNHU8LdgCzLZfOO:TMVBdTtfOO
MD5:	4BE3304509673D14428BD2FFC3070EF8
SHA1:	269C46096236A213905C8F2987CD0C422389D300
SHA-256:	CC678E75294007E177344FB3D841B23E1AA9877B4F5E22AACF93A8FE15FA5B4C
SHA-512:	96E17A55395AA231D5FDB5103A4A5C8D89074E3806909F6BDA2D275A614F01555549DB7280F9E48515AF472E4D0AABB5568D2589EBC1310218A970C3B09BCB1B
Malicious:	false
Reputation:	unknown
Preview:	<?xml version="1.0" encoding="utf-8" ?>.<Win32Res/>.

C:\Program Files (x86)\Google\Picasa3\cdautorun\Picasa CD Slideshow.app\Contents\Resources\fr.lproj\i18n\cdgo_stringres.xml

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 text
Category:	dropped
Size (bytes):	7014
Entropy (8bit):	4.847048376993295
Encrypted:	false
SSDEEP:	192:9Q5sC639xehe7tEe7e2v7rNPEoF3xoKq+Q5sC639xehe7tEe7e2v7rNPEoF3xoK0:Sk26Ecsk26EcW0K
MD5:	1706D46289FAE42B983F27DB9E08CCCF
SHA1:	43CEC722EAE0E41B4DE614E3396C5CBEE29CE504
SHA-256:	795F858E04DEB44C60408BE934FF65270DCE7211D8B50A5BEE9FF41DE228031A
SHA-512:	FFDA6FF21B2951C60140DBD0892BE49839D5A55770AEE55FBAAEB62A3884246BB8531F5064D233C73D27EFE14E076C69435621C997A10EBE850BC6EDC4934461
Malicious:	false
Reputation:	unknown
Preview:	<?xml version="1.0" encoding="utf-8" ?>.<resources>. <stringres id="February">. <xmbtext>f.vrier</xmbtext>. </stringres>. <stringres id="March">. <xmbtext>mars</xmbtext>. </stringres>. <stringres id="April">. <xmbtext>avril</xmbtext>. </stringres>. <stringres id="May">. <xmbtext>mai</xmbtext>. </stringres>. <stringres id="June">. <xmbtext>juin</xmbtext>. </stringres>. <stringres id="July">. <xmbtext>juillet</xmbtext>. </stringres>. <stringres id="August">. <xmbtext>ao.t</xmbtext>. </stringres>. <stringres id="September">. <xmbtext>septembre</xmbtext>. </stringres>. <stringres id="October">. <xmbtext>octobre</xmbtext>. </stringres>. <stringres id="November">. <xmbtext>novembre</xmbtext>. </stringres>. <stringres id="December">. <xmbtext>d.cembre</xmbtext>. </stringres>. <stringres id="Jan">. <xmbtext>janv.</xmbtext>. </stringres>. <stringres id="Feb">. <xmbtext>f.vr.</xmbtext>. </stringres>. <stringres id="Mar">. <xmbtext>mars</xmbtext>. </stringres>. <stringres id="Ap

C:\Program Files (x86)\Google\Picasa3\cdautorun\Picasa CD Slideshow.app\Contents\Resources\hr.lproj\i18n\cdgo.xml

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 text
Category:	dropped
Size (bytes):	779
Entropy (8bit):	4.862461291246003
Encrypted:	false
SSDEEP:	24:2dRTcwtlzYpJCzYVJHzYJr9s0nz8HPDjz8Hjcl+wC8:cuwtFIi0hQBHzi/yq+2
MD5:	44050051F886DB0894AEA5C160147464
SHA1:	C1A309AF89516978813935948DC8A11FE52D19B1
SHA-256:	46DA9979AAA0B2C4D51931987DB901ED4DD9E687CD98BEB757A8033B81D27459
SHA-512:	E33FC21380988CF322F87CB215454E3BCCC44E222439C0A127F3F6939552C37027F8A217518854359E60DE3698D9B6A639FAF08B5F9113BA14F93C1FC252DC27
Malicious:	false
Reputation:	unknown
Preview:	<?xml version="1.0" encoding="utf-8" ?>.<tooltips>. <action type="Label" target="cdgo/copytohd" xmbdesc="Label(cdgo/copytohd)">. <xmbtext>Spremi na disk</xmbtext>. </action>. <action type="Label" target="cdgo/eject" xmbdesc="Label(cdgo/eject)">. <xmbtext>Izbaci CD</xmbtext>. </action>. <action type="Label" target="cdgo/exit" xmbdesc="Label(cdgo/exit)">. <xmbtext>Izlaz</xmbtext>. </action>. <action type="Label" target="cdgo/topicasa" xmbdesc="Label(cdgo/topicasa)">. <xmbtext>Uvezi u uslugu Picasa</xmbtext>. </action>. <action type="Text" target="cdgo/loading" xmbdesc="Text(cdgo/loading)">. <xmbtext>U.ITAVA SE</xmbtext>. </action>. <action type="Text" target="cdgo/tpslabel" xmbdesc="Text(cdgo/tpslabel)">. <xmbtext>Prika.i vrijeme</xmbtext>. </action>.</tooltips>.

C:\Program Files (x86)\Google\Picasa3\cdautorun\Picasa CD Slideshow.app\Contents\Resources\hr.lproj\i18n\cdgo_resexport.xml

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe
File Type:	XML 1.0 document, ASCII text
Category:	dropped
Size (bytes):	52
Entropy (8bit):	4.849196208400893
Encrypted:	false
SSDEEP:	3:vFWWMNHU8LdgCzLZfOO:TMVBdTtfOO
MD5:	4BE3304509673D14428BD2FFC3070EF8
SHA1:	269C46096236A213905C8F2987CD0C422389D300
SHA-256:	CC678E75294007E177344FB3D841B23E1AA9877B4F5E22AACF93A8FE15FA5B4C
SHA-512:	96E17A55395AA231D5FDB5103A4A5C8D89074E3806909F6BDA2D275A614F01555549DB7280F9E48515AF472E4D0AABB5568D2589EBC1310218A970C3B09BCB1B
Malicious:	false
Reputation:	unknown
Preview:	<?xml version="1.0" encoding="utf-8" ?>.<Win32Res/>.

C:\Program Files (x86)\Google\Picasa3\cdautorun\Picasa CD Slideshow.app\Contents\Resources\hr.lproj\i18n\cdgo_stringres.xml

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 text
Category:	dropped
Size (bytes):	6980
Entropy (8bit):	4.8625900766931265
Encrypted:	false
SSDEEP:	192:9qQEWBShe0eftEe3edaL/DrZrtKRo1QwqQEWBShe0eftEe3edaL/DrZrtKRo1cU3:w30EiO30EiHMubBh
MD5:	20A27AB22001A03B746F5FCFB4F0019A
SHA1:	7D41DCA5B324C3E90AC18873EB2869F51EE5D66E
SHA-256:	022BFCF29CC0B948316DE8531A195B91B0F720A087E3B8B74E1C6206EF1103D9
SHA-512:	2ABA5C84192B9556A50841D9DC5B0C22F3BF88E2088A5037536E83A353B5EACDF41F0CC4F0A968554D1940A6917E232EA07CFCE4DFF5AF1EEAA9CAA92FDDA27E
Malicious:	false
Reputation:	unknown
Preview:	<?xml version="1.0" encoding="utf-8" ?>.<resources>. <stringres id="February">. <xmbtext>velja.a</xmbtext>. </stringres>. <stringres id="March">. <xmbtext>o.ujak</xmbtext>. </stringres>. <stringres id="April">. <xmbtext>travanj</xmbtext>. </stringres>. <stringres id="May">. <xmbtext>Svibanj</xmbtext>. </stringres>. <stringres id="June">. <xmbtext>Lipanj</xmbtext>. </stringres>. <stringres id="July">. <xmbtext>Srpanj</xmbtext>. </stringres>. <stringres id="August">. <xmbtext>kolovoz</xmbtext>. </stringres>. <stringres id="September">. <xmbtext>Rujan</xmbtext>. </stringres>. <stringres id="October">. <xmbtext>listopad</xmbtext>. </stringres>. <stringres id="November">. <xmbtext>Studeni</xmbtext>. </stringres>. <stringres id="December">. <xmbtext>prosinac</xmbtext>. </stringres>. <stringres id="Jan">. <xmbtext>Sij</xmbtext>. </stringres>. <stringres id="Feb">. <xmbtext>Vlj</xmbtext>. </stringres>. <stringres id="Mar">. <xmbtext>O.u</xmbtext>. </stringres>. <stringres id="

C:\Program Files (x86)\Google\Picasa3\cdautorun\Picasa CD Slideshow.app\Contents\Resources\hu.lproj\i18n\cdgo.xml

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 text
Category:	dropped
Size (bytes):	792
Entropy (8bit):	4.883497005999869
Encrypted:	false
SSDEEP:	24:2dRTcwtzozYpnzYVYzYJJxmCz8HPDaz8Hjcl+9jC8:cuwtzmIz02Qhikyq+9h
MD5:	DD7D1213432B281BC67CDF21CDED33D6
SHA1:	5C1D75152CCB89B0A378FBE2085D90FC40B1ED25
SHA-256:	7588F20D670D1EB6DB3AA8DD943684B0B1310A8B76080C12F63AF20757DACFB0
SHA-512:	21957939B6C52EB6CBF3E1ADBC1DB56F855F4A7A9BCCD4D42F4AB224E6221225BD6BD53AA791FC5C649021F72AF3650445A24A0CC3A217038BE522FC09DB93F7
Malicious:	false
Reputation:	unknown
Preview:	<?xml version="1.0" encoding="utf-8" ?>.<tooltips>. <action type="Label" target="cdgo/copytohd" xmbdesc="Label(cdgo/copytohd)">. <xmbtext>Ment.s lemezre</xmbtext>. </action>. <action type="Label" target="cdgo/eject" xmbdesc="Label(cdgo/eject)">. <xmbtext>CD kiad.sa</xmbtext>. </action>. <action type="Label" target="cdgo/exit" xmbdesc="Label(cdgo/exit)">. <xmbtext>Kil.p.s</xmbtext>. </action>. <action type="Label" target="cdgo/topicasa" xmbdesc="Label(cdgo/topicasa)">. <xmbtext>Import.l.s a Picas.ba</xmbtext>. </action>. <action type="Text" target="cdgo/loading" xmbdesc="Text(cdgo/loading)">. <xmbtext>BET.LT.S</xmbtext>. </action>. <action type="Text" target="cdgo/tpslabel" xmbdesc="Text(cdgo/tpslabel)">. <xmbtext>Megjelen.t.si id.</xmbtext>. </action>.</tooltips>.

C:\Program Files (x86)\Google\Picasa3\cdautorun\Picasa CD Slideshow.app\Contents\Resources\hu.lproj\i18n\cdgo_resexport.xml

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe
File Type:	XML 1.0 document, ASCII text
Category:	dropped
Size (bytes):	52
Entropy (8bit):	4.849196208400893
Encrypted:	false
SSDEEP:	3:vFWWMNHU8LdgCzLZfOO:TMVBdTtfOO
MD5:	4BE3304509673D14428BD2FFC3070EF8
SHA1:	269C46096236A213905C8F2987CD0C422389D300
SHA-256:	CC678E75294007E177344FB3D841B23E1AA9877B4F5E22AACF93A8FE15FA5B4C
SHA-512:	96E17A55395AA231D5FDB5103A4A5C8D89074E3806909F6BDA2D275A614F01555549DB7280F9E48515AF472E4D0AABB5568D2589EBC1310218A970C3B09BCB1B
Malicious:	false
Reputation:	unknown
Preview:	<?xml version="1.0" encoding="utf-8" ?>.<Win32Res/>.

C:\Program Files (x86)\Google\Picasa3\cdautorun\Picasa CD Slideshow.app\Contents\Resources\hu.lproj\i18n\cdgo_stringres.xml

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 text
Category:	dropped
Size (bytes):	6959
Entropy (8bit):	4.893815635944045
Encrypted:	false
SSDEEP:	192:9gWB06UUB6eTeCtEehe9j4J0QFHJBsXZoqbXgWB06UUB6eTeCtEehe9j4J0QFHJi:NB6SNECLvYB6SNECLvmw12mot4NDE
MD5:	DF898EC0FA409163F06ED1BF68115333
SHA1:	E5795122AECF397D0520CF590E7B40CA59E2B9AB
SHA-256:	3B39A671B8F270FBF846E22AF05FB3DAB112F6C39AE4D2AF019BD8F58DDBD0AB
SHA-512:	D34E330358D954C88F34CC6A1E35D186B56954371427DED6FD79AA2F886D9A68F52DF062A599B5150C10A07E14D7BEA8A374293518B81ABADB7FE5574342D4AC
Malicious:	false
Reputation:	unknown
Preview:	<?xml version="1.0" encoding="utf-8" ?>.<resources>. <stringres id="February">. <xmbtext>Febru.r</xmbtext>. </stringres>. <stringres id="March">. <xmbtext>M.rcius</xmbtext>. </stringres>. <stringres id="April">. <xmbtext>.prilis</xmbtext>. </stringres>. <stringres id="May">. <xmbtext>M.jus</xmbtext>. </stringres>. <stringres id="June">. <xmbtext>J.nius</xmbtext>. </stringres>. <stringres id="July">. <xmbtext>J.lius</xmbtext>. </stringres>. <stringres id="August">. <xmbtext>Augusztus</xmbtext>. </stringres>. <stringres id="September">. <xmbtext>Szeptember</xmbtext>. </stringres>. <stringres id="October">. <xmbtext>Okt.ber</xmbtext>. </stringres>. <stringres id="November">. <xmbtext>November</xmbtext>. </stringres>. <stringres id="December">. <xmbtext>December</xmbtext>. </stringres>. <stringres id="Jan">. <xmbtext>Jan.</xmbtext>. </stringres>. <stringres id="Feb">. <xmbtext>Febr.</xmbtext>. </stringres>. <stringres id="Mar">. <xmbtext>M.rc.</xmbtext>. </stringres>.

C:\Program Files (x86)\Google\Picasa3\cdautorun\Picasa CD Slideshow.app\Contents\Resources\id.lproj\i18n\cdgo.xml

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe
File Type:	XML 1.0 document, ASCII text
Category:	dropped
Size (bytes):	771
Entropy (8bit):	4.807691073492514
Encrypted:	false
SSDEEP:	24:2dRTcwt5EIzYp0zYVbzYJJS0nz8HPD8z8Hjcl+ykC8:cuwtaGIy0HQLziqyq+z
MD5:	203D7678E04A276EA598D7767059CAB3
SHA1:	62C8EA4A35BDDDBC563FC72B5E62FDDD987B4B90
SHA-256:	DB60D64BFE0D8CE9392FA8F9530E5A5C4EFE0AB328EBDEB73B08B031FB24CF72
SHA-512:	3DEA0286D526177EA87979515B8904F5583799A8D9C3AD7C9583396CF10A2E0156743E0C97E2309B8FC2961BF81EBC7C804CC92E2559D17DE2E717E7068ED532
Malicious:	false
Reputation:	unknown
Preview:	<?xml version="1.0" encoding="utf-8" ?>.<tooltips>. <action type="Label" target="cdgo/copytohd" xmbdesc="Label(cdgo/copytohd)">. <xmbtext>Simpan ke Diska</xmbtext>. </action>. <action type="Label" target="cdgo/eject" xmbdesc="Label(cdgo/eject)">. <xmbtext>Keluarkan CD</xmbtext>. </action>. <action type="Label" target="cdgo/exit" xmbdesc="Label(cdgo/exit)">. <xmbtext>Keluar</xmbtext>. </action>. <action type="Label" target="cdgo/topicasa" xmbdesc="Label(cdgo/topicasa)">. <xmbtext>Impor Ke Picasa</xmbtext>. </action>. <action type="Text" target="cdgo/loading" xmbdesc="Text(cdgo/loading)">. <xmbtext>MEMUAT</xmbtext>. </action>. <action type="Text" target="cdgo/tpslabel" xmbdesc="Text(cdgo/tpslabel)">. <xmbtext>Waktu Tampilan</xmbtext>. </action>.</tooltips>.

C:\Program Files (x86)\Google\Picasa3\cdautorun\Picasa CD Slideshow.app\Contents\Resources\id.lproj\i18n\cdgo_resexport.xml

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe
File Type:	XML 1.0 document, ASCII text
Category:	dropped
Size (bytes):	52
Entropy (8bit):	4.849196208400893
Encrypted:	false
SSDEEP:	3:vFWWMNHU8LdgCzLZfOO:TMVBdTtfOO
MD5:	4BE3304509673D14428BD2FFC3070EF8
SHA1:	269C46096236A213905C8F2987CD0C422389D300
SHA-256:	CC678E75294007E177344FB3D841B23E1AA9877B4F5E22AACF93A8FE15FA5B4C
SHA-512:	96E17A55395AA231D5FDB5103A4A5C8D89074E3806909F6BDA2D275A614F01555549DB7280F9E48515AF472E4D0AABB5568D2589EBC1310218A970C3B09BCB1B
Malicious:	false
Reputation:	unknown
Preview:	<?xml version="1.0" encoding="utf-8" ?>.<Win32Res/>.

C:\Program Files (x86)\Google\Picasa3\cdautorun\Picasa CD Slideshow.app\Contents\Resources\id.lproj\i18n\cdgo_stringres.xml

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe
File Type:	XML 1.0 document, ASCII text
Category:	dropped
Size (bytes):	6793
Entropy (8bit):	4.782589732391417
Encrypted:	false
SSDEEP:	192:9g0BSOpmBteTe5tEehet/8YBZzBnBU5HoedXg0BSOpmBteTe5tEehet/8YBZzBnm:tItA4ECANMItA4ECANrrPPI
MD5:	37E0BDDEC898E6DD85795C7FDC2211B4
SHA1:	10F1C7734E6ECA48D7C1FCB9D2D86AA6820252FB
SHA-256:	F6A5DA59A1A13EBA9FC8B4B44B4A376B44B2EB2B18452574DFD1F200A6577861
SHA-512:	C9218C93BEAF17CF1196997894F919A9B973AF45791AE7E943E6E99FC2058D81D920397FEFC2B5CBAECF94347ED67FD4CB69FA0E4D56AAF9703E765E5B6FE0C0
Malicious:	false
Reputation:	unknown
Preview:	<?xml version="1.0" encoding="utf-8" ?>.<resources>. <stringres id="February">. <xmbtext>Februari</xmbtext>. </stringres>. <stringres id="March">. <xmbtext>Maret</xmbtext>. </stringres>. <stringres id="April">. <xmbtext>April</xmbtext>. </stringres>. <stringres id="May">. <xmbtext>Mei</xmbtext>. </stringres>. <stringres id="June">. <xmbtext>Juni</xmbtext>. </stringres>. <stringres id="July">. <xmbtext>Juli</xmbtext>. </stringres>. <stringres id="August">. <xmbtext>Agustus</xmbtext>. </stringres>. <stringres id="September">. <xmbtext>September</xmbtext>. </stringres>. <stringres id="October">. <xmbtext>Oktober</xmbtext>. </stringres>. <stringres id="November">. <xmbtext>November</xmbtext>. </stringres>. <stringres id="December">. <xmbtext>Desember</xmbtext>. </stringres>. <stringres id="Jan">. <xmbtext>Jan</xmbtext>. </stringres>. <stringres id="Feb">. <xmbtext>Feb</xmbtext>. </stringres>. <stringres id="Mar">. <xmbtext>Mar</xmbtext>. </stringres>. <stringres id="Apr">. <

C:\Program Files (x86)\Google\Picasa3\cdautorun\Picasa CD Slideshow.app\Contents\Resources\it.lproj\i18n\cdgo.xml

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe
File Type:	XML 1.0 document, ASCII text
Category:	dropped
Size (bytes):	786
Entropy (8bit):	4.8218982452628865
Encrypted:	false
SSDEEP:	24:2dRTcwtgzYp9zYVnzYJJxs/0nz8HPDRz8Hjcl+DiC8:cuwtuIN0zQ0sziRyq+8
MD5:	B97FD1922B1D3B0546C5162969E2F07F
SHA1:	4B02E8685537552028C8A5B2E98955525BB04515
SHA-256:	B8895C2AC9A5636F10D85E8A76CB4619DDBB2AF23C2D74386005EA2E2760FBAD
SHA-512:	C721FC1041BF3BAA37B6FD1A8666A8F512F2B8002D549919DDCE480AC8199C6C38BFEF023879A1DF2553045C915EBCDBA581C08BC97222F34B28578B6E85E12E
Malicious:	false
Reputation:	unknown
Preview:	<?xml version="1.0" encoding="utf-8" ?>.<tooltips>. <action type="Label" target="cdgo/copytohd" xmbdesc="Label(cdgo/copytohd)">. <xmbtext>Salva su disco</xmbtext>. </action>. <action type="Label" target="cdgo/eject" xmbdesc="Label(cdgo/eject)">. <xmbtext>Espulsione CD</xmbtext>. </action>. <action type="Label" target="cdgo/exit" xmbdesc="Label(cdgo/exit)">. <xmbtext>Esci</xmbtext>. </action>. <action type="Label" target="cdgo/topicasa" xmbdesc="Label(cdgo/topicasa)">. <xmbtext>Importa in Picasa</xmbtext>. </action>. <action type="Text" target="cdgo/loading" xmbdesc="Text(cdgo/loading)">. <xmbtext>CARICAMENTO</xmbtext>. </action>. <action type="Text" target="cdgo/tpslabel" xmbdesc="Text(cdgo/tpslabel)">. <xmbtext>Tempo di visualizzazione</xmbtext>. </action>.</tooltips>.

C:\Program Files (x86)\Google\Picasa3\cdautorun\Picasa CD Slideshow.app\Contents\Resources\it.lproj\i18n\cdgo_resexport.xml

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe
File Type:	XML 1.0 document, ASCII text
Category:	dropped
Size (bytes):	52
Entropy (8bit):	4.849196208400893
Encrypted:	false
SSDEEP:	3:vFWWMNHU8LdgCzLZfOO:TMVBdTtfOO
MD5:	4BE3304509673D14428BD2FFC3070EF8
SHA1:	269C46096236A213905C8F2987CD0C422389D300
SHA-256:	CC678E75294007E177344FB3D841B23E1AA9877B4F5E22AACF93A8FE15FA5B4C
SHA-512:	96E17A55395AA231D5FDB5103A4A5C8D89074E3806909F6BDA2D275A614F01555549DB7280F9E48515AF472E4D0AABB5568D2589EBC1310218A970C3B09BCB1B
Malicious:	false
Reputation:	unknown
Preview:	<?xml version="1.0" encoding="utf-8" ?>.<Win32Res/>.

C:\Program Files (x86)\Google\Picasa3\cdautorun\Picasa CD Slideshow.app\Contents\Resources\it.lproj\i18n\cdgo_stringres.xml

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 text
Category:	dropped
Size (bytes):	6898
Entropy (8bit):	4.775404625768366
Encrypted:	false
SSDEEP:	192:9aqBn3aEBgeteWtEebe7u8YBZQzyBqVWoeBqaqBn3aEBgeteWtEebe7u8YBZQzyk:Zpgy3E8tp+pgy3E8tpV7c
MD5:	19AF6A7198A38AFB37A7C91FC23FA574
SHA1:	15D16013F483A29456CC6794C9BECBC35EF7C7A2
SHA-256:	B2B1F0606EDF2F54B21F5AE21A95FDA37C704B519A7B754B71D09A86A9936C0D
SHA-512:	295B62CFC427232EC1AA6C459826CE2E2B288561EF4CB76A3C58815B20A92E0A489398A5ECC780B003C6994930AB2C6DC57488AA69CE045406903E42A0C87DFD
Malicious:	false
Reputation:	unknown
Preview:	<?xml version="1.0" encoding="utf-8" ?>.<resources>. <stringres id="February">. <xmbtext>Febbraio</xmbtext>. </stringres>. <stringres id="March">. <xmbtext>Marzo</xmbtext>. </stringres>. <stringres id="April">. <xmbtext>Aprile</xmbtext>. </stringres>. <stringres id="May">. <xmbtext>Maggio</xmbtext>. </stringres>. <stringres id="June">. <xmbtext>Giugno</xmbtext>. </stringres>. <stringres id="July">. <xmbtext>Luglio</xmbtext>. </stringres>. <stringres id="August">. <xmbtext>Agosto</xmbtext>. </stringres>. <stringres id="September">. <xmbtext>Settembre</xmbtext>. </stringres>. <stringres id="October">. <xmbtext>Ottobre</xmbtext>. </stringres>. <stringres id="November">. <xmbtext>Novembre</xmbtext>. </stringres>. <stringres id="December">. <xmbtext>Dicembre</xmbtext>. </stringres>. <stringres id="Jan">. <xmbtext>Gen</xmbtext>. </stringres>. <stringres id="Feb">. <xmbtext>Feb</xmbtext>. </stringres>. <stringres id="Mar">. <xmbtext>Mar</xmbtext>. </stringres>. <stringres id="Ap

C:\Program Files (x86)\Google\Picasa3\cdautorun\Picasa CD Slideshow.app\Contents\Resources\ja.lproj\i18n\cdgo.xml

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 text
Category:	dropped
Size (bytes):	809
Entropy (8bit):	5.190030556941759
Encrypted:	false
SSDEEP:	24:2dRTcwta0bzYpWaqzYVdzYJSOkz8HPD9Jz8Hjcl+qC8:cuwta0HIWaU0tQSOCi9Zyq+o
MD5:	E8704F8CDA822EC073FFC1F79435343E
SHA1:	6271A2F6F4834C547E0EEBD67B7557A592D9BF1A
SHA-256:	4E197276533DAD5C0350042AA737A0288A9FFEBCEABB75FC1CE5539CE367FB5B
SHA-512:	7130E2E419BD7E1E44FE7F3EB9C66537690A4E2CB905D37349B922CA60160A0CFB556C10A82954157CBBFC287DB770A73E566CD3F2A327D3D03C7B4B94D5FD57
Malicious:	false
Reputation:	unknown
Preview:	<?xml version="1.0" encoding="utf-8" ?>.<tooltips>. <action type="Label" target="cdgo/copytohd" xmbdesc="Label(cdgo/copytohd)">. <xmbtext>.......</xmbtext>. </action>. <action type="Label" target="cdgo/eject" xmbdesc="Label(cdgo/eject)">. <xmbtext>CD .....</xmbtext>. </action>. <action type="Label" target="cdgo/exit" xmbdesc="Label(cdgo/exit)">. <xmbtext>..</xmbtext>. </action>. <action type="Label" target="cdgo/topicasa" xmbdesc="Label(cdgo/topicasa)">. <xmbtext>Picasa ......</xmbtext>. </action>. <action type="Text" target="cdgo/loading" xmbdesc="Text(cdgo/loading)">. <xmbtext>........</xmbtext>. </action>. <action type="Text" target="cdgo/tpslabel" xmbdesc="Text(cdgo/tpslabel)">. <xmbtext>....</xmbtext>. </action>.</tooltips>.

C:\Program Files (x86)\Google\Picasa3\cdautorun\Picasa CD Slideshow.app\Contents\Resources\ja.lproj\i18n\cdgo_resexport.xml

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe
File Type:	XML 1.0 document, ASCII text
Category:	dropped
Size (bytes):	52
Entropy (8bit):	4.849196208400893
Encrypted:	false
SSDEEP:	3:vFWWMNHU8LdgCzLZfOO:TMVBdTtfOO
MD5:	4BE3304509673D14428BD2FFC3070EF8
SHA1:	269C46096236A213905C8F2987CD0C422389D300
SHA-256:	CC678E75294007E177344FB3D841B23E1AA9877B4F5E22AACF93A8FE15FA5B4C
SHA-512:	96E17A55395AA231D5FDB5103A4A5C8D89074E3806909F6BDA2D275A614F01555549DB7280F9E48515AF472E4D0AABB5568D2589EBC1310218A970C3B09BCB1B
Malicious:	false
Reputation:	unknown
Preview:	<?xml version="1.0" encoding="utf-8" ?>.<Win32Res/>.

C:\Program Files (x86)\Google\Picasa3\cdautorun\Picasa CD Slideshow.app\Contents\Resources\ja.lproj\i18n\cdgo_stringres.xml

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 text
Category:	dropped
Size (bytes):	7162
Entropy (8bit):	5.204829379195291
Encrypted:	false
SSDEEP:	192:9SCC+x3FedeMtEeDerXjJCDyHZKMoTSQSCC+x3FedeMtEeDerXjJCDyHZKMoTWSf:P2XEAt2XEAoVC
MD5:	A6C3A1E7CABFF2B636087024057D2BD4
SHA1:	19CA57770F09738FF07E4BEDF788EAA62D83121F
SHA-256:	47808602BE3DCA197F0E067C110766F3AEA1A98332A32C918033909955AA2737
SHA-512:	C3E041C8B4AF3E24911D4CE0C032AFBB99EC1A636C9F6B1F2F39E96B0B00139394F0473CE8AF825D530DB7E5B9F320B206AD9B1BAA3BF2CAB07BD7681242C65E
Malicious:	false
Reputation:	unknown
Preview:	<?xml version="1.0" encoding="utf-8" ?>.<resources>. <stringres id="February">. <xmbtext>2 .</xmbtext>. </stringres>. <stringres id="March">. <xmbtext>3 .</xmbtext>. </stringres>. <stringres id="April">. <xmbtext>4 .</xmbtext>. </stringres>. <stringres id="May">. <xmbtext>5 .</xmbtext>. </stringres>. <stringres id="June">. <xmbtext>6 .</xmbtext>. </stringres>. <stringres id="July">. <xmbtext>7 .</xmbtext>. </stringres>. <stringres id="August">. <xmbtext>8 .</xmbtext>. </stringres>. <stringres id="September">. <xmbtext>9 .</xmbtext>. </stringres>. <stringres id="October">. <xmbtext>10 .</xmbtext>. </stringres>. <stringres id="November">. <xmbtext>11 .</xmbtext>. </stringres>. <stringres id="December">. <xmbtext>12 .</xmbtext>. </stringres>. <stringres id="Jan">. <xmbtext>1 .</xmbtext>. </stringres>. <stringres id="Feb">. <xmbtext>2 .</xmbtext>. </stringres>. <stringres id="Mar">. <xmbtext>3 .</xmbtext>. </stringres>. <stringres id="Apr">. <xmbt

C:\Program Files (x86)\Google\Picasa3\cdautorun\Picasa CD Slideshow.app\Contents\Resources\ko.lproj\i18n\cdgo.xml

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 text
Category:	dropped
Size (bytes):	785
Entropy (8bit):	5.0893575744611494
Encrypted:	false
SSDEEP:	24:2dRTcwtozYpwSzYV4zYJPKz8HPDwz8Hjcl+FlC8:cuwtmIL0WQP0ieyq+Fz
MD5:	E85F7C5162203322657607D8002F551D
SHA1:	27AD8CB49CCB56AA889CD33610C539ADBA2D226F
SHA-256:	988FF30830FFE15B7E69ED6DA0DD8E07C1C1D621C495EDA1BCA8906590403576
SHA-512:	3498376CD98865C9FAF4FDFD3E2A72C0CD32152985BA218D32D358CA91969328F7574DD8A571812A84874FB6BC38C4D6CAA9FB7E29C7078D02FDA22710AFDC76
Malicious:	false
Reputation:	unknown
Preview:	<?xml version="1.0" encoding="utf-8" ?>.<tooltips>. <action type="Label" target="cdgo/copytohd" xmbdesc="Label(cdgo/copytohd)">. <xmbtext>.... ..</xmbtext>. </action>. <action type="Label" target="cdgo/eject" xmbdesc="Label(cdgo/eject)">. <xmbtext>CD ...</xmbtext>. </action>. <action type="Label" target="cdgo/exit" xmbdesc="Label(cdgo/exit)">. <xmbtext>..</xmbtext>. </action>. <action type="Label" target="cdgo/topicasa" xmbdesc="Label(cdgo/topicasa)">. <xmbtext>Picasa. ....</xmbtext>. </action>. <action type="Text" target="cdgo/loading" xmbdesc="Text(cdgo/loading)">. <xmbtext>.. .</xmbtext>. </action>. <action type="Text" target="cdgo/tpslabel" xmbdesc="Text(cdgo/tpslabel)">. <xmbtext>.. ..</xmbtext>. </action>.</tooltips>.

C:\Program Files (x86)\Google\Picasa3\cdautorun\Picasa CD Slideshow.app\Contents\Resources\ko.lproj\i18n\cdgo_resexport.xml

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe
File Type:	XML 1.0 document, ASCII text
Category:	dropped
Size (bytes):	52
Entropy (8bit):	4.849196208400893
Encrypted:	false
SSDEEP:	3:vFWWMNHU8LdgCzLZfOO:TMVBdTtfOO
MD5:	4BE3304509673D14428BD2FFC3070EF8
SHA1:	269C46096236A213905C8F2987CD0C422389D300
SHA-256:	CC678E75294007E177344FB3D841B23E1AA9877B4F5E22AACF93A8FE15FA5B4C
SHA-512:	96E17A55395AA231D5FDB5103A4A5C8D89074E3806909F6BDA2D275A614F01555549DB7280F9E48515AF472E4D0AABB5568D2589EBC1310218A970C3B09BCB1B
Malicious:	false
Reputation:	unknown
Preview:	<?xml version="1.0" encoding="utf-8" ?>.<Win32Res/>.

C:\Program Files (x86)\Google\Picasa3\cdautorun\Picasa CD Slideshow.app\Contents\Resources\ko.lproj\i18n\cdgo_stringres.xml

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 text
Category:	dropped
Size (bytes):	6958
Entropy (8bit):	5.203639288708597
Encrypted:	false
SSDEEP:	192:91fxdkU+eceFtEeAVeKn2IwxiJCyfFoApLnv1fxdkU+eceFtEeAVeKn2IwxiJCy0:c9gEVVFVFO9gEVVFVe6EvzZpQI
MD5:	7C85A4A2CEC18762CDF4A34A205DB2B8
SHA1:	80A07F25251E3304A14CAE73249599BC4E955D83
SHA-256:	94918BBA962F9F7DCD64E6AE95C5E4313816A3FC5ED209E73713C79BE1D81791
SHA-512:	9C766DEC349243D04166FC0AC4F10BD8600EDE5F614320B9E9189EEE241679E37008DBA86E9FED35B3495873372405739C17313E00D1AF9B49D1B2A17A967244
Malicious:	false
Reputation:	unknown
Preview:	<?xml version="1.0" encoding="utf-8" ?>.<resources>. <stringres id="February">. <xmbtext>2.</xmbtext>. </stringres>. <stringres id="March">. <xmbtext>3.</xmbtext>. </stringres>. <stringres id="April">. <xmbtext>4.</xmbtext>. </stringres>. <stringres id="May">. <xmbtext>5.</xmbtext>. </stringres>. <stringres id="June">. <xmbtext>6.</xmbtext>. </stringres>. <stringres id="July">. <xmbtext>7.</xmbtext>. </stringres>. <stringres id="August">. <xmbtext>8.</xmbtext>. </stringres>. <stringres id="September">. <xmbtext>9.</xmbtext>. </stringres>. <stringres id="October">. <xmbtext>10.</xmbtext>. </stringres>. <stringres id="November">. <xmbtext>11.</xmbtext>. </stringres>. <stringres id="December">. <xmbtext>12.</xmbtext>. </stringres>. <stringres id="Jan">. <xmbtext>1.</xmbtext>. </stringres>. <stringres id="Feb">. <xmbtext>2.</xmbtext>. </stringres>. <stringres id="Mar">. <xmbtext>3.</xmbtext>. </stringres>. <stringres id="Apr">. <xmbtext>4.</xmbt

C:\Program Files (x86)\Google\Picasa3\cdautorun\Picasa CD Slideshow.app\Contents\Resources\lt.lproj\i18n\cdgo.xml

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 text
Category:	dropped
Size (bytes):	786
Entropy (8bit):	4.879797231746836
Encrypted:	false
SSDEEP:	24:2dRTcwtJ0M4nzYpJ/zYVJZzYJJxHRz8HPDESz8Hjcl+iC8:cuwta/zI10nQfRidyq+Q
MD5:	04D053935679EF96DD951487FDA2BC06
SHA1:	43C004EB86FBB2AF05B618766412A8E1503002C9
SHA-256:	D6FA290B2536F4637F019BF148ED6A35C6E3E9A4073B5E70DE9B111BB5B3A0DA
SHA-512:	01912B3C60971CD93D62F41F36A8FD1783FBE919D18C7EBCD191F4F5E9B2231C54F6381A2A31DC4B013795C743DCD77175BD69D52B69D607316D3E01D5897395
Malicious:	false
Reputation:	unknown
Preview:	<?xml version="1.0" encoding="utf-8" ?>.<tooltips>. <action type="Label" target="cdgo/copytohd" xmbdesc="Label(cdgo/copytohd)">. <xmbtext>I.saugoti diske</xmbtext>. </action>. <action type="Label" target="cdgo/eject" xmbdesc="Label(cdgo/eject)">. <xmbtext>I.stumti CD</xmbtext>. </action>. <action type="Label" target="cdgo/exit" xmbdesc="Label(cdgo/exit)">. <xmbtext>I.eiti</xmbtext>. </action>. <action type="Label" target="cdgo/topicasa" xmbdesc="Label(cdgo/topicasa)">. <xmbtext>Importuoti . .Picasa.</xmbtext>. </action>. <action type="Text" target="cdgo/loading" xmbdesc="Text(cdgo/loading)">. <xmbtext>.KELIAMA</xmbtext>. </action>. <action type="Text" target="cdgo/tpslabel" xmbdesc="Text(cdgo/tpslabel)">. <xmbtext>Rodymo laikas</xmbtext>. </action>.</tooltips>.

C:\Program Files (x86)\Google\Picasa3\cdautorun\Picasa CD Slideshow.app\Contents\Resources\lt.lproj\i18n\cdgo_resexport.xml

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe
File Type:	XML 1.0 document, ASCII text
Category:	dropped
Size (bytes):	52
Entropy (8bit):	4.849196208400893
Encrypted:	false
SSDEEP:	3:vFWWMNHU8LdgCzLZfOO:TMVBdTtfOO
MD5:	4BE3304509673D14428BD2FFC3070EF8
SHA1:	269C46096236A213905C8F2987CD0C422389D300
SHA-256:	CC678E75294007E177344FB3D841B23E1AA9877B4F5E22AACF93A8FE15FA5B4C
SHA-512:	96E17A55395AA231D5FDB5103A4A5C8D89074E3806909F6BDA2D275A614F01555549DB7280F9E48515AF472E4D0AABB5568D2589EBC1310218A970C3B09BCB1B
Malicious:	false
Reputation:	unknown
Preview:	<?xml version="1.0" encoding="utf-8" ?>.<Win32Res/>.

C:\Program Files (x86)\Google\Picasa3\cdautorun\Picasa CD Slideshow.app\Contents\Resources\lt.lproj\i18n\cdgo_stringres.xml

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 text
Category:	dropped
Size (bytes):	7013
Entropy (8bit):	4.887144489498068
Encrypted:	false
SSDEEP:	192:9RL09uFXe3ieftEeWeZC7aRCCaXo1oxslRL09uFXe3ieftEeWeZC7aRCCaXo1oxR:bMioEjsMioEj7uSyvM
MD5:	B1B1A9B562A38F7DCB16CD4D5E6C2562
SHA1:	80C4FA93629A7CCACA5C230C033AA42A5EC5F640
SHA-256:	D9D2B3B267C0B92E48BE686A6D5B22CED23412445C8EEFEFC2F45EB50C154D3F
SHA-512:	E58DFA326F5577F4C435F2914D0E527D569ADDB805F3008D3315FC22DC41BA6B84BBC6FC632E5339BD1D1990259708EFA2FB15BD5B1E7549784A1515DE01CE92
Malicious:	false
Reputation:	unknown
Preview:	<?xml version="1.0" encoding="utf-8" ?>.<resources>. <stringres id="February">. <xmbtext>Vasaris</xmbtext>. </stringres>. <stringres id="March">. <xmbtext>Kovas</xmbtext>. </stringres>. <stringres id="April">. <xmbtext>Balandis</xmbtext>. </stringres>. <stringres id="May">. <xmbtext>Gegu..</xmbtext>. </stringres>. <stringres id="June">. <xmbtext>Bir.elis</xmbtext>. </stringres>. <stringres id="July">. <xmbtext>Liepa</xmbtext>. </stringres>. <stringres id="August">. <xmbtext>Rugpj.tis</xmbtext>. </stringres>. <stringres id="September">. <xmbtext>Rugs.jis</xmbtext>. </stringres>. <stringres id="October">. <xmbtext>Spalis</xmbtext>. </stringres>. <stringres id="November">. <xmbtext>Lapkritis</xmbtext>. </stringres>. <stringres id="December">. <xmbtext>Gruodis</xmbtext>. </stringres>. <stringres id="Jan">. <xmbtext>Saus.</xmbtext>. </stringres>. <stringres id="Feb">. <xmbtext>Vas.</xmbtext>. </stringres>. <stringres id="Mar">. <xmbtext>Kov.</xmbtext>. </stringres>. <stri

C:\Program Files (x86)\Google\Picasa3\cdautorun\Picasa CD Slideshow.app\Contents\Resources\lv.lproj\i18n\cdgo.xml

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 text
Category:	dropped
Size (bytes):	791
Entropy (8bit):	4.848821131857386
Encrypted:	false
SSDEEP:	24:2dRTcwtIzYpJ2zYVJwzYJJxKw0nz8HPDJiz8Hjcl+DnC8:cuwtGIm0AQyrzi6yq+DV
MD5:	B76C88F0ABD23EEEE6D8191C55173A13
SHA1:	96D8470A0CB164F6F43221EE266C002D5A81F6AD
SHA-256:	93FCFCB16E81ABB0628B5F006A4811182C287288B0D9963CB8D00896952157C6
SHA-512:	2F97448B4337F9B89E6ACEAD53DBB034132421E82296A921EFAB161FD414CB7896560654FD2A371FBE068F8878FEEB5CC914B3DF360EC2EDA827F6C50682566E
Malicious:	false
Reputation:	unknown
Preview:	<?xml version="1.0" encoding="utf-8" ?>.<tooltips>. <action type="Label" target="cdgo/copytohd" xmbdesc="Label(cdgo/copytohd)">. <xmbtext>Saglab.t disk.</xmbtext>. </action>. <action type="Label" target="cdgo/eject" xmbdesc="Label(cdgo/eject)">. <xmbtext>Izstumt kompaktdisku</xmbtext>. </action>. <action type="Label" target="cdgo/exit" xmbdesc="Label(cdgo/exit)">. <xmbtext>Iziet</xmbtext>. </action>. <action type="Label" target="cdgo/topicasa" xmbdesc="Label(cdgo/topicasa)">. <xmbtext>Import.t programm. Picasa</xmbtext>. </action>. <action type="Text" target="cdgo/loading" xmbdesc="Text(cdgo/loading)">. <xmbtext>IEL.DE</xmbtext>. </action>. <action type="Text" target="cdgo/tpslabel" xmbdesc="Text(cdgo/tpslabel)">. <xmbtext>R.d.t laiku</xmbtext>. </action>.</tooltips>.

C:\Program Files (x86)\Google\Picasa3\cdautorun\Picasa CD Slideshow.app\Contents\Resources\lv.lproj\i18n\cdgo_resexport.xml

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe
File Type:	XML 1.0 document, ASCII text
Category:	dropped
Size (bytes):	52
Entropy (8bit):	4.849196208400893
Encrypted:	false
SSDEEP:	3:vFWWMNHU8LdgCzLZfOO:TMVBdTtfOO
MD5:	4BE3304509673D14428BD2FFC3070EF8
SHA1:	269C46096236A213905C8F2987CD0C422389D300
SHA-256:	CC678E75294007E177344FB3D841B23E1AA9877B4F5E22AACF93A8FE15FA5B4C
SHA-512:	96E17A55395AA231D5FDB5103A4A5C8D89074E3806909F6BDA2D275A614F01555549DB7280F9E48515AF472E4D0AABB5568D2589EBC1310218A970C3B09BCB1B
Malicious:	false
Reputation:	unknown
Preview:	<?xml version="1.0" encoding="utf-8" ?>.<Win32Res/>.

C:\Program Files (x86)\Google\Picasa3\cdautorun\Picasa CD Slideshow.app\Contents\Resources\lv.lproj\i18n\cdgo_stringres.xml

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 text
Category:	dropped
Size (bytes):	7087
Entropy (8bit):	4.883089039007238
Encrypted:	false
SSDEEP:	192:9nABidQqQBveQeMtEeOeeP43B9iQ9GBsXZoqb9nABidQqQBveQeMtEeOeeP43B95:mj3vhbEnMjkzj3vhbEnMjk4APfJE
MD5:	326B24E37525510F45DB78F692B38A78
SHA1:	36AD95DA43494A999784694232C36D7440E78D1E
SHA-256:	37617CF7AFF31408884C2EE9B1B358CF382085FFFEB5D8C0C386BF87383204C0
SHA-512:	9A2EEC216DFF2AE66C59333ED434B7A4892A9E72FD59517CD78D459FA05880EAF2C77D7BA67B6F11DEAB0C9A2D54D54F206A60B2C739B2C6B018FBAC94229AE3
Malicious:	false
Reputation:	unknown
Preview:	<?xml version="1.0" encoding="utf-8" ?>.<resources>. <stringres id="February">. <xmbtext>Febru.ris</xmbtext>. </stringres>. <stringres id="March">. <xmbtext>Marts</xmbtext>. </stringres>. <stringres id="April">. <xmbtext>Apr.lis</xmbtext>. </stringres>. <stringres id="May">. <xmbtext>Maijs</xmbtext>. </stringres>. <stringres id="June">. <xmbtext>J.nijs</xmbtext>. </stringres>. <stringres id="July">. <xmbtext>J.l.</xmbtext>. </stringres>. <stringres id="August">. <xmbtext>Augusts</xmbtext>. </stringres>. <stringres id="September">. <xmbtext>Septembris</xmbtext>. </stringres>. <stringres id="October">. <xmbtext>Oktobris</xmbtext>. </stringres>. <stringres id="November">. <xmbtext>Novembris</xmbtext>. </stringres>. <stringres id="December">. <xmbtext>Decembris</xmbtext>. </stringres>. <stringres id="Jan">. <xmbtext>Janv.</xmbtext>. </stringres>. <stringres id="Feb">. <xmbtext>Febr.</xmbtext>. </stringres>. <stringres id="Mar">. <xmbtext>Marts</xmbtext>. </stringres>. <st

C:\Program Files (x86)\Google\Picasa3\cdautorun\Picasa CD Slideshow.app\Contents\Resources\nl.lproj\i18n\cdgo.xml

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe
File Type:	XML 1.0 document, ASCII text
Category:	dropped
Size (bytes):	780
Entropy (8bit):	4.7776342371785585
Encrypted:	false
SSDEEP:	24:2dRTcwtfTzYp7jzYVBmzYJeMlz8HPD9z8Hjcl+KnC8:cuwtXI7/0BQQ1iNyq+KV
MD5:	DE67BC6008BB5FAF3D2B396A9749DCE6
SHA1:	DA236ED47C3D1E19446EF3541D0D3FCCC288DFD0
SHA-256:	2ACB33611646E2C3941A18349148B4685F41669BDFD7205337108862ED1D87A0
SHA-512:	202D405A04BB507419212CFA8AA735B294DB5A2C1FE8F0B610AACDB798801C5454786963048B05D944271AB550DE0889AFE48DF92A465D52E4CEB8DC27DFD6BC
Malicious:	false
Reputation:	unknown
Preview:	<?xml version="1.0" encoding="utf-8" ?>.<tooltips>. <action type="Label" target="cdgo/copytohd" xmbdesc="Label(cdgo/copytohd)">. <xmbtext>Opslaan op schijf</xmbtext>. </action>. <action type="Label" target="cdgo/eject" xmbdesc="Label(cdgo/eject)">. <xmbtext>Cd uitwerpen</xmbtext>. </action>. <action type="Label" target="cdgo/exit" xmbdesc="Label(cdgo/exit)">. <xmbtext>Afsluiten</xmbtext>. </action>. <action type="Label" target="cdgo/topicasa" xmbdesc="Label(cdgo/topicasa)">. <xmbtext>Naar Picasa importeren</xmbtext>. </action>. <action type="Text" target="cdgo/loading" xmbdesc="Text(cdgo/loading)">. <xmbtext>LADEN</xmbtext>. </action>. <action type="Text" target="cdgo/tpslabel" xmbdesc="Text(cdgo/tpslabel)">. <xmbtext>Weergavetijd</xmbtext>. </action>.</tooltips>.

C:\Program Files (x86)\Google\Picasa3\cdautorun\Picasa CD Slideshow.app\Contents\Resources\nl.lproj\i18n\cdgo_resexport.xml

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe
File Type:	XML 1.0 document, ASCII text
Category:	dropped
Size (bytes):	52
Entropy (8bit):	4.849196208400893
Encrypted:	false
SSDEEP:	3:vFWWMNHU8LdgCzLZfOO:TMVBdTtfOO
MD5:	4BE3304509673D14428BD2FFC3070EF8
SHA1:	269C46096236A213905C8F2987CD0C422389D300
SHA-256:	CC678E75294007E177344FB3D841B23E1AA9877B4F5E22AACF93A8FE15FA5B4C
SHA-512:	96E17A55395AA231D5FDB5103A4A5C8D89074E3806909F6BDA2D275A614F01555549DB7280F9E48515AF472E4D0AABB5568D2589EBC1310218A970C3B09BCB1B
Malicious:	false
Reputation:	unknown
Preview:	<?xml version="1.0" encoding="utf-8" ?>.<Win32Res/>.

C:\Program Files (x86)\Google\Picasa3\cdautorun\Picasa CD Slideshow.app\Contents\Resources\nl.lproj\i18n\cdgo_stringres.xml

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 text
Category:	dropped
Size (bytes):	6943
Entropy (8bit):	4.793030019229463
Encrypted:	false
SSDEEP:	192:9gGBSOpmB6eTe5tEehe9/8DBZzBnBg5HoeNXgGBSOpmB6eTe5tEehe9/8DBZzBnH:7I6A4ECdNuI6A4ECdN6reCCg2p1
MD5:	EFC52C2288209344D27C84DBC4732726
SHA1:	0FE60754BF044A4D9B3025CF7A796C0132196986
SHA-256:	178E398949B5881959CDBF11335FC9ECBF0EB96A35828DC34F95F7101061660C
SHA-512:	BA038CB1D1BF34384C7F1B27AFBF11A9416FF34D8A94FA20B12EB071D3381AFFB75D51CA2EFF712660CF37451FB487A191EE027CD8BBF067982E5161F98F65B0
Malicious:	false
Reputation:	unknown
Preview:	<?xml version="1.0" encoding="utf-8" ?>.<resources>. <stringres id="February">. <xmbtext>Februari</xmbtext>. </stringres>. <stringres id="March">. <xmbtext>Maart</xmbtext>. </stringres>. <stringres id="April">. <xmbtext>April</xmbtext>. </stringres>. <stringres id="May">. <xmbtext>Mei</xmbtext>. </stringres>. <stringres id="June">. <xmbtext>Juni</xmbtext>. </stringres>. <stringres id="July">. <xmbtext>Juli</xmbtext>. </stringres>. <stringres id="August">. <xmbtext>Augustus</xmbtext>. </stringres>. <stringres id="September">. <xmbtext>September</xmbtext>. </stringres>. <stringres id="October">. <xmbtext>Oktober</xmbtext>. </stringres>. <stringres id="November">. <xmbtext>November</xmbtext>. </stringres>. <stringres id="December">. <xmbtext>December</xmbtext>. </stringres>. <stringres id="Jan">. <xmbtext>Jan</xmbtext>. </stringres>. <stringres id="Feb">. <xmbtext>Feb</xmbtext>. </stringres>. <stringres id="Mar">. <xmbtext>Mrt</xmbtext>. </stringres>. <stringres id="Apr">.

C:\Program Files (x86)\Google\Picasa3\cdautorun\Picasa CD Slideshow.app\Contents\Resources\no.lproj\i18n\cdgo.xml

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 text
Category:	dropped
Size (bytes):	774
Entropy (8bit):	4.814239660053909
Encrypted:	false
SSDEEP:	24:2dRTcwtuIzYpzzYVBTYzYJJxO0nz8HPDQsz8Hjcl+9nC8:cuwthIv0BKQVziQ6yq+P
MD5:	2429549E4F386C8035F3956551F09895
SHA1:	A8660EF79288235EA7C690E2165B48BB95CC406A
SHA-256:	951C0DCF6187AE8A39613F6D285E6D94BEAF151974A3C809732603326948722B
SHA-512:	F9AF306220E6C3DE159287A57BAC58CCA27D268D17C1431881F0D6FE5336B0B111D2DD436E8CF7CCD0FC80ABB323EC5DD35F1C97680D412E2DD588B255FE39C3
Malicious:	false
Reputation:	unknown
Preview:	<?xml version="1.0" encoding="utf-8" ?>.<tooltips>. <action type="Label" target="cdgo/copytohd" xmbdesc="Label(cdgo/copytohd)">. <xmbtext>Lagre p. disk</xmbtext>. </action>. <action type="Label" target="cdgo/eject" xmbdesc="Label(cdgo/eject)">. <xmbtext>L.s ut CD</xmbtext>. </action>. <action type="Label" target="cdgo/exit" xmbdesc="Label(cdgo/exit)">. <xmbtext>Avslutt</xmbtext>. </action>. <action type="Label" target="cdgo/topicasa" xmbdesc="Label(cdgo/topicasa)">. <xmbtext>Importer til Picasa</xmbtext>. </action>. <action type="Text" target="cdgo/loading" xmbdesc="Text(cdgo/loading)">. <xmbtext>LASTER INN</xmbtext>. </action>. <action type="Text" target="cdgo/tpslabel" xmbdesc="Text(cdgo/tpslabel)">. <xmbtext>Visningstid</xmbtext>. </action>.</tooltips>.

C:\Program Files (x86)\Google\Picasa3\cdautorun\Picasa CD Slideshow.app\Contents\Resources\no.lproj\i18n\cdgo_resexport.xml

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe
File Type:	XML 1.0 document, ASCII text
Category:	dropped
Size (bytes):	52
Entropy (8bit):	4.849196208400893
Encrypted:	false
SSDEEP:	3:vFWWMNHU8LdgCzLZfOO:TMVBdTtfOO
MD5:	4BE3304509673D14428BD2FFC3070EF8
SHA1:	269C46096236A213905C8F2987CD0C422389D300
SHA-256:	CC678E75294007E177344FB3D841B23E1AA9877B4F5E22AACF93A8FE15FA5B4C
SHA-512:	96E17A55395AA231D5FDB5103A4A5C8D89074E3806909F6BDA2D275A614F01555549DB7280F9E48515AF472E4D0AABB5568D2589EBC1310218A970C3B09BCB1B
Malicious:	false
Reputation:	unknown
Preview:	<?xml version="1.0" encoding="utf-8" ?>.<Win32Res/>.

C:\Program Files (x86)\Google\Picasa3\cdautorun\Picasa CD Slideshow.app\Contents\Resources\no.lproj\i18n\cdgo_stringres.xml

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 text
Category:	dropped
Size (bytes):	6841
Entropy (8bit):	4.779770082095012
Encrypted:	false
SSDEEP:	192:93MBSapmBCeTe5tEehet/8YBZvBnBgNHoedS3MBSapmBCeTe5tEehet/8YBZvBn4:GMCA4ECApyMCA4ECApgChUjz
MD5:	B316D5D1EF11A46AA2B453D5CC277A73
SHA1:	54218A3FD5A2729451D6126DD0937A70405F224C
SHA-256:	602E25B03CBA9F99A1D5FFA3BE189DFCE9C30717A7F908790E760F13860FAC84
SHA-512:	CC56D14183C6C40431730D393539A36F7AE26EF90D109C0C08731907E98C951D08407397808E318672F7F3EA2E89EE4CF4C6B4F3CC7EC9A8770CEAE3276021A4
Malicious:	false
Reputation:	unknown
Preview:	<?xml version="1.0" encoding="utf-8" ?>.<resources>. <stringres id="February">. <xmbtext>Februar</xmbtext>. </stringres>. <stringres id="March">. <xmbtext>Mars</xmbtext>. </stringres>. <stringres id="April">. <xmbtext>April</xmbtext>. </stringres>. <stringres id="May">. <xmbtext>Mai</xmbtext>. </stringres>. <stringres id="June">. <xmbtext>Juni</xmbtext>. </stringres>. <stringres id="July">. <xmbtext>Juli</xmbtext>. </stringres>. <stringres id="August">. <xmbtext>August</xmbtext>. </stringres>. <stringres id="September">. <xmbtext>September</xmbtext>. </stringres>. <stringres id="October">. <xmbtext>Oktober</xmbtext>. </stringres>. <stringres id="November">. <xmbtext>November</xmbtext>. </stringres>. <stringres id="December">. <xmbtext>Desember</xmbtext>. </stringres>. <stringres id="Jan">. <xmbtext>Jan</xmbtext>. </stringres>. <stringres id="Feb">. <xmbtext>Feb</xmbtext>. </stringres>. <stringres id="Mar">. <xmbtext>Mar</xmbtext>. </stringres>. <stringres id="Apr">. <xmb

C:\Program Files (x86)\Google\Picasa3\cdautorun\Picasa CD Slideshow.app\Contents\Resources\pl.lproj\i18n\cdgo.xml

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 text
Category:	dropped
Size (bytes):	795
Entropy (8bit):	4.897833388396896
Encrypted:	false
SSDEEP:	24:2dRTcwtnnzYpczYV2zYJJxz0nz8HPDLz8Hjcl+uC8:cuwtnzIK0AQIziXyq+8
MD5:	DB9744E55098090E8EFE5297F6F6F9A8
SHA1:	CD20BF4FBD9E48AA488D8D526F56E7DEAC3885D1
SHA-256:	535F80553636FD01B29F82A9D1A9C96BCC04D02BBAA5E740344BF37069F397A8
SHA-512:	3B1ABBBB9EC747E60DFD36C0691A8B1DEDC29AC71BFCD5845742486448142EF23FC0324FCCEC6B00A34C7749AD451F3550E655E3EDF9266700937304EF8E5459
Malicious:	false
Reputation:	unknown
Preview:	<?xml version="1.0" encoding="utf-8" ?>.<tooltips>. <action type="Label" target="cdgo/copytohd" xmbdesc="Label(cdgo/copytohd)">. <xmbtext>Zapisz na dysku</xmbtext>. </action>. <action type="Label" target="cdgo/eject" xmbdesc="Label(cdgo/eject)">. <xmbtext>Wysu. dysk CD</xmbtext>. </action>. <action type="Label" target="cdgo/exit" xmbdesc="Label(cdgo/exit)">. <xmbtext>Zako.cz</xmbtext>. </action>. <action type="Label" target="cdgo/topicasa" xmbdesc="Label(cdgo/topicasa)">. <xmbtext>Importuj do programu Picasa</xmbtext>. </action>. <action type="Text" target="cdgo/loading" xmbdesc="Text(cdgo/loading)">. <xmbtext>.ADOWANIE</xmbtext>. </action>. <action type="Text" target="cdgo/tpslabel" xmbdesc="Text(cdgo/tpslabel)">. <xmbtext>Czas wy.wietlania</xmbtext>. </action>.</tooltips>.

C:\Program Files (x86)\Google\Picasa3\cdautorun\Picasa CD Slideshow.app\Contents\Resources\pl.lproj\i18n\cdgo_resexport.xml

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe
File Type:	XML 1.0 document, ASCII text
Category:	dropped
Size (bytes):	52
Entropy (8bit):	4.849196208400893
Encrypted:	false
SSDEEP:	3:vFWWMNHU8LdgCzLZfOO:TMVBdTtfOO
MD5:	4BE3304509673D14428BD2FFC3070EF8
SHA1:	269C46096236A213905C8F2987CD0C422389D300
SHA-256:	CC678E75294007E177344FB3D841B23E1AA9877B4F5E22AACF93A8FE15FA5B4C
SHA-512:	96E17A55395AA231D5FDB5103A4A5C8D89074E3806909F6BDA2D275A614F01555549DB7280F9E48515AF472E4D0AABB5568D2589EBC1310218A970C3B09BCB1B
Malicious:	false
Reputation:	unknown
Preview:	<?xml version="1.0" encoding="utf-8" ?>.<Win32Res/>.

C:\Program Files (x86)\Google\Picasa3\cdautorun\Picasa CD Slideshow.app\Contents\Resources\pl.lproj\i18n\cdgo_stringres.xml

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 text
Category:	dropped
Size (bytes):	6968
Entropy (8bit):	4.884491717477926
Encrypted:	false
SSDEEP:	192:9e56j3I2+eweZtEe9eXecYTsSB+2VovFme56j3I2+eweZtEe9eXecYTsSB+2Vovj:e/SECK/SECRp07L
MD5:	CC89463ED5FDBFFF5B457BC45059F26C
SHA1:	261E5A85ECFE07D6903202F2FAEA5765008358C8
SHA-256:	260E67CCAB190A77DA1705DFA0EF52FFC51E81B8F47698CA62F30F76135C8BF4
SHA-512:	5C48B82DCC3982B1899772BBFD37DB3F269550FD906D97259BB1E5435F92AD220CE742C397BAD0BF94E9A4F6C2A9C46D6813441A75F597F6A65C78FE02AE56DF
Malicious:	false
Reputation:	unknown
Preview:	<?xml version="1.0" encoding="utf-8" ?>.<resources>. <stringres id="February">. <xmbtext>Luty</xmbtext>. </stringres>. <stringres id="March">. <xmbtext>Marzec</xmbtext>. </stringres>. <stringres id="April">. <xmbtext>Kwiecie.</xmbtext>. </stringres>. <stringres id="May">. <xmbtext>Maj</xmbtext>. </stringres>. <stringres id="June">. <xmbtext>Czerwiec</xmbtext>. </stringres>. <stringres id="July">. <xmbtext>Lipiec</xmbtext>. </stringres>. <stringres id="August">. <xmbtext>Sierpie.</xmbtext>. </stringres>. <stringres id="September">. <xmbtext>Wrzesie.</xmbtext>. </stringres>. <stringres id="October">. <xmbtext>Pa.dziernik</xmbtext>. </stringres>. <stringres id="November">. <xmbtext>Listopad</xmbtext>. </stringres>. <stringres id="December">. <xmbtext>Grudzie.</xmbtext>. </stringres>. <stringres id="Jan">. <xmbtext>Sty</xmbtext>. </stringres>. <stringres id="Feb">. <xmbtext>Lut</xmbtext>. </stringres>. <stringres id="Mar">. <xmbtext>Mar</xmbtext>. </stringres>. <stringre

C:\Program Files (x86)\Google\Picasa3\cdautorun\Picasa CD Slideshow.app\Contents\Resources\pt.lproj\i18n\cdgo.xml

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 text
Category:	dropped
Size (bytes):	782
Entropy (8bit):	4.8134892262029645
Encrypted:	false
SSDEEP:	24:2dRTcwtuzYprzYV6zYJJx00nz8HPD9z8Hjcl+VJC8:cuwtII30EQ3ziNyq+t
MD5:	A43FD8FE8ECFB6C59E6C28884A5132FB
SHA1:	AA89C3EC7FE779F21F5D6152C71A1EB5F2151AC4
SHA-256:	EE1B6AF5A378B199D5391F726857E14F06205FF1CCD8C279C421FACD9032E873
SHA-512:	1030AD20683656715124835852166495039D852A6619495ECD57F4639F792991FD7A0C986C79DD093319AD2F167E3A41CC462FAB2A1AC3EEAB5FF60FB15D779E
Malicious:	false
Reputation:	unknown
Preview:	<?xml version="1.0" encoding="utf-8" ?>.<tooltips>. <action type="Label" target="cdgo/copytohd" xmbdesc="Label(cdgo/copytohd)">. <xmbtext>Salvar em disco</xmbtext>. </action>. <action type="Label" target="cdgo/eject" xmbdesc="Label(cdgo/eject)">. <xmbtext>Ejetar CD</xmbtext>. </action>. <action type="Label" target="cdgo/exit" xmbdesc="Label(cdgo/exit)">. <xmbtext>Sair</xmbtext>. </action>. <action type="Label" target="cdgo/topicasa" xmbdesc="Label(cdgo/topicasa)">. <xmbtext>Importar para o Picasa</xmbtext>. </action>. <action type="Text" target="cdgo/loading" xmbdesc="Text(cdgo/loading)">. <xmbtext>CARREGANDO</xmbtext>. </action>. <action type="Text" target="cdgo/tpslabel" xmbdesc="Text(cdgo/tpslabel)">. <xmbtext>Tempo de exibi..o</xmbtext>. </action>.</tooltips>.

C:\Program Files (x86)\Google\Picasa3\cdautorun\Picasa CD Slideshow.app\Contents\Resources\pt.lproj\i18n\cdgo_resexport.xml

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe
File Type:	XML 1.0 document, ASCII text
Category:	dropped
Size (bytes):	52
Entropy (8bit):	4.849196208400893
Encrypted:	false
SSDEEP:	3:vFWWMNHU8LdgCzLZfOO:TMVBdTtfOO
MD5:	4BE3304509673D14428BD2FFC3070EF8
SHA1:	269C46096236A213905C8F2987CD0C422389D300
SHA-256:	CC678E75294007E177344FB3D841B23E1AA9877B4F5E22AACF93A8FE15FA5B4C
SHA-512:	96E17A55395AA231D5FDB5103A4A5C8D89074E3806909F6BDA2D275A614F01555549DB7280F9E48515AF472E4D0AABB5568D2589EBC1310218A970C3B09BCB1B
Malicious:	false
Reputation:	unknown
Preview:	<?xml version="1.0" encoding="utf-8" ?>.<Win32Res/>.

C:\Program Files (x86)\Google\Picasa3\cdautorun\Picasa CD Slideshow.app\Contents\Resources\pt.lproj\i18n\cdgo_stringres.xml

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 text
Category:	dropped
Size (bytes):	6953
Entropy (8bit):	4.815069237664873
Encrypted:	false
SSDEEP:	192:9bmB4ZdyBge3eJtEeJefW/wYBHuBnBqV5oe4ZbmB4ZdyBge3eJtEeJefW/wYBHuU:0hgCMEKcCwmhgCMEKcCwhiuG
MD5:	EA6DA10F38F55161DCC588B13FA2C8AE
SHA1:	87B6E684E3EE59EEC725BDF9ECFA478D06F7E4EE
SHA-256:	67F47C02E82FAA92556AEE5D1F387807FCAAB1C548F0969DB470F7FFDD839A88
SHA-512:	2B19EDCE38CE2101CACA676AC2A12178DB04E378F485D213E473A162F1051362581D709CF11154EE8140D5C6B2362BD2C89CAE70E2306381F0298ACDDBB55485
Malicious:	false
Reputation:	unknown
Preview:	<?xml version="1.0" encoding="utf-8" ?>.<resources>. <stringres id="February">. <xmbtext>Fevereiro</xmbtext>. </stringres>. <stringres id="March">. <xmbtext>Mar.o</xmbtext>. </stringres>. <stringres id="April">. <xmbtext>Abril</xmbtext>. </stringres>. <stringres id="May">. <xmbtext>Maio</xmbtext>. </stringres>. <stringres id="June">. <xmbtext>Junho</xmbtext>. </stringres>. <stringres id="July">. <xmbtext>Julho</xmbtext>. </stringres>. <stringres id="August">. <xmbtext>Agosto</xmbtext>. </stringres>. <stringres id="September">. <xmbtext>Setembro</xmbtext>. </stringres>. <stringres id="October">. <xmbtext>Outubro</xmbtext>. </stringres>. <stringres id="November">. <xmbtext>Novembro</xmbtext>. </stringres>. <stringres id="December">. <xmbtext>Dezembro</xmbtext>. </stringres>. <stringres id="Jan">. <xmbtext>Jan</xmbtext>. </stringres>. <stringres id="Feb">. <xmbtext>Fev</xmbtext>. </stringres>. <stringres id="Mar">. <xmbtext>Mar</xmbtext>. </stringres>. <stringres id="Apr">.

C:\Program Files (x86)\Google\Picasa3\cdautorun\Picasa CD Slideshow.app\Contents\Resources\pt_BR.lproj\i18n\cdgo.xml

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 text
Category:	dropped
Size (bytes):	782
Entropy (8bit):	4.8134892262029645
Encrypted:	false
SSDEEP:	24:2dRTcwtuzYprzYV6zYJJx00nz8HPD9z8Hjcl+VJC8:cuwtII30EQ3ziNyq+t
MD5:	A43FD8FE8ECFB6C59E6C28884A5132FB
SHA1:	AA89C3EC7FE779F21F5D6152C71A1EB5F2151AC4
SHA-256:	EE1B6AF5A378B199D5391F726857E14F06205FF1CCD8C279C421FACD9032E873
SHA-512:	1030AD20683656715124835852166495039D852A6619495ECD57F4639F792991FD7A0C986C79DD093319AD2F167E3A41CC462FAB2A1AC3EEAB5FF60FB15D779E
Malicious:	false
Reputation:	unknown
Preview:	<?xml version="1.0" encoding="utf-8" ?>.<tooltips>. <action type="Label" target="cdgo/copytohd" xmbdesc="Label(cdgo/copytohd)">. <xmbtext>Salvar em disco</xmbtext>. </action>. <action type="Label" target="cdgo/eject" xmbdesc="Label(cdgo/eject)">. <xmbtext>Ejetar CD</xmbtext>. </action>. <action type="Label" target="cdgo/exit" xmbdesc="Label(cdgo/exit)">. <xmbtext>Sair</xmbtext>. </action>. <action type="Label" target="cdgo/topicasa" xmbdesc="Label(cdgo/topicasa)">. <xmbtext>Importar para o Picasa</xmbtext>. </action>. <action type="Text" target="cdgo/loading" xmbdesc="Text(cdgo/loading)">. <xmbtext>CARREGANDO</xmbtext>. </action>. <action type="Text" target="cdgo/tpslabel" xmbdesc="Text(cdgo/tpslabel)">. <xmbtext>Tempo de exibi..o</xmbtext>. </action>.</tooltips>.

C:\Program Files (x86)\Google\Picasa3\cdautorun\Picasa CD Slideshow.app\Contents\Resources\pt_BR.lproj\i18n\cdgo_resexport.xml

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe
File Type:	XML 1.0 document, ASCII text
Category:	dropped
Size (bytes):	52
Entropy (8bit):	4.849196208400893
Encrypted:	false
SSDEEP:	3:vFWWMNHU8LdgCzLZfOO:TMVBdTtfOO
MD5:	4BE3304509673D14428BD2FFC3070EF8
SHA1:	269C46096236A213905C8F2987CD0C422389D300
SHA-256:	CC678E75294007E177344FB3D841B23E1AA9877B4F5E22AACF93A8FE15FA5B4C
SHA-512:	96E17A55395AA231D5FDB5103A4A5C8D89074E3806909F6BDA2D275A614F01555549DB7280F9E48515AF472E4D0AABB5568D2589EBC1310218A970C3B09BCB1B
Malicious:	false
Reputation:	unknown
Preview:	<?xml version="1.0" encoding="utf-8" ?>.<Win32Res/>.

C:\Program Files (x86)\Google\Picasa3\cdautorun\Picasa CD Slideshow.app\Contents\Resources\pt_BR.lproj\i18n\cdgo_stringres.xml

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 text
Category:	dropped
Size (bytes):	6953
Entropy (8bit):	4.815069237664873
Encrypted:	false
SSDEEP:	192:9bmB4ZdyBge3eJtEeJefW/wYBHuBnBqV5oe4ZbmB4ZdyBge3eJtEeJefW/wYBHuU:0hgCMEKcCwmhgCMEKcCwhiuG
MD5:	EA6DA10F38F55161DCC588B13FA2C8AE
SHA1:	87B6E684E3EE59EEC725BDF9ECFA478D06F7E4EE
SHA-256:	67F47C02E82FAA92556AEE5D1F387807FCAAB1C548F0969DB470F7FFDD839A88
SHA-512:	2B19EDCE38CE2101CACA676AC2A12178DB04E378F485D213E473A162F1051362581D709CF11154EE8140D5C6B2362BD2C89CAE70E2306381F0298ACDDBB55485
Malicious:	false
Reputation:	unknown
Preview:	<?xml version="1.0" encoding="utf-8" ?>.<resources>. <stringres id="February">. <xmbtext>Fevereiro</xmbtext>. </stringres>. <stringres id="March">. <xmbtext>Mar.o</xmbtext>. </stringres>. <stringres id="April">. <xmbtext>Abril</xmbtext>. </stringres>. <stringres id="May">. <xmbtext>Maio</xmbtext>. </stringres>. <stringres id="June">. <xmbtext>Junho</xmbtext>. </stringres>. <stringres id="July">. <xmbtext>Julho</xmbtext>. </stringres>. <stringres id="August">. <xmbtext>Agosto</xmbtext>. </stringres>. <stringres id="September">. <xmbtext>Setembro</xmbtext>. </stringres>. <stringres id="October">. <xmbtext>Outubro</xmbtext>. </stringres>. <stringres id="November">. <xmbtext>Novembro</xmbtext>. </stringres>. <stringres id="December">. <xmbtext>Dezembro</xmbtext>. </stringres>. <stringres id="Jan">. <xmbtext>Jan</xmbtext>. </stringres>. <stringres id="Feb">. <xmbtext>Fev</xmbtext>. </stringres>. <stringres id="Mar">. <xmbtext>Mar</xmbtext>. </stringres>. <stringres id="Apr">.

C:\Program Files (x86)\Google\Picasa3\cdautorun\Picasa CD Slideshow.app\Contents\Resources\pt_PT.lproj\i18n\cdgo.xml

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 text
Category:	dropped
Size (bytes):	788
Entropy (8bit):	4.820627182378407
Encrypted:	false
SSDEEP:	24:2dRTcwtKzYpd6zYV6zYJJx00nz8HPDBVxz8Hjcl+fAJC8:cuwt0Ie0EQ3ziBDyq+i
MD5:	EA122387AAA039393B285BE8B1795A4C
SHA1:	7C83F675478AF709ED6553102BCEB6EDE118F740
SHA-256:	63531B4D3FB297FC1683557DA48F6816EABCFD3DAD6F2944B1ED7C1C4485E712
SHA-512:	0C28538EFE92771961B1AEB8482C83503AFEA3DD9E2E4F35654C8030ABFCEDC026B05AC855483E4A4194A2943BA1ED9D173B137AF71B7CC6188F15626B4CD293
Malicious:	false
Reputation:	unknown
Preview:	<?xml version="1.0" encoding="utf-8" ?>.<tooltips>. <action type="Label" target="cdgo/copytohd" xmbdesc="Label(cdgo/copytohd)">. <xmbtext>Guardar no disco</xmbtext>. </action>. <action type="Label" target="cdgo/eject" xmbdesc="Label(cdgo/eject)">. <xmbtext>Ejectar CD</xmbtext>. </action>. <action type="Label" target="cdgo/exit" xmbdesc="Label(cdgo/exit)">. <xmbtext>Sair</xmbtext>. </action>. <action type="Label" target="cdgo/topicasa" xmbdesc="Label(cdgo/topicasa)">. <xmbtext>Importar para o Picasa</xmbtext>. </action>. <action type="Text" target="cdgo/loading" xmbdesc="Text(cdgo/loading)">. <xmbtext>A CARREGAR</xmbtext>. </action>. <action type="Text" target="cdgo/tpslabel" xmbdesc="Text(cdgo/tpslabel)">. <xmbtext>Tempo de visualiza..o</xmbtext>. </action>.</tooltips>.

C:\Program Files (x86)\Google\Picasa3\cdautorun\Picasa CD Slideshow.app\Contents\Resources\pt_PT.lproj\i18n\cdgo_resexport.xml

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe
File Type:	XML 1.0 document, ASCII text
Category:	dropped
Size (bytes):	52
Entropy (8bit):	4.849196208400893
Encrypted:	false
SSDEEP:	3:vFWWMNHU8LdgCzLZfOO:TMVBdTtfOO
MD5:	4BE3304509673D14428BD2FFC3070EF8
SHA1:	269C46096236A213905C8F2987CD0C422389D300
SHA-256:	CC678E75294007E177344FB3D841B23E1AA9877B4F5E22AACF93A8FE15FA5B4C
SHA-512:	96E17A55395AA231D5FDB5103A4A5C8D89074E3806909F6BDA2D275A614F01555549DB7280F9E48515AF472E4D0AABB5568D2589EBC1310218A970C3B09BCB1B
Malicious:	false
Reputation:	unknown
Preview:	<?xml version="1.0" encoding="utf-8" ?>.<Win32Res/>.

C:\Program Files (x86)\Google\Picasa3\cdautorun\Picasa CD Slideshow.app\Contents\Resources\pt_PT.lproj\i18n\cdgo_stringres.xml

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 text
Category:	dropped
Size (bytes):	6996
Entropy (8bit):	4.81986330783332
Encrypted:	false
SSDEEP:	192:9bmB4adyBge3eJtEeJefW/wYBHvBnBqV5oe4ZbmB4adyBge3eJtEeJefW/wYBHvM:0igCMEKcC3migCMEKcC3r9jGGP+HAG
MD5:	4E9F9ABCEFB0EBDE546B59B78C870D1B
SHA1:	37B31C070AB8D374C1D44A89A348ECE520B05867
SHA-256:	F66250A649421D49987401C273159757C0A1F4E161F83024D7154F87CF1F84DA
SHA-512:	8E16F90B85BDA39E2F4EA12F803A790BE7DC150FFA807C6E9C6E52E5410334620A6EF1A2570ABCF1C3F5A3030871C38B16BB7898153A14157EB9CF0B81379E50
Malicious:	false
Reputation:	unknown
Preview:	<?xml version="1.0" encoding="utf-8" ?>.<resources>. <stringres id="February">. <xmbtext>Fevereiro</xmbtext>. </stringres>. <stringres id="March">. <xmbtext>Mar.o</xmbtext>. </stringres>. <stringres id="April">. <xmbtext>Abril</xmbtext>. </stringres>. <stringres id="May">. <xmbtext>Mai</xmbtext>. </stringres>. <stringres id="June">. <xmbtext>Junho</xmbtext>. </stringres>. <stringres id="July">. <xmbtext>Julho</xmbtext>. </stringres>. <stringres id="August">. <xmbtext>Agosto</xmbtext>. </stringres>. <stringres id="September">. <xmbtext>Setembro</xmbtext>. </stringres>. <stringres id="October">. <xmbtext>Outubro</xmbtext>. </stringres>. <stringres id="November">. <xmbtext>Novembro</xmbtext>. </stringres>. <stringres id="December">. <xmbtext>Dezembro</xmbtext>. </stringres>. <stringres id="Jan">. <xmbtext>Jan</xmbtext>. </stringres>. <stringres id="Feb">. <xmbtext>Fev</xmbtext>. </stringres>. <stringres id="Mar">. <xmbtext>Mar</xmbtext>. </stringres>. <stringres id="Apr">.

C:\Program Files (x86)\Google\Picasa3\cdautorun\Picasa CD Slideshow.app\Contents\Resources\ro.lproj\i18n\cdgo.xml

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 text
Category:	dropped
Size (bytes):	793
Entropy (8bit):	4.880858153959662
Encrypted:	false
SSDEEP:	24:2dRTcwtl6qzYpSzYVJ9zYJJx6s0nz8HPDvz8Hjcl+HC8:cuwtbIs03QSHziLyq+1
MD5:	AF93DDBB34C84A4D88EB4728CC8D8FE0
SHA1:	485048E77AD953E72403E6B01A8595D7D89EACFD
SHA-256:	2C9258A9356F5E5D5CAB88B1AA99D7EE561CF3E53D029283D34D5685506D6003
SHA-512:	9E532872AC3C63A286C408C171CB35BE499F244EBB0C4C7B4B5A1E0042F3DA943283774CDA7EDDCF94FBDCEEA5EB5C33CDD93BBB272DBAAB497046FB84F77A7C
Malicious:	false
Reputation:	unknown
Preview:	<?xml version="1.0" encoding="utf-8" ?>.<tooltips>. <action type="Label" target="cdgo/copytohd" xmbdesc="Label(cdgo/copytohd)">. <xmbtext>Salva.i pe disc</xmbtext>. </action>. <action type="Label" target="cdgo/eject" xmbdesc="Label(cdgo/eject)">. <xmbtext>Scoate.i CD-ul</xmbtext>. </action>. <action type="Label" target="cdgo/exit" xmbdesc="Label(cdgo/exit)">. <xmbtext>Ie.i.i</xmbtext>. </action>. <action type="Label" target="cdgo/topicasa" xmbdesc="Label(cdgo/topicasa)">. <xmbtext>Importa.i .n Picasa</xmbtext>. </action>. <action type="Text" target="cdgo/loading" xmbdesc="Text(cdgo/loading)">. <xmbtext>SE .NCARC.</xmbtext>. </action>. <action type="Text" target="cdgo/tpslabel" xmbdesc="Text(cdgo/tpslabel)">. <xmbtext>Durata de afi.are</xmbtext>. </action>.</tooltips>.

C:\Program Files (x86)\Google\Picasa3\cdautorun\Picasa CD Slideshow.app\Contents\Resources\ro.lproj\i18n\cdgo_resexport.xml

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe
File Type:	XML 1.0 document, ASCII text
Category:	dropped
Size (bytes):	52
Entropy (8bit):	4.849196208400893
Encrypted:	false
SSDEEP:	3:vFWWMNHU8LdgCzLZfOO:TMVBdTtfOO
MD5:	4BE3304509673D14428BD2FFC3070EF8
SHA1:	269C46096236A213905C8F2987CD0C422389D300
SHA-256:	CC678E75294007E177344FB3D841B23E1AA9877B4F5E22AACF93A8FE15FA5B4C
SHA-512:	96E17A55395AA231D5FDB5103A4A5C8D89074E3806909F6BDA2D275A614F01555549DB7280F9E48515AF472E4D0AABB5568D2589EBC1310218A970C3B09BCB1B
Malicious:	false
Reputation:	unknown
Preview:	<?xml version="1.0" encoding="utf-8" ?>.<Win32Res/>.

C:\Program Files (x86)\Google\Picasa3\cdautorun\Picasa CD Slideshow.app\Contents\Resources\ro.lproj\i18n\cdgo_stringres.xml

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 text
Category:	dropped
Size (bytes):	7128
Entropy (8bit):	4.823607099243748
Encrypted:	false
SSDEEP:	192:91hBMajUBCeaeJtEeReE2IqBMvICBGJJolJv1hBMajUBCeaeJtEeReE2IqBMvICm:zCCjMEs6mZCCjMEs6m/v0N
MD5:	8932F127654DB94DEEB214B2BF303B6E
SHA1:	5E0145A45904B86BCDCE89ACEF4CBD9FF509A620
SHA-256:	67FB5A23B3F0DFEC9487B878F6582E176CB38432E98E921FEB652CA32633299B
SHA-512:	76F515F025D6A2ABB68472BD544C01F1A39F10A1FE5518841B41C7AA9BF3AEA5BCDE0358635F4A8E29679E7F8AD26A4EC00F2145865FD985473CF769A53EDA37
Malicious:	false
Reputation:	unknown
Preview:	<?xml version="1.0" encoding="utf-8" ?>.<resources>. <stringres id="February">. <xmbtext>Februarie</xmbtext>. </stringres>. <stringres id="March">. <xmbtext>Martie</xmbtext>. </stringres>. <stringres id="April">. <xmbtext>Aprilie</xmbtext>. </stringres>. <stringres id="May">. <xmbtext>Mai</xmbtext>. </stringres>. <stringres id="June">. <xmbtext>Iunie</xmbtext>. </stringres>. <stringres id="July">. <xmbtext>Iulie</xmbtext>. </stringres>. <stringres id="August">. <xmbtext>August</xmbtext>. </stringres>. <stringres id="September">. <xmbtext>Septembrie</xmbtext>. </stringres>. <stringres id="October">. <xmbtext>Octombrie</xmbtext>. </stringres>. <stringres id="November">. <xmbtext>Noiembrie</xmbtext>. </stringres>. <stringres id="December">. <xmbtext>Decembrie</xmbtext>. </stringres>. <stringres id="Jan">. <xmbtext>Ianuarie</xmbtext>. </stringres>. <stringres id="Feb">. <xmbtext>Februarie</xmbtext>. </stringres>. <stringres id="Mar">. <xmbtext>Martie</xmbtext>. </stringres>.

C:\Program Files (x86)\Google\Picasa3\cdautorun\Picasa CD Slideshow.app\Contents\Resources\ru.lproj\i18n\cdgo.xml

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 text
Category:	dropped
Size (bytes):	853
Entropy (8bit):	5.160673202210205
Encrypted:	false
SSDEEP:	24:2dRTcwtlzYpoJzYVXkSJzYJodx0nz8HPD8Gdz8Hjcl+bfqC8:cuwtFII0XkIQSizi8iyq+bw
MD5:	389B8A7B2F73511E302DD59D9BA2B9DA
SHA1:	0E8F0D0C1626A445798C02A6423ADEA09958B0B4
SHA-256:	46F749A74575F488196837E58CD79D1E7C80461412E2BED634A328149B107648
SHA-512:	A646A2DB1925D157954B83DF3A27F246A7AA420A6640FE57B94546EB0CA58C65A0CBA250FC4A8E8BB1F55F355699AC2D648AE1344F024390EA6CB1E60C28EDDD
Malicious:	false
Reputation:	unknown
Preview:	<?xml version="1.0" encoding="utf-8" ?>.<tooltips>. <action type="Label" target="cdgo/copytohd" xmbdesc="Label(cdgo/copytohd)">. <xmbtext>......... .. ....</xmbtext>. </action>. <action type="Label" target="cdgo/eject" xmbdesc="Label(cdgo/eject)">. <xmbtext>....... .......-....</xmbtext>. </action>. <action type="Label" target="cdgo/exit" xmbdesc="Label(cdgo/exit)">. <xmbtext>.....</xmbtext>. </action>. <action type="Label" target="cdgo/topicasa" xmbdesc="Label(cdgo/topicasa)">. <xmbtext>...... . Picasa</xmbtext>. </action>. <action type="Text" target="cdgo/loading" xmbdesc="Text(cdgo/loading)">. <xmbtext>........</xmbtext>. </action>. <action type="Text" target="cdgo/tpslabel" xmbdesc="Text(cdgo/tpslabel)">. <xmbtext>................</xmbtext>. </action>.</tooltips>.

C:\Program Files (x86)\Google\Picasa3\cdautorun\Picasa CD Slideshow.app\Contents\Resources\ru.lproj\i18n\cdgo_resexport.xml

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe
File Type:	XML 1.0 document, ASCII text
Category:	dropped
Size (bytes):	52
Entropy (8bit):	4.849196208400893
Encrypted:	false
SSDEEP:	3:vFWWMNHU8LdgCzLZfOO:TMVBdTtfOO
MD5:	4BE3304509673D14428BD2FFC3070EF8
SHA1:	269C46096236A213905C8F2987CD0C422389D300
SHA-256:	CC678E75294007E177344FB3D841B23E1AA9877B4F5E22AACF93A8FE15FA5B4C
SHA-512:	96E17A55395AA231D5FDB5103A4A5C8D89074E3806909F6BDA2D275A614F01555549DB7280F9E48515AF472E4D0AABB5568D2589EBC1310218A970C3B09BCB1B
Malicious:	false
Reputation:	unknown
Preview:	<?xml version="1.0" encoding="utf-8" ?>.<Win32Res/>.

C:\Program Files (x86)\Google\Picasa3\cdautorun\Picasa CD Slideshow.app\Contents\Resources\ru.lproj\i18n\cdgo_stringres.xml

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 text
Category:	dropped
Size (bytes):	7682
Entropy (8bit):	5.213869819793985
Encrypted:	false
SSDEEP:	192:9xFLtkMPte8eFtEeReqbpF0WVRv2yoon+MxFLtkMPte8eFtEeReqbpF0WVRv2yot:3FGEO/FGEOBqDxFL
MD5:	337A27B4C669E1BC48E7ECCC5C8CB09D
SHA1:	9D7D20019F78EBC91102563F50EA3D1686176D74
SHA-256:	71E8FD17387E87D4145BEF57182399CE70E9561DD1B467E08E8CBB6FAB1EFEAA
SHA-512:	30BD4C89F9E9E33A18D6E532973382F8482D7045D9533A360954D048F67A21D93E49C173E97FB9315AD912850DDED3042D3D06A796AB81D23932949EA701E5F4
Malicious:	false
Reputation:	unknown
Preview:	<?xml version="1.0" encoding="utf-8" ?>.<resources>. <stringres id="February">. <xmbtext>.......</xmbtext>. </stringres>. <stringres id="March">. <xmbtext>....</xmbtext>. </stringres>. <stringres id="April">. <xmbtext>......</xmbtext>. </stringres>. <stringres id="May">. <xmbtext>...</xmbtext>. </stringres>. <stringres id="June">. <xmbtext>....</xmbtext>. </stringres>. <stringres id="July">. <xmbtext>....</xmbtext>. </stringres>. <stringres id="August">. <xmbtext>......</xmbtext>. </stringres>. <stringres id="September">. <xmbtext>........</xmbtext>. </stringres>. <stringres id="October">. <xmbtext>.......</xmbtext>. </stringres>. <stringres id="November">. <xmbtext>......</xmbtext>. </stringres>. <stringres id="December">. <xmbtext>.......</xmbtext>. </stringres>. <stringres id="Jan">. <xmbtext>....</xmbtext>. </stringres>. <stringres id="Feb">. <xmbtext>....</xmbtext>. </stringres>. <stringres id="Mar">.

C:\Program Files (x86)\Google\Picasa3\cdautorun\Picasa CD Slideshow.app\Contents\Resources\sk.lproj\i18n\cdgo.xml

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 text
Category:	dropped
Size (bytes):	803
Entropy (8bit):	4.918899696441604
Encrypted:	false
SSDEEP:	24:2dRTcwtIYFzYp4KzYVczYJJx+x0nz8HPDsz8Hjcl+xyC8:cuwt1lI400KQ7zi6yq+xA
MD5:	46F8E4ED4B3D7BCC8BA0FC0920E5EBD7
SHA1:	379CD398526BC4B43281D9ACA7ABE1FCF53096AD
SHA-256:	83BFBCC5D6025D36A5B2DE9FA5AEF3D9F3143AE2B68DBADBEDA53532A73B753F
SHA-512:	054A899FE1388F00978AEC139556BB86341C635FBD28AC5C25DF8EB351572F5DEDAE6476006B949B7B943F59FDB4D18BC4AB35330726675EAA1BE59EBC724136
Malicious:	false
Reputation:	unknown
Preview:	<?xml version="1.0" encoding="utf-8" ?>.<tooltips>. <action type="Label" target="cdgo/copytohd" xmbdesc="Label(cdgo/copytohd)">. <xmbtext>Ulo.i. na disk</xmbtext>. </action>. <action type="Label" target="cdgo/eject" xmbdesc="Label(cdgo/eject)">. <xmbtext>Vysun.. disk CD</xmbtext>. </action>. <action type="Label" target="cdgo/exit" xmbdesc="Label(cdgo/exit)">. <xmbtext>Skon.i.</xmbtext>. </action>. <action type="Label" target="cdgo/topicasa" xmbdesc="Label(cdgo/topicasa)">. <xmbtext>Importova. do programu Picasa</xmbtext>. </action>. <action type="Text" target="cdgo/loading" xmbdesc="Text(cdgo/loading)">. <xmbtext>NA..TAVA SA</xmbtext>. </action>. <action type="Text" target="cdgo/tpslabel" xmbdesc="Text(cdgo/tpslabel)">. <xmbtext>Doba zobrazenia</xmbtext>. </action>.</tooltips>.

C:\Program Files (x86)\Google\Picasa3\cdautorun\Picasa CD Slideshow.app\Contents\Resources\sk.lproj\i18n\cdgo_resexport.xml

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe
File Type:	XML 1.0 document, ASCII text
Category:	dropped
Size (bytes):	52
Entropy (8bit):	4.849196208400893
Encrypted:	false
SSDEEP:	3:vFWWMNHU8LdgCzLZfOO:TMVBdTtfOO
MD5:	4BE3304509673D14428BD2FFC3070EF8
SHA1:	269C46096236A213905C8F2987CD0C422389D300
SHA-256:	CC678E75294007E177344FB3D841B23E1AA9877B4F5E22AACF93A8FE15FA5B4C
SHA-512:	96E17A55395AA231D5FDB5103A4A5C8D89074E3806909F6BDA2D275A614F01555549DB7280F9E48515AF472E4D0AABB5568D2589EBC1310218A970C3B09BCB1B
Malicious:	false
Reputation:	unknown
Preview:	<?xml version="1.0" encoding="utf-8" ?>.<Win32Res/>.

C:\Program Files (x86)\Google\Picasa3\cdautorun\Picasa CD Slideshow.app\Contents\Resources\sk.lproj\i18n\cdgo_stringres.xml

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 text
Category:	dropped
Size (bytes):	7001
Entropy (8bit):	4.889117634610361
Encrypted:	false
SSDEEP:	192:9grB/sadBCeTeCtEehe9/8YBZN7FBg5HoeNXgrB/sadBCeTeCtEehe9/8YBZN7Fy:IjCANECwjFjCANECwjDNVCb
MD5:	4A60B768DEED7AC1646110437C831DC6
SHA1:	46FC48BD57F9F9E61352AB15106C2BADBB57E8F7
SHA-256:	E2AF35645CB7A46FD1002DBCBD90C55A354409433C017FF75D3A0F9E30A5CFCA
SHA-512:	FFF6B276957443A96372FF55D0861CD4F5C0C4C673843DF07B0814C9DAE85437F2862FBF9ECDC31BD164D668CA017F6925C14D9F7B2FE8BB1BEAC791C9A77C58
Malicious:	false
Reputation:	unknown
Preview:	<?xml version="1.0" encoding="utf-8" ?>.<resources>. <stringres id="February">. <xmbtext>Febru.r</xmbtext>. </stringres>. <stringres id="March">. <xmbtext>Marec</xmbtext>. </stringres>. <stringres id="April">. <xmbtext>Apr.l</xmbtext>. </stringres>. <stringres id="May">. <xmbtext>M.j</xmbtext>. </stringres>. <stringres id="June">. <xmbtext>J.n</xmbtext>. </stringres>. <stringres id="July">. <xmbtext>J.l</xmbtext>. </stringres>. <stringres id="August">. <xmbtext>August</xmbtext>. </stringres>. <stringres id="September">. <xmbtext>September</xmbtext>. </stringres>. <stringres id="October">. <xmbtext>Okt.ber</xmbtext>. </stringres>. <stringres id="November">. <xmbtext>November</xmbtext>. </stringres>. <stringres id="December">. <xmbtext>December</xmbtext>. </stringres>. <stringres id="Jan">. <xmbtext>Jan</xmbtext>. </stringres>. <stringres id="Feb">. <xmbtext>Feb</xmbtext>. </stringres>. <stringres id="Mar">. <xmbtext>Mar</xmbtext>. </stringres>. <stringres id="Apr">.

C:\Program Files (x86)\Google\Picasa3\cdautorun\Picasa CD Slideshow.app\Contents\Resources\sl.lproj\i18n\cdgo.xml

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 text
Category:	dropped
Size (bytes):	766
Entropy (8bit):	4.85658904327679
Encrypted:	false
SSDEEP:	12:TMHdRWaD4w8MAld9dBaDFAsSd9dBaDSHYTAs9d9dBaDFAwmmd9dBKH2K2D0AFgx0:2dRTcwtszYpJuzYVJ/zYJrz8HPDGjz88
MD5:	0B5A382751F02FB389619539EC04C71E
SHA1:	D90F0137CA82D86BAA4800B59239B466F01350AD
SHA-256:	20B2E88AF4390AD3C6D3B39B9E723831BD78822CDA1AAA77EB0410E7430A4C94
SHA-512:	5B5ACBF3188D2407D8BF8CBF9B25841196DD72295921D9D1110157CCE0197B8E1D56C39FB07E2B9D3358674123E63F7EACC06E620DE39354DC4FEFDCE05A33C4
Malicious:	false
Reputation:	unknown
Preview:	<?xml version="1.0" encoding="utf-8" ?>.<tooltips>. <action type="Label" target="cdgo/copytohd" xmbdesc="Label(cdgo/copytohd)">. <xmbtext>Shrani na disk</xmbtext>. </action>. <action type="Label" target="cdgo/eject" xmbdesc="Label(cdgo/eject)">. <xmbtext>Izvrzi CD</xmbtext>. </action>. <action type="Label" target="cdgo/exit" xmbdesc="Label(cdgo/exit)">. <xmbtext>Izhod</xmbtext>. </action>. <action type="Label" target="cdgo/topicasa" xmbdesc="Label(cdgo/topicasa)">. <xmbtext>Uvozi v Picaso</xmbtext>. </action>. <action type="Text" target="cdgo/loading" xmbdesc="Text(cdgo/loading)">. <xmbtext>NALAGANJE</xmbtext>. </action>. <action type="Text" target="cdgo/tpslabel" xmbdesc="Text(cdgo/tpslabel)">. <xmbtext>Prika.i uro</xmbtext>. </action>.</tooltips>.

C:\Program Files (x86)\Google\Picasa3\cdautorun\Picasa CD Slideshow.app\Contents\Resources\sl.lproj\i18n\cdgo_resexport.xml

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe
File Type:	XML 1.0 document, ASCII text
Category:	dropped
Size (bytes):	52
Entropy (8bit):	4.849196208400893
Encrypted:	false
SSDEEP:	3:vFWWMNHU8LdgCzLZfOO:TMVBdTtfOO
MD5:	4BE3304509673D14428BD2FFC3070EF8
SHA1:	269C46096236A213905C8F2987CD0C422389D300
SHA-256:	CC678E75294007E177344FB3D841B23E1AA9877B4F5E22AACF93A8FE15FA5B4C
SHA-512:	96E17A55395AA231D5FDB5103A4A5C8D89074E3806909F6BDA2D275A614F01555549DB7280F9E48515AF472E4D0AABB5568D2589EBC1310218A970C3B09BCB1B
Malicious:	false
Reputation:	unknown
Preview:	<?xml version="1.0" encoding="utf-8" ?>.<Win32Res/>.

C:\Program Files (x86)\Google\Picasa3\cdautorun\Picasa CD Slideshow.app\Contents\Resources\sl.lproj\i18n\cdgo_stringres.xml

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 text
Category:	dropped
Size (bytes):	6882
Entropy (8bit):	4.807610115409921
Encrypted:	false
SSDEEP:	192:9XLsDlBYLezeZtEeBedfc4jMhHPZno+tyXLsDlBYLezeZtEeBedfc4jMhHPZno+U:ZgYEiigYEi+k5cN
MD5:	B4F51B0FFF5FFD8BADDBB2AA0DBC0DE6
SHA1:	2B3A4835FBC640959A4C9B2ADAC0C50CFD49985A
SHA-256:	B1EC8A8F8FA8C559349077DE62A1FCBBCEAD81FE38EE08F9EDEAE9EFA8BB45A5
SHA-512:	08DF87C0717EC76519C9AAEC707E7DBEB6167E3BF7E8B40F5F75B0BF314AB668855B0BE20999410D6CE2E7B4FD79D213539ED2163115B5FDB5A8CDD31D7C1446
Malicious:	false
Reputation:	unknown
Preview:	<?xml version="1.0" encoding="utf-8" ?>.<resources>. <stringres id="February">. <xmbtext>februar</xmbtext>. </stringres>. <stringres id="March">. <xmbtext>marec</xmbtext>. </stringres>. <stringres id="April">. <xmbtext>april</xmbtext>. </stringres>. <stringres id="May">. <xmbtext>maj</xmbtext>. </stringres>. <stringres id="June">. <xmbtext>junij</xmbtext>. </stringres>. <stringres id="July">. <xmbtext>julij</xmbtext>. </stringres>. <stringres id="August">. <xmbtext>avgust</xmbtext>. </stringres>. <stringres id="September">. <xmbtext>september</xmbtext>. </stringres>. <stringres id="October">. <xmbtext>oktober</xmbtext>. </stringres>. <stringres id="November">. <xmbtext>november</xmbtext>. </stringres>. <stringres id="December">. <xmbtext>december</xmbtext>. </stringres>. <stringres id="Jan">. <xmbtext>jan</xmbtext>. </stringres>. <stringres id="Feb">. <xmbtext>feb</xmbtext>. </stringres>. <stringres id="Mar">. <xmbtext>mar</xmbtext>. </stringres>. <stringres id="Apr">. <

C:\Program Files (x86)\Google\Picasa3\cdautorun\Picasa CD Slideshow.app\Contents\Resources\sr.lproj\i18n\cdgo.xml

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 text
Category:	dropped
Size (bytes):	832
Entropy (8bit):	5.095253228015694
Encrypted:	false
SSDEEP:	24:2dRTcwtAzYpo5QzYVoSzYJ7WWE7z8HPDFqz8Hjcl+XSjC8:cuwtOIG+0JQ7W7iiyq+Xw
MD5:	3B6CC2E76E014779C3DE8C174A796F29
SHA1:	858B390B0EA4B93EA6D86B2D3EF54CC27D9F5552
SHA-256:	A5A6B706601ACCE63973A10FEB804BCDF1A453FD773BF53FA4FC6E358EAD275A
SHA-512:	BC81991CCEA3F9C1819A41D3B50C49DB37A2C6FFC23816AE7D09CC409A18B56A98EAC7AC6D05A17AA22ED408EE46DF152474741212893C11297A1B3905E80EFA
Malicious:	false
Reputation:	unknown
Preview:	<?xml version="1.0" encoding="utf-8" ?>.<tooltips>. <action type="Label" target="cdgo/copytohd" xmbdesc="Label(cdgo/copytohd)">. <xmbtext>....... .. .....</xmbtext>. </action>. <action type="Label" target="cdgo/eject" xmbdesc="Label(cdgo/eject)">. <xmbtext>...... CD</xmbtext>. </action>. <action type="Label" target="cdgo/exit" xmbdesc="Label(cdgo/exit)">. <xmbtext>.....</xmbtext>. </action>. <action type="Label" target="cdgo/topicasa" xmbdesc="Label(cdgo/topicasa)">. <xmbtext>..... . Picasa-.</xmbtext>. </action>. <action type="Text" target="cdgo/loading" xmbdesc="Text(cdgo/loading)">. <xmbtext>.........</xmbtext>. </action>. <action type="Text" target="cdgo/tpslabel" xmbdesc="Text(cdgo/tpslabel)">. <xmbtext>..... ...........</xmbtext>. </action>.</tooltips>.

C:\Program Files (x86)\Google\Picasa3\cdautorun\Picasa CD Slideshow.app\Contents\Resources\sr.lproj\i18n\cdgo_resexport.xml

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe
File Type:	XML 1.0 document, ASCII text
Category:	dropped
Size (bytes):	52
Entropy (8bit):	4.849196208400893
Encrypted:	false
SSDEEP:	3:vFWWMNHU8LdgCzLZfOO:TMVBdTtfOO
MD5:	4BE3304509673D14428BD2FFC3070EF8
SHA1:	269C46096236A213905C8F2987CD0C422389D300
SHA-256:	CC678E75294007E177344FB3D841B23E1AA9877B4F5E22AACF93A8FE15FA5B4C
SHA-512:	96E17A55395AA231D5FDB5103A4A5C8D89074E3806909F6BDA2D275A614F01555549DB7280F9E48515AF472E4D0AABB5568D2589EBC1310218A970C3B09BCB1B
Malicious:	false
Reputation:	unknown
Preview:	<?xml version="1.0" encoding="utf-8" ?>.<Win32Res/>.

C:\Program Files (x86)\Google\Picasa3\cdautorun\Picasa CD Slideshow.app\Contents\Resources\sr.lproj\i18n\cdgo_stringres.xml

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 text
Category:	dropped
Size (bytes):	7717
Entropy (8bit):	5.194835750602604
Encrypted:	false
SSDEEP:	192:9qlLXGOlNeXegtEeNeLWrl0X739h4goxyPqlLXGOlNeXegtEeNeLWrl0X739h4gB:CSfEaRSfEaD+Aqhn
MD5:	E4F5A9BA70029A97EBDC274B42F37D8F
SHA1:	365A126E79A03EF50D094CF937D277981693068E
SHA-256:	109B9267BF9A9045A016682918E663514B1E9C2FA84708595A59B26B1BEEB9BD
SHA-512:	5B1FD085945611D342748AE66994C4516306C684C3613ACB28D9949D99C6030119E57B13B1CE27731A6A04D3BB38FD37E3A7F06884991D798486269C502B3233
Malicious:	false
Reputation:	unknown
Preview:	<?xml version="1.0" encoding="utf-8" ?>.<resources>. <stringres id="February">. <xmbtext>.......</xmbtext>. </stringres>. <stringres id="March">. <xmbtext>....</xmbtext>. </stringres>. <stringres id="April">. <xmbtext>.....</xmbtext>. </stringres>. <stringres id="May">. <xmbtext>...</xmbtext>. </stringres>. <stringres id="June">. <xmbtext>...</xmbtext>. </stringres>. <stringres id="July">. <xmbtext>...</xmbtext>. </stringres>. <stringres id="August">. <xmbtext>......</xmbtext>. </stringres>. <stringres id="September">. <xmbtext>.........</xmbtext>. </stringres>. <stringres id="October">. <xmbtext>.......</xmbtext>. </stringres>. <stringres id="November">. <xmbtext>........</xmbtext>. </stringres>. <stringres id="December">. <xmbtext>........</xmbtext>. </stringres>. <stringres id="Jan">. <xmbtext>......</xmbtext>. </stringres>. <stringres id="Feb">. <xmbtext>.......</xmbtext>. </stringres>. <string

C:\Program Files (x86)\Google\Picasa3\cdautorun\Picasa CD Slideshow.app\Contents\Resources\sv.lproj\i18n\cdgo.xml

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 text
Category:	dropped
Size (bytes):	773
Entropy (8bit):	4.787663061783421
Encrypted:	false
SSDEEP:	24:2dRTcwtKLzYpczYVBT9zYJJxZ0nz8HPDFz8Hjcl+HC8:cuwtKXIK0B5Qizilyq+1
MD5:	B6B20C0850C64C0FB6EE9DC6A97F3922
SHA1:	D0BF2E06C85EFFEA97FC4569A25B62955B5FF980
SHA-256:	D9AE8C1C58847A78D7C88FD45F0AAABA01596629DFFF5B17FD6008B04629C4C9
SHA-512:	AE8D6F3E2820E7ED3875D793DCB569759E4963D55FEA5CB86A752E03DCBA0D85A28808C17D490245780F4C934ABCBBC099D28A0BC372D59D4915860F9B179D45
Malicious:	false
Reputation:	unknown
Preview:	<?xml version="1.0" encoding="utf-8" ?>.<tooltips>. <action type="Label" target="cdgo/copytohd" xmbdesc="Label(cdgo/copytohd)">. <xmbtext>Spara till disk</xmbtext>. </action>. <action type="Label" target="cdgo/eject" xmbdesc="Label(cdgo/eject)">. <xmbtext>Mata ut CD</xmbtext>. </action>. <action type="Label" target="cdgo/exit" xmbdesc="Label(cdgo/exit)">. <xmbtext>Avsluta</xmbtext>. </action>. <action type="Label" target="cdgo/topicasa" xmbdesc="Label(cdgo/topicasa)">. <xmbtext>Importera till Picasa</xmbtext>. </action>. <action type="Text" target="cdgo/loading" xmbdesc="Text(cdgo/loading)">. <xmbtext>L.SER IN</xmbtext>. </action>. <action type="Text" target="cdgo/tpslabel" xmbdesc="Text(cdgo/tpslabel)">. <xmbtext>Visa tid</xmbtext>. </action>.</tooltips>.

C:\Program Files (x86)\Google\Picasa3\cdautorun\Picasa CD Slideshow.app\Contents\Resources\sv.lproj\i18n\cdgo_resexport.xml

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe
File Type:	XML 1.0 document, ASCII text
Category:	dropped
Size (bytes):	52
Entropy (8bit):	4.849196208400893
Encrypted:	false
SSDEEP:	3:vFWWMNHU8LdgCzLZfOO:TMVBdTtfOO
MD5:	4BE3304509673D14428BD2FFC3070EF8
SHA1:	269C46096236A213905C8F2987CD0C422389D300
SHA-256:	CC678E75294007E177344FB3D841B23E1AA9877B4F5E22AACF93A8FE15FA5B4C
SHA-512:	96E17A55395AA231D5FDB5103A4A5C8D89074E3806909F6BDA2D275A614F01555549DB7280F9E48515AF472E4D0AABB5568D2589EBC1310218A970C3B09BCB1B
Malicious:	false
Reputation:	unknown
Preview:	<?xml version="1.0" encoding="utf-8" ?>.<Win32Res/>.

C:\Program Files (x86)\Google\Picasa3\cdautorun\Picasa CD Slideshow.app\Contents\Resources\sv.lproj\i18n\cdgo_stringres.xml

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 text
Category:	dropped
Size (bytes):	6868
Entropy (8bit):	4.796929913977787
Encrypted:	false
SSDEEP:	192:9gMBSjpmBBeTe5tEehe9/8YBZsKnBg5HoeNXgMBSjpmBBeTe5tEehe9/8YBZsKnC:DDBA4ECw9oDBA4ECw9PCc4F
MD5:	ADD698B09DB97DF309F25F1EA76E531B
SHA1:	30E587FD131FB33EED8E8CD379177F102DB61671
SHA-256:	AD3F6566581CDE0B49559851491E675245DD271B78F1000AE89227E6401F7A4B
SHA-512:	45BD1713E8BE84384F28BFF56DC545889A2F838F7C09AD0F500CDB03AEDF5FDDA7ECBACC8A5BF9FB8FDCEA5B0574AC12A6A42D3853648B0BD75CDD63D6568EC1
Malicious:	false
Reputation:	unknown
Preview:	<?xml version="1.0" encoding="utf-8" ?>.<resources>. <stringres id="February">. <xmbtext>Februari</xmbtext>. </stringres>. <stringres id="March">. <xmbtext>Mars</xmbtext>. </stringres>. <stringres id="April">. <xmbtext>April</xmbtext>. </stringres>. <stringres id="May">. <xmbtext>Maj</xmbtext>. </stringres>. <stringres id="June">. <xmbtext>Juni</xmbtext>. </stringres>. <stringres id="July">. <xmbtext>Juli</xmbtext>. </stringres>. <stringres id="August">. <xmbtext>Augusti</xmbtext>. </stringres>. <stringres id="September">. <xmbtext>September</xmbtext>. </stringres>. <stringres id="October">. <xmbtext>Oktober</xmbtext>. </stringres>. <stringres id="November">. <xmbtext>November</xmbtext>. </stringres>. <stringres id="December">. <xmbtext>December</xmbtext>. </stringres>. <stringres id="Jan">. <xmbtext>Jan</xmbtext>. </stringres>. <stringres id="Feb">. <xmbtext>Feb</xmbtext>. </stringres>. <stringres id="Mar">. <xmbtext>Mar</xmbtext>. </stringres>. <stringres id="Apr">. <x

C:\Program Files (x86)\Google\Picasa3\cdautorun\Picasa CD Slideshow.app\Contents\Resources\tl.lproj\i18n\cdgo.xml

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe
File Type:	XML 1.0 document, ASCII text
Category:	dropped
Size (bytes):	781
Entropy (8bit):	4.814194045266143
Encrypted:	false
SSDEEP:	24:2dRTcwtJXPzYpJoIzYVM6zYJJF/M0nz8HPDNz8Hjcl+JyC8:cuwtBId0MEQbzi9yq+W
MD5:	2A6599215282F275F9C542C802DC2F1F
SHA1:	6007211F45C2C5C41ED7F5EB5D3EE4B10D52119F
SHA-256:	DDC709715EA8EC4EADC62E24A2029EB6A7CCBB8CBF75FA4656F0D11E2A1F0284
SHA-512:	2230B30382C809ADBF2DE6A12ECEFB6AE791A90B5418BE80F1222632CB27FEF35015F602CBC44E2E8934B53C023DFCFA60172E5364FE4D8244BD39128FE3214F
Malicious:	false
Reputation:	unknown
Preview:	<?xml version="1.0" encoding="utf-8" ?>.<tooltips>. <action type="Label" target="cdgo/copytohd" xmbdesc="Label(cdgo/copytohd)">. <xmbtext>I-save sa Disk</xmbtext>. </action>. <action type="Label" target="cdgo/eject" xmbdesc="Label(cdgo/eject)">. <xmbtext>I-eject ang CD</xmbtext>. </action>. <action type="Label" target="cdgo/exit" xmbdesc="Label(cdgo/exit)">. <xmbtext>Exit</xmbtext>. </action>. <action type="Label" target="cdgo/topicasa" xmbdesc="Label(cdgo/topicasa)">. <xmbtext>I-import Sa Picasa</xmbtext>. </action>. <action type="Text" target="cdgo/loading" xmbdesc="Text(cdgo/loading)">. <xmbtext>NAGLO-LOAD</xmbtext>. </action>. <action type="Text" target="cdgo/tpslabel" xmbdesc="Text(cdgo/tpslabel)">. <xmbtext>I-display ang Oras</xmbtext>. </action>.</tooltips>.

C:\Program Files (x86)\Google\Picasa3\cdautorun\Picasa CD Slideshow.app\Contents\Resources\tl.lproj\i18n\cdgo_resexport.xml

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe
File Type:	XML 1.0 document, ASCII text
Category:	dropped
Size (bytes):	52
Entropy (8bit):	4.849196208400893
Encrypted:	false
SSDEEP:	3:vFWWMNHU8LdgCzLZfOO:TMVBdTtfOO
MD5:	4BE3304509673D14428BD2FFC3070EF8
SHA1:	269C46096236A213905C8F2987CD0C422389D300
SHA-256:	CC678E75294007E177344FB3D841B23E1AA9877B4F5E22AACF93A8FE15FA5B4C
SHA-512:	96E17A55395AA231D5FDB5103A4A5C8D89074E3806909F6BDA2D275A614F01555549DB7280F9E48515AF472E4D0AABB5568D2589EBC1310218A970C3B09BCB1B
Malicious:	false
Reputation:	unknown
Preview:	<?xml version="1.0" encoding="utf-8" ?>.<Win32Res/>.

C:\Program Files (x86)\Google\Picasa3\cdautorun\Picasa CD Slideshow.app\Contents\Resources\tl.lproj\i18n\cdgo_stringres.xml

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe
File Type:	XML 1.0 document, ASCII text
Category:	dropped
Size (bytes):	6920
Entropy (8bit):	4.796882116099494
Encrypted:	false
SSDEEP:	192:91VB4p6hBgeGettEe8eEWiYBHeLVBqVHoyxv81VB4p6hBgeGettEe8eEWiYBHeLz:3VgR0ERaE8kVgR0ERaEEuaXKb
MD5:	4D8735F18982CD39BB276B95D3F25B11
SHA1:	B0DD645EE2F61E06721C384F14198475F8C6531E
SHA-256:	2F86A2A92A8AA50595B460FC2F7B7A5529F578E7A2847E344DC628C7578B38F8
SHA-512:	154D943BF643B18B35095B0F8CEB677F029F1CC71D7D463032D769BFD2013A7D7E265EE5DB92B4B8DBD9B12EB69D56A8B675D093C219CFD284DC59D35441BEB6
Malicious:	false
Reputation:	unknown
Preview:	<?xml version="1.0" encoding="utf-8" ?>.<resources>. <stringres id="February">. <xmbtext>Pebrero</xmbtext>. </stringres>. <stringres id="March">. <xmbtext>Marso</xmbtext>. </stringres>. <stringres id="April">. <xmbtext>Abril</xmbtext>. </stringres>. <stringres id="May">. <xmbtext>Mayo</xmbtext>. </stringres>. <stringres id="June">. <xmbtext>Hunyo</xmbtext>. </stringres>. <stringres id="July">. <xmbtext>Hulyo</xmbtext>. </stringres>. <stringres id="August">. <xmbtext>Agosto</xmbtext>. </stringres>. <stringres id="September">. <xmbtext>Setyembre</xmbtext>. </stringres>. <stringres id="October">. <xmbtext>Oktubre</xmbtext>. </stringres>. <stringres id="November">. <xmbtext>Nobyembre</xmbtext>. </stringres>. <stringres id="December">. <xmbtext>Disyembre</xmbtext>. </stringres>. <stringres id="Jan">. <xmbtext>Ene</xmbtext>. </stringres>. <stringres id="Feb">. <xmbtext>Peb</xmbtext>. </stringres>. <stringres id="Mar">. <xmbtext>Mar</xmbtext>. </stringres>. <stringres id="Apr">.

C:\Program Files (x86)\Google\Picasa3\cdautorun\Picasa CD Slideshow.app\Contents\Resources\tr.lproj\i18n\cdgo.xml

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 text
Category:	dropped
Size (bytes):	793
Entropy (8bit):	5.004325009924887
Encrypted:	false
SSDEEP:	24:2dRTcwtwyzYppzYV4zYJEnz8HPDZfz8Hjcl+tC8:cuwtLI50WQEzipyq+L
MD5:	DACC5F5944D91BD920111C89FCE50A26
SHA1:	735299A003862C3F4DA2ABFDDA037C0198361D22
SHA-256:	9725FD612D9896D3FD72E710E6DC3D90A9CF6060CEF98CD6985CD4738F2F6903
SHA-512:	4E66E4DEE350F9602C5E45056CB1B74AA55C5E03610E05CE4B6DBC8CFDF63C9B83ED93B156D4F387C0CDDB4653C128425389C7C3FF5570B46336D61BC78B10D2
Malicious:	false
Reputation:	unknown
Preview:	<?xml version="1.0" encoding="utf-8" ?>.<tooltips>. <action type="Label" target="cdgo/copytohd" xmbdesc="Label(cdgo/copytohd)">. <xmbtext>Diske Kaydet</xmbtext>. </action>. <action type="Label" target="cdgo/eject" xmbdesc="Label(cdgo/eject)">. <xmbtext>CD'yi ..kar</xmbtext>. </action>. <action type="Label" target="cdgo/exit" xmbdesc="Label(cdgo/exit)">. <xmbtext>..k..</xmbtext>. </action>. <action type="Label" target="cdgo/topicasa" xmbdesc="Label(cdgo/topicasa)">. <xmbtext>Picasa.ya Aktar</xmbtext>. </action>. <action type="Text" target="cdgo/loading" xmbdesc="Text(cdgo/loading)">. <xmbtext>Y.KLEN.YOR</xmbtext>. </action>. <action type="Text" target="cdgo/tpslabel" xmbdesc="Text(cdgo/tpslabel)">. <xmbtext>G.r.nt.leme S.resi</xmbtext>. </action>.</tooltips>.

C:\Program Files (x86)\Google\Picasa3\cdautorun\Picasa CD Slideshow.app\Contents\Resources\tr.lproj\i18n\cdgo_resexport.xml

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe
File Type:	XML 1.0 document, ASCII text
Category:	dropped
Size (bytes):	52
Entropy (8bit):	4.849196208400893
Encrypted:	false
SSDEEP:	3:vFWWMNHU8LdgCzLZfOO:TMVBdTtfOO
MD5:	4BE3304509673D14428BD2FFC3070EF8
SHA1:	269C46096236A213905C8F2987CD0C422389D300
SHA-256:	CC678E75294007E177344FB3D841B23E1AA9877B4F5E22AACF93A8FE15FA5B4C
SHA-512:	96E17A55395AA231D5FDB5103A4A5C8D89074E3806909F6BDA2D275A614F01555549DB7280F9E48515AF472E4D0AABB5568D2589EBC1310218A970C3B09BCB1B
Malicious:	false
Reputation:	unknown
Preview:	<?xml version="1.0" encoding="utf-8" ?>.<Win32Res/>.

C:\Program Files (x86)\Google\Picasa3\cdautorun\Picasa CD Slideshow.app\Contents\Resources\tr.lproj\i18n\cdgo_stringres.xml

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 text
Category:	dropped
Size (bytes):	6904
Entropy (8bit):	4.917006628807013
Encrypted:	false
SSDEEP:	192:95TrIiCBVeLeTtEeWeBsnbYO5DsBifIoYBZj5TrIiCBVeLeTtEeWeBsnbYO5DsBx:EVSkEBiJBwVSkEBiJBCFW/QrE
MD5:	7838B6F373D69E8CBC75B73D270CC717
SHA1:	22E4F6BD783BE8C1338E90765B62E6E2C2339B5F
SHA-256:	836DC2739976CD5A6D7FF3A357D1C49EED42EF91C3B6CCC488401BFFADA05E21
SHA-512:	ABFC312CC42D505E6B966E03132E88EF465F7DB16D8A36CE1AE00C28642348C40EC1A0A5F05F36EF3FA4A9F993870B15D7642F394C9490B440F4308842A73272
Malicious:	false
Reputation:	unknown
Preview:	<?xml version="1.0" encoding="utf-8" ?>.<resources>. <stringres id="February">. <xmbtext>.ubat</xmbtext>. </stringres>. <stringres id="March">. <xmbtext>Mart</xmbtext>. </stringres>. <stringres id="April">. <xmbtext>Nisan</xmbtext>. </stringres>. <stringres id="May">. <xmbtext>May.s</xmbtext>. </stringres>. <stringres id="June">. <xmbtext>Haziran</xmbtext>. </stringres>. <stringres id="July">. <xmbtext>Temmuz</xmbtext>. </stringres>. <stringres id="August">. <xmbtext>A.ustos</xmbtext>. </stringres>. <stringres id="September">. <xmbtext>Eyl.l</xmbtext>. </stringres>. <stringres id="October">. <xmbtext>Ekim</xmbtext>. </stringres>. <stringres id="November">. <xmbtext>Kas.m</xmbtext>. </stringres>. <stringres id="December">. <xmbtext>Aral.k</xmbtext>. </stringres>. <stringres id="Jan">. <xmbtext>Oca</xmbtext>. </stringres>. <stringres id="Feb">. <xmbtext>.ub</xmbtext>. </stringres>. <stringres id="Mar">. <xmbtext>Mar</xmbtext>. </stringres>. <stringres id="Apr">. <xm

C:\Program Files (x86)\Google\Picasa3\cdautorun\Picasa CD Slideshow.app\Contents\Resources\uk.lproj\i18n\cdgo.xml

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 text
Category:	dropped
Size (bytes):	863
Entropy (8bit):	5.169295997196501
Encrypted:	false
SSDEEP:	24:2dRTcwtgD0zYpGczYVKzYJohA2O0nz8HPDeqz8Hjcl+S7C8:cuwtkyIJ00QoztzieUyq+SJ
MD5:	9750FA13B010F9D89B9524793840F225
SHA1:	70421E088E00F977F32D7C39A4DBF3001D049338
SHA-256:	AD8A624323DEB0EE27A76EDAFCD4C0B11ECF636D51F56CA1483CFA4B81F4757F
SHA-512:	026A958230599BD384098EEBC2B79278A534F4CF7580A1DED781C017FF99470077412B1F421541C10C8762F1D50A629E3DBE074AB0300AEE1AD4D250FEF124B6
Malicious:	false
Reputation:	unknown
Preview:	<?xml version="1.0" encoding="utf-8" ?>.<tooltips>. <action type="Label" target="cdgo/copytohd" xmbdesc="Label(cdgo/copytohd)">. <xmbtext>........ .. ....</xmbtext>. </action>. <action type="Label" target="cdgo/eject" xmbdesc="Label(cdgo/eject)">. <xmbtext>......... CD-....</xmbtext>. </action>. <action type="Label" target="cdgo/exit" xmbdesc="Label(cdgo/exit)">. <xmbtext>.....</xmbtext>. </action>. <action type="Label" target="cdgo/topicasa" xmbdesc="Label(cdgo/topicasa)">. <xmbtext>........... .. ...... Picasa</xmbtext>. </action>. <action type="Text" target="cdgo/loading" xmbdesc="Text(cdgo/loading)">. <xmbtext>............</xmbtext>. </action>. <action type="Text" target="cdgo/tpslabel" xmbdesc="Text(cdgo/tpslabel)">. <xmbtext>... ......</xmbtext>. </action>.</tooltips>.

C:\Program Files (x86)\Google\Picasa3\cdautorun\Picasa CD Slideshow.app\Contents\Resources\uk.lproj\i18n\cdgo_resexport.xml

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe
File Type:	XML 1.0 document, ASCII text
Category:	dropped
Size (bytes):	52
Entropy (8bit):	4.849196208400893
Encrypted:	false
SSDEEP:	3:vFWWMNHU8LdgCzLZfOO:TMVBdTtfOO
MD5:	4BE3304509673D14428BD2FFC3070EF8
SHA1:	269C46096236A213905C8F2987CD0C422389D300
SHA-256:	CC678E75294007E177344FB3D841B23E1AA9877B4F5E22AACF93A8FE15FA5B4C
SHA-512:	96E17A55395AA231D5FDB5103A4A5C8D89074E3806909F6BDA2D275A614F01555549DB7280F9E48515AF472E4D0AABB5568D2589EBC1310218A970C3B09BCB1B
Malicious:	false
Reputation:	unknown
Preview:	<?xml version="1.0" encoding="utf-8" ?>.<Win32Res/>.

C:\Program Files (x86)\Google\Picasa3\cdautorun\Picasa CD Slideshow.app\Contents\Resources\uk.lproj\i18n\cdgo_stringres.xml

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 text
Category:	dropped
Size (bytes):	7703
Entropy (8bit):	5.231086395964801
Encrypted:	false
SSDEEP:	192:9oVf7dl0eueFtEeEezicb60c5AArNoF/QoVf7dl0eueFtEeEezicb60c5AArNoFm:NnmEzJtnmEzJ4BsNiaVn
MD5:	1CC4D58075722C72C6BDD211D1491FBB
SHA1:	B5410AFA0C9E4806800A24332505D5DB99CA4B0E
SHA-256:	74F591FFCD0ED06C4524E4EE38FDFA03D2398671952861D65A732FA0DEC8CC03
SHA-512:	7A9ADC8665E530845B52AE4778261E8CA732334C3C4500A0FBB32A15623772353C5755914B24B792BFD7E146F242EB8A6649DC7FE34B5A71B15DF8C834018E95
Malicious:	false
Reputation:	unknown
Preview:	<?xml version="1.0" encoding="utf-8" ?>.<resources>. <stringres id="February">. <xmbtext>.....</xmbtext>. </stringres>. <stringres id="March">. <xmbtext>........</xmbtext>. </stringres>. <stringres id="April">. <xmbtext>.......</xmbtext>. </stringres>. <stringres id="May">. <xmbtext>.......</xmbtext>. </stringres>. <stringres id="June">. <xmbtext>.......</xmbtext>. </stringres>. <stringres id="July">. <xmbtext>......</xmbtext>. </stringres>. <stringres id="August">. <xmbtext>.......</xmbtext>. </stringres>. <stringres id="September">. <xmbtext>........</xmbtext>. </stringres>. <stringres id="October">. <xmbtext>.......</xmbtext>. </stringres>. <stringres id="November">. <xmbtext>........</xmbtext>. </stringres>. <stringres id="December">. <xmbtext>.......</xmbtext>. </stringres>. <stringres id="Jan">. <xmbtext>....</xmbtext>. </stringres>. <stringres id="Feb">. <xmbtext>....</xmbtext>. </str

C:\Program Files (x86)\Google\Picasa3\cdautorun\Picasa CD Slideshow.app\Contents\Resources\zh_CN.lproj\i18n\cdgo.xml

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 text
Category:	dropped
Size (bytes):	773
Entropy (8bit):	5.064442847811191
Encrypted:	false
SSDEEP:	24:2dRTcwtLnzYp4zYVTyzYJR0nz8HPDBdJz8Hjcl+JC8:cuwtPIW0gQCzirZyq+X
MD5:	2480D64BAA76D9F8CDAD7B4B3614FDAD
SHA1:	29D08B4BEAA2E7A577E9AEABCD2F82CDA27D7DA0
SHA-256:	61F16A78A48304AC6ED85FB26786B9746EAD0CD9BD1FA3DFC323FEF83493025C
SHA-512:	7EE42AED8A45C60763966F7672950CD10CC6C5BB0996A587CA0594703CE7B875ABB81136162EA0A3AF902971E4EA240AF15CFCE3AE9C2CE2F6A2D64C2009EC58
Malicious:	false
Reputation:	unknown
Preview:	<?xml version="1.0" encoding="utf-8" ?>.<tooltips>. <action type="Label" target="cdgo/copytohd" xmbdesc="Label(cdgo/copytohd)">. <xmbtext>.....</xmbtext>. </action>. <action type="Label" target="cdgo/eject" xmbdesc="Label(cdgo/eject)">. <xmbtext>.. CD</xmbtext>. </action>. <action type="Label" target="cdgo/exit" xmbdesc="Label(cdgo/exit)">. <xmbtext>..</xmbtext>. </action>. <action type="Label" target="cdgo/topicasa" xmbdesc="Label(cdgo/topicasa)">. <xmbtext>... Picasa</xmbtext>. </action>. <action type="Text" target="cdgo/loading" xmbdesc="Text(cdgo/loading)">. <xmbtext>....</xmbtext>. </action>. <action type="Text" target="cdgo/tpslabel" xmbdesc="Text(cdgo/tpslabel)">. <xmbtext>....</xmbtext>. </action>.</tooltips>.

C:\Program Files (x86)\Google\Picasa3\cdautorun\Picasa CD Slideshow.app\Contents\Resources\zh_CN.lproj\i18n\cdgo_resexport.xml

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe
File Type:	XML 1.0 document, ASCII text
Category:	dropped
Size (bytes):	52
Entropy (8bit):	4.849196208400893
Encrypted:	false
SSDEEP:	3:vFWWMNHU8LdgCzLZfOO:TMVBdTtfOO
MD5:	4BE3304509673D14428BD2FFC3070EF8
SHA1:	269C46096236A213905C8F2987CD0C422389D300
SHA-256:	CC678E75294007E177344FB3D841B23E1AA9877B4F5E22AACF93A8FE15FA5B4C
SHA-512:	96E17A55395AA231D5FDB5103A4A5C8D89074E3806909F6BDA2D275A614F01555549DB7280F9E48515AF472E4D0AABB5568D2589EBC1310218A970C3B09BCB1B
Malicious:	false
Reputation:	unknown
Preview:	<?xml version="1.0" encoding="utf-8" ?>.<Win32Res/>.

C:\Program Files (x86)\Google\Picasa3\cdautorun\Picasa CD Slideshow.app\Contents\Resources\zh_CN.lproj\i18n\cdgo_stringres.xml

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 text
Category:	dropped
Size (bytes):	6865
Entropy (8bit):	5.173187110672013
Encrypted:	false
SSDEEP:	192:9SCC+x3FedeMtEeDerXjJCDyHZKMoTSQSCC+x3FedeMtEeDerXjJCDyHZKMoTWbO:P2XEAt2XEANzd
MD5:	21045266D7D43E6E04F73B2AF4D1487E
SHA1:	1F087B7FCC2D4C3BAEBDE99221CA84573FBF70F3
SHA-256:	B5D4D2AC71728F8B3AAA6FF237C26BE84E3E1872F6B3FB1B6E852701C10C5E3A
SHA-512:	65C1BC5F030C2F4E9519555D58DC9951015B79435AE8DDCB0F640F6C834B31977554484DF9D43A9456CCBFF6C0867D0CC47F93A3C8CAE769FEE252719AE97F6E
Malicious:	false
Reputation:	unknown
Preview:	<?xml version="1.0" encoding="utf-8" ?>.<resources>. <stringres id="February">. <xmbtext>2 .</xmbtext>. </stringres>. <stringres id="March">. <xmbtext>3 .</xmbtext>. </stringres>. <stringres id="April">. <xmbtext>4 .</xmbtext>. </stringres>. <stringres id="May">. <xmbtext>5 .</xmbtext>. </stringres>. <stringres id="June">. <xmbtext>6 .</xmbtext>. </stringres>. <stringres id="July">. <xmbtext>7 .</xmbtext>. </stringres>. <stringres id="August">. <xmbtext>8 .</xmbtext>. </stringres>. <stringres id="September">. <xmbtext>9 .</xmbtext>. </stringres>. <stringres id="October">. <xmbtext>10 .</xmbtext>. </stringres>. <stringres id="November">. <xmbtext>11 .</xmbtext>. </stringres>. <stringres id="December">. <xmbtext>12 .</xmbtext>. </stringres>. <stringres id="Jan">. <xmbtext>1 .</xmbtext>. </stringres>. <stringres id="Feb">. <xmbtext>2 .</xmbtext>. </stringres>. <stringres id="Mar">. <xmbtext>3 .</xmbtext>. </stringres>. <stringres id="Apr">. <xmbt

C:\Program Files (x86)\Google\Picasa3\cdautorun\Picasa CD Slideshow.app\Contents\Resources\zh_TW.lproj\i18n\cdgo.xml

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 text
Category:	dropped
Size (bytes):	770
Entropy (8bit):	5.059148221978512
Encrypted:	false
SSDEEP:	24:2dRTcwt8zYpYzYVTyzYJimE0nz8HPD7Hqz8Hjcl+EXC8:cuwtqI20gQFziDUyq+El
MD5:	5B4AD6F7699BBBD326DECF945FE3A06F
SHA1:	C5171B810D962B0E0565A199C5C1CE9090FF0D42
SHA-256:	EDEE32765D0DD35A318ADB81180E663A5BD452BF7DB183E3CD9FA537651267CF
SHA-512:	E3AAE9A96906ACAFEAF1260BD339318935DC76C3C1FA20692C7BF701F0612C3AACCD41C151135B59A06672676F78343E010B2F7E184C2F626FEAA90584DA12D8
Malicious:	false
Reputation:	unknown
Preview:	<?xml version="1.0" encoding="utf-8" ?>.<tooltips>. <action type="Label" target="cdgo/copytohd" xmbdesc="Label(cdgo/copytohd)">. <xmbtext>.....</xmbtext>. </action>. <action type="Label" target="cdgo/eject" xmbdesc="Label(cdgo/eject)">. <xmbtext>CD ..</xmbtext>. </action>. <action type="Label" target="cdgo/exit" xmbdesc="Label(cdgo/exit)">. <xmbtext>..</xmbtext>. </action>. <action type="Label" target="cdgo/topicasa" xmbdesc="Label(cdgo/topicasa)">. <xmbtext>... Picasa</xmbtext>. </action>. <action type="Text" target="cdgo/loading" xmbdesc="Text(cdgo/loading)">. <xmbtext>...</xmbtext>. </action>. <action type="Text" target="cdgo/tpslabel" xmbdesc="Text(cdgo/tpslabel)">. <xmbtext>....</xmbtext>. </action>.</tooltips>.

C:\Program Files (x86)\Google\Picasa3\cdautorun\Picasa CD Slideshow.app\Contents\Resources\zh_TW.lproj\i18n\cdgo_resexport.xml

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe
File Type:	XML 1.0 document, ASCII text
Category:	dropped
Size (bytes):	52
Entropy (8bit):	4.849196208400893
Encrypted:	false
SSDEEP:	3:vFWWMNHU8LdgCzLZfOO:TMVBdTtfOO
MD5:	4BE3304509673D14428BD2FFC3070EF8
SHA1:	269C46096236A213905C8F2987CD0C422389D300
SHA-256:	CC678E75294007E177344FB3D841B23E1AA9877B4F5E22AACF93A8FE15FA5B4C
SHA-512:	96E17A55395AA231D5FDB5103A4A5C8D89074E3806909F6BDA2D275A614F01555549DB7280F9E48515AF472E4D0AABB5568D2589EBC1310218A970C3B09BCB1B
Malicious:	false
Reputation:	unknown
Preview:	<?xml version="1.0" encoding="utf-8" ?>.<Win32Res/>.

C:\Program Files (x86)\Google\Picasa3\cdautorun\Picasa CD Slideshow.app\Contents\Resources\zh_TW.lproj\i18n\cdgo_stringres.xml

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 text
Category:	dropped
Size (bytes):	6909
Entropy (8bit):	5.215748691253637
Encrypted:	false
SSDEEP:	192:9KOXTg5yeCeetEeEePmL9X8dp2xeomu/KOXTg5yeCeetEeEePmL9X8dp2xeomKbr:b7dEJx7dEJTWc
MD5:	204A37A1F6005B77754F042EF31B0653
SHA1:	26158892F8F49A144D4B93EFA5524A4A0A1A722B
SHA-256:	2F1C8C3D48047E6A4B72B53D27D959AC9823A7082A080E557B68411351AD01CC
SHA-512:	2B3C77861A72D3C495482FEBE65A8F076D4BFCC56EED672510DA9F1217951ED3FEAFCAC352B3E1608C0A2A8143D4B7618D302D0248CFF818AD399E166EA7ECE1
Malicious:	false
Reputation:	unknown
Preview:	<?xml version="1.0" encoding="utf-8" ?>.<resources>. <stringres id="February">. <xmbtext>..</xmbtext>. </stringres>. <stringres id="March">. <xmbtext>..</xmbtext>. </stringres>. <stringres id="April">. <xmbtext>..</xmbtext>. </stringres>. <stringres id="May">. <xmbtext>..</xmbtext>. </stringres>. <stringres id="June">. <xmbtext>..</xmbtext>. </stringres>. <stringres id="July">. <xmbtext>..</xmbtext>. </stringres>. <stringres id="August">. <xmbtext>..</xmbtext>. </stringres>. <stringres id="September">. <xmbtext>..</xmbtext>. </stringres>. <stringres id="October">. <xmbtext>..</xmbtext>. </stringres>. <stringres id="November">. <xmbtext>...</xmbtext>. </stringres>. <stringres id="December">. <xmbtext>...</xmbtext>. </stringres>. <stringres id="Jan">. <xmbtext>..</xmbtext>. </stringres>. <stringres id="Feb">. <xmbtext>..</xmbtext>. </stringres>. <stringres id="Mar">. <xmbtext>..</xmbtext>. </stringres>. <stringres

C:\Program Files (x86)\Google\Picasa3\cdautorun\Picasa Restore.app\Contents\Frameworks\GoogleBreakpad.framework\GoogleBreakpad

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	33
Entropy (8bit):	4.173033892020167
Encrypted:	false
SSDEEP:	3:RleRTCOnXh61vn:STCOnX6n
MD5:	5E8BFD7B4BE898A079400EB222235B0C
SHA1:	C64DC4A06CBC40C59FF6E725EF1716402DA799A9
SHA-256:	BCEDCF539F7BE07352FEAC52B47205B6D0ADE8C80ADF002861863CADCEC75C26
SHA-512:	381E2947D3240F0C6C597DF8EAD268CC08C25A6644984D489DD1B44A523CA10048673594E462EEC58CB6F18DF61E72F1877C8488F6239A677EACF4BCA276CF17
Malicious:	false
Reputation:	unknown
Preview:	Versions/Current/GoogleBreakpad..

C:\Program Files (x86)\Google\Picasa3\cdautorun\Picasa Restore.app\Contents\Frameworks\GoogleBreakpad.framework\Resources

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	28
Entropy (8bit):	3.6644977792004614
Encrypted:	false
SSDEEP:	3:RleRhWKCnn:SA7
MD5:	6A917155B381121118E116E3A723C1CF
SHA1:	A0664DDAC90014F23792A2670358EC61066D0A6E
SHA-256:	7D28787340ECAB581791AEA2E3484A4903ECE6F3F777E4363E3A95D6882D9E26
SHA-512:	45B8F904D3DCA60249F2822F989A9F66DED4EF93FCFAFFCECD6D6CECCFBEEAA93C5F2599040458E7076EC4D9D6246440B528DAE5B190C500A8D96E7BC2892049
Malicious:	false
Reputation:	unknown
Preview:	Versions/Current/Resources..

C:\Program Files (x86)\Google\Picasa3\cdautorun\Picasa Restore.app\Contents\Frameworks\GoogleBreakpad.framework\Versions\A\GoogleBreakpad

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe
File Type:	Mach-O universal binary with 2 architectures: [i386:Mach-O i386 dynamically linked shared library, flags:<NOUNDEFS\|DYLDLINK\|TWOLEVEL\|WEAK_DEFINES\|BINDS_TO_WEAK\|NO_REEXPORTED_DYLIBS>] [ppc:Mach-O ppc dynamically linked shared library, flags:<NOUNDEFS\|DYLDLINK\|TWOLEVEL\|WEAK_DEFINES\|BINDS_TO_WEAK\|NO_REEXPORTED_DYLIBS>]
Category:	dropped
Size (bytes):	212748
Entropy (8bit):	5.685361196810867
Encrypted:	false
SSDEEP:	3072:RsZsV0i1mxv6vsChZuzRP0/wbqCxZmmgb4n2wgGhqri7:uJxv6vsChZuz17bNOcn2hi7
MD5:	BCE705A493BDEED0E41899EDEBDA9461
SHA1:	2A460D1CFB2968D4AF76B61C253DD6EE761BAB6D
SHA-256:	46086C563E59AD200C248F5017D0023FF1C7A430C467CB43C1F0AA6CC72D6F47
SHA-512:	31F99ACA72439BEEA17EBEEED7EA843FCBA5F7AD54856B9E6B69459E5D4D633559E984502C22DDCBDF500E4167F3109D3646B18EFDD76D38924669F3701F3FB1
Malicious:	false
Reputation:	unknown
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Google\Picasa3\cdautorun\Picasa Restore.app\Contents\Frameworks\GoogleBreakpad.framework\Versions\A\Resources\Info.plist

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 text
Category:	dropped
Size (bytes):	994
Entropy (8bit):	5.258898328747738
Encrypted:	false
SSDEEP:	24:2dfyiwl6Nxxx6Ax6Y5gRGMa6rx642ReS0YIhi:cfyyx+VY5AGcsjMS0Nhi
MD5:	BDBC6E7FF6EFAEC8FB9A3CBF1EB1F691
SHA1:	BDC2B5476B5CFE4AE849D3A0FB3E7D213BCACA4C
SHA-256:	530873E051816CCDA4EDF00D61F766051CCB2BA5138037EC42F3412DBD46E7C7
SHA-512:	975B9D32F2F85AF7940655300631048D300BE0857FE347606B9738F01DFB5B2649E208E1606CE802949D1F79AE866B0C08696F5D148C4AB0AC20CD506E609C26
Malicious:	false
Reputation:	unknown
Preview:	<?xml version="1.0" encoding="UTF-8"?>.<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">.<plist version="1.0">.<dict>..<key>CFBundleDevelopmentRegion</key>..<string>English</string>..<key>CFBundleDisplayName</key>..<string>GoogleBreakpad</string>..<key>CFBundleExecutable</key>..<string>GoogleBreakpad</string>..<key>CFBundleGetInfoString</key>..<string>Google Breakpad 1.1.0.1138, . 2005-2009 Google Inc.</string>..<key>CFBundleIdentifier</key>..<string>com.Google.BreakpadFramework</string>..<key>CFBundleInfoDictionaryVersion</key>..<string>6.0</string>..<key>CFBundleName</key>..<string>GoogleBreakpad</string>..<key>CFBundlePackageType</key>..<string>FMWK</string>..<key>CFBundleShortVersionString</key>..<string>1.1.0</string>..<key>CFBundleSignature</key>..<string>????</string>..<key>CFBundleVersion</key>..<string>1.1.0.1138</string>..<key>NSHumanReadableCopyright</key>..<string>. 2005-2009 Google Inc.</string>.</dict>.</plist>.

C:\Program Files (x86)\Google\Picasa3\cdautorun\Picasa Restore.app\Contents\Frameworks\GoogleBreakpad.framework\Versions\A\Resources\Inspector

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe
File Type:	Mach-O universal binary with 2 architectures: [i386:\012- Mach-O i386 executable, flags:<NOUNDEFS\|DYLDLINK\|TWOLEVEL\|BINDS_TO_WEAK>] [ppc:\012- Mach-O ppc executable, flags:<NOUNDEFS\|DYLDLINK\|TWOLEVEL\|BINDS_TO_WEAK>]
Category:	dropped
Size (bytes):	123720
Entropy (8bit):	4.9365892176779465
Encrypted:	false
SSDEEP:	1536:z5BbaTOV0iKSd2JNGfYWB7P6mzh5CWzpf/cjOVYXzLDSPD0vvpN:z5BbyOV0iKSMNU9CycIYXnD4DmBN
MD5:	CE34CF0E6DBA7E4E003E20BD076E4F21
SHA1:	60DF0D3F38D36C83C13EC1D89EC142373A96538E
SHA-256:	B046837030FE7CF858B856F2AD53C1FD8C5E65B362FFD43954A498434153E989
SHA-512:	A669C9B5AB788371B35BD08C5A9EA344181FFF4AEA501D7C248C5668182F579AD523C0035A72A04D8FCBB14B0CDBD0C09E4F85F18FD9E27E36EA783A675D4060
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Reputation:	unknown
Preview:	.......................$...................H............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Google\Picasa3\cdautorun\Picasa Restore.app\Contents\Frameworks\GoogleBreakpad.framework\Versions\A\Resources\Reporter.app\Contents\Info.plist

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 text
Category:	dropped
Size (bytes):	1262
Entropy (8bit):	5.2120676261719225
Encrypted:	false
SSDEEP:	24:2dfyiwl6NxcHY5hOMa6m4oReS0YIhdorGuqFqI:cfyyxcHY5hOcm1MS0NhiSTFqI
MD5:	F53DCB8CB1A85F20015D6761BC685648
SHA1:	E30CB41435D6819765ABA81FF2E437C057414C2C
SHA-256:	586BEB3C678337E9E6E68579237CE70DD64052E58B4225774EBA2B66991C86B9
SHA-512:	245DC2195FE312193FE8C12908F6C09AA2C2AB2A26C729E7EF956C3788E8B8287F309CCB57779B318DCAE82C6DB64503167DD2877EAA116D7ACA0F8A49AFB549
Malicious:	false
Reputation:	unknown
Preview:	<?xml version="1.0" encoding="UTF-8"?>.<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">.<plist version="1.0">.<dict>..<key>CFBundleDevelopmentRegion</key>..<string>English</string>..<key>CFBundleDisplayName</key>..<string>Reporter</string>..<key>CFBundleExecutable</key>..<string>Reporter</string>..<key>CFBundleGetInfoString</key>..<string>Google Breakpad 1.1.0.1138, . 2005-2009 Google Inc.</string>..<key>CFBundleIconFile</key>..<string>ReporterIcon</string>..<key>CFBundleIdentifier</key>..<string>com.google.Reporter</string>..<key>CFBundleInfoDictionaryVersion</key>..<string>6.0</string>..<key>CFBundleName</key>..<string>Reporter</string>..<key>CFBundlePackageType</key>..<string>APPL</string>..<key>CFBundleShortVersionString</key>..<string>1.1.0</string>..<key>CFBundleSignature</key>..<string>????</string>..<key>CFBundleVersion</key>..<string>1.1.0.1138</string>..<key>LSUIElement</key>..<true/>..<key>NSHumanReadableCopyright</key>.

C:\Program Files (x86)\Google\Picasa3\cdautorun\Picasa Restore.app\Contents\Frameworks\GoogleBreakpad.framework\Versions\A\Resources\Reporter.app\Contents\MacOS\Reporter

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe
File Type:	Mach-O universal binary with 2 architectures: [i386:\012- Mach-O i386 executable, flags:<NOUNDEFS\|DYLDLINK\|TWOLEVEL>] [ppc:\012- Mach-O ppc executable, flags:<NOUNDEFS\|DYLDLINK\|TWOLEVEL>]
Category:	dropped
Size (bytes):	91380
Entropy (8bit):	4.567705123184215
Encrypted:	false
SSDEEP:	768:f3AM5SGsUB0M+DWn7d8qze8FNJrEWniUfIkhLQPbocdHB6jbZIb4N09:fBqW7qpG/nzhLQP1vJb4W9
MD5:	DF5A8247B6A561ECD330BCDC0644A674
SHA1:	EA83636BC0AF94F179DD9884650131529AA3E69F
SHA-256:	20CA80F33EC6ADB69AD3F2FA721DFAB4E848C3BAF6ADA434C040228BC2F46A6C
SHA-512:	0503E22366EC17FF522CCB83649873E8A162AEA720BAA3615784C162FBC617E81D3833B35C93685EED27A750BC60BF13B1778681D076D61DFB24413AD3B5C019
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Reputation:	unknown
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Google\Picasa3\cdautorun\Picasa Restore.app\Contents\Frameworks\GoogleBreakpad.framework\Versions\A\Resources\Reporter.app\Contents\PkgInfo

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	8
Entropy (8bit):	1.75
Encrypted:	false
SSDEEP:	3:k0Ra:f8
MD5:	23B7D7D024ABB0F558420E098800BF27
SHA1:	9F9EEA0CFE2D65F2C3D6B092E375B40782D08F31
SHA-256:	82502191C9484B04D685374F9879A0066069C49B8ACAE7A04B01D38D07E8ECA0
SHA-512:	F77D501528DD0CED155C80406CFBEE38D5D3649B64D2A9324F3D6CEE39491EB8F54CDEBAE49C6E21A20D2309D8FAE1B01C41631224811E73483DB25A2695738C
Malicious:	false
Reputation:	unknown
Preview:	APPL????

C:\Program Files (x86)\Google\Picasa3\cdautorun\Picasa Restore.app\Contents\Frameworks\GoogleBreakpad.framework\Versions\A\Resources\Reporter.app\Contents\Resources\English.lproj\Breakpad.nib

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe
File Type:	Apple binary property list
Category:	dropped
Size (bytes):	12664
Entropy (8bit):	6.721701305933168
Encrypted:	false
SSDEEP:	384:fAV87I27ddddddddddG5w5orhVPdpc4isN5mBdddddddddd4ddddddddddq/nLA0:oV806ddddddddddSjBxN56dddddddddP
MD5:	21ACEF5A8CC8A907050FC02AE1C79943
SHA1:	F71EDD449D7F386C82BCF8FF806E735F53CDD33E
SHA-256:	2F48F0E2D76FBBA92C2B4168398E301A1C42303384243C4E9515F16E38A5AF30
SHA-512:	5E29C2D081F86210C200F70A23E92FA527F47CCADA6669DDB9E9F8854F73E152B24710EFDDDEDE5AF8370A214D4967F3C12D739D9C62A7E435B8D00D762F176D
Malicious:	false
Reputation:	unknown
Preview:	bplist00.................X$versionT$topY$archiverX$objects..........]IB.objectdata.._..NSKeyedArchiver........1.5.6.<.=.A.E.Z.b.u.v.w...........................................................................#./.8.9.:.;.<.=.>.?.J.O.P.Q.T.W.Z.a.b.i.j.r.s.z.{....................................................................... .#.'.(....+.../.4.5.:.;.@.A.D.I.J.O.P.U.Z.[.`.e.f.k.u.v.w.x.{.............t...........................................(.G.H.I.J.K.L.M.N.O.P.Q.R.S.T.U.V.W.X.Y.Z.[.\.].^._.`.a.b.c.h.m....................................................................................................U$null.......................................... .!.".#.$.%.&.'.(.)..+.,.-.../.0VNSRootV$class]NSObjectsKeys_..NSClassesValues_..NSAccessibilityOidsValues]NSConnections[NSNamesKeys[NSFramework]NSClassesKeysZNSOidsKeys]NSNamesValues_..NSAccessibilityConnectors]NSFontManager_..NSVisibleWindows_..NSObjectsValues_..NSAccessibilityOidsKeysYNSNextOid\NSOidsValues..........................

C:\Program Files (x86)\Google\Picasa3\cdautorun\Picasa Restore.app\Contents\Frameworks\GoogleBreakpad.framework\Versions\A\Resources\Reporter.app\Contents\Resources\English.lproj\Louserzable.strings

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe
File Type:	Unicode text, UTF-16, little-endian text
Category:	dropped
Size (bytes):	1936
Entropy (8bit):	3.362092900968226
Encrypted:	false
SSDEEP:	48:cUAheJeteUWIJk3JeJe3D1JeUWIJTQWvM3I66l28GcwGDS5:cUdrUNJ0QK1QUNJs4u/0I
MD5:	CE2BD91D9C7CBD1BF13A1BA737F575A5
SHA1:	4CED7AE2221E28B519DDC34AF96CC5461783E2BB
SHA-256:	66D3DAE87F035F74F2F52231A2BE923125D4CF48741415415313171CCAF7BD19
SHA-512:	F626A6ABA33A27458F2D67358F1168C4493B07228EB9C4B36E38890E56BDBE4C765BAE89F388658D68F770D489B6DBFA73C1EB7AA6D90804066D35F98CC0DBEE
Malicious:	false
Reputation:	unknown
Preview:	../.. .S.t.r.i.n.g.s. .f.o.r. .U.s.e.r. .N.o.t.i.f.i.c.a.t.i.o.n. .o.f. .a. .c.r.a.s.h. ../...".c.r.a.s.h.D.i.a.l.o.g.H.e.a.d.e.r.". .=. .".T.h.e. .G.o.o.g.l.e. .p.r.o.g.r.a.m. .%.@. .h.a.s. .u.n.e.x.p.e.c.t.e.d.l.y. .q.u.i.t...".;...".c.r.a.s.h.D.i.a.l.o.g.M.s.g.". .=. .".T.h.e. .s.y.s.t.e.m. .a.n.d. .o.t.h.e.r. .a.p.p.l.i.c.a.t.i.o.n.s. .h.a.v.e. .n.o.t. .b.e.e.n. .a.f.f.e.c.t.e.d... .A. .r.e.p.o.r.t. .h.a.s. .b.e.e.n. .c.r.e.a.t.e.d. .t.h.a.t. .y.o.u. .c.a.n. .s.e.n.d. .t.o. .G.o.o.g.l.e. .t.o. .h.e.l.p. .i.d.e.n.t.i.f.y. .t.h.e. .p.r.o.b.l.e.m...".;.....".n.o.C.r.a.s.h.D.i.a.l.o.g.H.e.a.d.e.r.". .=. .".T.h.e. .G.o.o.g.l.e. .p.r.o.g.r.a.m. .%.@. .n.e.e.d.s. .t.o. .s.e.n.d. .i.n.f.o.r.m.a.t.i.o.n. .t.o. .G.o.o.g.l.e...".;...".n.o.C.r.a.s.h.D.i.a.l.o.g.M.s.g.". .=. .".T.h.e. .s.y.s.t.e.m. .a.n.d. .o.t.h.e.r. .a.p.p.l.i.c.a.t.i.o.n.s. .h.a.v.e. .n.o.t. .b.e.e.n. .a.f.f.e.c.t.e.d... .A. .r.e.p.o.r.t. .h.a.s. .b.e.e.n. .c.r.e.a.t.e.d. .t.h.a.t. .y.o.u. .c.a.n. .s.e.n.d. .t.o. .h.e.l.p.

C:\Program Files (x86)\Google\Picasa3\cdautorun\Picasa Restore.app\Contents\Frameworks\GoogleBreakpad.framework\Versions\A\Resources\Reporter.app\Contents\Resources\ReporterIcon.icns

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe
File Type:	Mac OS X icon, 170816 bytes, "is32" type
Category:	dropped
Size (bytes):	170816
Entropy (8bit):	7.686998845885342
Encrypted:	false
SSDEEP:	3072:EpZePFki+rvhbSrXvqgqAO8yuepPv4X3tpbg5bFzrghKXX5fFerj3xEQ/x:Er0FMhbS7vER3c3HgrzrgMBFeRT
MD5:	4BA266FE3EC1E27DF4F079CE3F501ABC
SHA1:	AA7AA6B6F5E9B27670044DCB335AF91DE6B270D0
SHA-256:	7C57E626BAB3E6585C9C4193BD5B13F2087E7328537CED18FA3033BEA531BEC9
SHA-512:	6A80C22183E3FD9D734D415DFEA2BD9E8ECD6D3B6AA01BFE67A5B3D8642F03B9968A080964FA6082B753E20798DA4172C92DA0C4416B473A5ADF906C3D201BD2
Malicious:	false
Reputation:	unknown
Preview:	icns...@is32...o.............................8...8...................3.....4.....................0.......0......................+.......,..................'.......(..............$.......%.e.......e..t\|z.{.z\|t............!.!.................,...-..................).....)....................%.......%....q................!........."................................................z..................U.............T..^d.b.`]`aa`b\.............9.......7:-......!;7H.......;~.+......'I...>"......PM..zA;......(hV..J.".....]k;R.0.........2p9%D.)!.....A.[;-.,j.#.......&C/4%q.Z. ......1733 .... ......>965,D.4 ....................s8mk...........................&.&............................4...4..........................0.....0........................,.......,......................(.........(....................$...........$.................. ............. .e.............d................il32...............................h...k.....................e.....e.......................^.......^...

C:\Program Files (x86)\Google\Picasa3\cdautorun\Picasa Restore.app\Contents\Frameworks\GoogleBreakpad.framework\Versions\A\Resources\Reporter.app\Contents\Resources\de.lproj\Louserzable.strings

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe
File Type:	Unicode text, UTF-8 text
Category:	dropped
Size (bytes):	462
Entropy (8bit):	4.662323393979104
Encrypted:	false
SSDEEP:	12:Ub1ipq78kpLEjr+JDmm8kpLU695YJqJNU:FpTkRHN+kRU6/YYNU
MD5:	C30CD9D64A4CB3C5A94C613912784D12
SHA1:	A8A343D4E6F6F39FBC454B10C52F0AE526926071
SHA-256:	B80A61609F31DB2ED34EA3CD8F032D4B743E6EEDA1B70F6D45DAD41573E6123B
SHA-512:	3436E1AF91253A3D6D86F5ABE5AADB9D3E73D8D8B54C9E5C6CCE0087842CEE7C393E2A6288036410E977B3EBA66C0C84EB920E16720577FD3AA5809AD0597DE7
Malicious:	false
Reputation:	unknown
Preview:	/* Strings for User Notification of a crash */."headerFmt" = "Das Google-Programm %@ wurde unerwartet geschlossen.";."msg" = "Das System und andere Anwendungen sind nicht betroffen. Es wurde ein Bericht erstellt, den Sie an Google senden k.nnen, um die Erkennung des Problems zu erleichtern.";."msgNoSend" = "Das System und andere Anwendungen sind nicht betroffen.";.."sendReportButton" = "Bericht senden";."cancelButton" = "Abbrechen";."noSendButton" = "OK";.

C:\Program Files (x86)\Google\Picasa3\cdautorun\Picasa Restore.app\Contents\Frameworks\GoogleBreakpad.framework\Versions\A\Resources\Reporter.app\Contents\Resources\en_GB.lproj\Louserzable.strings

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	425
Entropy (8bit):	4.6055553679336825
Encrypted:	false
SSDEEP:	6:Uk8pHsoiBzHGaKqRXAujVJMw362A+j91FrKkKt2NTRjTjVJMw362AE390Ctve/bV:Ub1ipPp1fvkD4z9SC6SNU
MD5:	D01FAF3470E3DFE8B6213ED4C555A5D4
SHA1:	1BDE0EE53A1B832A98D306E4DDE4210323A35416
SHA-256:	17B78790EFB08EAD6839806513F404EAB7FECA0013BAC756D32A8340D6864D8A
SHA-512:	FE802A393FA0EC6FEFF34DEF767DE9F92A56286603F1ED15717E9D88F835EF9DEB4B737F2E5D175D503EBF6B9E115A5F20C6A1F6BEC524779CA47DD1976B5790
Malicious:	false
Reputation:	unknown
Preview:	/* Strings for User Notification of a crash */."headerFmt" = "The Google program %@ has unexpectedly quit.";."msg" = "The system and other applications have not been affected. A report has been created that you can send to Google to help identify the problem.";."msgNoSend" = "The system and other applications have not been affected.";.."sendReportButton" = "Send Report";."cancelButton" = "Cancel";."noSendButton" = "OK";.

C:\Program Files (x86)\Google\Picasa3\cdautorun\Picasa Restore.app\Contents\Frameworks\GoogleBreakpad.framework\Versions\A\Resources\Reporter.app\Contents\Resources\es.lproj\Louserzable.strings

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe
File Type:	Unicode text, UTF-8 text
Category:	dropped
Size (bytes):	458
Entropy (8bit):	4.576332223071282
Encrypted:	false
SSDEEP:	12:Ub1ipr84Wz7lKjbTU2HQLCKjbTU2vUnxNw:FplWNKVHK1UnxNw
MD5:	B2B424C6706B9E1F760487493EA6B7DC
SHA1:	7F3223CE0B8AC3E315AF9FE2739CFCB6254E8BF3
SHA-256:	2A9F5E32A39C59EEA3543483BEE74786B02DBB583A7BEFB59AF961DC34761D38
SHA-512:	D2AFB7291CE32A8A832BC1AFAF98E13A2F3531695D0FAE4493E497C2B65FBAD3B2C223B818802D87A52CD822C79F16F02A6EE6394FD2D32EA34F886AD2A78C16
Malicious:	false
Reputation:	unknown
Preview:	/* Strings for User Notification of a crash */."headerFmt" = "El programa de Google %@ se ha cerrado inesperadamente.";."msg" = "El sistema y otras aplicaciones no se han visto afectados. Se ha creado un informe que podr.s enviar a Google y que ayudar. a identificar el problema.";."msgNoSend" = "El sistema y otras aplicaciones no se han visto afectados.";.."sendReportButton" = "Enviar informe";."cancelButton" = "Cancelar";."noSendButton" = "Aceptar";.

C:\Program Files (x86)\Google\Picasa3\cdautorun\Picasa Restore.app\Contents\Frameworks\GoogleBreakpad.framework\Versions\A\Resources\Reporter.app\Contents\Resources\fr.lproj\Louserzable.strings

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe
File Type:	Unicode text, UTF-8 text
Category:	dropped
Size (bytes):	467
Entropy (8bit):	4.702829299841821
Encrypted:	false
SSDEEP:	12:Ub1ipuiYtpTTsnQatVqiRCFLpTTUFc1ppNU:FpuiYttd6wtQi1ppNU
MD5:	152D60497AEC1F61EF5EDCD12E1D7D25
SHA1:	80D61A9AD96DB44D2EFC262B77896C63357EA86E
SHA-256:	ED2A38DB87BB001690D9895BDAC82CC13BF9A4280B0AA9F1EDA4793D854F4211
SHA-512:	00C9572B5691BAAFC048704B8301288189A32F8324A1B2CC983EC973F2D3FDB52D4B18FD82EFE8653AAA5DE9D139C795567461ED7B6EAD0B75E8ED0053BA7E7D
Malicious:	false
Reputation:	unknown
Preview:	/* Strings for User Notification of a crash */."headerFmt" = "Le programme Google %@ s'est arr.t. de fa.on inattendue.";."msg" = "Le syst.me et les autres applications ne sont pas concern.s. Vous pouvez envoyer le rapport g.n.r. . Google pour permettre d'identifier le probl.me.";."msgNoSend" = "Le syst.me et les autres applications ne sont pas concern.s.";.."sendReportButton" = "Envoyer un rapport";."cancelButton" = "Annuler";."noSendButton" = "OK";.

C:\Program Files (x86)\Google\Picasa3\cdautorun\Picasa Restore.app\Contents\Frameworks\GoogleBreakpad.framework\Versions\A\Resources\Reporter.app\Contents\Resources\goArrow.png

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe
File Type:	PNG image data, 12 x 12, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	3591
Entropy (8bit):	7.905053628867305
Encrypted:	false
SSDEEP:	96:dSEf9IhCyTXDxarEHf9II4S3e41eWg22uWwxGiE:oE1/ybVaYlImoWZEwtE
MD5:	0301B6F19F16D975BE707702696DC767
SHA1:	9E4BF6E43FE73CFE2171DA1B2D5E04D63D74BE78
SHA-256:	A94ACA8F3FEA9E4787353F4B3D0535701FFCEFA12C2A12A64BF6AF96DAE47D2F
SHA-512:	4E707E1CA26A9106F35C3F98DF0FAE1CF1AB2C3E21E4B333ACF155C2E1BEA166DA221547C2C1F9C0CC7DE40C0F525674C2841FB97C5C9F37AB4FEB7D03F7695C
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR.............Vu\.....iCCPICC Profile..x...y4.}......2..;ad.}_.o..fKIv...$eI.%.-(..-$Z...BBQ.C.e.?..9.y...........}...;..+.;.JF.@`Ph...!..........T@..#.j`mm....;....u.R.l/.2~.8;...hM..................z......k{..8.J..@\|............`{[#.....}..J..._..........t....<.........^!..x............\` ..._......P.....:9....;.@.....w.P.@y....=...\...).{..................F....f....h.4..e.t/@-..`p... -..v......@. .H1.....;F...e8.h.X.t.....%._A.eK'..gp...........m... .@:(\...H....b.v.c.7.t.....Q<.tW..j.Z...f.V...N....1.l.gF.&...f3.7Y..(..j....M....]..:....]0.........q..8..._..z........p...~...LQ..\|......;.#l..B....GV"W..FIE..E....'0.t'.Oa........Sp.,..i....L...,.l......xry...._.tQ..`.P..P...+"E..bW%.I\..!uS..x....m.R.2.;.w..).W)W.P....V..P.J.Z....[..<Y....{.......:L]\..K...F.&.f..W.-..;..m._[.... vd..{g....+...S.....y..}..{>.~...m`..`..._<.z.....{.....I.......F....=.4M.N.Q..;.<..#t^u.b!l1\|.....Z..+GV#.t..h......F7cn.e.Gb}.....T.%p.,<xnV....'Q.].C..k

C:\Program Files (x86)\Google\Picasa3\cdautorun\Picasa Restore.app\Contents\Frameworks\GoogleBreakpad.framework\Versions\A\Resources\Reporter.app\Contents\Resources\it.lproj\Louserzable.strings

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe
File Type:	Unicode text, UTF-8 text
Category:	dropped
Size (bytes):	435
Entropy (8bit):	4.535173396873331
Encrypted:	false
SSDEEP:	6:Uk8pHsoiBzH7IUV6Zh2qKQLAyLeej5FkLUFlfm5qKQLAyLeemHH90afIlsae/nG7:Ub1ipNwOiAy6a5FEZiAy6jCaPZnNU
MD5:	9992802DFE6571EF59EB1EEE23F3F6D8
SHA1:	B9B6056360B3EC7D80B553030E312B5559E026BE
SHA-256:	AF9B0E13AB67DC5EF498BD949E4326D434ABDEB88A12D955D881FE0C4A0645B7
SHA-512:	ECC0637DB3DA9FC6CFFF90FCFA8B9BB65633BBE907EA76A4A27F76B544C019D987B6BD0E24B2A12024E0836DF3A6EE5A1ACA39DBEE222BD9CD61804D26EF6337
Malicious:	false
Reputation:	unknown
Preview:	/* Strings for User Notification of a crash */."headerFmt" = "Il programma Google %@ si . chiuso inaspettatamente.";."msg" = "Il sistema e le altre applicazioni non ne hanno risentito. Puoi inviare la segnalazione creata per aiutarci a individuare il problema.";."msgNoSend" = "Il sistema e le altre applicazioni non ne hanno risentito.";.."sendReportButton" = "Invia segnalazione";."cancelButton" = "Annulla";."noSendButton" = "OK";.

C:\Program Files (x86)\Google\Picasa3\cdautorun\Picasa Restore.app\Contents\Frameworks\GoogleBreakpad.framework\Versions\A\Resources\Reporter.app\Contents\Resources\ja.lproj\Louserzable.strings

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe
File Type:	Unicode text, UTF-8 text
Category:	dropped
Size (bytes):	531
Entropy (8bit):	5.3298294267774
Encrypted:	false
SSDEEP:	12:Ub1ipUOxRA7QiEolfJX9XQiV+sknujDRNU:FpUcA8demWrknujVNU
MD5:	BC7F046A4CC02EA73891F2A7AAF275BA
SHA1:	97680A2E1567D714D3DEC3688C726E8469765AC0
SHA-256:	C4A80B1F17483122A273005FD022A17D1F4CECB6C2DF52CAA89953E9F7DDEE07
SHA-512:	DDC8DA80B9D7683A1D58AC4EAAB2003D49919467ECFC55CB986EF2101BDB1E01BF3E0D72BDB6A8BC6BDF4CBC60201D09566D8F8A6DA4286305547B0F4132C5FC
Malicious:	false
Reputation:	unknown
Preview:	/* Strings for User Notification of a crash */."headerFmt" = "Google ..... %@ ............";."msg" = "............................ ......... Google .....................";."msgNoSend" = "............................";.."sendReportButton" = ".......";."cancelButton" = ".....";."noSendButton" = "OK";.

C:\Program Files (x86)\Google\Picasa3\cdautorun\Picasa Restore.app\Contents\Frameworks\GoogleBreakpad.framework\Versions\A\Resources\Reporter.app\Contents\Resources\nl.lproj\Louserzable.strings

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	442
Entropy (8bit):	4.601760172921549
Encrypted:	false
SSDEEP:	6:Uk8pHsoiBzHNhIUGWVQESHA+FFQVzpmXQMIyLx/LESHA+HQ90uURM4e/8f+2GCU:Ub1ipt7GIQFQVzoXBPCAuI24JNU
MD5:	CE1CD9A5FAAE0DC2551D37D2157629EF
SHA1:	CA77AEFD6A850B4092EE986C7B0737AC9C9B1409
SHA-256:	103FAB7A3EAE8721C235B9C0973ECC425EED7A004618DDDA52115C47CE3E1727
SHA-512:	53D004416C3FA4F4CF92018E4471C77C6500E317E4FC3A0A7D6313F83A099B02622FBF88025838D13063DA3466150D3C4117D7C25C0D51D62ED771D02D270786
Malicious:	false
Reputation:	unknown
Preview:	/* Strings for User Notification of a crash */."headerFmt" = "Het programma Google %@ is onverwachts afgesloten.";."msg" = "Het systeem en andere toepassingen zijn niet gewijzigd. Er is een rapport gemaakt dat u naar Google kunt sturen om het probleem te identificeren.";."msgNoSend" = "Het systeem en andere toepassingen zijn niet gewijzigd.";.."sendReportButton" = "Rapport verzenden";."cancelButton" = "Annuleren";."noSendButton" = "OK";.

C:\Program Files (x86)\Google\Picasa3\cdautorun\Picasa Restore.app\Contents\Frameworks\GoogleBreakpad.framework\Versions\A\Resources\Reporter.app\Contents\Resources\zh_CN.lproj\Louserzable.strings

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe
File Type:	Unicode text, UTF-8 text
Category:	dropped
Size (bytes):	373
Entropy (8bit):	5.743464962192476
Encrypted:	false
SSDEEP:	6:Uk8pHsoiBzH0OL6qROpKknqUEzbXAky6w9baKknqUEw90n8GfYe/mGC/:Ub1ipUOLBEqUEfXDe90qUE7JvmN/
MD5:	28D06BEF66C56E8EC0773E33F8FD819B
SHA1:	E3C159553B2A171721D0E760A1A5EAD0EFCD3F80
SHA-256:	0C1FCE894DA1D21DDD6B7DEB8086653FD78D38CA3C15363575A72D42C92309A1
SHA-512:	B056575BD3880061B2E63ACF4D3AD3273EBD32558714F400C92FDE8E6503D28B057E4602CCCC8FA0DA2D0F5080631A1EA246809F7078A9298E691DD28B014E87
Malicious:	false
Reputation:	unknown
Preview:	/* Strings for User Notification of a crash */."headerFmt" = "Google .. %@ .....";."msg" = ".......................... Google.........";."msgNoSend" = "..............";.."sendReportButton" = "....";."cancelButton" = "..";."noSendButton" = "..";.

C:\Program Files (x86)\Google\Picasa3\cdautorun\Picasa Restore.app\Contents\Frameworks\GoogleBreakpad.framework\Versions\A\Resources\Reporter.app\Contents\Resources\zh_TW.lproj\Louserzable.strings

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe
File Type:	Unicode text, UTF-8 text
Category:	dropped
Size (bytes):	376
Entropy (8bit):	5.846645183876584
Encrypted:	false
SSDEEP:	6:Uk8pHsoiBzH0OL8T2yGJL+2RUaTkRcJAjtCG6Eb9pAy+OfGJL+2RUaw90aPre/ms:Ub1ipUOL8ZolRUa4R0mCO7AsolRUa7Es
MD5:	4C479A4F9C5B0473A73CF24256B9BD34
SHA1:	787456F8508F2780BF55A3993B526318AF29BC65
SHA-256:	9F7803835507BB3AD887A91338D99EB53EA2F05F3B721FE345E5B928D6098303
SHA-512:	05433545454985E3ECA8C8757051CE20483F4A7C4A34E531E4C00FA782FA0A3D651048646C1722D29F02A46D5A4B14C99867699B7266F5FFE3646FF462C1C54F
Malicious:	false
Reputation:	unknown
Preview:	/* Strings for User Notification of a crash */."headerFmt" = "Google .. %@ .....";."msg" = "............... ........... Google ........";."msgNoSend" = "...............";.."sendReportButton" = "....";."cancelButton" = "..";."noSendButton" = "..";.

C:\Program Files (x86)\Google\Picasa3\cdautorun\Picasa Restore.app\Contents\Frameworks\GoogleBreakpad.framework\Versions\Current

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	3
Entropy (8bit):	1.584962500721156
Encrypted:	false
SSDEEP:	3:5n:5n
MD5:	A5C8CE6978E46813E453D0277E47EA53
SHA1:	77CE5F28ACA6C1D3D0506F4124C446009BA65F16
SHA-256:	26FFD5886253906A36A7EA0F6E26056FC36472626CB4894BCB100A34DC69D1DB
SHA-512:	31FE80C8ECFC334B35B2D67F04BA40B303FEFE903D40BAC7644251D443610D205B5DFCBC35B5003FC8725AC0FB9BDA6AE22AA8B13338ECB65FF36B2FE1EA8ACC
Malicious:	false
Reputation:	unknown
Preview:	A..

C:\Program Files (x86)\Google\Picasa3\cdautorun\Picasa Restore.app\Contents\Info.plist

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 text
Category:	dropped
Size (bytes):	1423
Entropy (8bit):	5.180156431530566
Encrypted:	false
SSDEEP:	24:2dfyiwl6NaGYQ0MGoMGMa6vG4oRA0Yb3+G3ekG3cH3bkH3ubzBGuh:cfyyTYQ0FoFce1O0iPutsHIHczwg
MD5:	15510DA9D5FBDB58B107AB48C32CFA15
SHA1:	26D3CE2C576924B5B7FE801BD16C0B4F345225F2
SHA-256:	938FB7381E57BF6601BED8A1C6453E050933317EC8B382E9B1B6621FF8A5041F
SHA-512:	69571EC8C2BB634AFEE383E1212ED4AFCEAC2983CAF8A1BC82C2542A8CC040FC8FD6C143E0338510DE9700C113C28B597462D187B0E1DD1C2961A3B28285DADE
Malicious:	false
Reputation:	unknown
Preview:	<?xml version="1.0" encoding="UTF-8"?>.<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">.<plist version="1.0">.<dict>..<key>CFBundleDevelopmentRegion</key>..<string>English</string>..<key>CFBundleExecutable</key>..<string>Picasa Restore</string>..<key>CFBundleGetInfoString</key>..<string>Picasa 2.0.5.322 Labs, . 2007-2009 Google Inc.</string>..<key>CFBundleIconFile</key>..<string>PicasaRestore</string>..<key>CFBundleIdentifier</key>..<string>com.google.PicasaRestore</string>..<key>CFBundleInfoDictionaryVersion</key>..<string>6.0</string>..<key>CFBundleName</key>..<string>Picasa Restore</string>..<key>CFBundlePackageType</key>..<string>APPL</string>..<key>CFBundleShortVersionString</key>..<string>2.0.5</string>..<key>CFBundleSignature</key>..<string>????</string>..<key>CFBundleVersion</key>..<string>2.0.5.322</string>..<key>GoogleBreakpadProduct</key>..<string>Picasa_Mac_Restore</string>..<key>GoogleBreakpadProductDisplay</key>..<str

C:\Program Files (x86)\Google\Picasa3\cdautorun\Picasa Restore.app\Contents\MacOS\Picasa Restore

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe
File Type:	Mach-O i386 executable, flags:<NOUNDEFS\|DYLDLINK\|TWOLEVEL\|BINDS_TO_WEAK>
Category:	dropped
Size (bytes):	299348
Entropy (8bit):	5.810859288918615
Encrypted:	false
SSDEEP:	6144:2HW8nucbsNtOWc+12xFenLnlGt5V2HkB6pR:EWcEAFunUSpR
MD5:	8EA8E704430F905EFC4404BF0BD80355
SHA1:	D0AA91582A1D5719D03651A461B9AB80424003CF
SHA-256:	EF51FC456AC12FDD4A20BE93338DE48462F19B298B959789B42424A1C1A79055
SHA-512:	22CFFBEA8CD21089E949BF4C1F688DC224D6BCB292B9E95EEC4DB3283AA1744AB2D128E65143783D1BA45E2FF61BDCDBCCAFDB9A642B6B7B1A2028AB4C5484BC
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Reputation:	unknown
Preview:	....................<...........8...__PAGEZERO..........................................X...__TEXT..........................................__text..........__TEXT..........D$..L%..D...........................__cstring.......__TEXT...........I..!3...9..........................__eh_frame......__TEXT...........\|...l...l.................`........__const_coal....__TEXT..............l...............................__literal8......__TEXT..........(...h...(...........................__literal4......__TEXT..............................................__const.........__TEXT..............................................__StaticInit....__TEXT..............g.......................................__DATA.......................`..................__data..........__DATA..............................................__dyld..........__DATA..............................................__cfstring......__DATA..............p...............................__const_coal....__DATA..........@...4...@...............

C:\Program Files (x86)\Google\Picasa3\cdautorun\Picasa Restore.app\Contents\PkgInfo

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	8
Entropy (8bit):	1.75
Encrypted:	false
SSDEEP:	3:k0Ra:f8
MD5:	23B7D7D024ABB0F558420E098800BF27
SHA1:	9F9EEA0CFE2D65F2C3D6B092E375B40782D08F31
SHA-256:	82502191C9484B04D685374F9879A0066069C49B8ACAE7A04B01D38D07E8ECA0
SHA-512:	F77D501528DD0CED155C80406CFBEE38D5D3649B64D2A9324F3D6CEE39491EB8F54CDEBAE49C6E21A20D2309D8FAE1B01C41631224811E73483DB25A2695738C
Malicious:	false
Reputation:	unknown
Preview:	APPL????

C:\Program Files (x86)\Google\Picasa3\cdautorun\Picasa Restore.app\Contents\Resources\English.lproj\InfoPlist.strings

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe
File Type:	Unicode text, UTF-16, little-endian text
Category:	dropped
Size (bytes):	92
Entropy (8bit):	3.2610300066712608
Encrypted:	false
SSDEEP:	3:Qwh+yEilSlJlqXMLLkFlVlRDBWjUoFY9n:QpXioJqcLwVlRNWwou9n
MD5:	51EF59B60E5B41B91519CC662A9FE886
SHA1:	3222CA0C39EB50AAF8126BAF852E55430C4718AF
SHA-256:	39CF2EE07B7B333E7C179D0BF4D798A5B72AF6A4E584F51E642703BBFA4FC828
SHA-512:	3952A908B72D44040F5072F6344F6327FC78981C3AA55E931ACAE84C0C9BCC0D148991CD564AF4803765C328CBF5F7EFE9EB558FC56E47E8206B7B706026F30A
Malicious:	false
Reputation:	unknown
Preview:	../.. .L.o.c.a.l.i.z.e.d. .v.e.r.s.i.o.n.s. .o.f. .I.n.f.o...p.l.i.s.t. .k.e.y.s. ../.....

C:\Program Files (x86)\Google\Picasa3\cdautorun\Picasa Restore.app\Contents\Resources\English.lproj\PRMainMenu.nib\classes.nib

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe
File Type:	XML 1.0 document, ASCII text
Category:	dropped
Size (bytes):	1571
Entropy (8bit):	4.883604938493906
Encrypted:	false
SSDEEP:	24:2dfyiwqhtsd551XBeYSjV+NaBFh3gsX4DHLqaemns4:cfyghtc55DeHj3besX4DHZs4
MD5:	AFE57505E88B3C6CD5D7A27ED6539C66
SHA1:	CA6705B7559326C5C60F8A15DFC6751208DD0643
SHA-256:	BC6AF85CB27E3E742EA8E5519483ACA800F0D2C3C469C1E6AF2161CC5BE647F4
SHA-512:	D5EC7CCED627E987028E4EAB5030126D31E105C1EA91616A956D55552F19F2E71A1EA327D4039428959D661A33E4F072B806BA20BFB3CDD2D5EB0DF98CD4466C
Malicious:	false
Reputation:	unknown
Preview:	<?xml version="1.0" encoding="UTF-8"?>.<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">.<plist version="1.0">.<dict>..<key>IBClasses</key>..<array>...<dict>....<key>ACTIONS</key>....<dict>.....<key>cancelPromptForDestinationFolderChoice</key>.....<string>id</string>.....<key>cancelRestoration</key>.....<string>id</string>.....<key>finishPromptForDestinationFolderChoice</key>.....<string>id</string>.....<key>openManifestFile</key>.....<string>id</string>.....<key>openSourceInDefaultApplication</key>.....<string>id</string>.....<key>selectFolderForDestination</key>.....<string>id</string>.....<key>showDestinationInFinder</key>.....<string>id</string>.....<key>showInPreviewApplication</key>.....<string>id</string>.....<key>showSourceInFinder</key>.....<string>id</string>.....<key>startRestoration</key>.....<string>id</string>....</dict>....<key>CLASS</key>....<string>PRAppController</string>....<key>LANGUAGE</key>....<string>ObjC</stri

C:\Program Files (x86)\Google\Picasa3\cdautorun\Picasa Restore.app\Contents\Resources\English.lproj\PRMainMenu.nib\info.nib

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe
File Type:	XML 1.0 document, ASCII text
Category:	dropped
Size (bytes):	530
Entropy (8bit):	5.2572831082653915
Encrypted:	false
SSDEEP:	12:TMHdgo+tJVEdQiCXFbfNIfx2w0GeC6mwbn:2dfyiwFfNIZ2ZC6pb
MD5:	5B24AFE0F3D49E9D13C447576AF25421
SHA1:	9B3D09AA1EFF0D2238781AA873CC60BE7D932B5D
SHA-256:	B4D5B85DA4B9450CE0FC7CDDDA0EAE9B8ED92CDAF7A1B148924399331B104287
SHA-512:	58646DBD3CB3534477264E862EB2C08968C68717CA7B47F3B568FECF9D8B30938377932A8F815D15A914C2CD37BE61025DF2D54F4F3A9D4E029F22EF35E61AE9
Malicious:	false
Reputation:	unknown
Preview:	<?xml version="1.0" encoding="UTF-8"?>.<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">.<plist version="1.0">.<dict>..<key>IBFramework Version</key>..<string>677</string>..<key>IBLastKnownRelativeProjectPath</key>..<string>../../../Mac/Picasa.xcodeproj</string>..<key>IBOldestOS</key>..<integer>4</integer>..<key>IBOpenObjects</key>..<array/>..<key>IBSystem Version</key>..<string>9L31a</string>..<key>targetFramework</key>..<string>IBCocoaFramework</string>.</dict>.</plist>.

C:\Program Files (x86)\Google\Picasa3\cdautorun\Picasa Restore.app\Contents\Resources\English.lproj\PRMainMenu.nib\keyedobjects.nib

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe
File Type:	Apple binary property list
Category:	dropped
Size (bytes):	29013
Entropy (8bit):	7.001596299783399
Encrypted:	false
SSDEEP:	768:8V8w2nqK2O26sn6AsEV6fK5Rlo8HISk0JdYOvxj:8+w2nNrk445XISk0J9xj
MD5:	4311A279B0C8D5F7EC98032E56EAC25D
SHA1:	E4177612DC18469BDB68969A1A7A0046C6ECE785
SHA-256:	6BDA18266AD6D712A94119ABB70204367674E04B265230AA87159ABC7D45404B
SHA-512:	6B7E7CC381DCD76ACFD2ACD67CCB056726FCA5204909C4F86FF75A96FE2F5A309FD1E69C49F136797C821D7E1295B74C9C51592683086BA45E3EC6752B3D65CE
Malicious:	false
Reputation:	unknown
Preview:	bplist00.................X$versionT$topY$archiverX$objects..........]IB.objectdata.._..NSKeyedArchiver...*.....1.5.6.<.=.A.E.h.p.......................................%.&.)...1.9.:.;.>.D.M.R.W.X.[.`.a.c.f.n.o.u.v.\|..................................................................................... .!...%.&.).1.2.:.G.H.M.N.O.R.V.W.Z.b.c.n.u.v.}.~.............................................z...................................!.".#.$.'.(.,.5.9.:.;.<.@.H.M.N.O.P.U.].d...e.l.m.n.s.z.{.\|............................................................. .!.%.&.).1.2.:.;.?...D.H.I.M.O.R.T.U.B.V.\.].:.b.f.k.n.o.r.z.{...........................................................................!."................. .%.&.+.,.1.2.7.8.<.C.D.E.J.K.P.W.X.Y.Z.^.e.i.j.k.l.q.u.\|.}.~...........................................%...&.+.../.8.9.B...C.G...P.Q.X.a.b.i...r.s...v.....J.K.L.M.N.O.P.Q.R.S.T.U.V.W.X.Y.Z.[.\.].^._.`.a.b.c.d.e.f.g.h.i.j.k.l.m.n.o.p.q.r.s.t.u.v.w.x.y.z.{.\|.}.~................................

C:\Program Files (x86)\Google\Picasa3\cdautorun\Picasa Restore.app\Contents\Resources\PicasaRestore.icns

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe
File Type:	Mac OS X icon, 188983 bytes, "is32" type
Category:	dropped
Size (bytes):	188983
Entropy (8bit):	7.721295959340931
Encrypted:	false
SSDEEP:	3072:bA35mKjZXa/6y5vwQUJNYbmkSZMOuaVxOoMH018jM41DZMNXb:s1k3vhwcSZMaLTkLjMEZM5
MD5:	D9B70299D1D2544D7E9B92ACCD5B5157
SHA1:	8769837AE6A2BD9DE4260FFFC840A3B72AEA1303
SHA-256:	48140BF8B347A18DC60C5CDBA0BA93D3B21E13AB4D9570C9B485724D75C5F954
SHA-512:	EDDA8D4A2151E250DF28ABE6A767F7163ABF31CD4028E858F49056F2873514402C069A640878651F95AD5E1F8139A0A806C6E4A1DCB097426935B063190B695E
Malicious:	false
Reputation:	unknown
Preview:	icns...7is32.....................G...........z.......S.....`........./....................>...............U...........$...E.Z............$..W.......;?I..u.`Z.$<<m.y...a.............f................m...............{..C...................:.}............,,6!.==.......(.........L.....2.......x...EA..O....3`.f...f...4......k.............@.n............V......L...+...F................k........=>I...........}...a..............f..q.z.\|'{......m..s.{}}\|\|z.....{..7....................8k.............,7!.==.......(.........K.}...9.......\|..?=..O.....`....`.$e?.............\|..d=.......).k ...U.........]5...G........$.f(.............B?K ....kz\|c......d. Gg`EMM"......i..%......]....q../..*..........,A2452.Z..........!!.6S................1>% =As8mk.......................G....+................U......c.........1....................<...............Y...........)...M...........................ebk5..................................................................M.................""

C:\Program Files (x86)\Google\Picasa3\cdautorun\Picasa Restore.app\Contents\Resources\bg.lproj\PRMainMenu.nib\classes.nib

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe
File Type:	XML 1.0 document, ASCII text
Category:	dropped
Size (bytes):	1571
Entropy (8bit):	4.883604938493906
Encrypted:	false
SSDEEP:	24:2dfyiwqhtsd551XBeYSjV+NaBFh3gsX4DHLqaemns4:cfyghtc55DeHj3besX4DHZs4
MD5:	AFE57505E88B3C6CD5D7A27ED6539C66
SHA1:	CA6705B7559326C5C60F8A15DFC6751208DD0643
SHA-256:	BC6AF85CB27E3E742EA8E5519483ACA800F0D2C3C469C1E6AF2161CC5BE647F4
SHA-512:	D5EC7CCED627E987028E4EAB5030126D31E105C1EA91616A956D55552F19F2E71A1EA327D4039428959D661A33E4F072B806BA20BFB3CDD2D5EB0DF98CD4466C
Malicious:	false
Reputation:	unknown
Preview:	<?xml version="1.0" encoding="UTF-8"?>.<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">.<plist version="1.0">.<dict>..<key>IBClasses</key>..<array>...<dict>....<key>ACTIONS</key>....<dict>.....<key>cancelPromptForDestinationFolderChoice</key>.....<string>id</string>.....<key>cancelRestoration</key>.....<string>id</string>.....<key>finishPromptForDestinationFolderChoice</key>.....<string>id</string>.....<key>openManifestFile</key>.....<string>id</string>.....<key>openSourceInDefaultApplication</key>.....<string>id</string>.....<key>selectFolderForDestination</key>.....<string>id</string>.....<key>showDestinationInFinder</key>.....<string>id</string>.....<key>showInPreviewApplication</key>.....<string>id</string>.....<key>showSourceInFinder</key>.....<string>id</string>.....<key>startRestoration</key>.....<string>id</string>....</dict>....<key>CLASS</key>....<string>PRAppController</string>....<key>LANGUAGE</key>....<string>ObjC</stri

C:\Program Files (x86)\Google\Picasa3\cdautorun\Picasa Restore.app\Contents\Resources\bg.lproj\PRMainMenu.nib\info.nib

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe
File Type:	XML 1.0 document, ASCII text
Category:	dropped
Size (bytes):	530
Entropy (8bit):	5.250472465860794
Encrypted:	false
SSDEEP:	12:TMHdgo+tJVEdQiCXFbCGIfx2w0GeC6mwbn:2dfyiwFrIZ2ZC6pb
MD5:	0E168543FD71A479FA5AD0E0613A1BA5
SHA1:	9ACD86A59CE7EC341021D75817D082118D351C56
SHA-256:	7C87E946FB8E106D8856A962C780503F602FAE5B09A818F5AD3ACDFC6468546A
SHA-512:	DFFAB3A94B1994D3EC558F308729DED11A9759CC6B4C6E0022ECE502AE5D2BB8437211B37549454DDB43CCACF91F0989E61A1C173B4F59FBCFF423BAFBEAC44A
Malicious:	false
Reputation:	unknown
Preview:	<?xml version="1.0" encoding="UTF-8"?>.<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">.<plist version="1.0">.<dict>..<key>IBFramework Version</key>..<string>680</string>..<key>IBLastKnownRelativeProjectPath</key>..<string>../../../Mac/Picasa.xcodeproj</string>..<key>IBOldestOS</key>..<integer>4</integer>..<key>IBOpenObjects</key>..<array/>..<key>IBSystem Version</key>..<string>9L31a</string>..<key>targetFramework</key>..<string>IBCocoaFramework</string>.</dict>.</plist>.

C:\Program Files (x86)\Google\Picasa3\cdautorun\Picasa Restore.app\Contents\Resources\bg.lproj\PRMainMenu.nib\keyedobjects.nib

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe
File Type:	Apple binary property list
Category:	dropped
Size (bytes):	24231
Entropy (8bit):	6.859413246559702
Encrypted:	false
SSDEEP:	384:dLx3oV88POLGTDxdF1EfLK81yvt89jo0z+xusjy9f0qBk4BjrXzxsVVw+Sg6aVeY:zoV825Dx72DzC0yxxIf0ykAzxkVw+SgT
MD5:	1FC9EB7D0D21CE8E19007330959B9BA1
SHA1:	118716F12AD8997A25E02D527B4C1DC850ED3D90
SHA-256:	D30A599340272FF3427A1279B40DDEEA46E067568E8DA673831E95C1D3E7568D
SHA-512:	FC3EAEAAA668459B25EF95AFC9E982E90F5F16177BB010190FE3D894EA9EBE91A7E5E4B16D7F67095BB4CF4B952BA97508072FB43E548DFB8DC29DD09458F704
Malicious:	false
Reputation:	unknown
Preview:	bplist00.................X$versionT$topY$archiverX$objects..........]IB.objectdata.._..NSKeyedArchiver.........1.5.6.<.=.A.E.h.p....................................................... .!.$.,.?.@.L.M.U.V.Y.^.a.i.j.k.n.t.}.........................................................................................#.(.).,./.0.3.@.A.B.E.M.N...R.S.V.^.e.f.m.n.y.............................................................!.0.1.5.6.5.:.=.@.I...J.K.r.L.S.T.Y.Z.].d.e.m.n.r.u.\|.}...........................................................................................$.(.)..+./.6.;.<.=.A.I.J.K.L.Q.V.W.\.a.b.g.s.t.u.\|.......................................................................................................%.&.'.,.-.1.8.9.:.;.E.F.G.H.K.T.U.V.W.^._.`.t.......................................................&.../.0...3.5.{................................................. .!.".#.$.%.&.'.(.)..+.,.-.../.0.1.2.3.4.5.6.7.8.9.:.;.<.=.>.?.@.A.B.C.D.E.F.G.H.I.J.K.L.M.P.S...!.".#.$.%.&.'.(.).*.+.,

C:\Program Files (x86)\Google\Picasa3\cdautorun\Picasa Restore.app\Contents\Resources\bg.lproj\i18n\restore_resexport.xml

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 text
Category:	dropped
Size (bytes):	2952
Entropy (8bit):	5.2153219396563975
Encrypted:	false
SSDEEP:	48:c/4Ullz/VgRA3V0ssR5XJUpJyRV5+UllbVUD8DeUO1xBTZRf:GpVrFnOUUDS3BTZRf
MD5:	79BA53CB270EB5E1C8D530F533A171D5
SHA1:	A932CA9F18C91CD12755C9934F76BBD8266C89C6
SHA-256:	EB16F49E9B56F4A4BEDC675C8276EF7F36A70D5A4998DE78862CD8B76A691362
SHA-512:	2EEF8F1AF3EEAFA321552AA073BB9E80255C9B026C1CD26AB84D5296596ADAC9679D963A212B0746FFC7D81C46DD02251742D228178BC09A926C1F2B6836B24C
Malicious:	false
Reputation:	unknown
Preview:	<?xml version="1.0" encoding="utf-8" ?>.<Win32Res>. <RT_DIALOG>. <res resid="#904">. <dtitle>. <xmbtext>.............. .. ........ ..... .. Picasa</xmbtext>. </dtitle>. <dlayout>rect(0 0 296 154)</dlayout>. <item itemid="1" itemtype="Button" layout="rect(177 133 227 147)">. <xmbtext>......</xmbtext>. </item>. <item itemid="2" itemtype="Button" layout="rect(239 133 289 147)">. <xmbtext>.....</xmbtext>. </item>. <item itemid="3" itemtype="Button" layout="rect(7 133 57 147)">. <xmbtext>.........</xmbtext>. </item>. <item itemid="1010" itemtype="Button" layout="rect(25 47 236 59)">. <xmbtext>............ ..............</xmbtext>. </item>. <item itemid="1011" itemtype="Button" layout="rect(25 83 241 95)">. <xmbtext>.... .....</xmbtext>. </item>. <item itemid="1009" itemtype="Edit" layout="rect(41 100 221 113)"/>. <item itemid="4" itemtype="Button" layout="rec

C:\Program Files (x86)\Google\Picasa3\cdautorun\Picasa Restore.app\Contents\Resources\bg.lproj\i18n\restore_stringres.xml

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 text
Category:	dropped
Size (bytes):	10981
Entropy (8bit):	5.155600184848421
Encrypted:	false
SSDEEP:	192:9SFL3kd+teXertEeyeTxznMVmcilooZqDSFL3kd+teXertEeyeTxznMVmcilooZs:22UENo2UEN2a5JCOJ4/igmL
MD5:	23E5670305FEE89A4183D638B15258FE
SHA1:	BA07A7BBC50830FDDF830EE9186F1467229955AE
SHA-256:	C155AC698E0DCB8D17F4A4BC5761D4833DDDBD3C392EEC4D54A325C8A019A4CA
SHA-512:	6CCE5127483F5730862469085709DD8E5D2C53495615EE132FE40915B7AB04F756FF0FF20AF91BAFE4D03E8756723AEE9FE9890488E7D237A284BA0C5D21470E
Malicious:	false
Reputation:	unknown
Preview:	<?xml version="1.0" encoding="utf-8" ?>.<resources>. <stringres id="February">. <xmbtext>........</xmbtext>. </stringres>. <stringres id="March">. <xmbtext>....</xmbtext>. </stringres>. <stringres id="April">. <xmbtext>.....</xmbtext>. </stringres>. <stringres id="May">. <xmbtext>...</xmbtext>. </stringres>. <stringres id="June">. <xmbtext>...</xmbtext>. </stringres>. <stringres id="July">. <xmbtext>...</xmbtext>. </stringres>. <stringres id="August">. <xmbtext>......</xmbtext>. </stringres>. <stringres id="September">. <xmbtext>.........</xmbtext>. </stringres>. <stringres id="October">. <xmbtext>........</xmbtext>. </stringres>. <stringres id="November">. <xmbtext>.......</xmbtext>. </stringres>. <stringres id="December">. <xmbtext>........</xmbtext>. </stringres>. <stringres id="Jan">. <xmbtext>..</xmbtext>. </stringres>. <stringres id="Feb">. <xmbtext>...</xmbtext>. </stringres>. <stringres id="Mar">.

C:\Program Files (x86)\Google\Picasa3\cdautorun\Picasa Restore.app\Contents\Resources\ca.lproj\PRMainMenu.nib\classes.nib

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe
File Type:	XML 1.0 document, ASCII text
Category:	dropped
Size (bytes):	1571
Entropy (8bit):	4.883604938493906
Encrypted:	false
SSDEEP:	24:2dfyiwqhtsd551XBeYSjV+NaBFh3gsX4DHLqaemns4:cfyghtc55DeHj3besX4DHZs4
MD5:	AFE57505E88B3C6CD5D7A27ED6539C66
SHA1:	CA6705B7559326C5C60F8A15DFC6751208DD0643
SHA-256:	BC6AF85CB27E3E742EA8E5519483ACA800F0D2C3C469C1E6AF2161CC5BE647F4
SHA-512:	D5EC7CCED627E987028E4EAB5030126D31E105C1EA91616A956D55552F19F2E71A1EA327D4039428959D661A33E4F072B806BA20BFB3CDD2D5EB0DF98CD4466C
Malicious:	false
Reputation:	unknown
Preview:	<?xml version="1.0" encoding="UTF-8"?>.<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">.<plist version="1.0">.<dict>..<key>IBClasses</key>..<array>...<dict>....<key>ACTIONS</key>....<dict>.....<key>cancelPromptForDestinationFolderChoice</key>.....<string>id</string>.....<key>cancelRestoration</key>.....<string>id</string>.....<key>finishPromptForDestinationFolderChoice</key>.....<string>id</string>.....<key>openManifestFile</key>.....<string>id</string>.....<key>openSourceInDefaultApplication</key>.....<string>id</string>.....<key>selectFolderForDestination</key>.....<string>id</string>.....<key>showDestinationInFinder</key>.....<string>id</string>.....<key>showInPreviewApplication</key>.....<string>id</string>.....<key>showSourceInFinder</key>.....<string>id</string>.....<key>startRestoration</key>.....<string>id</string>....</dict>....<key>CLASS</key>....<string>PRAppController</string>....<key>LANGUAGE</key>....<string>ObjC</stri

C:\Program Files (x86)\Google\Picasa3\cdautorun\Picasa Restore.app\Contents\Resources\ca.lproj\PRMainMenu.nib\info.nib

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe
File Type:	XML 1.0 document, ASCII text
Category:	dropped
Size (bytes):	530
Entropy (8bit):	5.250472465860794
Encrypted:	false
SSDEEP:	12:TMHdgo+tJVEdQiCXFbCGIfx2w0GeC6mwbn:2dfyiwFrIZ2ZC6pb
MD5:	0E168543FD71A479FA5AD0E0613A1BA5
SHA1:	9ACD86A59CE7EC341021D75817D082118D351C56
SHA-256:	7C87E946FB8E106D8856A962C780503F602FAE5B09A818F5AD3ACDFC6468546A
SHA-512:	DFFAB3A94B1994D3EC558F308729DED11A9759CC6B4C6E0022ECE502AE5D2BB8437211B37549454DDB43CCACF91F0989E61A1C173B4F59FBCFF423BAFBEAC44A
Malicious:	false
Reputation:	unknown
Preview:	<?xml version="1.0" encoding="UTF-8"?>.<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">.<plist version="1.0">.<dict>..<key>IBFramework Version</key>..<string>680</string>..<key>IBLastKnownRelativeProjectPath</key>..<string>../../../Mac/Picasa.xcodeproj</string>..<key>IBOldestOS</key>..<integer>4</integer>..<key>IBOpenObjects</key>..<array/>..<key>IBSystem Version</key>..<string>9L31a</string>..<key>targetFramework</key>..<string>IBCocoaFramework</string>.</dict>.</plist>.

C:\Program Files (x86)\Google\Picasa3\cdautorun\Picasa Restore.app\Contents\Resources\ca.lproj\PRMainMenu.nib\keyedobjects.nib

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe
File Type:	Apple binary property list
Category:	dropped
Size (bytes):	23174
Entropy (8bit):	6.891873766867606
Encrypted:	false
SSDEEP:	384:QgzGoV88871EBT+1a1vg/U+M12IBnZdjH04FtfduAltaOkk5ryC5Nrpf0KqAohl5:96oV8T24LM+Q2IBZl7TfdfiONrpf0Kqn
MD5:	0F9EEE109D2F78D549338F717F4E70C1
SHA1:	E693FA3B7B70758552154B529CD623182393DC41
SHA-256:	4A879C75461393682BCFBC5C21C8DF76AC4A7D8A9A6B9B0541F717E787995FF7
SHA-512:	FA228D1025ADA9815280FAF261EFEC74D2551080D0C8F05A20518DD17049B1F1172908834654A8AB1D6F08C0FC840436B072B5B5DEAC3E87415A30CACAF803D6
Malicious:	false
Reputation:	unknown
Preview:	bplist00.................X$versionT$topY$archiverX$objects..........]IB.objectdata.._..NSKeyedArchiver.........1.5.6.<.=.A.E.h.p...........................................................!.".%.-.@.A.M.N.U.V.Y.^.a.i.j.k.n.t.}....................................................................................... .$.)..-.0.3.4.5.8.<.C.G.H.I.J.O.W.\.].o.p.s.v.w.\|.......................................................................................#..+.,.-.2.8.@.G.H.P.Q.\.c.d.k.l.n.o.t.u.z.{...............................................r...........................%.&.8.B.F.G.H.I.O.G.Z.c.G.d.h.k.r.s.z.{.............................................................................................................".#.'.../.0.5.6.;.E.F.G.H.K.T.U.V.W.^._.`.........................................................&...'.+.2.3.5.{................................................. .!.".#.$.%.&.'.(.)..+.,.-.../.0.1.2.3.4.5.6.7.8.9.:.;.<.=.>.?.@.A.B.C.D.E.F.G.H.I.J.K.L.M.P.S...!.".#.$.%.&.'.(.)..+.,

C:\Program Files (x86)\Google\Picasa3\cdautorun\Picasa Restore.app\Contents\Resources\ca.lproj\i18n\restore_resexport.xml

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 text
Category:	dropped
Size (bytes):	2651
Entropy (8bit):	4.9002969998278125
Encrypted:	false
SSDEEP:	24:2dRtIk0nzDLQuRKK7EvAydJ1ggov6FvREGDEpe9kvkEKiHqHzUEwAEu4snXLKTzc:c/sz/V+AV9mR5EVuqbyAtr2MmRf
MD5:	2739BB9F625625AB0FD7E3436AF7C4A4
SHA1:	98AA5D3C3DEE9C627548E526354F401F40AB8835
SHA-256:	D5A6E0A40696CDBC34B9AE285D93888F9E58CFE7FA162753C0B44934E1E7429C
SHA-512:	0171E0F2C2075D0EA430A0C731E4CFFC9ED2B929717AA7B9AC49DF5825724338216FDCDD5FE90B437CD5EEE7D8CFD95AB9DFF906AABB4CE4EA87C83896BE047C
Malicious:	false
Reputation:	unknown
Preview:	<?xml version="1.0" encoding="utf-8" ?>.<Win32Res>. <RT_DIALOG>. <res resid="#904">. <dtitle>. <xmbtext>Restaura des d'una c.pia de seguretat a Picasa</xmbtext>. </dtitle>. <dlayout>rect(0 0 296 154)</dlayout>. <item itemid="1" itemtype="Button" layout="rect(177 133 227 147)">. <xmbtext>Seg.ent</xmbtext>. </item>. <item itemid="2" itemtype="Button" layout="rect(239 133 289 147)">. <xmbtext>Cancel.la</xmbtext>. </item>. <item itemid="3" itemtype="Button" layout="rect(7 133 57 147)">. <xmbtext>Expulsa</xmbtext>. </item>. <item itemid="1010" itemtype="Button" layout="rect(25 47 236 59)">. <xmbtext>Les ubicacions originals</xmbtext>. </item>. <item itemid="1011" itemtype="Button" layout="rect(25 83 241 95)">. <xmbtext>Aquesta carpeta</xmbtext>. </item>. <item itemid="1009" itemtype="Edit" layout="rect(41 100 221 113)"/>. <item itemid="4" itemtype="Button" layout="rect(227 100 277 114)">. <xmbtext>Canvia...</xmbtext>. </item>.

C:\Program Files (x86)\Google\Picasa3\cdautorun\Picasa Restore.app\Contents\Resources\ca.lproj\i18n\restore_stringres.xml

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 text
Category:	dropped
Size (bytes):	10180
Entropy (8bit):	4.822115440278687
Encrypted:	false
SSDEEP:	192:9YdB4x5FBHepeltEebevu8+BHWanBqV/oedUYdB4x5FBHepeltEebevu8+BHWano:aYHkME8LJyYHkME8LJUIqF1OBzJlpS
MD5:	8D5B4ADC8680817B863098234B26492D
SHA1:	DD70112F62C2CE262C066A82204FFA083688EB50
SHA-256:	FF20759DFA403EB184BC28E4BAFABDB5FC709DC2C27482461FA51DEDCDACBEE7
SHA-512:	E6A284BF4EA58E720E98144F4F4307B86E08F8D795CC6D43BEC38E664A188D4FA7FCFD631DEAC0D1776F1833DFBF25AAF1D55696DF8FDB0B26FD81E7C6F07799
Malicious:	false
Reputation:	unknown
Preview:	<?xml version="1.0" encoding="utf-8" ?>.<resources>. <stringres id="February">. <xmbtext>Febrer</xmbtext>. </stringres>. <stringres id="March">. <xmbtext>Mar.</xmbtext>. </stringres>. <stringres id="April">. <xmbtext>Abril</xmbtext>. </stringres>. <stringres id="May">. <xmbtext>Maig</xmbtext>. </stringres>. <stringres id="June">. <xmbtext>Juny</xmbtext>. </stringres>. <stringres id="July">. <xmbtext>Juliol</xmbtext>. </stringres>. <stringres id="August">. <xmbtext>Agost</xmbtext>. </stringres>. <stringres id="September">. <xmbtext>Setembre</xmbtext>. </stringres>. <stringres id="October">. <xmbtext>Octubre</xmbtext>. </stringres>. <stringres id="November">. <xmbtext>Novembre</xmbtext>. </stringres>. <stringres id="December">. <xmbtext>Desembre</xmbtext>. </stringres>. <stringres id="Jan">. <xmbtext>Gen</xmbtext>. </stringres>. <stringres id="Feb">. <xmbtext>Feb</xmbtext>. </stringres>. <stringres id="Mar">. <xmbtext>Mar.</xmbtext>. </stringres>. <stringres id="Apr">. <

C:\Program Files (x86)\Google\Picasa3\cdautorun\Picasa Restore.app\Contents\Resources\cs.lproj\PRMainMenu.nib\classes.nib

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe
File Type:	XML 1.0 document, ASCII text
Category:	dropped
Size (bytes):	1571
Entropy (8bit):	4.883604938493906
Encrypted:	false
SSDEEP:	24:2dfyiwqhtsd551XBeYSjV+NaBFh3gsX4DHLqaemns4:cfyghtc55DeHj3besX4DHZs4
MD5:	AFE57505E88B3C6CD5D7A27ED6539C66
SHA1:	CA6705B7559326C5C60F8A15DFC6751208DD0643
SHA-256:	BC6AF85CB27E3E742EA8E5519483ACA800F0D2C3C469C1E6AF2161CC5BE647F4
SHA-512:	D5EC7CCED627E987028E4EAB5030126D31E105C1EA91616A956D55552F19F2E71A1EA327D4039428959D661A33E4F072B806BA20BFB3CDD2D5EB0DF98CD4466C
Malicious:	false
Reputation:	unknown
Preview:	<?xml version="1.0" encoding="UTF-8"?>.<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">.<plist version="1.0">.<dict>..<key>IBClasses</key>..<array>...<dict>....<key>ACTIONS</key>....<dict>.....<key>cancelPromptForDestinationFolderChoice</key>.....<string>id</string>.....<key>cancelRestoration</key>.....<string>id</string>.....<key>finishPromptForDestinationFolderChoice</key>.....<string>id</string>.....<key>openManifestFile</key>.....<string>id</string>.....<key>openSourceInDefaultApplication</key>.....<string>id</string>.....<key>selectFolderForDestination</key>.....<string>id</string>.....<key>showDestinationInFinder</key>.....<string>id</string>.....<key>showInPreviewApplication</key>.....<string>id</string>.....<key>showSourceInFinder</key>.....<string>id</string>.....<key>startRestoration</key>.....<string>id</string>....</dict>....<key>CLASS</key>....<string>PRAppController</string>....<key>LANGUAGE</key>....<string>ObjC</stri

C:\Program Files (x86)\Google\Picasa3\cdautorun\Picasa Restore.app\Contents\Resources\cs.lproj\PRMainMenu.nib\info.nib

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe
File Type:	XML 1.0 document, ASCII text
Category:	dropped
Size (bytes):	530
Entropy (8bit):	5.250472465860794
Encrypted:	false
SSDEEP:	12:TMHdgo+tJVEdQiCXFbCGIfx2w0GeC6mwbn:2dfyiwFrIZ2ZC6pb
MD5:	0E168543FD71A479FA5AD0E0613A1BA5
SHA1:	9ACD86A59CE7EC341021D75817D082118D351C56
SHA-256:	7C87E946FB8E106D8856A962C780503F602FAE5B09A818F5AD3ACDFC6468546A
SHA-512:	DFFAB3A94B1994D3EC558F308729DED11A9759CC6B4C6E0022ECE502AE5D2BB8437211B37549454DDB43CCACF91F0989E61A1C173B4F59FBCFF423BAFBEAC44A
Malicious:	false
Reputation:	unknown
Preview:	<?xml version="1.0" encoding="UTF-8"?>.<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">.<plist version="1.0">.<dict>..<key>IBFramework Version</key>..<string>680</string>..<key>IBLastKnownRelativeProjectPath</key>..<string>../../../Mac/Picasa.xcodeproj</string>..<key>IBOldestOS</key>..<integer>4</integer>..<key>IBOpenObjects</key>..<array/>..<key>IBSystem Version</key>..<string>9L31a</string>..<key>targetFramework</key>..<string>IBCocoaFramework</string>.</dict>.</plist>.

C:\Program Files (x86)\Google\Picasa3\cdautorun\Picasa Restore.app\Contents\Resources\cs.lproj\PRMainMenu.nib\keyedobjects.nib

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe
File Type:	Apple binary property list
Category:	dropped
Size (bytes):	23995
Entropy (8bit):	6.776611950606686
Encrypted:	false
SSDEEP:	384:QgzGoV888w1EBTM1a1v48M12NGZ4W3IQfZtSduAltaIkPjryC5n5QzQ3x9qEH88l:96oV8o2aSQ2NGeOIuSdfiF5QzUxTH88l
MD5:	86737BACC0697CE0B35B38CF3D34D7A3
SHA1:	BF2AF021550EF292F4938FF78A1399227CAECC99
SHA-256:	7A8338FE516313F554B54BAF510508E264DA5E2E10AC3473FBEC61D827FFA540
SHA-512:	D8B0477DB2140834E8D0369154F074A64D01ED015D4D82E1568D5F061FDE095CB960D727AFCFAEE63A9D7877544E0E663B89B2E6D59419D553F255F7B5BE7F12
Malicious:	false
Reputation:	unknown
Preview:	bplist00.................X$versionT$topY$archiverX$objects..........]IB.objectdata.._..NSKeyedArchiver.........1.5.6.<.=.A.E.h.p...........................................................!.".%.-.@.A.M.N.U.V.Y.^.a.i.j.k.n.t.}....................................................................................... .$.)..-.0.3.4.5.8.<.C.G.H.I.J.O.W.\.].o.p.s.v.w.\|.......................................................................................#..+.,.-.2.8.@.G.H.P.Q.\.c.d.k.l.n.o.t.u.z.{...............................................r...........................%.&.8.B.F.G.H.I.O.G.Z.c.G.d.h.k.r.s.z.{.............................................................................................................".#.'.../.0.5.6.;.E.F.G.H.K.T.U.V.W.^._.`.........................................................&...'.+.2.3.5.{................................................. .!.".#.$.%.&.'.(.)..+.,.-.../.0.1.2.3.4.5.6.7.8.9.:.;.<.=.>.?.@.A.B.C.D.E.F.G.H.I.J.K.L.M.P.S...!.".#.$.%.&.'.(.)..+.,

C:\Program Files (x86)\Google\Picasa3\cdautorun\Picasa Restore.app\Contents\Resources\cs.lproj\i18n\restore_resexport.xml

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 text
Category:	dropped
Size (bytes):	2543
Entropy (8bit):	4.994970938188011
Encrypted:	false
SSDEEP:	24:2dRtI0nzDLQun7EvAn+1gRovRAIFvREGDfve9kvPKK5Hvh1EwAEu4sPsNLKn0nj0:c/Dz/VYAJCjR5HP1CRGbO1aFD6tTZRf
MD5:	E2975FC226A963C26D9E80F8AC0D2DF7
SHA1:	3E2142D0F5C1243A95AFD75D83F9A6B223DC094A
SHA-256:	E79ACFC83088F005B90C68FF2044FEA0558CA876327815DAEF2D706B3E5FF827
SHA-512:	850CBB37DCEF28DFEC87B53166313E04E8F3A24F0FE10C580FCA35DDF30051A2A0A6AFBB35DAB4A90B477F7A1F1325AC76C0E46E5E678959610C9A471BC2BD16
Malicious:	false
Reputation:	unknown
Preview:	<?xml version="1.0" encoding="utf-8" ?>.<Win32Res>. <RT_DIALOG>. <res resid="#904">. <dtitle>. <xmbtext>Obnovit ze z.lohy Picasa</xmbtext>. </dtitle>. <dlayout>rect(0 0 296 154)</dlayout>. <item itemid="1" itemtype="Button" layout="rect(177 133 227 147)">. <xmbtext>Dal..</xmbtext>. </item>. <item itemid="2" itemtype="Button" layout="rect(239 133 289 147)">. <xmbtext>Zru.it</xmbtext>. </item>. <item itemid="3" itemtype="Button" layout="rect(7 133 57 147)">. <xmbtext>Vysunout</xmbtext>. </item>. <item itemid="1010" itemtype="Button" layout="rect(25 47 236 59)">. <xmbtext>P.vodn. um.st.n.</xmbtext>. </item>. <item itemid="1011" itemtype="Button" layout="rect(25 83 241 95)">. <xmbtext>Tato slo.ka</xmbtext>. </item>. <item itemid="1009" itemtype="Edit" layout="rect(41 100 221 113)"/>. <item itemid="4" itemtype="Button" layout="rect(227 100 277 114)">. <xmbtext>Zm.nit.</xmbtext>. </item>. <item itemid="-1" itemtype="Button"

C:\Program Files (x86)\Google\Picasa3\cdautorun\Picasa Restore.app\Contents\Resources\cs.lproj\i18n\restore_stringres.xml

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 text
Category:	dropped
Size (bytes):	10027
Entropy (8bit):	4.896373155592107
Encrypted:	false
SSDEEP:	192:9uXcchIneue/tEe9e5+PIcdiuLd/ohc3uXcchIneue/tEe9e5+PIcdiuLd/ohwUs:19KECR9KECyxkCczswXcJ5BI
MD5:	63A1D21C54C3BDEB468FF7DC605E1CB5
SHA1:	EB8A1B2F8F9F76A4F73EEC4350E8F25C808122EC
SHA-256:	A4F869F56BDEC3B431479AFD35E4BA283CFF12F608148FE908C322DAF0171450
SHA-512:	F2659563043DD9AA8BE09EDB5331B6952CA9E9EE1BFAC4F336F003D4A2937FA3F8D1EF637EAC2CB6D8F3C16C45E1E7405916FBB3E587E15C3D73CAC6BA898902
Malicious:	false
Reputation:	unknown
Preview:	<?xml version="1.0" encoding="utf-8" ?>.<resources>. <stringres id="February">. <xmbtext>.nor</xmbtext>. </stringres>. <stringres id="March">. <xmbtext>B.ezen</xmbtext>. </stringres>. <stringres id="April">. <xmbtext>Duben</xmbtext>. </stringres>. <stringres id="May">. <xmbtext>Kv.ten</xmbtext>. </stringres>. <stringres id="June">. <xmbtext>.erven</xmbtext>. </stringres>. <stringres id="July">. <xmbtext>.ervenec</xmbtext>. </stringres>. <stringres id="August">. <xmbtext>Srpen</xmbtext>. </stringres>. <stringres id="September">. <xmbtext>Z...</xmbtext>. </stringres>. <stringres id="October">. <xmbtext>..jen</xmbtext>. </stringres>. <stringres id="November">. <xmbtext>Listopad</xmbtext>. </stringres>. <stringres id="December">. <xmbtext>Prosinec</xmbtext>. </stringres>. <stringres id="Jan">. <xmbtext>Leden</xmbtext>. </stringres>. <stringres id="Feb">. <xmbtext>.nor</xmbtext>. </stringres>. <stringres id="Mar">. <xmbtext>B.ezen</xmbtext>. </stringres>. <stringre

C:\Program Files (x86)\Google\Picasa3\cdautorun\Picasa Restore.app\Contents\Resources\da.lproj\PRMainMenu.nib\classes.nib

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe
File Type:	XML 1.0 document, ASCII text
Category:	dropped
Size (bytes):	1571
Entropy (8bit):	4.883604938493906
Encrypted:	false
SSDEEP:	24:2dfyiwqhtsd551XBeYSjV+NaBFh3gsX4DHLqaemns4:cfyghtc55DeHj3besX4DHZs4
MD5:	AFE57505E88B3C6CD5D7A27ED6539C66
SHA1:	CA6705B7559326C5C60F8A15DFC6751208DD0643
SHA-256:	BC6AF85CB27E3E742EA8E5519483ACA800F0D2C3C469C1E6AF2161CC5BE647F4
SHA-512:	D5EC7CCED627E987028E4EAB5030126D31E105C1EA91616A956D55552F19F2E71A1EA327D4039428959D661A33E4F072B806BA20BFB3CDD2D5EB0DF98CD4466C
Malicious:	false
Reputation:	unknown
Preview:	<?xml version="1.0" encoding="UTF-8"?>.<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">.<plist version="1.0">.<dict>..<key>IBClasses</key>..<array>...<dict>....<key>ACTIONS</key>....<dict>.....<key>cancelPromptForDestinationFolderChoice</key>.....<string>id</string>.....<key>cancelRestoration</key>.....<string>id</string>.....<key>finishPromptForDestinationFolderChoice</key>.....<string>id</string>.....<key>openManifestFile</key>.....<string>id</string>.....<key>openSourceInDefaultApplication</key>.....<string>id</string>.....<key>selectFolderForDestination</key>.....<string>id</string>.....<key>showDestinationInFinder</key>.....<string>id</string>.....<key>showInPreviewApplication</key>.....<string>id</string>.....<key>showSourceInFinder</key>.....<string>id</string>.....<key>startRestoration</key>.....<string>id</string>....</dict>....<key>CLASS</key>....<string>PRAppController</string>....<key>LANGUAGE</key>....<string>ObjC</stri

C:\Program Files (x86)\Google\Picasa3\cdautorun\Picasa Restore.app\Contents\Resources\da.lproj\PRMainMenu.nib\info.nib

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe
File Type:	XML 1.0 document, ASCII text
Category:	dropped
Size (bytes):	530
Entropy (8bit):	5.250472465860794
Encrypted:	false
SSDEEP:	12:TMHdgo+tJVEdQiCXFbCGIfx2w0GeC6mwbn:2dfyiwFrIZ2ZC6pb
MD5:	0E168543FD71A479FA5AD0E0613A1BA5
SHA1:	9ACD86A59CE7EC341021D75817D082118D351C56
SHA-256:	7C87E946FB8E106D8856A962C780503F602FAE5B09A818F5AD3ACDFC6468546A
SHA-512:	DFFAB3A94B1994D3EC558F308729DED11A9759CC6B4C6E0022ECE502AE5D2BB8437211B37549454DDB43CCACF91F0989E61A1C173B4F59FBCFF423BAFBEAC44A
Malicious:	false
Reputation:	unknown
Preview:	<?xml version="1.0" encoding="UTF-8"?>.<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">.<plist version="1.0">.<dict>..<key>IBFramework Version</key>..<string>680</string>..<key>IBLastKnownRelativeProjectPath</key>..<string>../../../Mac/Picasa.xcodeproj</string>..<key>IBOldestOS</key>..<integer>4</integer>..<key>IBOpenObjects</key>..<array/>..<key>IBSystem Version</key>..<string>9L31a</string>..<key>targetFramework</key>..<string>IBCocoaFramework</string>.</dict>.</plist>.

C:\Program Files (x86)\Google\Picasa3\cdautorun\Picasa Restore.app\Contents\Resources\da.lproj\PRMainMenu.nib\keyedobjects.nib

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe
File Type:	Apple binary property list
Category:	dropped
Size (bytes):	22870
Entropy (8bit):	6.93737381610732
Encrypted:	false
SSDEEP:	384:rCioV8vV+/KwNIJr81EshV8sXUrcMIfwTIbzUIX0Z5CuasT7dMdRmrQz6Zc3wDeE:rCioV89+ywmC2AWCDsliU0z6Z8Yiedn
MD5:	EEEFA10E665877988A890D42AC4CB71A
SHA1:	5456FB73F5F865FB1895D74F6853791E5257B7D3
SHA-256:	CE358F4A64966E71160853805591D4250A38ED17CDFB1AA68FC5DB0AB6BD2D82
SHA-512:	708ED61A374CC14B876A47E9925809651C07E4358E9270AF8DC132F21D220D3DD412A988DF8E9821278DD687D4170A38FBFACFD37445300A43B23583AC5DBE25
Malicious:	false
Reputation:	unknown
Preview:	bplist00.................X$versionT$topY$archiverX$objects..........]IB.objectdata.._..NSKeyedArchiver.........1.5.6.<.=.A.E.h.p.~.............................................................................#.$.%..1.2.9.:.;.@.A.F.M.S.T.U.Z.z...............................................................!.".(.)./.9.:.@.A.F.G.J.P.X.Y._.`.f.n.o.u.v.~............................................................................................. .)../.0.3.4.8.?.C.D.E.F.J.Q.R.S.X.l.m.n.o.y....................................................................... .&...1.:...;.?.B.I.J.Q.R.].f.g.h.i.j.k.l.m.w.{.\|......................................................................................................... .!.%.,.-.../.4.5.:.;.E.F.G.H.K.R.S.T.U.^._.`.......................................................!."...+.2.3.5.{................................................. .!.".#.$.%.&.'.(.)..+.,.-.../.0.1.2.3.4.5.6.7.8.9.:.;.<.=.>.?.@.A.B.C.D.E.F.G.H.I.J.K.L.M.P.S...!.".#.$.%.&.'.(.)..+.,.-

C:\Program Files (x86)\Google\Picasa3\cdautorun\Picasa Restore.app\Contents\Resources\da.lproj\i18n\restore_resexport.xml

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 text
Category:	dropped
Size (bytes):	2542
Entropy (8bit):	4.883021898334612
Encrypted:	false
SSDEEP:	48:c/H/V+1AskWBuR5HCDZFw8RiknIu0UTZRf:GfVRskWeiXIknIuTZRf
MD5:	C33935D5A40A5A7842A552DD7681F2E7
SHA1:	E1EF2D165388A4830BD6989E72ED6BD6EDE8A858
SHA-256:	325ECB7E78D8DFF505E15DDBD6BD5BCA44C71208228A963B8729BB62BD63D812
SHA-512:	25A385D9D64F320AF07D1D10EA396200F2BC6FB3E971B4315C33B3F5B74D9E0BBAEDA2847B3711195AEBD4E88DC690B07C83436E85AE64D01E8909CC09C8A2FB
Malicious:	false
Reputation:	unknown
Preview:	<?xml version="1.0" encoding="utf-8" ?>.<Win32Res>. <RT_DIALOG>. <res resid="#904">. <dtitle>. <xmbtext>Gendan fra en Picasa-sikkerhedskopi</xmbtext>. </dtitle>. <dlayout>rect(0 0 296 154)</dlayout>. <item itemid="1" itemtype="Button" layout="rect(177 133 227 147)">. <xmbtext>N.ste</xmbtext>. </item>. <item itemid="2" itemtype="Button" layout="rect(239 133 289 147)">. <xmbtext>Annuller</xmbtext>. </item>. <item itemid="3" itemtype="Button" layout="rect(7 133 57 147)">. <xmbtext>Skub ud</xmbtext>. </item>. <item itemid="1010" itemtype="Button" layout="rect(25 47 236 59)">. <xmbtext>Oprindelige placeringer</xmbtext>. </item>. <item itemid="1011" itemtype="Button" layout="rect(25 83 241 95)">. <xmbtext>Denne mappe</xmbtext>. </item>. <item itemid="1009" itemtype="Edit" layout="rect(41 100 221 113)"/>. <item itemid="4" itemtype="Button" layout="rect(227 100 277 114)">. <xmbtext>Rediger...</xmbtext>. </item>. <item itemid="-1" itemtyp

C:\Program Files (x86)\Google\Picasa3\cdautorun\Picasa Restore.app\Contents\Resources\da.lproj\i18n\restore_stringres.xml

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 text
Category:	dropped
Size (bytes):	9955
Entropy (8bit):	4.798016776675084
Encrypted:	false
SSDEEP:	192:93ABSjpmBCeTe5tEehe9joOB9sFTBsTZoqbS3ABSjpmBCeTe5tEehe9joOB9sFTH:GDCA4ECWc0DCA4ECWcvU7OqVKz
MD5:	AB3A83CFFFE07D2D126A2E1F36E5A6FD
SHA1:	0543E1879D78B9ECDDE1A5906A3FEF473C0CFAD1
SHA-256:	E5AE5AE45FA7B0BF1A3013F7146E011758ED1C9AD705CA501F6BCEF44F3A97D2
SHA-512:	8FFC2FF527B7972BB67E81C22C88587603F6511390309259AF70F72A34472896112E61B38F5D61F27F7CC5A2F1CAC8A682D9E97DED42514000EAB62535A267DE
Malicious:	false
Reputation:	unknown
Preview:	<?xml version="1.0" encoding="utf-8" ?>.<resources>. <stringres id="February">. <xmbtext>Februar</xmbtext>. </stringres>. <stringres id="March">. <xmbtext>Marts</xmbtext>. </stringres>. <stringres id="April">. <xmbtext>April</xmbtext>. </stringres>. <stringres id="May">. <xmbtext>Maj</xmbtext>. </stringres>. <stringres id="June">. <xmbtext>Juni</xmbtext>. </stringres>. <stringres id="July">. <xmbtext>Juli</xmbtext>. </stringres>. <stringres id="August">. <xmbtext>August</xmbtext>. </stringres>. <stringres id="September">. <xmbtext>September</xmbtext>. </stringres>. <stringres id="October">. <xmbtext>Oktober</xmbtext>. </stringres>. <stringres id="November">. <xmbtext>November</xmbtext>. </stringres>. <stringres id="December">. <xmbtext>December</xmbtext>. </stringres>. <stringres id="Jan">. <xmbtext>Jan.</xmbtext>. </stringres>. <stringres id="Feb">. <xmbtext>Feb.</xmbtext>. </stringres>. <stringres id="Mar">. <xmbtext>Mar.</xmbtext>. </stringres>. <stringres id="Apr">.

C:\Program Files (x86)\Google\Picasa3\cdautorun\Picasa Restore.app\Contents\Resources\de.lproj\PRMainMenu.nib\classes.nib

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe
File Type:	XML 1.0 document, ASCII text
Category:	dropped
Size (bytes):	1571
Entropy (8bit):	4.883604938493906
Encrypted:	false
SSDEEP:	24:2dfyiwqhtsd551XBeYSjV+NaBFh3gsX4DHLqaemns4:cfyghtc55DeHj3besX4DHZs4
MD5:	AFE57505E88B3C6CD5D7A27ED6539C66
SHA1:	CA6705B7559326C5C60F8A15DFC6751208DD0643
SHA-256:	BC6AF85CB27E3E742EA8E5519483ACA800F0D2C3C469C1E6AF2161CC5BE647F4
SHA-512:	D5EC7CCED627E987028E4EAB5030126D31E105C1EA91616A956D55552F19F2E71A1EA327D4039428959D661A33E4F072B806BA20BFB3CDD2D5EB0DF98CD4466C
Malicious:	false
Reputation:	unknown
Preview:	<?xml version="1.0" encoding="UTF-8"?>.<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">.<plist version="1.0">.<dict>..<key>IBClasses</key>..<array>...<dict>....<key>ACTIONS</key>....<dict>.....<key>cancelPromptForDestinationFolderChoice</key>.....<string>id</string>.....<key>cancelRestoration</key>.....<string>id</string>.....<key>finishPromptForDestinationFolderChoice</key>.....<string>id</string>.....<key>openManifestFile</key>.....<string>id</string>.....<key>openSourceInDefaultApplication</key>.....<string>id</string>.....<key>selectFolderForDestination</key>.....<string>id</string>.....<key>showDestinationInFinder</key>.....<string>id</string>.....<key>showInPreviewApplication</key>.....<string>id</string>.....<key>showSourceInFinder</key>.....<string>id</string>.....<key>startRestoration</key>.....<string>id</string>....</dict>....<key>CLASS</key>....<string>PRAppController</string>....<key>LANGUAGE</key>....<string>ObjC</stri

C:\Program Files (x86)\Google\Picasa3\cdautorun\Picasa Restore.app\Contents\Resources\de.lproj\PRMainMenu.nib\info.nib

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe
File Type:	XML 1.0 document, ASCII text
Category:	dropped
Size (bytes):	530
Entropy (8bit):	5.250472465860794
Encrypted:	false
SSDEEP:	12:TMHdgo+tJVEdQiCXFbCGIfx2w0GeC6mwbn:2dfyiwFrIZ2ZC6pb
MD5:	0E168543FD71A479FA5AD0E0613A1BA5
SHA1:	9ACD86A59CE7EC341021D75817D082118D351C56
SHA-256:	7C87E946FB8E106D8856A962C780503F602FAE5B09A818F5AD3ACDFC6468546A
SHA-512:	DFFAB3A94B1994D3EC558F308729DED11A9759CC6B4C6E0022ECE502AE5D2BB8437211B37549454DDB43CCACF91F0989E61A1C173B4F59FBCFF423BAFBEAC44A
Malicious:	false
Reputation:	unknown
Preview:	<?xml version="1.0" encoding="UTF-8"?>.<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">.<plist version="1.0">.<dict>..<key>IBFramework Version</key>..<string>680</string>..<key>IBLastKnownRelativeProjectPath</key>..<string>../../../Mac/Picasa.xcodeproj</string>..<key>IBOldestOS</key>..<integer>4</integer>..<key>IBOpenObjects</key>..<array/>..<key>IBSystem Version</key>..<string>9L31a</string>..<key>targetFramework</key>..<string>IBCocoaFramework</string>.</dict>.</plist>.

C:\Program Files (x86)\Google\Picasa3\cdautorun\Picasa Restore.app\Contents\Resources\de.lproj\PRMainMenu.nib\keyedobjects.nib

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe
File Type:	Apple binary property list
Category:	dropped
Size (bytes):	23342
Entropy (8bit):	6.858294287669083
Encrypted:	false
SSDEEP:	384:QgzGoV888w1EBTU1a1vYxaM12sfT1m8rSwjq4wEduAltadkBryC5oF4C7K3VfamH:96oV842yHaQ2mTouOREdfixF4Z3V7x06
MD5:	402440CC360CFE0EB802EE70528CB554
SHA1:	CA03A94909DB37A426D0E349127858744075E958
SHA-256:	E94628A17C6FF7BE07D4F441D8CE12292B55E334123C7693AB9678153429692F
SHA-512:	89A936D1202F460431C9466ADBA50E17FD5D45E3B2CEC644EE74526BC4E0F19A6D8ED4F687492C3F1CF694CE739D05A46EF296AC083CD63DE0BDD8A4C47D9266
Malicious:	false
Reputation:	unknown
Preview:	bplist00.................X$versionT$topY$archiverX$objects..........]IB.objectdata.._..NSKeyedArchiver.........1.5.6.<.=.A.E.h.p...........................................................!.".%.-.@.A.M.N.U.V.Y.^.a.i.j.k.n.t.}....................................................................................... .$.)..-.0.3.4.5.8.<.C.G.H.I.J.O.W.\.].o.p.s.v.w.\|.......................................................................................#..+.,.-.2.8.@.G.H.P.Q.\.c.d.k.l.n.o.t.u.z.{...............................................r...........................%.&.8.B.F.G.H.I.O.G.Z.c.G.d.h.k.r.s.z.{.............................................................................................................".#.'.../.0.5.6.;.E.F.G.H.K.T.U.V.W.^._.`.........................................................&...'.+.2.3.5.{................................................. .!.".#.$.%.&.'.(.)..+.,.-.../.0.1.2.3.4.5.6.7.8.9.:.;.<.=.>.?.@.A.B.C.D.E.F.G.H.I.J.K.L.M.P.S...!.".#.$.%.&.'.(.)..+.,

C:\Program Files (x86)\Google\Picasa3\cdautorun\Picasa Restore.app\Contents\Resources\de.lproj\i18n\restore_resexport.xml

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 text
Category:	dropped
Size (bytes):	2626
Entropy (8bit):	4.8907440476857
Encrypted:	false
SSDEEP:	48:c/KDC/VFAsysvmh2R58cywiTdDgSU7zvONveCmtTZRf:GKKV2syspFSS7zGNKtTZRf
MD5:	11D112A12BAA5A73DFDA43A3BAF65980
SHA1:	6B0D3869CB08F49821FE844B070459972EF80D7F
SHA-256:	25CBC47FDD1D92625D010720BA219FDC5647AB3CE5DF4312D19A20188A6C4402
SHA-512:	366069C365A2A7850D56744BDCDE2820B6FEBBEB4F887A504314C4B0AD1E6EE559B477DD0F75609CC079F83A93A01D34B09F390CDB490EB96ADD7E1F4D4AC177
Malicious:	false
Reputation:	unknown
Preview:	<?xml version="1.0" encoding="utf-8" ?>.<Win32Res>. <RT_DIALOG>. <res resid="#904">. <dtitle>. <xmbtext>Aus Picasa-Sicherung wiederherstellen</xmbtext>. </dtitle>. <dlayout>rect(0 0 296 154)</dlayout>. <item itemid="1" itemtype="Button" layout="rect(177 133 227 147)">. <xmbtext>Weiter</xmbtext>. </item>. <item itemid="2" itemtype="Button" layout="rect(239 133 289 147)">. <xmbtext>Abbrechen</xmbtext>. </item>. <item itemid="3" itemtype="Button" layout="rect(7 133 57 147)">. <xmbtext>Auswerfen</xmbtext>. </item>. <item itemid="1010" itemtype="Button" layout="rect(25 47 236 59)">. <xmbtext>Urspr.ngliche Speicherorte</xmbtext>. </item>. <item itemid="1011" itemtype="Button" layout="rect(25 83 241 95)">. <xmbtext>Dieser Ordner</xmbtext>. </item>. <item itemid="1009" itemtype="Edit" layout="rect(41 100 221 113)"/>. <item itemid="4" itemtype="Button" layout="rect(227 100 277 114)">. <xmbtext>.ndern.</xmbtext>. </item>. <item itemid="

C:\Program Files (x86)\Google\Picasa3\cdautorun\Picasa Restore.app\Contents\Resources\de.lproj\i18n\restore_stringres.xml

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 text
Category:	dropped
Size (bytes):	10121
Entropy (8bit):	4.808450740867083
Encrypted:	false
SSDEEP:	192:93DBSapmBCeTe5tEehefejoMB9vKUBsTZoqES3DBSapmBCeTe5tEehefejoMB9vN:nMCA4ECcmliMCA4ECcml8+9alK3ORnlg
MD5:	8F8E361532FF6C4E10E9EBBE75828533
SHA1:	9C9EEE055B6CA2B7BE050B5D437FDD6F0A06F5E3
SHA-256:	0F325F8458CEE35618D0C5535B197C3B1B9E99E68BA8266E5B3E7F1FA1F4E65C
SHA-512:	FAF73C65C6D97D5C3274BD73BD2BA6FA0A5DE72E11BB85D19E85740D5B09771B1036796F9443E42D1A0D2151A017514C370F6AF01C40B56C4A1A2B85B5623E27
Malicious:	false
Reputation:	unknown
Preview:	<?xml version="1.0" encoding="utf-8" ?>.<resources>. <stringres id="February">. <xmbtext>Februar</xmbtext>. </stringres>. <stringres id="March">. <xmbtext>M.rz</xmbtext>. </stringres>. <stringres id="April">. <xmbtext>April</xmbtext>. </stringres>. <stringres id="May">. <xmbtext>Mai</xmbtext>. </stringres>. <stringres id="June">. <xmbtext>Juni</xmbtext>. </stringres>. <stringres id="July">. <xmbtext>Juli</xmbtext>. </stringres>. <stringres id="August">. <xmbtext>August</xmbtext>. </stringres>. <stringres id="September">. <xmbtext>September</xmbtext>. </stringres>. <stringres id="October">. <xmbtext>Oktober</xmbtext>. </stringres>. <stringres id="November">. <xmbtext>November</xmbtext>. </stringres>. <stringres id="December">. <xmbtext>Dezember</xmbtext>. </stringres>. <stringres id="Jan">. <xmbtext>Jan.</xmbtext>. </stringres>. <stringres id="Feb">. <xmbtext>Feb.</xmbtext>. </stringres>. <stringres id="Mar">. <xmbtext>M.rz</xmbtext>. </stringres>. <stringres id="Apr">.

C:\Program Files (x86)\Google\Picasa3\cdautorun\Picasa Restore.app\Contents\Resources\el.lproj\PRMainMenu.nib\classes.nib

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe
File Type:	XML 1.0 document, ASCII text
Category:	dropped
Size (bytes):	1571
Entropy (8bit):	4.883604938493906
Encrypted:	false
SSDEEP:	24:2dfyiwqhtsd551XBeYSjV+NaBFh3gsX4DHLqaemns4:cfyghtc55DeHj3besX4DHZs4
MD5:	AFE57505E88B3C6CD5D7A27ED6539C66
SHA1:	CA6705B7559326C5C60F8A15DFC6751208DD0643
SHA-256:	BC6AF85CB27E3E742EA8E5519483ACA800F0D2C3C469C1E6AF2161CC5BE647F4
SHA-512:	D5EC7CCED627E987028E4EAB5030126D31E105C1EA91616A956D55552F19F2E71A1EA327D4039428959D661A33E4F072B806BA20BFB3CDD2D5EB0DF98CD4466C
Malicious:	false
Reputation:	unknown
Preview:	<?xml version="1.0" encoding="UTF-8"?>.<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">.<plist version="1.0">.<dict>..<key>IBClasses</key>..<array>...<dict>....<key>ACTIONS</key>....<dict>.....<key>cancelPromptForDestinationFolderChoice</key>.....<string>id</string>.....<key>cancelRestoration</key>.....<string>id</string>.....<key>finishPromptForDestinationFolderChoice</key>.....<string>id</string>.....<key>openManifestFile</key>.....<string>id</string>.....<key>openSourceInDefaultApplication</key>.....<string>id</string>.....<key>selectFolderForDestination</key>.....<string>id</string>.....<key>showDestinationInFinder</key>.....<string>id</string>.....<key>showInPreviewApplication</key>.....<string>id</string>.....<key>showSourceInFinder</key>.....<string>id</string>.....<key>startRestoration</key>.....<string>id</string>....</dict>....<key>CLASS</key>....<string>PRAppController</string>....<key>LANGUAGE</key>....<string>ObjC</stri

C:\Program Files (x86)\Google\Picasa3\cdautorun\Picasa Restore.app\Contents\Resources\el.lproj\PRMainMenu.nib\info.nib

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe
File Type:	XML 1.0 document, ASCII text
Category:	dropped
Size (bytes):	530
Entropy (8bit):	5.250472465860794
Encrypted:	false
SSDEEP:	12:TMHdgo+tJVEdQiCXFbCGIfx2w0GeC6mwbn:2dfyiwFrIZ2ZC6pb
MD5:	0E168543FD71A479FA5AD0E0613A1BA5
SHA1:	9ACD86A59CE7EC341021D75817D082118D351C56
SHA-256:	7C87E946FB8E106D8856A962C780503F602FAE5B09A818F5AD3ACDFC6468546A
SHA-512:	DFFAB3A94B1994D3EC558F308729DED11A9759CC6B4C6E0022ECE502AE5D2BB8437211B37549454DDB43CCACF91F0989E61A1C173B4F59FBCFF423BAFBEAC44A
Malicious:	false
Reputation:	unknown
Preview:	<?xml version="1.0" encoding="UTF-8"?>.<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">.<plist version="1.0">.<dict>..<key>IBFramework Version</key>..<string>680</string>..<key>IBLastKnownRelativeProjectPath</key>..<string>../../../Mac/Picasa.xcodeproj</string>..<key>IBOldestOS</key>..<integer>4</integer>..<key>IBOpenObjects</key>..<array/>..<key>IBSystem Version</key>..<string>9L31a</string>..<key>targetFramework</key>..<string>IBCocoaFramework</string>.</dict>.</plist>.

C:\Program Files (x86)\Google\Picasa3\cdautorun\Picasa Restore.app\Contents\Resources\el.lproj\PRMainMenu.nib\keyedobjects.nib

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe
File Type:	Apple binary property list
Category:	dropped
Size (bytes):	24725
Entropy (8bit):	6.868554301413276
Encrypted:	false
SSDEEP:	384:VgzhBV8N8Z1EBTm1a1v/oM1267oj6Flyt/8zduAlta2ukfrNC1fm1YhGoeXPu1cf:OVBV8E24LQ2675Kkdfihm1YHy0G
MD5:	6DA207E5D80A1AC4751C1B7962E178BB
SHA1:	3F56BE3E076A0599E6C3DE580FF1DF3AA59F8DB7
SHA-256:	66386FB94939786CA0146DE5CE038F00F8413D229DCD5DFBC2D3CB109E24D14D
SHA-512:	34D58D2F594DDFD225B6E0F038D83106168159D7F5126D97475FED7E30C14AEA374A5D39E30EB436BCD45F0425393C28878C3809ACE993B75A8DD0E297F9D68A
Malicious:	false
Reputation:	unknown
Preview:	bplist00.................X$versionT$topY$archiverX$objects..........]IB.objectdata.._..NSKeyedArchiver.........1.5.6.<.=.A.E.h.p...........................................................!.".%.-.@.A.M.N.U.V.Y.^.a.i.j.k.n.t.}....................................................................................... .$.)..-.0.3.4.5.8.<.C.G.H.I.J.O.W.\.].o.p.s.v.w.\|.......................................................................................#..+.,.-.2.8.@.G.H.P.Q.\.c.d.k.l.n.o.t.u.z.{...............................................r...........................%.&.8.B.F.G.H.I.O.G.Z.c.G.d.h.k.r.s.z.{.............................................................................................................".#.'.../.0.5.6.;.E.F.G.H.K.T.U.V.W.^._.`...........................................................'...(.,.3.4.6.\|............................................... .!.".#.$.%.&.'.(.)..+.,.-.../.0.1.2.3.4.5.6.7.8.9.:.;.<.=.>.?.@.A.B.C.D.E.F.G.H.I.J.K.L.M.N.Q.T...".#.$.%.&.'.(.)..+.,

C:\Program Files (x86)\Google\Picasa3\cdautorun\Picasa Restore.app\Contents\Resources\el.lproj\i18n\restore_resexport.xml

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 text
Category:	dropped
Size (bytes):	2951
Entropy (8bit):	5.266202396286038
Encrypted:	false
SSDEEP:	48:c/bz/VTAdV9kR5ZCrIbQNTxtVub9L8yEJZTZRf:G3V03AZCs8NltVly2TZRf
MD5:	E4D13D1912F21677C96A43F21824E8CB
SHA1:	2739567059FE9180101AF159E4F59AB00369C6D2
SHA-256:	B7D27B7B54E388D3DB5FAAD00058F6C7EB638C95DB72A5F3F15CA08499F51411
SHA-512:	DB6E26C8BE354560916F00CA3365E8C7EAC8326F91EE85379F93895E600EC4D0DC1F801EB2E593A4372ABFCEF986C7B9BB2252085DCAF4E5F60585523AD05795
Malicious:	false
Reputation:	unknown
Preview:	<?xml version="1.0" encoding="utf-8" ?>.<Win32Res>. <RT_DIALOG>. <res resid="#904">. <dtitle>. <xmbtext>........ ... ......... ......... ... Picasa</xmbtext>. </dtitle>. <dlayout>rect(0 0 296 154)</dlayout>. <item itemid="1" itemtype="Button" layout="rect(177 133 227 147)">. <xmbtext>.......</xmbtext>. </item>. <item itemid="2" itemtype="Button" layout="rect(239 133 289 147)">. <xmbtext>.......</xmbtext>. </item>. <item itemid="3" itemtype="Button" layout="rect(7 133 57 147)">. <xmbtext>.......</xmbtext>. </item>. <item itemid="1010" itemtype="Button" layout="rect(25 47 236 59)">. <xmbtext>....... ..........</xmbtext>. </item>. <item itemid="1011" itemtype="Button" layout="rect(25 83 241 95)">. <xmbtext>..... . .......</xmbtext>. </item>. <item itemid="1009" itemtype="Edit" layout="rect(41 100 221 113)"/>. <item itemid="4" itemtype="Button" layout="rect(22

C:\Program Files (x86)\Google\Picasa3\cdautorun\Picasa Restore.app\Contents\Resources\el.lproj\i18n\restore_stringres.xml

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 text
Category:	dropped
Size (bytes):	11452
Entropy (8bit):	5.259383618080336
Encrypted:	false
SSDEEP:	192:9HbPYNaleQe7tEeJeJ7wyIpPFfhHo08CHbPYNaleQe7tEeJeJ7wyIpPFfhHo0QUU:bZYE2dZYE2Ks6GOK/g5H
MD5:	7CB7B4AE3E3CBC1D7FC608E0C456A0C7
SHA1:	D8EEC2886B6C8A137326135EB61648BA3EE29817
SHA-256:	381BB888C03C22EE0D525A13553F8C1ECD7A3BD9AEA75F983E495B8FF17E44F6
SHA-512:	5B42122F14FBECB23C784D5FAAF163D0C4BBEC5BB9B6F4DA76726B059D5AB7E3931C98525786EA4ED182FDDFD2367F01952298AC9C8C72DA7F6BB6F0BED8C47D
Malicious:	false
Reputation:	unknown
Preview:	<?xml version="1.0" encoding="utf-8" ?>.<resources>. <stringres id="February">. <xmbtext>...........</xmbtext>. </stringres>. <stringres id="March">. <xmbtext>.......</xmbtext>. </stringres>. <stringres id="April">. <xmbtext>........</xmbtext>. </stringres>. <stringres id="May">. <xmbtext>.....</xmbtext>. </stringres>. <stringres id="June">. <xmbtext>.......</xmbtext>. </stringres>. <stringres id="July">. <xmbtext>.......</xmbtext>. </stringres>. <stringres id="August">. <xmbtext>.........</xmbtext>. </stringres>. <stringres id="September">. <xmbtext>...........</xmbtext>. </stringres>. <stringres id="October">. <xmbtext>.........</xmbtext>. </stringres>. <stringres id="November">. <xmbtext>.........</xmbtext>. </stringres>. <stringres id="December">. <xmbtext>..........</xmbtext>. </stringres>. <stringres id="Jan">. <xmbtext>....</xmbtext>. </stringres>. <stringres id="Feb">. <

C:\Program Files (x86)\Google\Picasa3\cdautorun\Picasa Restore.app\Contents\Resources\en_GB.lproj\PRMainMenu.nib\classes.nib

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe
File Type:	XML 1.0 document, ASCII text
Category:	dropped
Size (bytes):	1571
Entropy (8bit):	4.883604938493906
Encrypted:	false
SSDEEP:	24:2dfyiwqhtsd551XBeYSjV+NaBFh3gsX4DHLqaemns4:cfyghtc55DeHj3besX4DHZs4
MD5:	AFE57505E88B3C6CD5D7A27ED6539C66
SHA1:	CA6705B7559326C5C60F8A15DFC6751208DD0643
SHA-256:	BC6AF85CB27E3E742EA8E5519483ACA800F0D2C3C469C1E6AF2161CC5BE647F4
SHA-512:	D5EC7CCED627E987028E4EAB5030126D31E105C1EA91616A956D55552F19F2E71A1EA327D4039428959D661A33E4F072B806BA20BFB3CDD2D5EB0DF98CD4466C
Malicious:	false
Reputation:	unknown
Preview:	<?xml version="1.0" encoding="UTF-8"?>.<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">.<plist version="1.0">.<dict>..<key>IBClasses</key>..<array>...<dict>....<key>ACTIONS</key>....<dict>.....<key>cancelPromptForDestinationFolderChoice</key>.....<string>id</string>.....<key>cancelRestoration</key>.....<string>id</string>.....<key>finishPromptForDestinationFolderChoice</key>.....<string>id</string>.....<key>openManifestFile</key>.....<string>id</string>.....<key>openSourceInDefaultApplication</key>.....<string>id</string>.....<key>selectFolderForDestination</key>.....<string>id</string>.....<key>showDestinationInFinder</key>.....<string>id</string>.....<key>showInPreviewApplication</key>.....<string>id</string>.....<key>showSourceInFinder</key>.....<string>id</string>.....<key>startRestoration</key>.....<string>id</string>....</dict>....<key>CLASS</key>....<string>PRAppController</string>....<key>LANGUAGE</key>....<string>ObjC</stri

C:\Program Files (x86)\Google\Picasa3\cdautorun\Picasa Restore.app\Contents\Resources\en_GB.lproj\PRMainMenu.nib\info.nib

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe
File Type:	XML 1.0 document, ASCII text
Category:	dropped
Size (bytes):	530
Entropy (8bit):	5.250472465860794
Encrypted:	false
SSDEEP:	12:TMHdgo+tJVEdQiCXFbCGIfx2w0GeC6mwbn:2dfyiwFrIZ2ZC6pb
MD5:	0E168543FD71A479FA5AD0E0613A1BA5
SHA1:	9ACD86A59CE7EC341021D75817D082118D351C56
SHA-256:	7C87E946FB8E106D8856A962C780503F602FAE5B09A818F5AD3ACDFC6468546A
SHA-512:	DFFAB3A94B1994D3EC558F308729DED11A9759CC6B4C6E0022ECE502AE5D2BB8437211B37549454DDB43CCACF91F0989E61A1C173B4F59FBCFF423BAFBEAC44A
Malicious:	false
Reputation:	unknown
Preview:	<?xml version="1.0" encoding="UTF-8"?>.<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">.<plist version="1.0">.<dict>..<key>IBFramework Version</key>..<string>680</string>..<key>IBLastKnownRelativeProjectPath</key>..<string>../../../Mac/Picasa.xcodeproj</string>..<key>IBOldestOS</key>..<integer>4</integer>..<key>IBOpenObjects</key>..<array/>..<key>IBSystem Version</key>..<string>9L31a</string>..<key>targetFramework</key>..<string>IBCocoaFramework</string>.</dict>.</plist>.

C:\Program Files (x86)\Google\Picasa3\cdautorun\Picasa Restore.app\Contents\Resources\en_GB.lproj\PRMainMenu.nib\keyedobjects.nib

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe
File Type:	Apple binary property list
Category:	dropped
Size (bytes):	22376
Entropy (8bit):	6.981069818086069
Encrypted:	false
SSDEEP:	384:04V88orw+RsRsH1EYO5p/T50a/8ja7HszCr+oMNveuPwkgiJLSA1t66b4+YUcll9:04V8Zw+RfH2PX1/8ja7MzCr+oMpeIwkI
MD5:	E77E1A2D5D7F602F5854E5F312D0A818
SHA1:	1CDA1855D21C53CC630422D8D277057D472708FC
SHA-256:	1287843DADA97713E92B26648F1EB8E3AC51245D0B73CAA935B83895DF150776
SHA-512:	33ABE15290BC22AE59682EDB34F8B357A20951A730260CBC69BC10BDAB5FAFA76D97C3FC493A6992DF67AFD873BEFB528B23A18AB98D261814C3644D6CEEC79F
Malicious:	false
Reputation:	unknown
Preview:	bplist00.................X$versionT$topY$archiverX$objects..........]IB.objectdata.._..NSKeyedArchiver.........1.5.6.<.=.A.E.h.n.~.....................................................................................!.)..+.0.1.6.=.B.C.J.K.L.Q.q.......................................................................%./.0.6.7.<.=.@.F.N.O.U.V.\.d.e.k.l.t.\|.........................................................................................#.$.%.(.0.1...5.6.9.A.B.K.L.Q.R.U.a.c.f.g.j.k.m.n.o.p.s.t.y.z.~.............................................................................$.%..7.8.<.=.<.A.D.N...O.P...Q.X.Y.\.c.d.l.m.q.x.y...................................................................m.n.............".#.'...2.3.4.5.:.D.E.F.G.J.S.T.U.V.].^._.........................................................#.,...-.1.2.4.z................................................... .!.".#.$.%.&.'.(.)..+.,.-.../.0.1.2.3.4.5.6.7.8.9.:.;.<.=.>.?.@.A.B.C.D.E.F.G.H.I.J.K.L.O.R... .!.".#.$.%.&.'.(.)..+

C:\Program Files (x86)\Google\Picasa3\cdautorun\Picasa Restore.app\Contents\Resources\en_GB.lproj\i18n\restore_resexport.xml

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe
File Type:	XML 1.0 document, ASCII text
Category:	dropped
Size (bytes):	2500
Entropy (8bit):	4.8537743887046005
Encrypted:	false
SSDEEP:	24:2dRtvIzDLQuM67EvA61gq6ov9JFvREGDtIe9kv/KJnHruEwAEu4sBoLKRojvj7EY:c/e/VcAlG97R5Ye7ADXqgn+mTZRf
MD5:	68F8FEF370EFF8699B1FAA4021AE09DE
SHA1:	53E7F5D8C3392191371678BBCE79D757CF2B719B
SHA-256:	A1896738D9646F0715D58EEA081CD9B1A27009430B059A5F8FC80FCCC4DAF981
SHA-512:	9ABD5D5A8622F26093A43644AD15803D66835763E7DEE0317762DCAF08D464A835CE79CD96C473EE050C6069C263A6D6BFAE70B01C605B026BE1248D46907414
Malicious:	false
Reputation:	unknown
Preview:	<?xml version="1.0" encoding="utf-8" ?>.<Win32Res>. <RT_DIALOG>. <res resid="#904">. <dtitle>. <xmbtext>Restore from a Picasa backup</xmbtext>. </dtitle>. <dlayout>rect(0 0 296 154)</dlayout>. <item itemid="1" itemtype="Button" layout="rect(177 133 227 147)">. <xmbtext>Next</xmbtext>. </item>. <item itemid="2" itemtype="Button" layout="rect(239 133 289 147)">. <xmbtext>Cancel</xmbtext>. </item>. <item itemid="3" itemtype="Button" layout="rect(7 133 57 147)">. <xmbtext>Eject</xmbtext>. </item>. <item itemid="1010" itemtype="Button" layout="rect(25 47 236 59)">. <xmbtext>Original locations</xmbtext>. </item>. <item itemid="1011" itemtype="Button" layout="rect(25 83 241 95)">. <xmbtext>This folder</xmbtext>. </item>. <item itemid="1009" itemtype="Edit" layout="rect(41 100 221 113)"/>. <item itemid="4" itemtype="Button" layout="rect(227 100 277 114)">. <xmbtext>Change...</xmbtext>. </item>. <item itemid="-1" itemtype="Button" layout="

C:\Program Files (x86)\Google\Picasa3\cdautorun\Picasa Restore.app\Contents\Resources\en_GB.lproj\i18n\restore_stringres.xml

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe
File Type:	XML 1.0 document, ASCII text
Category:	dropped
Size (bytes):	9839
Entropy (8bit):	4.775069613166302
Encrypted:	false
SSDEEP:	192:9w6BSKl2BCeTehtEehe9/8YBZ/BnBg5/oeNHw6BSKl2BCeTehtEehe9/8YBZ/Bnj:3oCAAECwZ6oCAAECwZen/fOEby
MD5:	2CED46594F1F2DF3570F47FA318F5B30
SHA1:	8ECE145F747620B59874C5F4A31FC8868B58DB9B
SHA-256:	CD7460FAB031B5E3954E2B1871734395D74AE4C70E4DAEE7BC90484CB6F1C084
SHA-512:	1E787B0A9F42A69CAF3628D210C08733C1EFA1974FEE1DD2118367E153478DC19EB529785E3C0FFB475D22B1DA70891950DAB3C6955C49556F912E3FB718E18F
Malicious:	false
Reputation:	unknown
Preview:	<?xml version="1.0" encoding="utf-8" ?>.<resources>. <stringres id="February">. <xmbtext>February</xmbtext>. </stringres>. <stringres id="March">. <xmbtext>March</xmbtext>. </stringres>. <stringres id="April">. <xmbtext>April</xmbtext>. </stringres>. <stringres id="May">. <xmbtext>May</xmbtext>. </stringres>. <stringres id="June">. <xmbtext>June</xmbtext>. </stringres>. <stringres id="July">. <xmbtext>July</xmbtext>. </stringres>. <stringres id="August">. <xmbtext>August</xmbtext>. </stringres>. <stringres id="September">. <xmbtext>September</xmbtext>. </stringres>. <stringres id="October">. <xmbtext>October</xmbtext>. </stringres>. <stringres id="November">. <xmbtext>November</xmbtext>. </stringres>. <stringres id="December">. <xmbtext>December</xmbtext>. </stringres>. <stringres id="Jan">. <xmbtext>Jan</xmbtext>. </stringres>. <stringres id="Feb">. <xmbtext>Feb</xmbtext>. </stringres>. <stringres id="Mar">. <xmbtext>Mar</xmbtext>. </stringres>. <stringres id="Apr">. <x

C:\Program Files (x86)\Google\Picasa3\cdautorun\Picasa Restore.app\Contents\Resources\es.lproj\PRMainMenu.nib\classes.nib

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe
File Type:	XML 1.0 document, ASCII text
Category:	dropped
Size (bytes):	1571
Entropy (8bit):	4.883604938493906
Encrypted:	false
SSDEEP:	24:2dfyiwqhtsd551XBeYSjV+NaBFh3gsX4DHLqaemns4:cfyghtc55DeHj3besX4DHZs4
MD5:	AFE57505E88B3C6CD5D7A27ED6539C66
SHA1:	CA6705B7559326C5C60F8A15DFC6751208DD0643
SHA-256:	BC6AF85CB27E3E742EA8E5519483ACA800F0D2C3C469C1E6AF2161CC5BE647F4
SHA-512:	D5EC7CCED627E987028E4EAB5030126D31E105C1EA91616A956D55552F19F2E71A1EA327D4039428959D661A33E4F072B806BA20BFB3CDD2D5EB0DF98CD4466C
Malicious:	false
Reputation:	unknown
Preview:	<?xml version="1.0" encoding="UTF-8"?>.<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">.<plist version="1.0">.<dict>..<key>IBClasses</key>..<array>...<dict>....<key>ACTIONS</key>....<dict>.....<key>cancelPromptForDestinationFolderChoice</key>.....<string>id</string>.....<key>cancelRestoration</key>.....<string>id</string>.....<key>finishPromptForDestinationFolderChoice</key>.....<string>id</string>.....<key>openManifestFile</key>.....<string>id</string>.....<key>openSourceInDefaultApplication</key>.....<string>id</string>.....<key>selectFolderForDestination</key>.....<string>id</string>.....<key>showDestinationInFinder</key>.....<string>id</string>.....<key>showInPreviewApplication</key>.....<string>id</string>.....<key>showSourceInFinder</key>.....<string>id</string>.....<key>startRestoration</key>.....<string>id</string>....</dict>....<key>CLASS</key>....<string>PRAppController</string>....<key>LANGUAGE</key>....<string>ObjC</stri

C:\Program Files (x86)\Google\Picasa3\cdautorun\Picasa Restore.app\Contents\Resources\es.lproj\PRMainMenu.nib\info.nib

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe
File Type:	XML 1.0 document, ASCII text
Category:	dropped
Size (bytes):	530
Entropy (8bit):	5.250472465860794
Encrypted:	false
SSDEEP:	12:TMHdgo+tJVEdQiCXFbCGIfx2w0GeC6mwbn:2dfyiwFrIZ2ZC6pb
MD5:	0E168543FD71A479FA5AD0E0613A1BA5
SHA1:	9ACD86A59CE7EC341021D75817D082118D351C56
SHA-256:	7C87E946FB8E106D8856A962C780503F602FAE5B09A818F5AD3ACDFC6468546A
SHA-512:	DFFAB3A94B1994D3EC558F308729DED11A9759CC6B4C6E0022ECE502AE5D2BB8437211B37549454DDB43CCACF91F0989E61A1C173B4F59FBCFF423BAFBEAC44A
Malicious:	false
Reputation:	unknown
Preview:	<?xml version="1.0" encoding="UTF-8"?>.<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">.<plist version="1.0">.<dict>..<key>IBFramework Version</key>..<string>680</string>..<key>IBLastKnownRelativeProjectPath</key>..<string>../../../Mac/Picasa.xcodeproj</string>..<key>IBOldestOS</key>..<integer>4</integer>..<key>IBOpenObjects</key>..<array/>..<key>IBSystem Version</key>..<string>9L31a</string>..<key>targetFramework</key>..<string>IBCocoaFramework</string>.</dict>.</plist>.

C:\Program Files (x86)\Google\Picasa3\cdautorun\Picasa Restore.app\Contents\Resources\es.lproj\PRMainMenu.nib\keyedobjects.nib

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe
File Type:	Apple binary property list
Category:	dropped
Size (bytes):	23190
Entropy (8bit):	6.892517368074783
Encrypted:	false
SSDEEP:	384:/gz5oV8v8G1EBTF1a1vYfc12IUzmXtr/gX8duAltaCker/C1UCRgV2cp97psbhMY:odoV8b2vPg2IUyFK8dfiUCRgBbdEmy3
MD5:	C69AA0D4B004C3D2374B65E20383EF72
SHA1:	F5E65E7446513356170942C0EDBFC12F7987765C
SHA-256:	64182014EB2577519A439EE4C59398F3FDCAF745768F4B55BEA1CEFD71D21DAD
SHA-512:	ED6F30888CD4BA1DF08161FDC91CBBE94DB8AC4ED1C455BAED321FB252F625260CFD9D763BD3FE43AC9C6ABB2389317D6D2A5E4348E3C3213E0E9A00B1EE65D2
Malicious:	false
Reputation:	unknown
Preview:	bplist00.................X$versionT$topY$archiverX$objects..........]IB.objectdata.._..NSKeyedArchiver.........1.5.6.<.=.A.E.h.p...........................................................!.".%.-.@.A.M.N.U.V.Y.^.a.i.j.k.n.t.}....................................................................................... .$.)..-.0.3.4.5.8.<.C.G.H.I.J.O.W.\.].o.p.s.v.w.\|.......................................................................................#..+.,.-.2.8.@.G.H.P.Q.\.c.d.k.l.n.o.t.u.z.{...............................................r...........................%.&.8.B.F.G.H.I.O.G.Z.c.G.d.h.k.r.s.z.{.............................................................................................................".#.'.../.0.5.6.;.E.F.G.H.K.T.U.V.W.^._.`.......................................................&...'.+.2.3.5.{................................................. .!.".#.$.%.&.'.(.)..+.,.-.../.0.1.2.3.4.5.6.7.8.9.:.;.<.=.>.?.@.A.B.C.D.E.F.G.H.I.J.K.L.M.P.S...!.".#.$.%.&.'.(.)..+.,.-

C:\Program Files (x86)\Google\Picasa3\cdautorun\Picasa Restore.app\Contents\Resources\es.lproj\i18n\restore_resexport.xml

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 text
Category:	dropped
Size (bytes):	2632
Entropy (8bit):	4.848520483069766
Encrypted:	false
SSDEEP:	48:c/Xz/VU1Aqd0R59dCABgJCUTEPblSBs0Rf:GLVTqcraYxSy0Rf
MD5:	66C5BA0EA055252E09B81BA239AB5F78
SHA1:	4DAB32844E26328900C064273CC4E951299784B0
SHA-256:	C549983A294830EA060D5BFD8CE9B972E8E9A478C6F9C8B81A6CFCEEB1E86CD1
SHA-512:	4BE34AE37B59A1025196E9401B1058EB84E5682110708883FA3FF8156911742C4EE80CBA0BF2FC650D71F479054DB494BDBE65748389D39D7AF2AE0ED64F3C34
Malicious:	false
Reputation:	unknown
Preview:	<?xml version="1.0" encoding="utf-8" ?>.<Win32Res>. <RT_DIALOG>. <res resid="#904">. <dtitle>. <xmbtext>Restaurar a partir de la copia de seguridad de Picasa</xmbtext>. </dtitle>. <dlayout>rect(0 0 296 154)</dlayout>. <item itemid="1" itemtype="Button" layout="rect(177 133 227 147)">. <xmbtext>Siguiente</xmbtext>. </item>. <item itemid="2" itemtype="Button" layout="rect(239 133 289 147)">. <xmbtext>Cancelar</xmbtext>. </item>. <item itemid="3" itemtype="Button" layout="rect(7 133 57 147)">. <xmbtext>Expulsar</xmbtext>. </item>. <item itemid="1010" itemtype="Button" layout="rect(25 47 236 59)">. <xmbtext>Ubicaciones originales</xmbtext>. </item>. <item itemid="1011" itemtype="Button" layout="rect(25 83 241 95)">. <xmbtext>Esta carpeta</xmbtext>. </item>. <item itemid="1009" itemtype="Edit" layout="rect(41 100 221 113)"/>. <item itemid="4" itemtype="Button" layout="rect(227 100 277 114)">. <xmbtext>Cambiar...</xmbtext>. </item>. <it

C:\Program Files (x86)\Google\Picasa3\cdautorun\Picasa Restore.app\Contents\Resources\es.lproj\i18n\restore_stringres.xml

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 text
Category:	dropped
Size (bytes):	10063
Entropy (8bit):	4.793558521719824
Encrypted:	false
SSDEEP:	192:9PqB4pI/BgeOeltEewekW8YBHeBnBq5/oeBv8PqB4pI/BgeOeltEewekW8YBHeBO:MpgPMEtUAE3pgPMEtUAOOWOq/v+sv1zN
MD5:	05E09295AC4AAC3A56D214B81802728D
SHA1:	61FC06906BF8375AF706A8D3E60E423724A97070
SHA-256:	68F7AE6FA077651BE05E542BF17478106950711B9C42D00E7E5FFBE4E735420A
SHA-512:	04999103E8C942C8D5CBF85A22EA877388393F5B325A0AD7222F0E1D58F9C7C082EA11FDA8921FCD70051945D9068FC7D16A2563CD906EA25032FE3996DF3A6B
Malicious:	false
Reputation:	unknown
Preview:	<?xml version="1.0" encoding="utf-8" ?>.<resources>. <stringres id="February">. <xmbtext>Febrero</xmbtext>. </stringres>. <stringres id="March">. <xmbtext>Marzo</xmbtext>. </stringres>. <stringres id="April">. <xmbtext>Abril</xmbtext>. </stringres>. <stringres id="May">. <xmbtext>Mayo</xmbtext>. </stringres>. <stringres id="June">. <xmbtext>Junio</xmbtext>. </stringres>. <stringres id="July">. <xmbtext>Julio</xmbtext>. </stringres>. <stringres id="August">. <xmbtext>Agosto</xmbtext>. </stringres>. <stringres id="September">. <xmbtext>Septiembre</xmbtext>. </stringres>. <stringres id="October">. <xmbtext>Octubre</xmbtext>. </stringres>. <stringres id="November">. <xmbtext>Noviembre</xmbtext>. </stringres>. <stringres id="December">. <xmbtext>Diciembre</xmbtext>. </stringres>. <stringres id="Jan">. <xmbtext>Ene</xmbtext>. </stringres>. <stringres id="Feb">. <xmbtext>Feb</xmbtext>. </stringres>. <stringres id="Mar">. <xmbtext>Mar</xmbtext>. </stringres>. <stringres id="Apr">

C:\Program Files (x86)\Google\Picasa3\cdautorun\Picasa Restore.app\Contents\Resources\fi.lproj\PRMainMenu.nib\classes.nib

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe
File Type:	XML 1.0 document, ASCII text
Category:	dropped
Size (bytes):	1571
Entropy (8bit):	4.883604938493906
Encrypted:	false
SSDEEP:	24:2dfyiwqhtsd551XBeYSjV+NaBFh3gsX4DHLqaemns4:cfyghtc55DeHj3besX4DHZs4
MD5:	AFE57505E88B3C6CD5D7A27ED6539C66
SHA1:	CA6705B7559326C5C60F8A15DFC6751208DD0643
SHA-256:	BC6AF85CB27E3E742EA8E5519483ACA800F0D2C3C469C1E6AF2161CC5BE647F4
SHA-512:	D5EC7CCED627E987028E4EAB5030126D31E105C1EA91616A956D55552F19F2E71A1EA327D4039428959D661A33E4F072B806BA20BFB3CDD2D5EB0DF98CD4466C
Malicious:	false
Reputation:	unknown
Preview:	<?xml version="1.0" encoding="UTF-8"?>.<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">.<plist version="1.0">.<dict>..<key>IBClasses</key>..<array>...<dict>....<key>ACTIONS</key>....<dict>.....<key>cancelPromptForDestinationFolderChoice</key>.....<string>id</string>.....<key>cancelRestoration</key>.....<string>id</string>.....<key>finishPromptForDestinationFolderChoice</key>.....<string>id</string>.....<key>openManifestFile</key>.....<string>id</string>.....<key>openSourceInDefaultApplication</key>.....<string>id</string>.....<key>selectFolderForDestination</key>.....<string>id</string>.....<key>showDestinationInFinder</key>.....<string>id</string>.....<key>showInPreviewApplication</key>.....<string>id</string>.....<key>showSourceInFinder</key>.....<string>id</string>.....<key>startRestoration</key>.....<string>id</string>....</dict>....<key>CLASS</key>....<string>PRAppController</string>....<key>LANGUAGE</key>....<string>ObjC</stri

C:\Program Files (x86)\Google\Picasa3\cdautorun\Picasa Restore.app\Contents\Resources\fi.lproj\PRMainMenu.nib\info.nib

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe
File Type:	XML 1.0 document, ASCII text
Category:	dropped
Size (bytes):	530
Entropy (8bit):	5.250472465860794
Encrypted:	false
SSDEEP:	12:TMHdgo+tJVEdQiCXFbCGIfx2w0GeC6mwbn:2dfyiwFrIZ2ZC6pb
MD5:	0E168543FD71A479FA5AD0E0613A1BA5
SHA1:	9ACD86A59CE7EC341021D75817D082118D351C56
SHA-256:	7C87E946FB8E106D8856A962C780503F602FAE5B09A818F5AD3ACDFC6468546A
SHA-512:	DFFAB3A94B1994D3EC558F308729DED11A9759CC6B4C6E0022ECE502AE5D2BB8437211B37549454DDB43CCACF91F0989E61A1C173B4F59FBCFF423BAFBEAC44A
Malicious:	false
Reputation:	unknown
Preview:	<?xml version="1.0" encoding="UTF-8"?>.<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">.<plist version="1.0">.<dict>..<key>IBFramework Version</key>..<string>680</string>..<key>IBLastKnownRelativeProjectPath</key>..<string>../../../Mac/Picasa.xcodeproj</string>..<key>IBOldestOS</key>..<integer>4</integer>..<key>IBOpenObjects</key>..<array/>..<key>IBSystem Version</key>..<string>9L31a</string>..<key>targetFramework</key>..<string>IBCocoaFramework</string>.</dict>.</plist>.

C:\Program Files (x86)\Google\Picasa3\cdautorun\Picasa Restore.app\Contents\Resources\fi.lproj\PRMainMenu.nib\keyedobjects.nib

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe
File Type:	Apple binary property list
Category:	dropped
Size (bytes):	22790
Entropy (8bit):	6.956784705695929
Encrypted:	false
SSDEEP:	384:rCioV8vV+VNwN4prd1EshJ8sXUr9BMb/fnTNbHWgjxy6QuasTBdsdRXPQzjb9caW:rCioV89+bwGj2iF7QDs7C9ozjb9P9Zob
MD5:	E9E8AE52B93E11BE32B3AB1AD77C26CD
SHA1:	EAF59A433A3B20AF78441A074D2087C585E1BF32
SHA-256:	C40A4F7CE9C76E99334F9AF3EE317AFA9CCD416DE27C84EA208BC44FB24C162A
SHA-512:	160D3392E445B6BC6B25FC817F4ADB188E3C266E75C4941BE051C8930FC652D88C4FA2A6A70DD624784965A92AD5818F66BA007A03006360BDF1076186497BD6
Malicious:	false
Reputation:	unknown
Preview:	bplist00.................X$versionT$topY$archiverX$objects..........]IB.objectdata.._..NSKeyedArchiver.........1.5.6.<.=.A.E.h.p.~.............................................................................#.$.%..1.2.9.:.;.@.A.F.M.S.T.U.Z.z...............................................................!.".(.)./.9.:.@.A.F.G.J.P.X.Y._.`.f.n.o.u.v.~............................................................................................. .)../.0.3.4.8.?.C.D.E.F.J.Q.R.S.X.l.m.n.o.y....................................................................... .&...1.:...;.?.B.I.J.Q.R.].f.g.h.i.j.k.l.m.w.{.\|......................................................................................................... .!.%.,.-.../.4.5.:.;.E.F.G.H.K.R.S.T.U.^._.`.......................................................!."...+.2.3.5.{................................................. .!.".#.$.%.&.'.(.)..+.,.-.../.0.1.2.3.4.5.6.7.8.9.:.;.<.=.>.?.@.A.B.C.D.E.F.G.H.I.J.K.L.M.P.S...!.".#.$.%.&.'.(.)..+.,.-

C:\Program Files (x86)\Google\Picasa3\cdautorun\Picasa Restore.app\Contents\Resources\fi.lproj\i18n\restore_resexport.xml

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 text
Category:	dropped
Size (bytes):	2580
Entropy (8bit):	4.889546574531093
Encrypted:	false
SSDEEP:	24:2dRtFehrzDLQuxq7EvAQJ1geoviwJFvREGDUsqe9kvasKKEdHtpvM+3wAEu4sms3:c/2/VbA3rikR5UXasMhbLR8HetTZRf
MD5:	38B91A7FD86E019165266ED154C0CF0B
SHA1:	5C25866129055C72F9A12BA124B22CCAC02E0B72
SHA-256:	CE9F98284A75E9F5D4AB7D601727D7A1C5935D4A83A7E12542582BB798CA5B61
SHA-512:	871D144C2CAB46582BF3C598A55DA205760937EDD48F5D2640D156BC97AAE6FA1053A906BA2BB7AA3EBB9A6E7EF46DDE272789BFE4E01C0229C7D04855D2DE61
Malicious:	false
Reputation:	unknown
Preview:	<?xml version="1.0" encoding="utf-8" ?>.<Win32Res>. <RT_DIALOG>. <res resid="#904">. <dtitle>. <xmbtext>Palauta Picasan varmuuskopiosta</xmbtext>. </dtitle>. <dlayout>rect(0 0 296 154)</dlayout>. <item itemid="1" itemtype="Button" layout="rect(177 133 227 147)">. <xmbtext>Seuraava</xmbtext>. </item>. <item itemid="2" itemtype="Button" layout="rect(239 133 289 147)">. <xmbtext>Peruuta</xmbtext>. </item>. <item itemid="3" itemtype="Button" layout="rect(7 133 57 147)">. <xmbtext>Poista</xmbtext>. </item>. <item itemid="1010" itemtype="Button" layout="rect(25 47 236 59)">. <xmbtext>Alkuper.iset sijainnit</xmbtext>. </item>. <item itemid="1011" itemtype="Button" layout="rect(25 83 241 95)">. <xmbtext>T.m. kansio</xmbtext>. </item>. <item itemid="1009" itemtype="Edit" layout="rect(41 100 221 113)"/>. <item itemid="4" itemtype="Button" layout="rect(227 100 277 114)">. <xmbtext>Vaihda.</xmbtext>. </item>. <item itemid="-1" itemtype="

C:\Program Files (x86)\Google\Picasa3\cdautorun\Picasa Restore.app\Contents\Resources\fi.lproj\i18n\restore_stringres.xml

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 text
Category:	dropped
Size (bytes):	10033
Entropy (8bit):	4.837950637830866
Encrypted:	false
SSDEEP:	192:9EpLtEq8eTettEe2eI64LfSxU9smob7uEpLtEq8eTettEe2eI64LfSxU9smobLUI:rcoE3ncoE34qWkOX8S
MD5:	55101B506E2CF3B3F955DC8DD1D4FF87
SHA1:	9FA9712B82566E2FDB94855B8A368BB4872F9D38
SHA-256:	A34AD77BA2CE219D0081905611A1254118BD629FE5292F24EDBCEBA9C51C522E
SHA-512:	05EE189D7B9EA2363982F033E1DA9CC7CDF91E5FA1A0EDB78DF05D63C2943ED1E8F18A1A9670055636C6F4E12169140E0C03A0EEAF9020846E9C56171CEC2F32
Malicious:	false
Reputation:	unknown
Preview:	<?xml version="1.0" encoding="utf-8" ?>.<resources>. <stringres id="February">. <xmbtext>Helmikuu</xmbtext>. </stringres>. <stringres id="March">. <xmbtext>Maaliskuu</xmbtext>. </stringres>. <stringres id="April">. <xmbtext>Huhtikuu</xmbtext>. </stringres>. <stringres id="May">. <xmbtext>Touko</xmbtext>. </stringres>. <stringres id="June">. <xmbtext>Kes.kuu</xmbtext>. </stringres>. <stringres id="July">. <xmbtext>Hein.kuu</xmbtext>. </stringres>. <stringres id="August">. <xmbtext>Elokuu</xmbtext>. </stringres>. <stringres id="September">. <xmbtext>Syyskuu</xmbtext>. </stringres>. <stringres id="October">. <xmbtext>Lokakuu</xmbtext>. </stringres>. <stringres id="November">. <xmbtext>Marraskuu</xmbtext>. </stringres>. <stringres id="December">. <xmbtext>Joulukuu</xmbtext>. </stringres>. <stringres id="Jan">. <xmbtext>Tam</xmbtext>. </stringres>. <stringres id="Feb">. <xmbtext>Hel</xmbtext>. </stringres>. <stringres id="Mar">. <xmbtext>Maa</xmbtext>. </stringres>. <stringr

C:\Program Files (x86)\Google\Picasa3\cdautorun\Picasa Restore.app\Contents\Resources\fil.lproj\PRMainMenu.nib\classes.nib

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe
File Type:	XML 1.0 document, ASCII text
Category:	dropped
Size (bytes):	1571
Entropy (8bit):	4.883604938493906
Encrypted:	false
SSDEEP:	24:2dfyiwqhtsd551XBeYSjV+NaBFh3gsX4DHLqaemns4:cfyghtc55DeHj3besX4DHZs4
MD5:	AFE57505E88B3C6CD5D7A27ED6539C66
SHA1:	CA6705B7559326C5C60F8A15DFC6751208DD0643
SHA-256:	BC6AF85CB27E3E742EA8E5519483ACA800F0D2C3C469C1E6AF2161CC5BE647F4
SHA-512:	D5EC7CCED627E987028E4EAB5030126D31E105C1EA91616A956D55552F19F2E71A1EA327D4039428959D661A33E4F072B806BA20BFB3CDD2D5EB0DF98CD4466C
Malicious:	false
Reputation:	unknown
Preview:	<?xml version="1.0" encoding="UTF-8"?>.<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">.<plist version="1.0">.<dict>..<key>IBClasses</key>..<array>...<dict>....<key>ACTIONS</key>....<dict>.....<key>cancelPromptForDestinationFolderChoice</key>.....<string>id</string>.....<key>cancelRestoration</key>.....<string>id</string>.....<key>finishPromptForDestinationFolderChoice</key>.....<string>id</string>.....<key>openManifestFile</key>.....<string>id</string>.....<key>openSourceInDefaultApplication</key>.....<string>id</string>.....<key>selectFolderForDestination</key>.....<string>id</string>.....<key>showDestinationInFinder</key>.....<string>id</string>.....<key>showInPreviewApplication</key>.....<string>id</string>.....<key>showSourceInFinder</key>.....<string>id</string>.....<key>startRestoration</key>.....<string>id</string>....</dict>....<key>CLASS</key>....<string>PRAppController</string>....<key>LANGUAGE</key>....<string>ObjC</stri

C:\Program Files (x86)\Google\Picasa3\cdautorun\Picasa Restore.app\Contents\Resources\fil.lproj\PRMainMenu.nib\info.nib

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe
File Type:	XML 1.0 document, ASCII text
Category:	dropped
Size (bytes):	530
Entropy (8bit):	5.250472465860794
Encrypted:	false
SSDEEP:	12:TMHdgo+tJVEdQiCXFbCGIfx2w0GeC6mwbn:2dfyiwFrIZ2ZC6pb
MD5:	0E168543FD71A479FA5AD0E0613A1BA5
SHA1:	9ACD86A59CE7EC341021D75817D082118D351C56
SHA-256:	7C87E946FB8E106D8856A962C780503F602FAE5B09A818F5AD3ACDFC6468546A
SHA-512:	DFFAB3A94B1994D3EC558F308729DED11A9759CC6B4C6E0022ECE502AE5D2BB8437211B37549454DDB43CCACF91F0989E61A1C173B4F59FBCFF423BAFBEAC44A
Malicious:	false
Reputation:	unknown
Preview:	<?xml version="1.0" encoding="UTF-8"?>.<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">.<plist version="1.0">.<dict>..<key>IBFramework Version</key>..<string>680</string>..<key>IBLastKnownRelativeProjectPath</key>..<string>../../../Mac/Picasa.xcodeproj</string>..<key>IBOldestOS</key>..<integer>4</integer>..<key>IBOpenObjects</key>..<array/>..<key>IBSystem Version</key>..<string>9L31a</string>..<key>targetFramework</key>..<string>IBCocoaFramework</string>.</dict>.</plist>.

C:\Program Files (x86)\Google\Picasa3\cdautorun\Picasa Restore.app\Contents\Resources\fil.lproj\PRMainMenu.nib\keyedobjects.nib

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe
File Type:	Apple binary property list
Category:	dropped
Size (bytes):	22657
Entropy (8bit):	6.986266005378583
Encrypted:	false
SSDEEP:	384:6voV88FA1EPrFNkGcGuHhYxd2rBnnGO1ype+EuM1qtnyRKv7KcBMOtDmaK6HMPdW:6oV8j2jzcGuBRoOIpe5xsNyRA7RB3mSb
MD5:	098C95E9C0EFE6BB873019090506232F
SHA1:	556C8CED1BC551546592187148C868DD05D351EA
SHA-256:	40F3A47007EDBCFFDC12F58817605E7DBD889350607B5631C848D3AB8D0D844A
SHA-512:	FE1E22EA92493C4878EA9E04F0BFD4B1C50B9D528B368C8B85535B33847DCAB9A6D333344518A5AA2A8A018960FDAA0E5C12B90D9FCC53EB987E6F38E3997BD3
Malicious:	false
Reputation:	unknown
Preview:	bplist00.................X$versionT$topY$archiverX$objects..........]IB.objectdata.._..NSKeyedArchiver.........1.5.6.<.=.A.E.h.p........................................... .%.(.0.1.2.5.;.D.I.N.O.R.W.X.Z.].e.f.l.m.s.}.~.............................................................................................&.'./.<.=.B.C.D.G.K.L.O.W.X.c.j.k.r.s.u.v.z.................................................................................#.(.).5.6.9.<.=.B.E.I.P.Q.R.S.W.^.b.c.d.e.j.~...............................&.....9......................................... .!.'...2.6.9.@.A.H.I.T.].^._.`.a.b.c.d.n.r.s.v.y.z.\|.}.~.......................................................................\|.}....................... .!.%.,.-.../.4.5.:.;.E.F.G.H.K.T.U.V.W.^._.`...........................................................(./.0...3.5.{................................................. .!.".#.$.%.&.'.(.)..+.,.-.../.0.1.2.3.4.5.6.7.8.9.:.;.<.=.>.?.@.A.B.C.D.E.F.G.H.I.J.K.L.M.P.S...!.".#.$.%.&.'.(.)..+.,

C:\Program Files (x86)\Google\Picasa3\cdautorun\Picasa Restore.app\Contents\Resources\fil.lproj\i18n\restore_resexport.xml

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe
File Type:	XML 1.0 document, ASCII text
Category:	dropped
Size (bytes):	2585
Entropy (8bit):	4.895470495619398
Encrypted:	false
SSDEEP:	48:c/QHz/VOdAjsepZR5E2NErJEc+2pKlxPTW6TZRf:GIVljXNE2+JEP2pmxPTZRf
MD5:	FAECB0F97A8BBE307B9F11B590F10234
SHA1:	30CDC238166E2B72EC8E3030FF0AD24DC0916D63
SHA-256:	47FE8A8AB57B70BB83528B8F03F6739CC5C658EA632F41043555F65995A6AB37
SHA-512:	09D7F99C0562A889067B4CA49AFD836ED914CD1882616CE82908DA74DD478E4A39932BC79BEB1B6270403A923ED7B2C56197BC2B6DD3791927BB9F82BDAA6C3A
Malicious:	false
Reputation:	unknown
Preview:	<?xml version="1.0" encoding="utf-8" ?>.<Win32Res>. <RT_DIALOG>. <res resid="#904">. <dtitle>. <xmbtext>Ibalik mula sa isang backup sa Picasa</xmbtext>. </dtitle>. <dlayout>rect(0 0 296 154)</dlayout>. <item itemid="1" itemtype="Button" layout="rect(177 133 227 147)">. <xmbtext>Susunod</xmbtext>. </item>. <item itemid="2" itemtype="Button" layout="rect(239 133 289 147)">. <xmbtext>Kanselahin</xmbtext>. </item>. <item itemid="3" itemtype="Button" layout="rect(7 133 57 147)">. <xmbtext>I-eject</xmbtext>. </item>. <item itemid="1010" itemtype="Button" layout="rect(25 47 236 59)">. <xmbtext>Mga orihinal na kinalalagyan</xmbtext>. </item>. <item itemid="1011" itemtype="Button" layout="rect(25 83 241 95)">. <xmbtext>Ang folder na ito</xmbtext>. </item>. <item itemid="1009" itemtype="Edit" layout="rect(41 100 221 113)"/>. <item itemid="4" itemtype="Button" layout="rect(227 100 277 114)">. <xmbtext>Baguhin...</xmbtext>. </item>. <item ite

C:\Program Files (x86)\Google\Picasa3\cdautorun\Picasa Restore.app\Contents\Resources\fil.lproj\i18n\restore_stringres.xml

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe
File Type:	XML 1.0 document, ASCII text
Category:	dropped
Size (bytes):	10100
Entropy (8bit):	4.813110271248783
Encrypted:	false
SSDEEP:	192:91VB4p6hBgeGettEe8eEWiYBHeLVBqVHoyxv81VB4p6hBgeGettEe8eEWiYBHeLQ:3VgR0ERaE8kVgR0ERaEQuamOfXm2
MD5:	77245F74542801720783902F87B05A82
SHA1:	B96C4A3B6F2860CD1C7501D0A24553FEF67A0DCC
SHA-256:	A468BC41EA437008CE5B6BF58BE5705E608F6FF335BB75C5DC59C2EFF2FD9640
SHA-512:	F536F66E943A0FA28FB2CCC9BC15F0E2289A5E30E3F3A9C56833C1FBE3EA21E4446BDD95D86B23473AF4C796411D2DEAF9F073A8ACE6B0BC452B796A52D69DA6
Malicious:	false
Reputation:	unknown
Preview:	<?xml version="1.0" encoding="utf-8" ?>.<resources>. <stringres id="February">. <xmbtext>Pebrero</xmbtext>. </stringres>. <stringres id="March">. <xmbtext>Marso</xmbtext>. </stringres>. <stringres id="April">. <xmbtext>Abril</xmbtext>. </stringres>. <stringres id="May">. <xmbtext>Mayo</xmbtext>. </stringres>. <stringres id="June">. <xmbtext>Hunyo</xmbtext>. </stringres>. <stringres id="July">. <xmbtext>Hulyo</xmbtext>. </stringres>. <stringres id="August">. <xmbtext>Agosto</xmbtext>. </stringres>. <stringres id="September">. <xmbtext>Setyembre</xmbtext>. </stringres>. <stringres id="October">. <xmbtext>Oktubre</xmbtext>. </stringres>. <stringres id="November">. <xmbtext>Nobyembre</xmbtext>. </stringres>. <stringres id="December">. <xmbtext>Disyembre</xmbtext>. </stringres>. <stringres id="Jan">. <xmbtext>Ene</xmbtext>. </stringres>. <stringres id="Feb">. <xmbtext>Peb</xmbtext>. </stringres>. <stringres id="Mar">. <xmbtext>Mar</xmbtext>. </stringres>. <stringres id="Apr">.

C:\Program Files (x86)\Google\Picasa3\cdautorun\Picasa Restore.app\Contents\Resources\fr.lproj\PRMainMenu.nib\classes.nib

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe
File Type:	XML 1.0 document, ASCII text
Category:	dropped
Size (bytes):	1571
Entropy (8bit):	4.883604938493906
Encrypted:	false
SSDEEP:	24:2dfyiwqhtsd551XBeYSjV+NaBFh3gsX4DHLqaemns4:cfyghtc55DeHj3besX4DHZs4
MD5:	AFE57505E88B3C6CD5D7A27ED6539C66
SHA1:	CA6705B7559326C5C60F8A15DFC6751208DD0643
SHA-256:	BC6AF85CB27E3E742EA8E5519483ACA800F0D2C3C469C1E6AF2161CC5BE647F4
SHA-512:	D5EC7CCED627E987028E4EAB5030126D31E105C1EA91616A956D55552F19F2E71A1EA327D4039428959D661A33E4F072B806BA20BFB3CDD2D5EB0DF98CD4466C
Malicious:	false
Reputation:	unknown
Preview:	<?xml version="1.0" encoding="UTF-8"?>.<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">.<plist version="1.0">.<dict>..<key>IBClasses</key>..<array>...<dict>....<key>ACTIONS</key>....<dict>.....<key>cancelPromptForDestinationFolderChoice</key>.....<string>id</string>.....<key>cancelRestoration</key>.....<string>id</string>.....<key>finishPromptForDestinationFolderChoice</key>.....<string>id</string>.....<key>openManifestFile</key>.....<string>id</string>.....<key>openSourceInDefaultApplication</key>.....<string>id</string>.....<key>selectFolderForDestination</key>.....<string>id</string>.....<key>showDestinationInFinder</key>.....<string>id</string>.....<key>showInPreviewApplication</key>.....<string>id</string>.....<key>showSourceInFinder</key>.....<string>id</string>.....<key>startRestoration</key>.....<string>id</string>....</dict>....<key>CLASS</key>....<string>PRAppController</string>....<key>LANGUAGE</key>....<string>ObjC</stri

C:\Program Files (x86)\Google\Picasa3\cdautorun\Picasa Restore.app\Contents\Resources\fr.lproj\PRMainMenu.nib\info.nib

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe
File Type:	XML 1.0 document, ASCII text
Category:	dropped
Size (bytes):	530
Entropy (8bit):	5.250472465860794
Encrypted:	false
SSDEEP:	12:TMHdgo+tJVEdQiCXFbCGIfx2w0GeC6mwbn:2dfyiwFrIZ2ZC6pb
MD5:	0E168543FD71A479FA5AD0E0613A1BA5
SHA1:	9ACD86A59CE7EC341021D75817D082118D351C56
SHA-256:	7C87E946FB8E106D8856A962C780503F602FAE5B09A818F5AD3ACDFC6468546A
SHA-512:	DFFAB3A94B1994D3EC558F308729DED11A9759CC6B4C6E0022ECE502AE5D2BB8437211B37549454DDB43CCACF91F0989E61A1C173B4F59FBCFF423BAFBEAC44A
Malicious:	false
Reputation:	unknown
Preview:	<?xml version="1.0" encoding="UTF-8"?>.<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">.<plist version="1.0">.<dict>..<key>IBFramework Version</key>..<string>680</string>..<key>IBLastKnownRelativeProjectPath</key>..<string>../../../Mac/Picasa.xcodeproj</string>..<key>IBOldestOS</key>..<integer>4</integer>..<key>IBOpenObjects</key>..<array/>..<key>IBSystem Version</key>..<string>9L31a</string>..<key>targetFramework</key>..<string>IBCocoaFramework</string>.</dict>.</plist>.

C:\Program Files (x86)\Google\Picasa3\cdautorun\Picasa Restore.app\Contents\Resources\fr.lproj\PRMainMenu.nib\keyedobjects.nib

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe
File Type:	Apple binary property list
Category:	dropped
Size (bytes):	23948
Entropy (8bit):	6.801189558993169
Encrypted:	false
SSDEEP:	384:FnE4V8vPOLTTDxdF1EfKL1MvFreV84QkSuCZ5dZXYBwl9rBxqM5cT423M7/OGDmZ:1E4V8HkDx726S4VS3DTXgwLqgcs3TOvZ
MD5:	5DD37AEA62D9FB6E3046906E0E2CE1BD
SHA1:	1357978F4A0D4A816C1C1B7B740BA83488DFF5D3
SHA-256:	0FA823AF0837BB03D1F7C4F59C4CDFE3E65EA0F56F8EDBEE29C1496287115D9A
SHA-512:	DDD2BB7090F6E880233F6A3FF0EF9E34A3CCA24C23327FCFCCC0764D90E4C5E5681736CDD7594643F554AC57514E2F4E7176EBE2C8F2C4DC40755A0EA62F996A
Malicious:	false
Reputation:	unknown
Preview:	bplist00.................X$versionT$topY$archiverX$objects..........]IB.objectdata.._..NSKeyedArchiver.........1.5.6.<.=.A.E.h.p....................................................... .!.$.,.?.@.?.L.T.U.X.].`.h.i.j.m.s.\|.........................................................................................".'.(.+.../.2.?.@.A.D.L.M...Q.R.U.].d.e.l.m.x............................................................. ./.0.4.5.4.9.<.?.H...I.J.q.K.R.S.X.Y.\.c.d.l.m.q.t.{.\|...........................................................................................#.'.(.)....5.:.;.<.@.H.I.J.K.P.U.V.[.`.a.f.r.s.t.{.......................................................................................................$.%.&.+.,.0.7.8.9.:.D.E.F.G.J.S.T.U.V.].^._.......................................................%...../...2.4.z................................................... .!.".#.$.%.&.'.(.)..+.,.-.../.0.1.2.3.4.5.6.7.8.9.:.;.<.=.>.?.@.A.B.C.D.E.F.G.H.I.J.K.L.O.R... .!.".#.$.%.&.'.(.).*.+.,

C:\Program Files (x86)\Google\Picasa3\cdautorun\Picasa Restore.app\Contents\Resources\fr.lproj\i18n\restore_resexport.xml

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 text
Category:	dropped
Size (bytes):	2636
Entropy (8bit):	4.919064594545526
Encrypted:	false
SSDEEP:	48:c/Vz/VjlAskg0j1R5bGFRZD2zCbekBj0tvTZRf:GJVjWskgYRcrErkBj05TZRf
MD5:	9E389A3B050AA292E884D478642BDB4C
SHA1:	DA8248A94822D56A6ED73A9145312E70ADD0E9DA
SHA-256:	868C247F29B492AC4795315FF0F8B63C797AA890869E62A82990FBA282F10DF3
SHA-512:	EBD23B2A4639F82B4C6562273F8AC8A0F05C26C147E5F97C0BEFC1744378ED8BBBD77143AE015D53B11847A84B3759505A3E2DD9AB62FA53FC78EF83E306C594
Malicious:	false
Reputation:	unknown
Preview:	<?xml version="1.0" encoding="utf-8" ?>.<Win32Res>. <RT_DIALOG>. <res resid="#904">. <dtitle>. <xmbtext>Restaurer . partir d'une sauvegarde de Picasa</xmbtext>. </dtitle>. <dlayout>rect(0 0 296 154)</dlayout>. <item itemid="1" itemtype="Button" layout="rect(177 133 227 147)">. <xmbtext>Suivant</xmbtext>. </item>. <item itemid="2" itemtype="Button" layout="rect(239 133 289 147)">. <xmbtext>Annuler</xmbtext>. </item>. <item itemid="3" itemtype="Button" layout="rect(7 133 57 147)">. <xmbtext>.jecter</xmbtext>. </item>. <item itemid="1010" itemtype="Button" layout="rect(25 47 236 59)">. <xmbtext>Emplacements d'origine</xmbtext>. </item>. <item itemid="1011" itemtype="Button" layout="rect(25 83 241 95)">. <xmbtext>Ce dossier</xmbtext>. </item>. <item itemid="1009" itemtype="Edit" layout="rect(41 100 221 113)"/>. <item itemid="4" itemtype="Button" layout="rect(227 100 277 114)">. <xmbtext>Modifier...</xmbtext>. </item>. <ite

C:\Program Files (x86)\Google\Picasa3\cdautorun\Picasa Restore.app\Contents\Resources\fr.lproj\i18n\restore_stringres.xml

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 text
Category:	dropped
Size (bytes):	10134
Entropy (8bit):	4.826376376308784
Encrypted:	false
SSDEEP:	192:9Q5sC639xehe7tEe7e2v7rNPEoF3xoKq+Q5sC639xehe7tEe7e2v7rNPEoF3xoK+:Sk26Ecsk26EceLMOcGaqV
MD5:	ACFF70D8001DE73E19E56B02D181BA5F
SHA1:	2A2FDBE545CF40195BD40A3DA01D64848BDEF0D1
SHA-256:	18E993FF256022C41F04E6DB6753DC7067571CEDD9CEF828573CEC6ADA47C384
SHA-512:	CF8EC499E3967AFB3282232E02AF7FB3CCA8CE3469C4B46617A080D5BFC290E14F7F8D1596576A5AB251A0F0BD18106253E0A5713865E803386AE688A7E469EF
Malicious:	false
Reputation:	unknown
Preview:	<?xml version="1.0" encoding="utf-8" ?>.<resources>. <stringres id="February">. <xmbtext>f.vrier</xmbtext>. </stringres>. <stringres id="March">. <xmbtext>mars</xmbtext>. </stringres>. <stringres id="April">. <xmbtext>avril</xmbtext>. </stringres>. <stringres id="May">. <xmbtext>mai</xmbtext>. </stringres>. <stringres id="June">. <xmbtext>juin</xmbtext>. </stringres>. <stringres id="July">. <xmbtext>juillet</xmbtext>. </stringres>. <stringres id="August">. <xmbtext>ao.t</xmbtext>. </stringres>. <stringres id="September">. <xmbtext>septembre</xmbtext>. </stringres>. <stringres id="October">. <xmbtext>octobre</xmbtext>. </stringres>. <stringres id="November">. <xmbtext>novembre</xmbtext>. </stringres>. <stringres id="December">. <xmbtext>d.cembre</xmbtext>. </stringres>. <stringres id="Jan">. <xmbtext>janv.</xmbtext>. </stringres>. <stringres id="Feb">. <xmbtext>f.vr.</xmbtext>. </stringres>. <stringres id="Mar">. <xmbtext>mars</xmbtext>. </stringres>. <stringres id="Ap

C:\Program Files (x86)\Google\Picasa3\cdautorun\Picasa Restore.app\Contents\Resources\hr.lproj\PRMainMenu.nib\classes.nib

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe
File Type:	XML 1.0 document, ASCII text
Category:	dropped
Size (bytes):	1571
Entropy (8bit):	4.883604938493906
Encrypted:	false
SSDEEP:	24:2dfyiwqhtsd551XBeYSjV+NaBFh3gsX4DHLqaemns4:cfyghtc55DeHj3besX4DHZs4
MD5:	AFE57505E88B3C6CD5D7A27ED6539C66
SHA1:	CA6705B7559326C5C60F8A15DFC6751208DD0643
SHA-256:	BC6AF85CB27E3E742EA8E5519483ACA800F0D2C3C469C1E6AF2161CC5BE647F4
SHA-512:	D5EC7CCED627E987028E4EAB5030126D31E105C1EA91616A956D55552F19F2E71A1EA327D4039428959D661A33E4F072B806BA20BFB3CDD2D5EB0DF98CD4466C
Malicious:	false
Reputation:	unknown
Preview:	<?xml version="1.0" encoding="UTF-8"?>.<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">.<plist version="1.0">.<dict>..<key>IBClasses</key>..<array>...<dict>....<key>ACTIONS</key>....<dict>.....<key>cancelPromptForDestinationFolderChoice</key>.....<string>id</string>.....<key>cancelRestoration</key>.....<string>id</string>.....<key>finishPromptForDestinationFolderChoice</key>.....<string>id</string>.....<key>openManifestFile</key>.....<string>id</string>.....<key>openSourceInDefaultApplication</key>.....<string>id</string>.....<key>selectFolderForDestination</key>.....<string>id</string>.....<key>showDestinationInFinder</key>.....<string>id</string>.....<key>showInPreviewApplication</key>.....<string>id</string>.....<key>showSourceInFinder</key>.....<string>id</string>.....<key>startRestoration</key>.....<string>id</string>....</dict>....<key>CLASS</key>....<string>PRAppController</string>....<key>LANGUAGE</key>....<string>ObjC</stri

C:\Program Files (x86)\Google\Picasa3\cdautorun\Picasa Restore.app\Contents\Resources\hr.lproj\PRMainMenu.nib\info.nib

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe
File Type:	XML 1.0 document, ASCII text
Category:	dropped
Size (bytes):	530
Entropy (8bit):	5.250472465860794
Encrypted:	false
SSDEEP:	12:TMHdgo+tJVEdQiCXFbCGIfx2w0GeC6mwbn:2dfyiwFrIZ2ZC6pb
MD5:	0E168543FD71A479FA5AD0E0613A1BA5
SHA1:	9ACD86A59CE7EC341021D75817D082118D351C56
SHA-256:	7C87E946FB8E106D8856A962C780503F602FAE5B09A818F5AD3ACDFC6468546A
SHA-512:	DFFAB3A94B1994D3EC558F308729DED11A9759CC6B4C6E0022ECE502AE5D2BB8437211B37549454DDB43CCACF91F0989E61A1C173B4F59FBCFF423BAFBEAC44A
Malicious:	false
Reputation:	unknown
Preview:	<?xml version="1.0" encoding="UTF-8"?>.<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">.<plist version="1.0">.<dict>..<key>IBFramework Version</key>..<string>680</string>..<key>IBLastKnownRelativeProjectPath</key>..<string>../../../Mac/Picasa.xcodeproj</string>..<key>IBOldestOS</key>..<integer>4</integer>..<key>IBOpenObjects</key>..<array/>..<key>IBSystem Version</key>..<string>9L31a</string>..<key>targetFramework</key>..<string>IBCocoaFramework</string>.</dict>.</plist>.

C:\Program Files (x86)\Google\Picasa3\cdautorun\Picasa Restore.app\Contents\Resources\hr.lproj\PRMainMenu.nib\keyedobjects.nib

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe
File Type:	Apple binary property list
Category:	dropped
Size (bytes):	23380
Entropy (8bit):	6.875156031028724
Encrypted:	false
SSDEEP:	384:Zi/oV88qP+Ahaj1EfA1E1OzNKgh84jUPuqXOFKVQo0qkLaLL3iCyVyLsd:Zi/oV8jP+Au2RF7neYrlh3ih4sd
MD5:	B2E352E86F83A5FD368B29F55C238351
SHA1:	230E211CFC4D37F203349D2275DEA498D702378D
SHA-256:	8AEF3A53461A244F4CDBF703AF3000EE58492CA6FC04CEDB21A78B007931D433
SHA-512:	2CD71EB6041684285F383E5F2D12B57749325D332BCA3F1DD43CD7CF9ED5E7D7514F9283F80E476DFBA4C536BE6F18BF1F534B0C36070AA226E4191C50190101
Malicious:	false
Reputation:	unknown
Preview:	bplist00.................X$versionT$topY$archiverX$objects..........]IB.objectdata.._..NSKeyedArchiver.........1.5.6.<.=.A.E.h.p.~.............................................................................!.".%..?.G.U.Y.x.y...........................................................................".#.&.,.4.5.;.<.B.J.K.Q.R.Z.b.o.p.q.r.s.t...u.v.z.{.~.........................................................................................!..../.0.D.E.J.^._.`.a.k...................................................................../......./....... .!.(.).4.=.>.?.@.A.B.C.D.N.R.S.V.Y.Z.\.].^.a.b.g.j.o.v.w.~...................................................................................\.]...................#..+.,.1.8.9.:.;.E.F.G.H.K.T.U.V.W.^._.`.........................................................&.../.0...3.5.{................................................. .!.".#.$.%.&.'.(.)..+.,.-.../.0.1.2.3.4.5.6.7.8.9.:.;.<.=.>.?.@.A.B.C.D.E.F.G.H.I.J.K.L.M.P.S...!.".#.$.%.&.'.(.).*.+.,

C:\Program Files (x86)\Google\Picasa3\cdautorun\Picasa Restore.app\Contents\Resources\hr.lproj\i18n\restore_resexport.xml

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 text
Category:	dropped
Size (bytes):	2564
Entropy (8bit):	4.890697635293419
Encrypted:	false
SSDEEP:	48:c/Srz/V8AA1/HR5XIqP99ErbVc0lyD8Rf:GSnVnujPo20YD8Rf
MD5:	945E550F834C13D1660A94B6F6578EF6
SHA1:	2B24BB437E7A163AF1FFE693A859DB8AE66D1E0C
SHA-256:	7A18DC3B6BBDDF31A2B7482BFC0325744C3C547FB13132F152F9F2D44594C82A
SHA-512:	8048F520AD29E97ABD868349F4B8DBA5B60ABD85B68CACB552F7BBDFEC11440F40445B9577E128AA84B6B0E4D80302AAB3AD3B13849B77E8FA47803C1D6029B3
Malicious:	false
Reputation:	unknown
Preview:	<?xml version="1.0" encoding="utf-8" ?>.<Win32Res>. <RT_DIALOG>. <res resid="#904">. <dtitle>. <xmbtext>Vrati iz sigurnosne kopije usluge Picasa</xmbtext>. </dtitle>. <dlayout>rect(0 0 296 154)</dlayout>. <item itemid="1" itemtype="Button" layout="rect(177 133 227 147)">. <xmbtext>Sljede.e</xmbtext>. </item>. <item itemid="2" itemtype="Button" layout="rect(239 133 289 147)">. <xmbtext>Odustani</xmbtext>. </item>. <item itemid="3" itemtype="Button" layout="rect(7 133 57 147)">. <xmbtext>Izbaci</xmbtext>. </item>. <item itemid="1010" itemtype="Button" layout="rect(25 47 236 59)">. <xmbtext>Izvorne lokacije</xmbtext>. </item>. <item itemid="1011" itemtype="Button" layout="rect(25 83 241 95)">. <xmbtext>Ova mapa</xmbtext>. </item>. <item itemid="1009" itemtype="Edit" layout="rect(41 100 221 113)"/>. <item itemid="4" itemtype="Button" layout="rect(227 100 277 114)">. <xmbtext>Promijeni...</xmbtext>. </item>. <item itemid="-1" itemtype

C:\Program Files (x86)\Google\Picasa3\cdautorun\Picasa Restore.app\Contents\Resources\hr.lproj\i18n\restore_stringres.xml

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 text
Category:	dropped
Size (bytes):	10132
Entropy (8bit):	4.866471130824257
Encrypted:	false
SSDEEP:	192:9qQEWBShe0eftEe3edaL/DrZrtKRo1QwqQEWBShe0eftEe3edaL/DrZrtKRo1cUV:w30EiO30EilMubHfuOFfn
MD5:	0A6FC352C4799CE202861221E53A8F84
SHA1:	78D93862C5F4FE87B882412366D746A86E2EF790
SHA-256:	EF693CF3C425AF1E34DB824E79901D1ADE835F33C1F2D40AE12D930BDB341D99
SHA-512:	A41A1E4C7BF80224CB2C37FA150F172684A3C043C5A9893E284DFABA8D09BABF4EEF90A5D4B2A713B204FB999CFCE8644D8727C6D9924033C2E2BEF15468A5D1
Malicious:	false
Reputation:	unknown
Preview:	<?xml version="1.0" encoding="utf-8" ?>.<resources>. <stringres id="February">. <xmbtext>velja.a</xmbtext>. </stringres>. <stringres id="March">. <xmbtext>o.ujak</xmbtext>. </stringres>. <stringres id="April">. <xmbtext>travanj</xmbtext>. </stringres>. <stringres id="May">. <xmbtext>Svibanj</xmbtext>. </stringres>. <stringres id="June">. <xmbtext>Lipanj</xmbtext>. </stringres>. <stringres id="July">. <xmbtext>Srpanj</xmbtext>. </stringres>. <stringres id="August">. <xmbtext>kolovoz</xmbtext>. </stringres>. <stringres id="September">. <xmbtext>Rujan</xmbtext>. </stringres>. <stringres id="October">. <xmbtext>listopad</xmbtext>. </stringres>. <stringres id="November">. <xmbtext>Studeni</xmbtext>. </stringres>. <stringres id="December">. <xmbtext>prosinac</xmbtext>. </stringres>. <stringres id="Jan">. <xmbtext>Sij</xmbtext>. </stringres>. <stringres id="Feb">. <xmbtext>Vlj</xmbtext>. </stringres>. <stringres id="Mar">. <xmbtext>O.u</xmbtext>. </stringres>. <stringres id="

C:\Program Files (x86)\Google\Picasa3\cdautorun\Picasa Restore.app\Contents\Resources\hu.lproj\PRMainMenu.nib\classes.nib

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe
File Type:	XML 1.0 document, ASCII text
Category:	dropped
Size (bytes):	1571
Entropy (8bit):	4.883604938493906
Encrypted:	false
SSDEEP:	24:2dfyiwqhtsd551XBeYSjV+NaBFh3gsX4DHLqaemns4:cfyghtc55DeHj3besX4DHZs4
MD5:	AFE57505E88B3C6CD5D7A27ED6539C66
SHA1:	CA6705B7559326C5C60F8A15DFC6751208DD0643
SHA-256:	BC6AF85CB27E3E742EA8E5519483ACA800F0D2C3C469C1E6AF2161CC5BE647F4
SHA-512:	D5EC7CCED627E987028E4EAB5030126D31E105C1EA91616A956D55552F19F2E71A1EA327D4039428959D661A33E4F072B806BA20BFB3CDD2D5EB0DF98CD4466C
Malicious:	false
Reputation:	unknown
Preview:	<?xml version="1.0" encoding="UTF-8"?>.<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">.<plist version="1.0">.<dict>..<key>IBClasses</key>..<array>...<dict>....<key>ACTIONS</key>....<dict>.....<key>cancelPromptForDestinationFolderChoice</key>.....<string>id</string>.....<key>cancelRestoration</key>.....<string>id</string>.....<key>finishPromptForDestinationFolderChoice</key>.....<string>id</string>.....<key>openManifestFile</key>.....<string>id</string>.....<key>openSourceInDefaultApplication</key>.....<string>id</string>.....<key>selectFolderForDestination</key>.....<string>id</string>.....<key>showDestinationInFinder</key>.....<string>id</string>.....<key>showInPreviewApplication</key>.....<string>id</string>.....<key>showSourceInFinder</key>.....<string>id</string>.....<key>startRestoration</key>.....<string>id</string>....</dict>....<key>CLASS</key>....<string>PRAppController</string>....<key>LANGUAGE</key>....<string>ObjC</stri

C:\Program Files (x86)\Google\Picasa3\cdautorun\Picasa Restore.app\Contents\Resources\hu.lproj\PRMainMenu.nib\info.nib

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe
File Type:	XML 1.0 document, ASCII text
Category:	dropped
Size (bytes):	530
Entropy (8bit):	5.250472465860794
Encrypted:	false
SSDEEP:	12:TMHdgo+tJVEdQiCXFbCGIfx2w0GeC6mwbn:2dfyiwFrIZ2ZC6pb
MD5:	0E168543FD71A479FA5AD0E0613A1BA5
SHA1:	9ACD86A59CE7EC341021D75817D082118D351C56
SHA-256:	7C87E946FB8E106D8856A962C780503F602FAE5B09A818F5AD3ACDFC6468546A
SHA-512:	DFFAB3A94B1994D3EC558F308729DED11A9759CC6B4C6E0022ECE502AE5D2BB8437211B37549454DDB43CCACF91F0989E61A1C173B4F59FBCFF423BAFBEAC44A
Malicious:	false
Reputation:	unknown
Preview:	<?xml version="1.0" encoding="UTF-8"?>.<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">.<plist version="1.0">.<dict>..<key>IBFramework Version</key>..<string>680</string>..<key>IBLastKnownRelativeProjectPath</key>..<string>../../../Mac/Picasa.xcodeproj</string>..<key>IBOldestOS</key>..<integer>4</integer>..<key>IBOpenObjects</key>..<array/>..<key>IBSystem Version</key>..<string>9L31a</string>..<key>targetFramework</key>..<string>IBCocoaFramework</string>.</dict>.</plist>.

C:\Program Files (x86)\Google\Picasa3\cdautorun\Picasa Restore.app\Contents\Resources\hu.lproj\PRMainMenu.nib\keyedobjects.nib

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe
File Type:	Apple binary property list
Category:	dropped
Size (bytes):	24436
Entropy (8bit):	6.742174271616233
Encrypted:	false
SSDEEP:	384:/gz5oV8v8L1EBT61a1v5cN12I5TgXz3sZ5o7BduAltal6kPpr/C1/YTTv8Ek0neZ:odoV8G2wF72I5cXz8IBdfilMYvv8Ek0g
MD5:	412194BBA99928A29110854B808358A4
SHA1:	3B9BB26ADA549BE014D06151CABF9CF6B0E540B0
SHA-256:	F813E1F24A5C26D1121C55FE6F20120BE91D38C9CED28707D204B217FF6038F8
SHA-512:	22A4E72A8E582DADE74FE7689C84951EAADE5D145E78C19717D198E1FAFF138560AE3858E423423E5E92974728184645E9E7FF721670528F41E57219B7460B79
Malicious:	false
Reputation:	unknown
Preview:	bplist00.................X$versionT$topY$archiverX$objects..........]IB.objectdata.._..NSKeyedArchiver.........1.5.6.<.=.A.E.h.p...........................................................!.".%.-.@.A.M.N.U.V.Y.^.a.i.j.k.n.t.}....................................................................................... .$.)..-.0.3.4.5.8.<.C.G.H.I.J.O.W.\.].o.p.s.v.w.\|.......................................................................................#..+.,.-.2.8.@.G.H.P.Q.\.c.d.k.l.n.o.t.u.z.{...............................................r...........................%.&.8.B.F.G.H.I.O.G.Z.c.G.d.h.k.r.s.z.{.............................................................................................................".#.'.../.0.5.6.;.E.F.G.H.K.T.U.V.W.^._.`.......................................................&...'.+.2.3.5.{................................................. .!.".#.$.%.&.'.(.)..+.,.-.../.0.1.2.3.4.5.6.7.8.9.:.;.<.=.>.?.@.A.B.C.D.E.F.G.H.I.J.K.L.M.P.S...!.".#.$.%.&.'.(.)..+.,.-

C:\Program Files (x86)\Google\Picasa3\cdautorun\Picasa Restore.app\Contents\Resources\hu.lproj\i18n\restore_resexport.xml

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 text
Category:	dropped
Size (bytes):	2646
Entropy (8bit):	4.992531621118596
Encrypted:	false
SSDEEP:	48:c/qu3H/VCArVcR5DM5Xh+pu3ff28cvDTZRf:GqAfVlrQQ5XgpAn28crTZRf
MD5:	2EEC25C73571B7DAA819094A99F2C1B7
SHA1:	4A9A85199BA73ED6D515C5823956DC334579100A
SHA-256:	ADF3377B9F4E00F296104903EE674ABCD12512505669587CB9B4D57A991F747E
SHA-512:	6186E1ACE04CD2D2ABF864BF8D7BF3BAD5260AE83E0EBA0A22CAC61454D46E893CA6922396F70BEC7DB7C549CFB59EC309CB2352BF2B9EFB32A2E39DA36E15A2
Malicious:	false
Reputation:	unknown
Preview:	<?xml version="1.0" encoding="utf-8" ?>.<Win32Res>. <RT_DIALOG>. <res resid="#904">. <dtitle>. <xmbtext>Vissza.ll.t.s a Picasa egyik biztons.gi m.solat.b.l</xmbtext>. </dtitle>. <dlayout>rect(0 0 296 154)</dlayout>. <item itemid="1" itemtype="Button" layout="rect(177 133 227 147)">. <xmbtext>K.vetkez.</xmbtext>. </item>. <item itemid="2" itemtype="Button" layout="rect(239 133 289 147)">. <xmbtext>M.gse</xmbtext>. </item>. <item itemid="3" itemtype="Button" layout="rect(7 133 57 147)">. <xmbtext>Kiad.s</xmbtext>. </item>. <item itemid="1010" itemtype="Button" layout="rect(25 47 236 59)">. <xmbtext>Eredeti helyek</xmbtext>. </item>. <item itemid="1011" itemtype="Button" layout="rect(25 83 241 95)">. <xmbtext>Ez a mappa</xmbtext>. </item>. <item itemid="1009" itemtype="Edit" layout="rect(41 100 221 113)"/>. <item itemid="4" itemtype="Button" layout="rect(227 100 277 114)">. <xmbtext>M.dos.t.s...</xmbtext>. </item>. <ite

C:\Program Files (x86)\Google\Picasa3\cdautorun\Picasa Restore.app\Contents\Resources\hu.lproj\i18n\restore_stringres.xml

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 text
Category:	dropped
Size (bytes):	10083
Entropy (8bit):	4.908626277928887
Encrypted:	false
SSDEEP:	192:9gWB06UUB6eTeCtEehe9j4J0QFHJBsXZoqbXgWB06UUB6eTeCtEehe9j4J0QFHJS:NB6SNECLvYB6SNECLvm12mo26OcY7
MD5:	A435EDDFA5D6485212CACD97E2BA537D
SHA1:	81D056264CBD130A7A5A28CE306793EFAA7C00CC
SHA-256:	D5300F950F482465E60A1AA20A0088377EC451FA662F43312404051072BBE0F7
SHA-512:	8C4AD8C20C7F4080448A462C92FDC6A05B6D2DD6F3A50FE22EEBDFC789843CACC840860048A85C4951BAFE37592ADB0AD967B4D67A1FEB5808F6C511C4487B5D
Malicious:	false
Reputation:	unknown
Preview:	<?xml version="1.0" encoding="utf-8" ?>.<resources>. <stringres id="February">. <xmbtext>Febru.r</xmbtext>. </stringres>. <stringres id="March">. <xmbtext>M.rcius</xmbtext>. </stringres>. <stringres id="April">. <xmbtext>.prilis</xmbtext>. </stringres>. <stringres id="May">. <xmbtext>M.jus</xmbtext>. </stringres>. <stringres id="June">. <xmbtext>J.nius</xmbtext>. </stringres>. <stringres id="July">. <xmbtext>J.lius</xmbtext>. </stringres>. <stringres id="August">. <xmbtext>Augusztus</xmbtext>. </stringres>. <stringres id="September">. <xmbtext>Szeptember</xmbtext>. </stringres>. <stringres id="October">. <xmbtext>Okt.ber</xmbtext>. </stringres>. <stringres id="November">. <xmbtext>November</xmbtext>. </stringres>. <stringres id="December">. <xmbtext>December</xmbtext>. </stringres>. <stringres id="Jan">. <xmbtext>Jan.</xmbtext>. </stringres>. <stringres id="Feb">. <xmbtext>Febr.</xmbtext>. </stringres>. <stringres id="Mar">. <xmbtext>M.rc.</xmbtext>. </stringres>.

C:\Program Files (x86)\Google\Picasa3\cdautorun\Picasa Restore.app\Contents\Resources\id.lproj\PRMainMenu.nib\classes.nib

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe
File Type:	XML 1.0 document, ASCII text
Category:	dropped
Size (bytes):	1571
Entropy (8bit):	4.883604938493906
Encrypted:	false
SSDEEP:	24:2dfyiwqhtsd551XBeYSjV+NaBFh3gsX4DHLqaemns4:cfyghtc55DeHj3besX4DHZs4
MD5:	AFE57505E88B3C6CD5D7A27ED6539C66
SHA1:	CA6705B7559326C5C60F8A15DFC6751208DD0643
SHA-256:	BC6AF85CB27E3E742EA8E5519483ACA800F0D2C3C469C1E6AF2161CC5BE647F4
SHA-512:	D5EC7CCED627E987028E4EAB5030126D31E105C1EA91616A956D55552F19F2E71A1EA327D4039428959D661A33E4F072B806BA20BFB3CDD2D5EB0DF98CD4466C
Malicious:	false
Reputation:	unknown
Preview:	<?xml version="1.0" encoding="UTF-8"?>.<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">.<plist version="1.0">.<dict>..<key>IBClasses</key>..<array>...<dict>....<key>ACTIONS</key>....<dict>.....<key>cancelPromptForDestinationFolderChoice</key>.....<string>id</string>.....<key>cancelRestoration</key>.....<string>id</string>.....<key>finishPromptForDestinationFolderChoice</key>.....<string>id</string>.....<key>openManifestFile</key>.....<string>id</string>.....<key>openSourceInDefaultApplication</key>.....<string>id</string>.....<key>selectFolderForDestination</key>.....<string>id</string>.....<key>showDestinationInFinder</key>.....<string>id</string>.....<key>showInPreviewApplication</key>.....<string>id</string>.....<key>showSourceInFinder</key>.....<string>id</string>.....<key>startRestoration</key>.....<string>id</string>....</dict>....<key>CLASS</key>....<string>PRAppController</string>....<key>LANGUAGE</key>....<string>ObjC</stri

C:\Program Files (x86)\Google\Picasa3\cdautorun\Picasa Restore.app\Contents\Resources\id.lproj\PRMainMenu.nib\info.nib

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe
File Type:	XML 1.0 document, ASCII text
Category:	dropped
Size (bytes):	530
Entropy (8bit):	5.250472465860794
Encrypted:	false
SSDEEP:	12:TMHdgo+tJVEdQiCXFbCGIfx2w0GeC6mwbn:2dfyiwFrIZ2ZC6pb
MD5:	0E168543FD71A479FA5AD0E0613A1BA5
SHA1:	9ACD86A59CE7EC341021D75817D082118D351C56
SHA-256:	7C87E946FB8E106D8856A962C780503F602FAE5B09A818F5AD3ACDFC6468546A
SHA-512:	DFFAB3A94B1994D3EC558F308729DED11A9759CC6B4C6E0022ECE502AE5D2BB8437211B37549454DDB43CCACF91F0989E61A1C173B4F59FBCFF423BAFBEAC44A
Malicious:	false
Reputation:	unknown
Preview:	<?xml version="1.0" encoding="UTF-8"?>.<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">.<plist version="1.0">.<dict>..<key>IBFramework Version</key>..<string>680</string>..<key>IBLastKnownRelativeProjectPath</key>..<string>../../../Mac/Picasa.xcodeproj</string>..<key>IBOldestOS</key>..<integer>4</integer>..<key>IBOpenObjects</key>..<array/>..<key>IBSystem Version</key>..<string>9L31a</string>..<key>targetFramework</key>..<string>IBCocoaFramework</string>.</dict>.</plist>.

C:\Program Files (x86)\Google\Picasa3\cdautorun\Picasa Restore.app\Contents\Resources\id.lproj\PRMainMenu.nib\keyedobjects.nib

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe
File Type:	Apple binary property list
Category:	dropped
Size (bytes):	22473
Entropy (8bit):	6.980768471101198
Encrypted:	false
SSDEEP:	384:QgzGoV888q1EBTy1a1vSOM12rnn0uTfTGduAltaFkOryC5cn+Mu7crF8M3TCeT:96oV8y2sIQ2rnD3GdfiYn+Mu7EqM3+eT
MD5:	BD884F855D13D4F8463CFD26EE8BD631
SHA1:	363D59BAE77FE72172CF4ACEDB6718236703505C
SHA-256:	BB8FF022A1D7E8EF985E8F506CEE11C2102543D8889F3DDC32DB1C630253AA69
SHA-512:	F75FA228ADEA0DC464F5A38F1C2A4C7D784893C20E7D110F69DD1C751CBF67319234BB87AB06C203C4F212D4DEC6CB67073D38CEF98939269B0EB9C7F4C0F183
Malicious:	false
Reputation:	unknown
Preview:	bplist00.................X$versionT$topY$archiverX$objects..........]IB.objectdata.._..NSKeyedArchiver.........1.5.6.<.=.A.E.h.p...........................................................!.".%.-.@.A.M.N.U.V.Y.^.a.i.j.k.n.t.}....................................................................................... .$.)..-.0.3.4.5.8.<.C.G.H.I.J.O.W.\.].o.p.s.v.w.\|.......................................................................................#..+.,.-.2.8.@.G.H.P.Q.\.c.d.k.l.n.o.t.u.z.{...............................................r...........................%.&.8.B.F.G.H.I.O.G.Z.c.G.d.h.k.r.s.z.{.............................................................................................................".#.'.../.0.5.6.;.E.F.G.H.K.T.U.V.W.^._.`.........................................................&...'.+.2.3.5.{................................................. .!.".#.$.%.&.'.(.)..+.,.-.../.0.1.2.3.4.5.6.7.8.9.:.;.<.=.>.?.@.A.B.C.D.E.F.G.H.I.J.K.L.M.P.S...!.".#.$.%.&.'.(.)..+.,

C:\Program Files (x86)\Google\Picasa3\cdautorun\Picasa Restore.app\Contents\Resources\id.lproj\i18n\restore_resexport.xml

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe
File Type:	XML 1.0 document, ASCII text
Category:	dropped
Size (bytes):	2526
Entropy (8bit):	4.857480818631133
Encrypted:	false
SSDEEP:	48:c/9z/VnAgOxaZR5vMBt3ugbGP0lZmTZRf:GBVAgOYaCP0LmTZRf
MD5:	A438F3FABE4780AFE4E2E0AE8549A81F
SHA1:	BD9407F5228B3F5BB9D2FB55ECEAD0AC6B4D9B7A
SHA-256:	D9ABC7FA8D3DD78EC06E703BA8104EF7850F29853C4E59BE7C9D18B3841299B7
SHA-512:	EC59D0A09D1B240BF972D395877787ECF0340A300DC7EC77A42EE95AF5A5873CC5312B7265F954FA8443A78DE21A5ACA7D38D6262AA450F7C8684F0DC75C4FAF
Malicious:	false
Reputation:	unknown
Preview:	<?xml version="1.0" encoding="utf-8" ?>.<Win32Res>. <RT_DIALOG>. <res resid="#904">. <dtitle>. <xmbtext>Kembalikan dari cadangan Picasa</xmbtext>. </dtitle>. <dlayout>rect(0 0 296 154)</dlayout>. <item itemid="1" itemtype="Button" layout="rect(177 133 227 147)">. <xmbtext>Berikutnya</xmbtext>. </item>. <item itemid="2" itemtype="Button" layout="rect(239 133 289 147)">. <xmbtext>Batal</xmbtext>. </item>. <item itemid="3" itemtype="Button" layout="rect(7 133 57 147)">. <xmbtext>Keluarkan</xmbtext>. </item>. <item itemid="1010" itemtype="Button" layout="rect(25 47 236 59)">. <xmbtext>Lokasi asli</xmbtext>. </item>. <item itemid="1011" itemtype="Button" layout="rect(25 83 241 95)">. <xmbtext>Map ini</xmbtext>. </item>. <item itemid="1009" itemtype="Edit" layout="rect(41 100 221 113)"/>. <item itemid="4" itemtype="Button" layout="rect(227 100 277 114)">. <xmbtext>Ubah...</xmbtext>. </item>. <item itemid="-1" itemtype="Button" layout="r

C:\Program Files (x86)\Google\Picasa3\cdautorun\Picasa Restore.app\Contents\Resources\id.lproj\i18n\restore_stringres.xml

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe
File Type:	XML 1.0 document, ASCII text
Category:	dropped
Size (bytes):	9895
Entropy (8bit):	4.789006794714652
Encrypted:	false
SSDEEP:	192:9g0BSOpmBteTe5tEehet/8YBZzBnBU5HoedXg0BSOpmBteTe5tEehet/8YBZzBnZ:tItA4ECANMItA4ECANYySOFFrF
MD5:	0294CE3D80A4FBDD8CCF1DB285D4EF58
SHA1:	BE4DAD081D9B553D846718E7E21F0191803B5BE9
SHA-256:	98E3FA87A0CB4F053315517C89A9F9208C0263A498CDF5A8B0DE2366A5C63AFB
SHA-512:	5390A2C45F92FE0FBC67F9FCFCDEBFD9E2CEC7E360BA386A7BABE86CCBA7D2EC98CA4E404FB11BCACA27393A61985B6DB7FB936FECDD0B70A29DA38F4922E74C
Malicious:	false
Reputation:	unknown
Preview:	<?xml version="1.0" encoding="utf-8" ?>.<resources>. <stringres id="February">. <xmbtext>Februari</xmbtext>. </stringres>. <stringres id="March">. <xmbtext>Maret</xmbtext>. </stringres>. <stringres id="April">. <xmbtext>April</xmbtext>. </stringres>. <stringres id="May">. <xmbtext>Mei</xmbtext>. </stringres>. <stringres id="June">. <xmbtext>Juni</xmbtext>. </stringres>. <stringres id="July">. <xmbtext>Juli</xmbtext>. </stringres>. <stringres id="August">. <xmbtext>Agustus</xmbtext>. </stringres>. <stringres id="September">. <xmbtext>September</xmbtext>. </stringres>. <stringres id="October">. <xmbtext>Oktober</xmbtext>. </stringres>. <stringres id="November">. <xmbtext>November</xmbtext>. </stringres>. <stringres id="December">. <xmbtext>Desember</xmbtext>. </stringres>. <stringres id="Jan">. <xmbtext>Jan</xmbtext>. </stringres>. <stringres id="Feb">. <xmbtext>Feb</xmbtext>. </stringres>. <stringres id="Mar">. <xmbtext>Mar</xmbtext>. </stringres>. <stringres id="Apr">. <

C:\Program Files (x86)\Google\Picasa3\cdautorun\Picasa Restore.app\Contents\Resources\it.lproj\PRMainMenu.nib\classes.nib

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe
File Type:	XML 1.0 document, ASCII text
Category:	dropped
Size (bytes):	1571
Entropy (8bit):	4.883604938493906
Encrypted:	false
SSDEEP:	24:2dfyiwqhtsd551XBeYSjV+NaBFh3gsX4DHLqaemns4:cfyghtc55DeHj3besX4DHZs4
MD5:	AFE57505E88B3C6CD5D7A27ED6539C66
SHA1:	CA6705B7559326C5C60F8A15DFC6751208DD0643
SHA-256:	BC6AF85CB27E3E742EA8E5519483ACA800F0D2C3C469C1E6AF2161CC5BE647F4
SHA-512:	D5EC7CCED627E987028E4EAB5030126D31E105C1EA91616A956D55552F19F2E71A1EA327D4039428959D661A33E4F072B806BA20BFB3CDD2D5EB0DF98CD4466C
Malicious:	false
Reputation:	unknown
Preview:	<?xml version="1.0" encoding="UTF-8"?>.<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">.<plist version="1.0">.<dict>..<key>IBClasses</key>..<array>...<dict>....<key>ACTIONS</key>....<dict>.....<key>cancelPromptForDestinationFolderChoice</key>.....<string>id</string>.....<key>cancelRestoration</key>.....<string>id</string>.....<key>finishPromptForDestinationFolderChoice</key>.....<string>id</string>.....<key>openManifestFile</key>.....<string>id</string>.....<key>openSourceInDefaultApplication</key>.....<string>id</string>.....<key>selectFolderForDestination</key>.....<string>id</string>.....<key>showDestinationInFinder</key>.....<string>id</string>.....<key>showInPreviewApplication</key>.....<string>id</string>.....<key>showSourceInFinder</key>.....<string>id</string>.....<key>startRestoration</key>.....<string>id</string>....</dict>....<key>CLASS</key>....<string>PRAppController</string>....<key>LANGUAGE</key>....<string>ObjC</stri

C:\Program Files (x86)\Google\Picasa3\cdautorun\Picasa Restore.app\Contents\Resources\it.lproj\PRMainMenu.nib\info.nib

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe
File Type:	XML 1.0 document, ASCII text
Category:	dropped
Size (bytes):	530
Entropy (8bit):	5.250472465860794
Encrypted:	false
SSDEEP:	12:TMHdgo+tJVEdQiCXFbCGIfx2w0GeC6mwbn:2dfyiwFrIZ2ZC6pb
MD5:	0E168543FD71A479FA5AD0E0613A1BA5
SHA1:	9ACD86A59CE7EC341021D75817D082118D351C56
SHA-256:	7C87E946FB8E106D8856A962C780503F602FAE5B09A818F5AD3ACDFC6468546A
SHA-512:	DFFAB3A94B1994D3EC558F308729DED11A9759CC6B4C6E0022ECE502AE5D2BB8437211B37549454DDB43CCACF91F0989E61A1C173B4F59FBCFF423BAFBEAC44A
Malicious:	false
Reputation:	unknown
Preview:	<?xml version="1.0" encoding="UTF-8"?>.<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">.<plist version="1.0">.<dict>..<key>IBFramework Version</key>..<string>680</string>..<key>IBLastKnownRelativeProjectPath</key>..<string>../../../Mac/Picasa.xcodeproj</string>..<key>IBOldestOS</key>..<integer>4</integer>..<key>IBOpenObjects</key>..<array/>..<key>IBSystem Version</key>..<string>9L31a</string>..<key>targetFramework</key>..<string>IBCocoaFramework</string>.</dict>.</plist>.

C:\Program Files (x86)\Google\Picasa3\cdautorun\Picasa Restore.app\Contents\Resources\it.lproj\PRMainMenu.nib\keyedobjects.nib

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe
File Type:	Apple binary property list
Category:	dropped
Size (bytes):	22574
Entropy (8bit):	6.976514768671229
Encrypted:	false
SSDEEP:	384:dLx3oV88POLpTDxdF1EfXK81yvYHQ89qB0D7jusjc9f0jNBb4VnjrXhQWLu2qJaa:zoV82iDx72f1RVDvxaf0jvbQyJwQwLJO
MD5:	FB64E38F2AB82B736379BFA9462AC97E
SHA1:	46E10602F64B176F6A679359C73E887BBA2DDE60
SHA-256:	C3ED888371D7CBDEA2B8F20A402E5DF12C895B12D533475B93723E31EB11A19F
SHA-512:	A87316768A0FE089512A67B65B1C42E81A33B4D9392FF66277A29F0480F03815DD9F74CFD7B4E2E4CBBD9116897AD952450FF765B890C684FC2A6749215FCD5F
Malicious:	false
Reputation:	unknown
Preview:	bplist00.................X$versionT$topY$archiverX$objects..........]IB.objectdata.._..NSKeyedArchiver.........1.5.6.<.=.A.E.h.p....................................................... .!.$.,.?.@.L.M.U.V.Y.^.a.i.j.k.n.t.}.........................................................................................#.(.).,./.0.3.@.A.B.E.M.N...R.S.V.^.e.f.m.n.y.............................................................!.0.1.5.6.5.:.=.@.I...J.K.r.L.S.T.Y.Z.].d.e.m.n.r.u.\|.}...........................................................................................$.(.)..+./.6.;.<.=.A.I.J.K.L.Q.V.W.\.a.b.g.s.t.u.\|.......................................................................................................%.&.'.,.-.1.8.9.:.;.E.F.G.H.K.T.U.V.W.^._.`.t.......................................................&.../.0...3.5.{................................................. .!.".#.$.%.&.'.(.)..+.,.-.../.0.1.2.3.4.5.6.7.8.9.:.;.<.=.>.?.@.A.B.C.D.E.F.G.H.I.J.K.L.M.P.S...!.".#.$.%.&.'.(.).*.+.,

C:\Program Files (x86)\Google\Picasa3\cdautorun\Picasa Restore.app\Contents\Resources\it.lproj\i18n\restore_resexport.xml

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 text
Category:	dropped
Size (bytes):	2577
Entropy (8bit):	4.856425734215127
Encrypted:	false
SSDEEP:	48:c/ynz/Vs/Asko2eR5U6ZZq+uzC0nb+k558aTZRf:GOVs4skonRZqkk55rTZRf
MD5:	22C8C2FB3AC7E4E35C8138B61701CA99
SHA1:	EEFC35812C7550477A5EEF04DAD16159A3D4F7D1
SHA-256:	E1BAA857CB15F37A0FC24C9D0ABD7B8B5DAEF676B0FA9599280944B2D7A1E4E4
SHA-512:	8289DDD482BFE25AF78B6D329478849C356B79E19B425F5DFC41DEC94E206D35F11F27035C450CBE80D0EBCFE129A3579A7C684FED7C3EB1242C65F4FC933D17
Malicious:	false
Reputation:	unknown
Preview:	<?xml version="1.0" encoding="utf-8" ?>.<Win32Res>. <RT_DIALOG>. <res resid="#904">. <dtitle>. <xmbtext>Ripristina da un backup Picasa</xmbtext>. </dtitle>. <dlayout>rect(0 0 296 154)</dlayout>. <item itemid="1" itemtype="Button" layout="rect(177 133 227 147)">. <xmbtext>Avanti</xmbtext>. </item>. <item itemid="2" itemtype="Button" layout="rect(239 133 289 147)">. <xmbtext>Annulla</xmbtext>. </item>. <item itemid="3" itemtype="Button" layout="rect(7 133 57 147)">. <xmbtext>Espulsione</xmbtext>. </item>. <item itemid="1010" itemtype="Button" layout="rect(25 47 236 59)">. <xmbtext>Posizioni originali</xmbtext>. </item>. <item itemid="1011" itemtype="Button" layout="rect(25 83 241 95)">. <xmbtext>Questa cartella</xmbtext>. </item>. <item itemid="1009" itemtype="Edit" layout="rect(41 100 221 113)"/>. <item itemid="4" itemtype="Button" layout="rect(227 100 277 114)">. <xmbtext>Cambia...</xmbtext>. </item>. <item itemid="-1" itemtype="B

C:\Program Files (x86)\Google\Picasa3\cdautorun\Picasa Restore.app\Contents\Resources\it.lproj\i18n\restore_stringres.xml

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe
File Type:	XML 1.0 document, ASCII text
Category:	dropped
Size (bytes):	9979
Entropy (8bit):	4.767292319481719
Encrypted:	false
SSDEEP:	192:9aqBn3aEBgeteWtEebe7u8YBZQzyBqVWoeBqaqBn3aEBgeteWtEebe7u8YBZQzyt:Zpgy3E8tp+pgy3E8tp9ROcgQrj
MD5:	5DD91EA40091A6A448C46BE0F319DA0D
SHA1:	E8A3EA4899FB38441AD1821DD9245B8A6DB3CD08
SHA-256:	FA11A68224FA323EE267F341889B76C94D6AAC3EA7EAD0457199B2B24E7F7130
SHA-512:	3E703EB7AB38A67EDEECB52C5A78291CFC60872D4F8CB20CAE029EECA0F36E3D19D0C95CBD94724C984F2CC3C1B893FF9D84DD34517220B0584F7E0268BBB115
Malicious:	false
Reputation:	unknown
Preview:	<?xml version="1.0" encoding="utf-8" ?>.<resources>. <stringres id="February">. <xmbtext>Febbraio</xmbtext>. </stringres>. <stringres id="March">. <xmbtext>Marzo</xmbtext>. </stringres>. <stringres id="April">. <xmbtext>Aprile</xmbtext>. </stringres>. <stringres id="May">. <xmbtext>Maggio</xmbtext>. </stringres>. <stringres id="June">. <xmbtext>Giugno</xmbtext>. </stringres>. <stringres id="July">. <xmbtext>Luglio</xmbtext>. </stringres>. <stringres id="August">. <xmbtext>Agosto</xmbtext>. </stringres>. <stringres id="September">. <xmbtext>Settembre</xmbtext>. </stringres>. <stringres id="October">. <xmbtext>Ottobre</xmbtext>. </stringres>. <stringres id="November">. <xmbtext>Novembre</xmbtext>. </stringres>. <stringres id="December">. <xmbtext>Dicembre</xmbtext>. </stringres>. <stringres id="Jan">. <xmbtext>Gen</xmbtext>. </stringres>. <stringres id="Feb">. <xmbtext>Feb</xmbtext>. </stringres>. <stringres id="Mar">. <xmbtext>Mar</xmbtext>. </stringres>. <stringres id="Ap

C:\Program Files (x86)\Google\Picasa3\cdautorun\Picasa Restore.app\Contents\Resources\ja.lproj\PRMainMenu.nib\classes.nib

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe
File Type:	XML 1.0 document, ASCII text
Category:	dropped
Size (bytes):	1571
Entropy (8bit):	4.883604938493906
Encrypted:	false
SSDEEP:	24:2dfyiwqhtsd551XBeYSjV+NaBFh3gsX4DHLqaemns4:cfyghtc55DeHj3besX4DHZs4
MD5:	AFE57505E88B3C6CD5D7A27ED6539C66
SHA1:	CA6705B7559326C5C60F8A15DFC6751208DD0643
SHA-256:	BC6AF85CB27E3E742EA8E5519483ACA800F0D2C3C469C1E6AF2161CC5BE647F4
SHA-512:	D5EC7CCED627E987028E4EAB5030126D31E105C1EA91616A956D55552F19F2E71A1EA327D4039428959D661A33E4F072B806BA20BFB3CDD2D5EB0DF98CD4466C
Malicious:	false
Reputation:	unknown
Preview:	<?xml version="1.0" encoding="UTF-8"?>.<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">.<plist version="1.0">.<dict>..<key>IBClasses</key>..<array>...<dict>....<key>ACTIONS</key>....<dict>.....<key>cancelPromptForDestinationFolderChoice</key>.....<string>id</string>.....<key>cancelRestoration</key>.....<string>id</string>.....<key>finishPromptForDestinationFolderChoice</key>.....<string>id</string>.....<key>openManifestFile</key>.....<string>id</string>.....<key>openSourceInDefaultApplication</key>.....<string>id</string>.....<key>selectFolderForDestination</key>.....<string>id</string>.....<key>showDestinationInFinder</key>.....<string>id</string>.....<key>showInPreviewApplication</key>.....<string>id</string>.....<key>showSourceInFinder</key>.....<string>id</string>.....<key>startRestoration</key>.....<string>id</string>....</dict>....<key>CLASS</key>....<string>PRAppController</string>....<key>LANGUAGE</key>....<string>ObjC</stri

C:\Program Files (x86)\Google\Picasa3\cdautorun\Picasa Restore.app\Contents\Resources\ja.lproj\PRMainMenu.nib\info.nib

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe
File Type:	XML 1.0 document, ASCII text
Category:	dropped
Size (bytes):	530
Entropy (8bit):	5.250472465860794
Encrypted:	false
SSDEEP:	12:TMHdgo+tJVEdQiCXFbCGIfx2w0GeC6mwbn:2dfyiwFrIZ2ZC6pb
MD5:	0E168543FD71A479FA5AD0E0613A1BA5
SHA1:	9ACD86A59CE7EC341021D75817D082118D351C56
SHA-256:	7C87E946FB8E106D8856A962C780503F602FAE5B09A818F5AD3ACDFC6468546A
SHA-512:	DFFAB3A94B1994D3EC558F308729DED11A9759CC6B4C6E0022ECE502AE5D2BB8437211B37549454DDB43CCACF91F0989E61A1C173B4F59FBCFF423BAFBEAC44A
Malicious:	false
Reputation:	unknown
Preview:	<?xml version="1.0" encoding="UTF-8"?>.<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">.<plist version="1.0">.<dict>..<key>IBFramework Version</key>..<string>680</string>..<key>IBLastKnownRelativeProjectPath</key>..<string>../../../Mac/Picasa.xcodeproj</string>..<key>IBOldestOS</key>..<integer>4</integer>..<key>IBOpenObjects</key>..<array/>..<key>IBSystem Version</key>..<string>9L31a</string>..<key>targetFramework</key>..<string>IBCocoaFramework</string>.</dict>.</plist>.

C:\Program Files (x86)\Google\Picasa3\cdautorun\Picasa Restore.app\Contents\Resources\ja.lproj\PRMainMenu.nib\keyedobjects.nib

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe
File Type:	Apple binary property list
Category:	dropped
Size (bytes):	22903
Entropy (8bit):	6.949239072188486
Encrypted:	false
SSDEEP:	384:QgzGoV888P1EBTX1a1v4oM12I4ayfBaA7IduAltaNkmryC5bwkMVOTR2rtF/2nQi:96oV832pKQ2I4DZlIdfiVwkMsTR2rH/a
MD5:	07FAEF7617E60283BE4659C0685E2FF9
SHA1:	CEBE8859BE55B149991F2AB8DD0110AD5DD0CB34
SHA-256:	983F2EDC02D05C47006099FCC3632AFC807FF4670428B2E257E6A5F35CB09E9D
SHA-512:	BD4F2AB5DE11D1AC742422EC59E36B218CF14178650AE98EFA61A629F8E44144381D86487F29C12F43B1E415B7A91ED9E52BE6DB9F2A31D71EEFE03A39BE4B81
Malicious:	false
Reputation:	unknown
Preview:	bplist00.................X$versionT$topY$archiverX$objects..........]IB.objectdata.._..NSKeyedArchiver.........1.5.6.<.=.A.E.h.p...........................................................!.".%.-.@.A.M.N.U.V.Y.^.a.i.j.k.n.t.}....................................................................................... .$.)..-.0.3.4.5.8.<.C.G.H.I.J.O.W.\.].o.p.s.v.w.\|.......................................................................................#..+.,.-.2.8.@.G.H.P.Q.\.c.d.k.l.n.o.t.u.z.{...............................................r...........................%.&.8.B.F.G.H.I.O.G.Z.c.G.d.h.k.r.s.z.{.............................................................................................................".#.'.../.0.5.6.;.E.F.G.H.K.T.U.V.W.^._.`.........................................................&...'.+.2.3.5.{................................................. .!.".#.$.%.&.'.(.)..+.,.-.../.0.1.2.3.4.5.6.7.8.9.:.;.<.=.>.?.@.A.B.C.D.E.F.G.H.I.J.K.L.M.P.S...!.".#.$.%.&.'.(.)..+.,

C:\Program Files (x86)\Google\Picasa3\cdautorun\Picasa Restore.app\Contents\Resources\ja.lproj\i18n\restore_resexport.xml

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 text
Category:	dropped
Size (bytes):	2604
Entropy (8bit):	5.273309685093036
Encrypted:	false
SSDEEP:	48:c/LrR/VqAe9n/R5XqhMajX1kNrxR+T8AVTZRf:GL9VNe9jsMwOf+TdTZRf
MD5:	9064C996992F45C14F10D3DF4AD56374
SHA1:	F4F0292C2EE68402E6A0C5A88FC0369247FC236F
SHA-256:	435CC8757373096AF15BB2BC7392E597E46655842D4AB328242691511D8142EA
SHA-512:	CB008F768841DB1CBDCAE5578583E69DEF121DECEE99F1F3FC5DBA1F9598F48A12F0ECA5FAE309146B36A187E11969F207A8A7C0DCE16D30A7FA10966BE326AF
Malicious:	false
Reputation:	unknown
Preview:	<?xml version="1.0" encoding="utf-8" ?>.<Win32Res>. <RT_DIALOG>. <res resid="#904">. <dtitle>. <xmbtext>Picasa ..........</xmbtext>. </dtitle>. <dlayout>rect(0 0 296 154)</dlayout>. <item itemid="1" itemtype="Button" layout="rect(177 133 227 147)">. <xmbtext>..</xmbtext>. </item>. <item itemid="2" itemtype="Button" layout="rect(239 133 289 147)">. <xmbtext>.....</xmbtext>. </item>. <item itemid="3" itemtype="Button" layout="rect(7 133 57 147)">. <xmbtext>....</xmbtext>. </item>. <item itemid="1010" itemtype="Button" layout="rect(25 47 236 59)">. <xmbtext>....</xmbtext>. </item>. <item itemid="1011" itemtype="Button" layout="rect(25 83 241 95)">. <xmbtext>......</xmbtext>. </item>. <item itemid="1009" itemtype="Edit" layout="rect(41 100 221 113)"/>. <item itemid="4" itemtype="Button" layout="rect(227 100 277 114)">. <xmbtext>.....</xmbtext>. </item>. <item itemid="-1

C:\Program Files (x86)\Google\Picasa3\cdautorun\Picasa Restore.app\Contents\Resources\ja.lproj\i18n\restore_stringres.xml

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 text
Category:	dropped
Size (bytes):	10523
Entropy (8bit):	5.268744678268913
Encrypted:	false
SSDEEP:	192:9SCC+x3FedeMtEeDerXjJCDyHZKMoTSQSCC+x3FedeMtEeDerXjJCDyHZKMoTWSe:P2XEAt2XEAx6OM3f
MD5:	666F64C2BED7F0B591C36F05FD0F923F
SHA1:	9E236D4935FD2BCDE3E40A3833D3D5185DE4816D
SHA-256:	287117828E592559AD425775DA1ADEE8AFB2A8024FAF3B3153942418F28383E9
SHA-512:	11A60971AC96CE71F7EE735623CB29FDF6EBACC7CCCC4E4D3F69BE6808E3015E542AC95C9C26F36A3810DAB241EE7A0E19A1D26E9D047C0DE287E1E6929C655A
Malicious:	false
Reputation:	unknown
Preview:	<?xml version="1.0" encoding="utf-8" ?>.<resources>. <stringres id="February">. <xmbtext>2 .</xmbtext>. </stringres>. <stringres id="March">. <xmbtext>3 .</xmbtext>. </stringres>. <stringres id="April">. <xmbtext>4 .</xmbtext>. </stringres>. <stringres id="May">. <xmbtext>5 .</xmbtext>. </stringres>. <stringres id="June">. <xmbtext>6 .</xmbtext>. </stringres>. <stringres id="July">. <xmbtext>7 .</xmbtext>. </stringres>. <stringres id="August">. <xmbtext>8 .</xmbtext>. </stringres>. <stringres id="September">. <xmbtext>9 .</xmbtext>. </stringres>. <stringres id="October">. <xmbtext>10 .</xmbtext>. </stringres>. <stringres id="November">. <xmbtext>11 .</xmbtext>. </stringres>. <stringres id="December">. <xmbtext>12 .</xmbtext>. </stringres>. <stringres id="Jan">. <xmbtext>1 .</xmbtext>. </stringres>. <stringres id="Feb">. <xmbtext>2 .</xmbtext>. </stringres>. <stringres id="Mar">. <xmbtext>3 .</xmbtext>. </stringres>. <stringres id="Apr">. <xmbt

C:\Program Files (x86)\Google\Picasa3\cdautorun\Picasa Restore.app\Contents\Resources\ko.lproj\PRMainMenu.nib\classes.nib

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe
File Type:	XML 1.0 document, ASCII text
Category:	dropped
Size (bytes):	1571
Entropy (8bit):	4.883604938493906
Encrypted:	false
SSDEEP:	24:2dfyiwqhtsd551XBeYSjV+NaBFh3gsX4DHLqaemns4:cfyghtc55DeHj3besX4DHZs4
MD5:	AFE57505E88B3C6CD5D7A27ED6539C66
SHA1:	CA6705B7559326C5C60F8A15DFC6751208DD0643
SHA-256:	BC6AF85CB27E3E742EA8E5519483ACA800F0D2C3C469C1E6AF2161CC5BE647F4
SHA-512:	D5EC7CCED627E987028E4EAB5030126D31E105C1EA91616A956D55552F19F2E71A1EA327D4039428959D661A33E4F072B806BA20BFB3CDD2D5EB0DF98CD4466C
Malicious:	false
Reputation:	unknown
Preview:	<?xml version="1.0" encoding="UTF-8"?>.<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">.<plist version="1.0">.<dict>..<key>IBClasses</key>..<array>...<dict>....<key>ACTIONS</key>....<dict>.....<key>cancelPromptForDestinationFolderChoice</key>.....<string>id</string>.....<key>cancelRestoration</key>.....<string>id</string>.....<key>finishPromptForDestinationFolderChoice</key>.....<string>id</string>.....<key>openManifestFile</key>.....<string>id</string>.....<key>openSourceInDefaultApplication</key>.....<string>id</string>.....<key>selectFolderForDestination</key>.....<string>id</string>.....<key>showDestinationInFinder</key>.....<string>id</string>.....<key>showInPreviewApplication</key>.....<string>id</string>.....<key>showSourceInFinder</key>.....<string>id</string>.....<key>startRestoration</key>.....<string>id</string>....</dict>....<key>CLASS</key>....<string>PRAppController</string>....<key>LANGUAGE</key>....<string>ObjC</stri

C:\Program Files (x86)\Google\Picasa3\cdautorun\Picasa Restore.app\Contents\Resources\ko.lproj\PRMainMenu.nib\info.nib

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe
File Type:	XML 1.0 document, ASCII text
Category:	dropped
Size (bytes):	530
Entropy (8bit):	5.250472465860794
Encrypted:	false
SSDEEP:	12:TMHdgo+tJVEdQiCXFbCGIfx2w0GeC6mwbn:2dfyiwFrIZ2ZC6pb
MD5:	0E168543FD71A479FA5AD0E0613A1BA5
SHA1:	9ACD86A59CE7EC341021D75817D082118D351C56
SHA-256:	7C87E946FB8E106D8856A962C780503F602FAE5B09A818F5AD3ACDFC6468546A
SHA-512:	DFFAB3A94B1994D3EC558F308729DED11A9759CC6B4C6E0022ECE502AE5D2BB8437211B37549454DDB43CCACF91F0989E61A1C173B4F59FBCFF423BAFBEAC44A
Malicious:	false
Reputation:	unknown
Preview:	<?xml version="1.0" encoding="UTF-8"?>.<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">.<plist version="1.0">.<dict>..<key>IBFramework Version</key>..<string>680</string>..<key>IBLastKnownRelativeProjectPath</key>..<string>../../../Mac/Picasa.xcodeproj</string>..<key>IBOldestOS</key>..<integer>4</integer>..<key>IBOpenObjects</key>..<array/>..<key>IBSystem Version</key>..<string>9L31a</string>..<key>targetFramework</key>..<string>IBCocoaFramework</string>.</dict>.</plist>.

C:\Program Files (x86)\Google\Picasa3\cdautorun\Picasa Restore.app\Contents\Resources\ko.lproj\PRMainMenu.nib\keyedobjects.nib

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe
File Type:	Apple binary property list
Category:	dropped
Size (bytes):	22719
Entropy (8bit):	6.972817405750206
Encrypted:	false
SSDEEP:	384:rCioV8vV+cfwN+NrY1EshK8sXUrOMtfPTsFpbVTnR6IYuasTAdUdR7NQzspWE5w0:rCioV89+owIS2ZUIYDsAKByzsotefVmw
MD5:	91ADCFB8AAD3E11F21CB9D523AA88636
SHA1:	521B25A564CEB7FAD48B04ACB0A15A5EC892B9C3
SHA-256:	36F6D619D11ED3EF27989B8F4490F602453314D79166503FCB8AD3922B42F231
SHA-512:	D0FE6785CEAB4BBC95228489C4A2DEBB266DE2EAC96998D80083C4F592ACE62F8A108E8AE4EA91A32BFD926624E98FB3800104EEAC7882C4AE9AAB598CC185AA
Malicious:	false
Reputation:	unknown
Preview:	bplist00.................X$versionT$topY$archiverX$objects..........]IB.objectdata.._..NSKeyedArchiver.........1.5.6.<.=.A.E.h.p.~.............................................................................#.$.%..1.2.9.:.;.@.A.F.M.S.T.U.Z.z...............................................................!.".(.)./.9.:.@.A.F.G.J.P.X.Y._.`.f.n.o.u.v.~............................................................................................. .)../.0.3.4.8.?.C.D.E.F.J.Q.R.S.X.l.m.n.o.y....................................................................... .&...1.:...;.?.B.I.J.Q.R.].f.g.h.i.j.k.l.m.w.{.\|......................................................................................................... .!.%.,.-.../.4.5.:.;.E.F.G.H.K.R.S.T.U.^._.`.......................................................!."...+.2.3.5.{................................................. .!.".#.$.%.&.'.(.)..+.,.-.../.0.1.2.3.4.5.6.7.8.9.:.;.<.=.>.?.@.A.B.C.D.E.F.G.H.I.J.K.L.M.P.S...!.".#.$.%.&.'.(.)..+.,.-

C:\Program Files (x86)\Google\Picasa3\cdautorun\Picasa Restore.app\Contents\Resources\ko.lproj\i18n\restore_resexport.xml

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 text
Category:	dropped
Size (bytes):	2500
Entropy (8bit):	5.220114400775547
Encrypted:	false
SSDEEP:	24:2dRtDSpnzDLQu537EvAdn1g/vov8FvREGDpe9kvAFIKKYHkbawAEu4saiLKkSpn+:c/+9/V5IAE/g4R5VAyAcVt0yAvtgiRf
MD5:	84F4B294E99FF4EBF8DA9C320E3A1915
SHA1:	F969849B45A6B2BBDE1964CB33802A130D89F01B
SHA-256:	B04F2D30FD5E6750E482CFDA74385AD0EAE35B941F185B04444E74253FF360F8
SHA-512:	3E1610DB655076D3118D66640EA23E794165E80725E81FD1B6A0525D4B1D56C97CFE3F86049A92117F8FDF4F80AD310A2DD251F9969BCE56DB46616CF4A08AAA
Malicious:	false
Reputation:	unknown
Preview:	<?xml version="1.0" encoding="utf-8" ?>.<Win32Res>. <RT_DIALOG>. <res resid="#904">. <dtitle>. <xmbtext>Picasa .... ..</xmbtext>. </dtitle>. <dlayout>rect(0 0 296 154)</dlayout>. <item itemid="1" itemtype="Button" layout="rect(177 133 227 147)">. <xmbtext>..</xmbtext>. </item>. <item itemid="2" itemtype="Button" layout="rect(239 133 289 147)">. <xmbtext>..</xmbtext>. </item>. <item itemid="3" itemtype="Button" layout="rect(7 133 57 147)">. <xmbtext>...</xmbtext>. </item>. <item itemid="1010" itemtype="Button" layout="rect(25 47 236 59)">. <xmbtext>.. ..</xmbtext>. </item>. <item itemid="1011" itemtype="Button" layout="rect(25 83 241 95)">. <xmbtext>.. ..</xmbtext>. </item>. <item itemid="1009" itemtype="Edit" layout="rect(41 100 221 113)"/>. <item itemid="4" itemtype="Button" layout="rect(227 100 277 114)">. <xmbtext>...</xmbtext>. </item>. <item itemid="-1" itemtype="Button" layout=

C:\Program Files (x86)\Google\Picasa3\cdautorun\Picasa Restore.app\Contents\Resources\ko.lproj\i18n\restore_stringres.xml

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 text
Category:	dropped
Size (bytes):	10102
Entropy (8bit):	5.2279920104026925
Encrypted:	false
SSDEEP:	192:91fxdkU+eceFtEeAVeKn2IwxiJCyfFoApLnv1fxdkU+eceFtEeAVeKn2IwxiJCyo:c9gEVVFVFO9gEVVFVi6EvzZ/O/O
MD5:	BA53430EF9E46990011FE4DA9C4EBBEE
SHA1:	57449070BE1DD6557E41E03226565A1B1610054D
SHA-256:	80B21983D6DD9108E215C0D4998C5FB9007C1FC77A151ECA311DD89627E65EB9
SHA-512:	63A1C01ABDD0B90CAB0829F3C3B4F72C815F09E853AE34CE757A8EE33019D8D12AC6C91B22229B0A4D1E55AF3E3BA3CF157E25C10CACAC192D731A307871E12E
Malicious:	false
Reputation:	unknown
Preview:	<?xml version="1.0" encoding="utf-8" ?>.<resources>. <stringres id="February">. <xmbtext>2.</xmbtext>. </stringres>. <stringres id="March">. <xmbtext>3.</xmbtext>. </stringres>. <stringres id="April">. <xmbtext>4.</xmbtext>. </stringres>. <stringres id="May">. <xmbtext>5.</xmbtext>. </stringres>. <stringres id="June">. <xmbtext>6.</xmbtext>. </stringres>. <stringres id="July">. <xmbtext>7.</xmbtext>. </stringres>. <stringres id="August">. <xmbtext>8.</xmbtext>. </stringres>. <stringres id="September">. <xmbtext>9.</xmbtext>. </stringres>. <stringres id="October">. <xmbtext>10.</xmbtext>. </stringres>. <stringres id="November">. <xmbtext>11.</xmbtext>. </stringres>. <stringres id="December">. <xmbtext>12.</xmbtext>. </stringres>. <stringres id="Jan">. <xmbtext>1.</xmbtext>. </stringres>. <stringres id="Feb">. <xmbtext>2.</xmbtext>. </stringres>. <stringres id="Mar">. <xmbtext>3.</xmbtext>. </stringres>. <stringres id="Apr">. <xmbtext>4.</xmbt

C:\Program Files (x86)\Google\Picasa3\cdautorun\Picasa Restore.app\Contents\Resources\lt.lproj\PRMainMenu.nib\classes.nib

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe
File Type:	XML 1.0 document, ASCII text
Category:	dropped
Size (bytes):	1571
Entropy (8bit):	4.883604938493906
Encrypted:	false
SSDEEP:	24:2dfyiwqhtsd551XBeYSjV+NaBFh3gsX4DHLqaemns4:cfyghtc55DeHj3besX4DHZs4
MD5:	AFE57505E88B3C6CD5D7A27ED6539C66
SHA1:	CA6705B7559326C5C60F8A15DFC6751208DD0643
SHA-256:	BC6AF85CB27E3E742EA8E5519483ACA800F0D2C3C469C1E6AF2161CC5BE647F4
SHA-512:	D5EC7CCED627E987028E4EAB5030126D31E105C1EA91616A956D55552F19F2E71A1EA327D4039428959D661A33E4F072B806BA20BFB3CDD2D5EB0DF98CD4466C
Malicious:	false
Reputation:	unknown
Preview:	<?xml version="1.0" encoding="UTF-8"?>.<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">.<plist version="1.0">.<dict>..<key>IBClasses</key>..<array>...<dict>....<key>ACTIONS</key>....<dict>.....<key>cancelPromptForDestinationFolderChoice</key>.....<string>id</string>.....<key>cancelRestoration</key>.....<string>id</string>.....<key>finishPromptForDestinationFolderChoice</key>.....<string>id</string>.....<key>openManifestFile</key>.....<string>id</string>.....<key>openSourceInDefaultApplication</key>.....<string>id</string>.....<key>selectFolderForDestination</key>.....<string>id</string>.....<key>showDestinationInFinder</key>.....<string>id</string>.....<key>showInPreviewApplication</key>.....<string>id</string>.....<key>showSourceInFinder</key>.....<string>id</string>.....<key>startRestoration</key>.....<string>id</string>....</dict>....<key>CLASS</key>....<string>PRAppController</string>....<key>LANGUAGE</key>....<string>ObjC</stri

C:\Program Files (x86)\Google\Picasa3\cdautorun\Picasa Restore.app\Contents\Resources\lt.lproj\PRMainMenu.nib\info.nib

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe
File Type:	XML 1.0 document, ASCII text
Category:	dropped
Size (bytes):	530
Entropy (8bit):	5.250472465860794
Encrypted:	false
SSDEEP:	12:TMHdgo+tJVEdQiCXFbCGIfx2w0GeC6mwbn:2dfyiwFrIZ2ZC6pb
MD5:	0E168543FD71A479FA5AD0E0613A1BA5
SHA1:	9ACD86A59CE7EC341021D75817D082118D351C56
SHA-256:	7C87E946FB8E106D8856A962C780503F602FAE5B09A818F5AD3ACDFC6468546A
SHA-512:	DFFAB3A94B1994D3EC558F308729DED11A9759CC6B4C6E0022ECE502AE5D2BB8437211B37549454DDB43CCACF91F0989E61A1C173B4F59FBCFF423BAFBEAC44A
Malicious:	false
Reputation:	unknown
Preview:	<?xml version="1.0" encoding="UTF-8"?>.<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">.<plist version="1.0">.<dict>..<key>IBFramework Version</key>..<string>680</string>..<key>IBLastKnownRelativeProjectPath</key>..<string>../../../Mac/Picasa.xcodeproj</string>..<key>IBOldestOS</key>..<integer>4</integer>..<key>IBOpenObjects</key>..<array/>..<key>IBSystem Version</key>..<string>9L31a</string>..<key>targetFramework</key>..<string>IBCocoaFramework</string>.</dict>.</plist>.

C:\Program Files (x86)\Google\Picasa3\cdautorun\Picasa Restore.app\Contents\Resources\lt.lproj\PRMainMenu.nib\keyedobjects.nib

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe
File Type:	Apple binary property list
Category:	dropped
Size (bytes):	23876
Entropy (8bit):	6.813270643539299
Encrypted:	false
SSDEEP:	384:+LxXoV8vPOLtTDxdF1Ef2K81yv0r89NZilusjSRf1bBx4rjrX+xwMN4c0nVM4PK:8oV8HeDx72exwPZilxgf11xCAwMmjPK
MD5:	4EA78C6BE8E222D988F8418898F9BF19
SHA1:	F8FDB92C622E22233AC94EC02524C2E6237C854D
SHA-256:	B9D4EDFDDD4822147061DAA560D4208C2B98309ABD7E868A59154E4AB761E8DB
SHA-512:	0BB8429715D74E6B25B374EAB61349DDF8811A3D2A4CCE090344DA3A32D2E5C2D4EE14A257F2A48F7F7D6282B6CEC2F1261CCA907AE9AE323B5A25064F06C911
Malicious:	false
Reputation:	unknown
Preview:	bplist00.................X$versionT$topY$archiverX$objects..........]IB.objectdata.._..NSKeyedArchiver.........1.5.6.<.=.A.E.h.p....................................................... .!.$.,.?.@.L.M.U.V.Y.^.a.i.j.k.n.t.}.........................................................................................#.(.).,./.0.3.@.A.B.E.M.N...R.S.V.^.e.f.m.n.y.............................................................!.0.1.5.6.5.:.=.@.I...J.K.r.L.S.T.Y.Z.].d.e.m.n.r.u.\|.}...........................................................................................$.(.)..+./.6.;.<.=.A.I.J.K.L.Q.V.W.\.a.b.g.s.t.u.\|.......................................................................................................%.&.'.,.-.1.8.9.:.;.E.F.G.H.K.T.U.V.W.^._.`.......................................................&.../.0...3.5.{................................................. .!.".#.$.%.&.'.(.)..+.,.-.../.0.1.2.3.4.5.6.7.8.9.:.;.<.=.>.?.@.A.B.C.D.E.F.G.H.I.J.K.L.M.P.S...!.".#.$.%.&.'.(.).*.+.,.-

C:\Program Files (x86)\Google\Picasa3\cdautorun\Picasa Restore.app\Contents\Resources\lt.lproj\i18n\restore_resexport.xml

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 text
Category:	dropped
Size (bytes):	2582
Entropy (8bit):	4.971873576071106
Encrypted:	false
SSDEEP:	48:c/K6U/VdAsASgn2R5WVsMbXH8bvAbZsj5HTZRf:GKZVusASDSdb3cvAbZstTZRf
MD5:	1E522B0B7874604DF2E91F0948E4BB81
SHA1:	E308C63952A838A0D7E1DAD8003298085E7B0980
SHA-256:	8DA5BBC3A8AB310AF25F44BC825736D3FF53C55E5165839F785C8C8C47F12437
SHA-512:	8F3FF6801DD0431505EAA4F6A3530F080AE5934507C727EE6391065F6B2CCF6A817C152939CCF9B407EC29D747F3A189473DF93E5F2B5090DB45485F7A3D25B5
Malicious:	false
Reputation:	unknown
Preview:	<?xml version="1.0" encoding="utf-8" ?>.<Win32Res>. <RT_DIALOG>. <res resid="#904">. <dtitle>. <xmbtext>Atkurti i. .Picasa. atsargin.s kopijos</xmbtext>. </dtitle>. <dlayout>rect(0 0 296 154)</dlayout>. <item itemid="1" itemtype="Button" layout="rect(177 133 227 147)">. <xmbtext>Kitas</xmbtext>. </item>. <item itemid="2" itemtype="Button" layout="rect(239 133 289 147)">. <xmbtext>At.aukti</xmbtext>. </item>. <item itemid="3" itemtype="Button" layout="rect(7 133 57 147)">. <xmbtext>I.stumti</xmbtext>. </item>. <item itemid="1010" itemtype="Button" layout="rect(25 47 236 59)">. <xmbtext>Pradin.s vietos</xmbtext>. </item>. <item itemid="1011" itemtype="Button" layout="rect(25 83 241 95)">. <xmbtext>.is aplankas</xmbtext>. </item>. <item itemid="1009" itemtype="Edit" layout="rect(41 100 221 113)"/>. <item itemid="4" itemtype="Button" layout="rect(227 100 277 114)">. <xmbtext>Keisti...</xmbtext>. </item>. <item itemid="-1" it

C:\Program Files (x86)\Google\Picasa3\cdautorun\Picasa Restore.app\Contents\Resources\lt.lproj\i18n\restore_stringres.xml

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 text
Category:	dropped
Size (bytes):	10111
Entropy (8bit):	4.86112421520367
Encrypted:	false
SSDEEP:	192:9RL09uFXe3ieftEeWeZC7aRCCaXo1oxslRL09uFXe3ieftEeWeZC7aRCCaXo1oxJ:bMioEjsMioEj0uSwJGOxtEzWf3Tt
MD5:	40D8F07520267671ED3DE3E83935DECD
SHA1:	496B71BFEB3ED0A64E924B790703803FE16C32BF
SHA-256:	C83D845F6DE50AE83CF663057C7F3B914EFB77F83074A7DE63E6FE44F142A3A1
SHA-512:	C734C09246CF97552B924ABB1BDA08EAA2763E0B71FE45BA4284F81D13B7153A47B16B471C1686C672AEFEB588880A039BF1454E53DD163EA36B91ADB6C56CD6
Malicious:	false
Reputation:	unknown
Preview:	<?xml version="1.0" encoding="utf-8" ?>.<resources>. <stringres id="February">. <xmbtext>Vasaris</xmbtext>. </stringres>. <stringres id="March">. <xmbtext>Kovas</xmbtext>. </stringres>. <stringres id="April">. <xmbtext>Balandis</xmbtext>. </stringres>. <stringres id="May">. <xmbtext>Gegu..</xmbtext>. </stringres>. <stringres id="June">. <xmbtext>Bir.elis</xmbtext>. </stringres>. <stringres id="July">. <xmbtext>Liepa</xmbtext>. </stringres>. <stringres id="August">. <xmbtext>Rugpj.tis</xmbtext>. </stringres>. <stringres id="September">. <xmbtext>Rugs.jis</xmbtext>. </stringres>. <stringres id="October">. <xmbtext>Spalis</xmbtext>. </stringres>. <stringres id="November">. <xmbtext>Lapkritis</xmbtext>. </stringres>. <stringres id="December">. <xmbtext>Gruodis</xmbtext>. </stringres>. <stringres id="Jan">. <xmbtext>Saus.</xmbtext>. </stringres>. <stringres id="Feb">. <xmbtext>Vas.</xmbtext>. </stringres>. <stringres id="Mar">. <xmbtext>Kov.</xmbtext>. </stringres>. <stri

C:\Program Files (x86)\Google\Picasa3\cdautorun\Picasa Restore.app\Contents\Resources\lv.lproj\PRMainMenu.nib\classes.nib

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe
File Type:	XML 1.0 document, ASCII text
Category:	dropped
Size (bytes):	1571
Entropy (8bit):	4.883604938493906
Encrypted:	false
SSDEEP:	24:2dfyiwqhtsd551XBeYSjV+NaBFh3gsX4DHLqaemns4:cfyghtc55DeHj3besX4DHZs4
MD5:	AFE57505E88B3C6CD5D7A27ED6539C66
SHA1:	CA6705B7559326C5C60F8A15DFC6751208DD0643
SHA-256:	BC6AF85CB27E3E742EA8E5519483ACA800F0D2C3C469C1E6AF2161CC5BE647F4
SHA-512:	D5EC7CCED627E987028E4EAB5030126D31E105C1EA91616A956D55552F19F2E71A1EA327D4039428959D661A33E4F072B806BA20BFB3CDD2D5EB0DF98CD4466C
Malicious:	false
Reputation:	unknown
Preview:	<?xml version="1.0" encoding="UTF-8"?>.<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">.<plist version="1.0">.<dict>..<key>IBClasses</key>..<array>...<dict>....<key>ACTIONS</key>....<dict>.....<key>cancelPromptForDestinationFolderChoice</key>.....<string>id</string>.....<key>cancelRestoration</key>.....<string>id</string>.....<key>finishPromptForDestinationFolderChoice</key>.....<string>id</string>.....<key>openManifestFile</key>.....<string>id</string>.....<key>openSourceInDefaultApplication</key>.....<string>id</string>.....<key>selectFolderForDestination</key>.....<string>id</string>.....<key>showDestinationInFinder</key>.....<string>id</string>.....<key>showInPreviewApplication</key>.....<string>id</string>.....<key>showSourceInFinder</key>.....<string>id</string>.....<key>startRestoration</key>.....<string>id</string>....</dict>....<key>CLASS</key>....<string>PRAppController</string>....<key>LANGUAGE</key>....<string>ObjC</stri

C:\Program Files (x86)\Google\Picasa3\cdautorun\Picasa Restore.app\Contents\Resources\lv.lproj\PRMainMenu.nib\info.nib

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe
File Type:	XML 1.0 document, ASCII text
Category:	dropped
Size (bytes):	530
Entropy (8bit):	5.250472465860794
Encrypted:	false
SSDEEP:	12:TMHdgo+tJVEdQiCXFbCGIfx2w0GeC6mwbn:2dfyiwFrIZ2ZC6pb
MD5:	0E168543FD71A479FA5AD0E0613A1BA5
SHA1:	9ACD86A59CE7EC341021D75817D082118D351C56
SHA-256:	7C87E946FB8E106D8856A962C780503F602FAE5B09A818F5AD3ACDFC6468546A
SHA-512:	DFFAB3A94B1994D3EC558F308729DED11A9759CC6B4C6E0022ECE502AE5D2BB8437211B37549454DDB43CCACF91F0989E61A1C173B4F59FBCFF423BAFBEAC44A
Malicious:	false
Reputation:	unknown
Preview:	<?xml version="1.0" encoding="UTF-8"?>.<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">.<plist version="1.0">.<dict>..<key>IBFramework Version</key>..<string>680</string>..<key>IBLastKnownRelativeProjectPath</key>..<string>../../../Mac/Picasa.xcodeproj</string>..<key>IBOldestOS</key>..<integer>4</integer>..<key>IBOpenObjects</key>..<array/>..<key>IBSystem Version</key>..<string>9L31a</string>..<key>targetFramework</key>..<string>IBCocoaFramework</string>.</dict>.</plist>.

C:\Program Files (x86)\Google\Picasa3\cdautorun\Picasa Restore.app\Contents\Resources\lv.lproj\PRMainMenu.nib\keyedobjects.nib

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe
File Type:	Apple binary property list
Category:	dropped
Size (bytes):	24073
Entropy (8bit):	6.7629726034206845
Encrypted:	false
SSDEEP:	384:/gz5oV8v8l1EBTT1a1v4cIv12YOoUNTvX1duAltahkRr/C1h7vtfJfT9zGuF3HwE:odoV8c2dUI92YOjz1dfiN7VxfNmWv4U
MD5:	0AC17E2CF24549585E7D98287A1BDE64
SHA1:	9482D0D84A72E35A17431D03F1CAD4355A345EA8
SHA-256:	65599F6AB08116460C644832A473584E187AC000C852C1A743AE3C0F194093E2
SHA-512:	81BDF461561F0E28A730449FD341575FCF8D481D69EB152E84535A455E456C45646E8BCD7DDD004427B8619528629A3E60CB8ECC193E8622EF02D3C9B09695B3
Malicious:	false
Reputation:	unknown
Preview:	bplist00.................X$versionT$topY$archiverX$objects..........]IB.objectdata.._..NSKeyedArchiver.........1.5.6.<.=.A.E.h.p...........................................................!.".%.-.@.A.M.N.U.V.Y.^.a.i.j.k.n.t.}....................................................................................... .$.)..-.0.3.4.5.8.<.C.G.H.I.J.O.W.\.].o.p.s.v.w.\|.......................................................................................#..+.,.-.2.8.@.G.H.P.Q.\.c.d.k.l.n.o.t.u.z.{...............................................r...........................%.&.8.B.F.G.H.I.O.G.Z.c.G.d.h.k.r.s.z.{.............................................................................................................".#.'.../.0.5.6.;.E.F.G.H.K.T.U.V.W.^._.`.......................................................&...'.+.2.3.5.{................................................. .!.".#.$.%.&.'.(.)..+.,.-.../.0.1.2.3.4.5.6.7.8.9.:.;.<.=.>.?.@.A.B.C.D.E.F.G.H.I.J.K.L.M.P.S...!.".#.$.%.&.'.(.)..+.,.-

C:\Program Files (x86)\Google\Picasa3\cdautorun\Picasa Restore.app\Contents\Resources\lv.lproj\i18n\restore_resexport.xml

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 text
Category:	dropped
Size (bytes):	2570
Entropy (8bit):	4.956414139049053
Encrypted:	false
SSDEEP:	48:c/KA/VsAs55oR5D1z0/woWmbB40s0XcTZRf:GKsVXs5gDa/1WCB40sfTZRf
MD5:	6221DA3CEEB3354FDAC2168A6E79FCD4
SHA1:	00F77146569562CE2F5F35CBF46852E7CCC71C3B
SHA-256:	07E1D0097C60C39A00E9DA58DBE3F6A5BD3C197350F04A3C12A7CEEF788731CA
SHA-512:	71795BB51542335ADC310B5C208F25651C4796B6CDC75E5D1F203B459C7DBEBAA981D58A9CB1C3A0510422DD656E92E0A91EB4D32D3B92C413D57DCB87521F2C
Malicious:	false
Reputation:	unknown
Preview:	<?xml version="1.0" encoding="utf-8" ?>.<Win32Res>. <RT_DIALOG>. <res resid="#904">. <dtitle>. <xmbtext>Atjaunot no Picasa dubl.juma</xmbtext>. </dtitle>. <dlayout>rect(0 0 296 154)</dlayout>. <item itemid="1" itemtype="Button" layout="rect(177 133 227 147)">. <xmbtext>N.kamais</xmbtext>. </item>. <item itemid="2" itemtype="Button" layout="rect(239 133 289 147)">. <xmbtext>Atcelt</xmbtext>. </item>. <item itemid="3" itemtype="Button" layout="rect(7 133 57 147)">. <xmbtext>Izstumt</xmbtext>. </item>. <item itemid="1010" itemtype="Button" layout="rect(25 47 236 59)">. <xmbtext>S.kotn.j.s atra.an.s vietas</xmbtext>. </item>. <item itemid="1011" itemtype="Button" layout="rect(25 83 241 95)">. <xmbtext>.. mape</xmbtext>. </item>. <item itemid="1009" itemtype="Edit" layout="rect(41 100 221 113)"/>. <item itemid="4" itemtype="Button" layout="rect(227 100 277 114)">. <xmbtext>Main.t...</xmbtext>. </item>. <item itemid="-1" itemt

C:\Program Files (x86)\Google\Picasa3\cdautorun\Picasa Restore.app\Contents\Resources\lv.lproj\i18n\restore_stringres.xml

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 text
Category:	dropped
Size (bytes):	10179
Entropy (8bit):	4.903840265358526
Encrypted:	false
SSDEEP:	192:9nABidQqQBveQeMtEeOeeP43B9iQ9GBsXZoqb9nABidQqQBveQeMtEeOeeP43B9L:mj3vhbEnMjkzj3vhbEnMjk4P2lurBOKD
MD5:	98663EBFD14DB8EB584DE289B932D9CF
SHA1:	2C5AC3B44B9C7F7573AF38F65C8430CDB28D5404
SHA-256:	6FCFBEA675493B9957636E3796AE57E7749689646072C79F6D3782177B091670
SHA-512:	5DE14F93F6F4D82C3B1D82E138CD0432A0DD1B0297219C876C97F7B6358567AAAE953E1D33B12E7FE7C895930C4139D459C8CB374DB294AB3739B584CE9273E2
Malicious:	false
Reputation:	unknown
Preview:	<?xml version="1.0" encoding="utf-8" ?>.<resources>. <stringres id="February">. <xmbtext>Febru.ris</xmbtext>. </stringres>. <stringres id="March">. <xmbtext>Marts</xmbtext>. </stringres>. <stringres id="April">. <xmbtext>Apr.lis</xmbtext>. </stringres>. <stringres id="May">. <xmbtext>Maijs</xmbtext>. </stringres>. <stringres id="June">. <xmbtext>J.nijs</xmbtext>. </stringres>. <stringres id="July">. <xmbtext>J.l.</xmbtext>. </stringres>. <stringres id="August">. <xmbtext>Augusts</xmbtext>. </stringres>. <stringres id="September">. <xmbtext>Septembris</xmbtext>. </stringres>. <stringres id="October">. <xmbtext>Oktobris</xmbtext>. </stringres>. <stringres id="November">. <xmbtext>Novembris</xmbtext>. </stringres>. <stringres id="December">. <xmbtext>Decembris</xmbtext>. </stringres>. <stringres id="Jan">. <xmbtext>Janv.</xmbtext>. </stringres>. <stringres id="Feb">. <xmbtext>Febr.</xmbtext>. </stringres>. <stringres id="Mar">. <xmbtext>Marts</xmbtext>. </stringres>. <st

C:\Program Files (x86)\Google\Picasa3\cdautorun\Picasa Restore.app\Contents\Resources\nl.lproj\PRMainMenu.nib\classes.nib

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe
File Type:	XML 1.0 document, ASCII text
Category:	dropped
Size (bytes):	1571
Entropy (8bit):	4.883604938493906
Encrypted:	false
SSDEEP:	24:2dfyiwqhtsd551XBeYSjV+NaBFh3gsX4DHLqaemns4:cfyghtc55DeHj3besX4DHZs4
MD5:	AFE57505E88B3C6CD5D7A27ED6539C66
SHA1:	CA6705B7559326C5C60F8A15DFC6751208DD0643
SHA-256:	BC6AF85CB27E3E742EA8E5519483ACA800F0D2C3C469C1E6AF2161CC5BE647F4
SHA-512:	D5EC7CCED627E987028E4EAB5030126D31E105C1EA91616A956D55552F19F2E71A1EA327D4039428959D661A33E4F072B806BA20BFB3CDD2D5EB0DF98CD4466C
Malicious:	false
Reputation:	unknown
Preview:	<?xml version="1.0" encoding="UTF-8"?>.<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">.<plist version="1.0">.<dict>..<key>IBClasses</key>..<array>...<dict>....<key>ACTIONS</key>....<dict>.....<key>cancelPromptForDestinationFolderChoice</key>.....<string>id</string>.....<key>cancelRestoration</key>.....<string>id</string>.....<key>finishPromptForDestinationFolderChoice</key>.....<string>id</string>.....<key>openManifestFile</key>.....<string>id</string>.....<key>openSourceInDefaultApplication</key>.....<string>id</string>.....<key>selectFolderForDestination</key>.....<string>id</string>.....<key>showDestinationInFinder</key>.....<string>id</string>.....<key>showInPreviewApplication</key>.....<string>id</string>.....<key>showSourceInFinder</key>.....<string>id</string>.....<key>startRestoration</key>.....<string>id</string>....</dict>....<key>CLASS</key>....<string>PRAppController</string>....<key>LANGUAGE</key>....<string>ObjC</stri

C:\Program Files (x86)\Google\Picasa3\cdautorun\Picasa Restore.app\Contents\Resources\nl.lproj\PRMainMenu.nib\info.nib

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe
File Type:	XML 1.0 document, ASCII text
Category:	dropped
Size (bytes):	530
Entropy (8bit):	5.250472465860794
Encrypted:	false
SSDEEP:	12:TMHdgo+tJVEdQiCXFbCGIfx2w0GeC6mwbn:2dfyiwFrIZ2ZC6pb
MD5:	0E168543FD71A479FA5AD0E0613A1BA5
SHA1:	9ACD86A59CE7EC341021D75817D082118D351C56
SHA-256:	7C87E946FB8E106D8856A962C780503F602FAE5B09A818F5AD3ACDFC6468546A
SHA-512:	DFFAB3A94B1994D3EC558F308729DED11A9759CC6B4C6E0022ECE502AE5D2BB8437211B37549454DDB43CCACF91F0989E61A1C173B4F59FBCFF423BAFBEAC44A
Malicious:	false
Reputation:	unknown
Preview:	<?xml version="1.0" encoding="UTF-8"?>.<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">.<plist version="1.0">.<dict>..<key>IBFramework Version</key>..<string>680</string>..<key>IBLastKnownRelativeProjectPath</key>..<string>../../../Mac/Picasa.xcodeproj</string>..<key>IBOldestOS</key>..<integer>4</integer>..<key>IBOpenObjects</key>..<array/>..<key>IBSystem Version</key>..<string>9L31a</string>..<key>targetFramework</key>..<string>IBCocoaFramework</string>.</dict>.</plist>.

C:\Program Files (x86)\Google\Picasa3\cdautorun\Picasa Restore.app\Contents\Resources\nl.lproj\PRMainMenu.nib\keyedobjects.nib

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe
File Type:	Apple binary property list
Category:	dropped
Size (bytes):	22531
Entropy (8bit):	6.9745055415121575
Encrypted:	false
SSDEEP:	384:/gz5oV8v8W1EBTn1a1vCE4K12IAkCjqxorHvduAltapMkRr/C1or9dwX2+UvO:odoV8h2Fu4u2IAD2WvdfizrsXoO
MD5:	9467308854C800FDC336154B83A38C50
SHA1:	E4AFFB5A7CE733265D2490FE09797C8551560829
SHA-256:	DE5FAF9DABC1BCAAE1D86E0E1F612125ACC0D68C3E6737F1FE43D1B9DA110F64
SHA-512:	98B98ECC30F9BDC3C49CE99199418DEA4E0C074CEBFE218C62E569F5C129F1D15BCC9804140B661ED82436E813D321DF312C7A6C588F0AA9D833F9EE564E4784
Malicious:	false
Reputation:	unknown
Preview:	bplist00.................X$versionT$topY$archiverX$objects..........]IB.objectdata.._..NSKeyedArchiver.........1.5.6.<.=.A.E.h.p...........................................................!.".%.-.@.A.M.N.U.V.Y.^.a.i.j.k.n.t.}....................................................................................... .$.)..-.0.3.4.5.8.<.C.G.H.I.J.O.W.\.].o.p.s.v.w.\|.......................................................................................#..+.,.-.2.8.@.G.H.P.Q.\.c.d.k.l.n.o.t.u.z.{...............................................r...........................%.&.8.B.F.G.H.I.O.G.Z.c.G.d.h.k.r.s.z.{.............................................................................................................".#.'.../.0.5.6.;.E.F.G.H.K.T.U.V.W.^._.`.......................................................&...'.+.2.3.5.{................................................. .!.".#.$.%.&.'.(.)..+.,.-.../.0.1.2.3.4.5.6.7.8.9.:.;.<.=.>.?.@.A.B.C.D.E.F.G.H.I.J.K.L.M.P.S...!.".#.$.%.&.'.(.)..+.,.-

C:\Program Files (x86)\Google\Picasa3\cdautorun\Picasa Restore.app\Contents\Resources\nl.lproj\i18n\restore_resexport.xml

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 text
Category:	dropped
Size (bytes):	2592
Entropy (8bit):	4.883556812017356
Encrypted:	false
SSDEEP:	48:c/9LDz/VfVAskbYP7R5qvvQVZjSuqiXmcUkSNnL7njtTZRf:GVPVfGskbenuOptykSNL7jtTZRf
MD5:	5F2761E493B015855280DEAC4618E3B7
SHA1:	33D68199D4F8055407AEF937A70584CFAA62B685
SHA-256:	58D878B5E0CC4621A7F961EF3C806D0783FD72FA4AF675BE9B2B9B7EAF0A6618
SHA-512:	278463C9C1BFB7C0320CEC96C44C54CE2E76E84F8D8E710C3F73FFC287C9CF682BB7B85C19751FB8B04311DDC2368B604F7C4A242F7589B971F942F611BDEF63
Malicious:	false
Reputation:	unknown
Preview:	<?xml version="1.0" encoding="utf-8" ?>.<Win32Res>. <RT_DIALOG>. <res resid="#904">. <dtitle>. <xmbtext>Herstellen met een back-up van Picasa</xmbtext>. </dtitle>. <dlayout>rect(0 0 296 154)</dlayout>. <item itemid="1" itemtype="Button" layout="rect(177 133 227 147)">. <xmbtext>Volgende</xmbtext>. </item>. <item itemid="2" itemtype="Button" layout="rect(239 133 289 147)">. <xmbtext>Annuleren</xmbtext>. </item>. <item itemid="3" itemtype="Button" layout="rect(7 133 57 147)">. <xmbtext>Uitwerpen</xmbtext>. </item>. <item itemid="1010" itemtype="Button" layout="rect(25 47 236 59)">. <xmbtext>Oorspronkelijke locaties</xmbtext>. </item>. <item itemid="1011" itemtype="Button" layout="rect(25 83 241 95)">. <xmbtext>Deze map</xmbtext>. </item>. <item itemid="1009" itemtype="Edit" layout="rect(41 100 221 113)"/>. <item itemid="4" itemtype="Button" layout="rect(227 100 277 114)">. <xmbtext>Wijzigen.</xmbtext>. </item>. <item itemid="-1" i

C:\Program Files (x86)\Google\Picasa3\cdautorun\Picasa Restore.app\Contents\Resources\nl.lproj\i18n\restore_stringres.xml

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 text
Category:	dropped
Size (bytes):	10071
Entropy (8bit):	4.7783736067325115
Encrypted:	false
SSDEEP:	192:9gGBSOpmB6eTe5tEehe9/8DBZzBnBg5HoeNXgGBSOpmB6eTe5tEehe9/8DBZzBnx:7I6A4ECdNuI6A4ECdN6eCFOsafHR
MD5:	A793ADC90EE1273B3EBBDDD1D6DC6185
SHA1:	DB6B8BBA868C03A7AC9E546A05EF9DAFB06D51BE
SHA-256:	719AAC5923349CB15D4F63B9609F4C24D43F6ADA32E15F32316B5EBAE714DE79
SHA-512:	49BCD5C2E1CD05DAC97F46D7888AAE4ED5EC9AF54EBB8003AF6C0D45A898AD16CBBFD81272688508F10EAD10CA7D8910BF640BEB2D4756805477C7CF2385A332
Malicious:	false
Reputation:	unknown
Preview:	<?xml version="1.0" encoding="utf-8" ?>.<resources>. <stringres id="February">. <xmbtext>Februari</xmbtext>. </stringres>. <stringres id="March">. <xmbtext>Maart</xmbtext>. </stringres>. <stringres id="April">. <xmbtext>April</xmbtext>. </stringres>. <stringres id="May">. <xmbtext>Mei</xmbtext>. </stringres>. <stringres id="June">. <xmbtext>Juni</xmbtext>. </stringres>. <stringres id="July">. <xmbtext>Juli</xmbtext>. </stringres>. <stringres id="August">. <xmbtext>Augustus</xmbtext>. </stringres>. <stringres id="September">. <xmbtext>September</xmbtext>. </stringres>. <stringres id="October">. <xmbtext>Oktober</xmbtext>. </stringres>. <stringres id="November">. <xmbtext>November</xmbtext>. </stringres>. <stringres id="December">. <xmbtext>December</xmbtext>. </stringres>. <stringres id="Jan">. <xmbtext>Jan</xmbtext>. </stringres>. <stringres id="Feb">. <xmbtext>Feb</xmbtext>. </stringres>. <stringres id="Mar">. <xmbtext>Mrt</xmbtext>. </stringres>. <stringres id="Apr">.

C:\Program Files (x86)\Google\Picasa3\cdautorun\Picasa Restore.app\Contents\Resources\no.lproj\PRMainMenu.nib\classes.nib

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe
File Type:	XML 1.0 document, ASCII text
Category:	dropped
Size (bytes):	1571
Entropy (8bit):	4.883604938493906
Encrypted:	false
SSDEEP:	24:2dfyiwqhtsd551XBeYSjV+NaBFh3gsX4DHLqaemns4:cfyghtc55DeHj3besX4DHZs4
MD5:	AFE57505E88B3C6CD5D7A27ED6539C66
SHA1:	CA6705B7559326C5C60F8A15DFC6751208DD0643
SHA-256:	BC6AF85CB27E3E742EA8E5519483ACA800F0D2C3C469C1E6AF2161CC5BE647F4
SHA-512:	D5EC7CCED627E987028E4EAB5030126D31E105C1EA91616A956D55552F19F2E71A1EA327D4039428959D661A33E4F072B806BA20BFB3CDD2D5EB0DF98CD4466C
Malicious:	false
Reputation:	unknown
Preview:	<?xml version="1.0" encoding="UTF-8"?>.<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">.<plist version="1.0">.<dict>..<key>IBClasses</key>..<array>...<dict>....<key>ACTIONS</key>....<dict>.....<key>cancelPromptForDestinationFolderChoice</key>.....<string>id</string>.....<key>cancelRestoration</key>.....<string>id</string>.....<key>finishPromptForDestinationFolderChoice</key>.....<string>id</string>.....<key>openManifestFile</key>.....<string>id</string>.....<key>openSourceInDefaultApplication</key>.....<string>id</string>.....<key>selectFolderForDestination</key>.....<string>id</string>.....<key>showDestinationInFinder</key>.....<string>id</string>.....<key>showInPreviewApplication</key>.....<string>id</string>.....<key>showSourceInFinder</key>.....<string>id</string>.....<key>startRestoration</key>.....<string>id</string>....</dict>....<key>CLASS</key>....<string>PRAppController</string>....<key>LANGUAGE</key>....<string>ObjC</stri

C:\Program Files (x86)\Google\Picasa3\cdautorun\Picasa Restore.app\Contents\Resources\no.lproj\PRMainMenu.nib\info.nib

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe
File Type:	XML 1.0 document, ASCII text
Category:	dropped
Size (bytes):	530
Entropy (8bit):	5.250472465860794
Encrypted:	false
SSDEEP:	12:TMHdgo+tJVEdQiCXFbCGIfx2w0GeC6mwbn:2dfyiwFrIZ2ZC6pb
MD5:	0E168543FD71A479FA5AD0E0613A1BA5
SHA1:	9ACD86A59CE7EC341021D75817D082118D351C56
SHA-256:	7C87E946FB8E106D8856A962C780503F602FAE5B09A818F5AD3ACDFC6468546A
SHA-512:	DFFAB3A94B1994D3EC558F308729DED11A9759CC6B4C6E0022ECE502AE5D2BB8437211B37549454DDB43CCACF91F0989E61A1C173B4F59FBCFF423BAFBEAC44A
Malicious:	false
Reputation:	unknown
Preview:	<?xml version="1.0" encoding="UTF-8"?>.<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">.<plist version="1.0">.<dict>..<key>IBFramework Version</key>..<string>680</string>..<key>IBLastKnownRelativeProjectPath</key>..<string>../../../Mac/Picasa.xcodeproj</string>..<key>IBOldestOS</key>..<integer>4</integer>..<key>IBOpenObjects</key>..<array/>..<key>IBSystem Version</key>..<string>9L31a</string>..<key>targetFramework</key>..<string>IBCocoaFramework</string>.</dict>.</plist>.

C:\Program Files (x86)\Google\Picasa3\cdautorun\Picasa Restore.app\Contents\Resources\no.lproj\PRMainMenu.nib\keyedobjects.nib

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe
File Type:	Apple binary property list
Category:	dropped
Size (bytes):	22699
Entropy (8bit):	6.9546517025449885
Encrypted:	false
SSDEEP:	384:RCgBV8NV+6nwN9Tr81EshV8sXUrcMFfwTlaIl02RZCVS7uasTcl6dRs9kQPqmDXZ:RCgBV8D+4wDs2vhS7DsUEurPqmDCmHNL
MD5:	CA7EE39817174CAC993BE2DBA49C43BC
SHA1:	8640F7BAD593116A6AF0700CE67076BAC3AC6697
SHA-256:	87F1F5AED1DD3C494EDC8893C680D95C6DA73696225A7F7E36BF9D842D3D1608
SHA-512:	C44A6FE57304536641B0F1B6610EB30C976CB0AF45840A0B6E63A808FE21BBD7093036EBFA27004F1B6BBC8AD68866652A3BC0ADF188DD0FD41978126F729E9C
Malicious:	false
Reputation:	unknown
Preview:	bplist00.................X$versionT$topY$archiverX$objects..........]IB.objectdata.._..NSKeyedArchiver.........1.5.6.<.=.A.E.h.p.~.............................................................................#.$.%..1.2.9.:.;.@.A.F.M.S.T.U.Z.z...............................................................!.".(.)./.9.:.@.A.F.G.J.P.X.Y._.`.f.n.o.u.v.~............................................................................................. .)../.0.3.4.8.?.C.D.E.F.J.Q.R.S.X.l.m.n.o.y....................................................................... .&...1.:...;.?.B.I.J.Q.R.].f.g.h.i.j.k.l.m.w.{.\|......................................................................................................... .!.%.,.-.../.4.5.:.;.E.F.G.H.K.R.S.T.U.^._.`...........................................................".#...,.3.4.6.\|............................................... .!.".#.$.%.&.'.(.)..+.,.-.../.0.1.2.3.4.5.6.7.8.9.:.;.<.=.>.?.@.A.B.C.D.E.F.G.H.I.J.K.L.M.N.Q.T...".#.$.%.&.'.(.)..+.,

C:\Program Files (x86)\Google\Picasa3\cdautorun\Picasa Restore.app\Contents\Resources\no.lproj\i18n\restore_resexport.xml

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 text
Category:	dropped
Size (bytes):	2563
Entropy (8bit):	4.887285231244204
Encrypted:	false
SSDEEP:	24:2dRtSxzDLQuaq7EvAs/1g5ovLFvREGDVe9kvEKKAHHAywAEu4s89G5LKyxjvz7E9:c/E/Va1AsK6tR5JECiQZ3j7ZUtTZRf
MD5:	E8C57CDA0833A0D165F6C67DC2486750
SHA1:	AD37D7742351318C9001B0D938F7597FD955B8EB
SHA-256:	7FE5CECD0F01AB96F7E26E0340B99952EE8C90EBC6230A1C306F180003792859
SHA-512:	A68896B597641145C7668C34A3A59DB70B14197BF05174A17DA868F8BA2F55549EB9CD1AF7C25BCE3A03F5F82F77534BC65648FC05005B8805CB97AEFEFF837A
Malicious:	false
Reputation:	unknown
Preview:	<?xml version="1.0" encoding="utf-8" ?>.<Win32Res>. <RT_DIALOG>. <res resid="#904">. <dtitle>. <xmbtext>Gjenopprett fra en Picasa-sikkerhetskopi</xmbtext>. </dtitle>. <dlayout>rect(0 0 296 154)</dlayout>. <item itemid="1" itemtype="Button" layout="rect(177 133 227 147)">. <xmbtext>Neste</xmbtext>. </item>. <item itemid="2" itemtype="Button" layout="rect(239 133 289 147)">. <xmbtext>Avbryt</xmbtext>. </item>. <item itemid="3" itemtype="Button" layout="rect(7 133 57 147)">. <xmbtext>L.s ut</xmbtext>. </item>. <item itemid="1010" itemtype="Button" layout="rect(25 47 236 59)">. <xmbtext>Opprinnelige plasseringer</xmbtext>. </item>. <item itemid="1011" itemtype="Button" layout="rect(25 83 241 95)">. <xmbtext>Denne mappen</xmbtext>. </item>. <item itemid="1009" itemtype="Edit" layout="rect(41 100 221 113)"/>. <item itemid="4" itemtype="Button" layout="rect(227 100 277 114)">. <xmbtext>Endre.</xmbtext>. </item>. <item itemid="-1" item

C:\Program Files (x86)\Google\Picasa3\cdautorun\Picasa Restore.app\Contents\Resources\no.lproj\i18n\restore_stringres.xml

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 text
Category:	dropped
Size (bytes):	9897
Entropy (8bit):	4.784576908922286
Encrypted:	false
SSDEEP:	192:93MBSapmBCeTe5tEehet/8YBZvBnBgNHoedS3MBSapmBCeTe5tEehet/8YBZvBnp:GMCA4ECApyMCA4ECApSNUOlfcJl
MD5:	002CC1A6B0EE978DF5B728942785572F
SHA1:	1316E9B0607364AD3825FD61E9FA22C21BD8100B
SHA-256:	AACE636FE6EE4C8A2D5B11681280E3FAE8BB88980919BBFB8E5DA30A43379E80
SHA-512:	336EF0E2C6264BF051C595012CC4AB87C4C76B4FBCC1C0EC2CA8CE6E00DC932D5E959B96A69C84B9E93FC76E2DC30DB776D8ED97F58A2A893E23F6D5969A86AA
Malicious:	false
Reputation:	unknown
Preview:	<?xml version="1.0" encoding="utf-8" ?>.<resources>. <stringres id="February">. <xmbtext>Februar</xmbtext>. </stringres>. <stringres id="March">. <xmbtext>Mars</xmbtext>. </stringres>. <stringres id="April">. <xmbtext>April</xmbtext>. </stringres>. <stringres id="May">. <xmbtext>Mai</xmbtext>. </stringres>. <stringres id="June">. <xmbtext>Juni</xmbtext>. </stringres>. <stringres id="July">. <xmbtext>Juli</xmbtext>. </stringres>. <stringres id="August">. <xmbtext>August</xmbtext>. </stringres>. <stringres id="September">. <xmbtext>September</xmbtext>. </stringres>. <stringres id="October">. <xmbtext>Oktober</xmbtext>. </stringres>. <stringres id="November">. <xmbtext>November</xmbtext>. </stringres>. <stringres id="December">. <xmbtext>Desember</xmbtext>. </stringres>. <stringres id="Jan">. <xmbtext>Jan</xmbtext>. </stringres>. <stringres id="Feb">. <xmbtext>Feb</xmbtext>. </stringres>. <stringres id="Mar">. <xmbtext>Mar</xmbtext>. </stringres>. <stringres id="Apr">. <xmb

C:\Program Files (x86)\Google\Picasa3\cdautorun\Picasa Restore.app\Contents\Resources\pl.lproj\PRMainMenu.nib\classes.nib

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe
File Type:	XML 1.0 document, ASCII text
Category:	dropped
Size (bytes):	1571
Entropy (8bit):	4.883604938493906
Encrypted:	false
SSDEEP:	24:2dfyiwqhtsd551XBeYSjV+NaBFh3gsX4DHLqaemns4:cfyghtc55DeHj3besX4DHZs4
MD5:	AFE57505E88B3C6CD5D7A27ED6539C66
SHA1:	CA6705B7559326C5C60F8A15DFC6751208DD0643
SHA-256:	BC6AF85CB27E3E742EA8E5519483ACA800F0D2C3C469C1E6AF2161CC5BE647F4
SHA-512:	D5EC7CCED627E987028E4EAB5030126D31E105C1EA91616A956D55552F19F2E71A1EA327D4039428959D661A33E4F072B806BA20BFB3CDD2D5EB0DF98CD4466C
Malicious:	false
Reputation:	unknown
Preview:	<?xml version="1.0" encoding="UTF-8"?>.<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">.<plist version="1.0">.<dict>..<key>IBClasses</key>..<array>...<dict>....<key>ACTIONS</key>....<dict>.....<key>cancelPromptForDestinationFolderChoice</key>.....<string>id</string>.....<key>cancelRestoration</key>.....<string>id</string>.....<key>finishPromptForDestinationFolderChoice</key>.....<string>id</string>.....<key>openManifestFile</key>.....<string>id</string>.....<key>openSourceInDefaultApplication</key>.....<string>id</string>.....<key>selectFolderForDestination</key>.....<string>id</string>.....<key>showDestinationInFinder</key>.....<string>id</string>.....<key>showInPreviewApplication</key>.....<string>id</string>.....<key>showSourceInFinder</key>.....<string>id</string>.....<key>startRestoration</key>.....<string>id</string>....</dict>....<key>CLASS</key>....<string>PRAppController</string>....<key>LANGUAGE</key>....<string>ObjC</stri

C:\Program Files (x86)\Google\Picasa3\cdautorun\Picasa Restore.app\Contents\Resources\pl.lproj\PRMainMenu.nib\info.nib

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe
File Type:	XML 1.0 document, ASCII text
Category:	dropped
Size (bytes):	530
Entropy (8bit):	5.250472465860794
Encrypted:	false
SSDEEP:	12:TMHdgo+tJVEdQiCXFbCGIfx2w0GeC6mwbn:2dfyiwFrIZ2ZC6pb
MD5:	0E168543FD71A479FA5AD0E0613A1BA5
SHA1:	9ACD86A59CE7EC341021D75817D082118D351C56
SHA-256:	7C87E946FB8E106D8856A962C780503F602FAE5B09A818F5AD3ACDFC6468546A
SHA-512:	DFFAB3A94B1994D3EC558F308729DED11A9759CC6B4C6E0022ECE502AE5D2BB8437211B37549454DDB43CCACF91F0989E61A1C173B4F59FBCFF423BAFBEAC44A
Malicious:	false
Reputation:	unknown
Preview:	<?xml version="1.0" encoding="UTF-8"?>.<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">.<plist version="1.0">.<dict>..<key>IBFramework Version</key>..<string>680</string>..<key>IBLastKnownRelativeProjectPath</key>..<string>../../../Mac/Picasa.xcodeproj</string>..<key>IBOldestOS</key>..<integer>4</integer>..<key>IBOpenObjects</key>..<array/>..<key>IBSystem Version</key>..<string>9L31a</string>..<key>targetFramework</key>..<string>IBCocoaFramework</string>.</dict>.</plist>.

C:\Program Files (x86)\Google\Picasa3\cdautorun\Picasa Restore.app\Contents\Resources\pl.lproj\PRMainMenu.nib\keyedobjects.nib

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe
File Type:	Apple binary property list
Category:	dropped
Size (bytes):	23844
Entropy (8bit):	6.8584272077785275
Encrypted:	false
SSDEEP:	384:rCioV8vV+9RwNBfrW1Esh18sXUrPMLfETp2qYSsoEwYf7LPuasTcdjdRkSQzNOyQ:rCioV89+rwfa2jK6+PDs8Zmjz0yHkupm
MD5:	18FBEA8BD112BC567FE6CB29D0A671C7
SHA1:	A10E562A9F8BC04106BD1064DCC090EEC4A021D1
SHA-256:	EFB65D519C704205E9F6E6B2A05B1C3E383FD9CD92137E526FE933C3EF59A0AC
SHA-512:	B31804A7BF1140BBCEB040865F7236D47193DDD6A2510247249BF9F38A64E0DC23A5886C97953E00CE6F8182CD30137E63CB62D9732E505C6FE74411890C0637
Malicious:	false
Reputation:	unknown
Preview:	bplist00.................X$versionT$topY$archiverX$objects..........]IB.objectdata.._..NSKeyedArchiver.........1.5.6.<.=.A.E.h.p.~.............................................................................#.$.%..1.2.9.:.;.@.A.F.M.S.T.U.Z.z...............................................................!.".(.)./.9.:.@.A.F.G.J.P.X.Y._.`.f.n.o.u.v.~............................................................................................. .)../.0.3.4.8.?.C.D.E.F.J.Q.R.S.X.l.m.n.o.y....................................................................... .&...1.:...;.?.B.I.J.Q.R.].f.g.h.i.j.k.l.m.w.{.\|......................................................................................................... .!.%.,.-.../.4.5.:.;.E.F.G.H.K.R.S.T.U.^._.`.......................................................!."...+.2.3.5.{................................................. .!.".#.$.%.&.'.(.)..+.,.-.../.0.1.2.3.4.5.6.7.8.9.:.;.<.=.>.?.@.A.B.C.D.E.F.G.H.I.J.K.L.M.P.S...!.".#.$.%.&.'.(.)..+.,.-

C:\Program Files (x86)\Google\Picasa3\cdautorun\Picasa Restore.app\Contents\Resources\pl.lproj\i18n\restore_resexport.xml

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 text
Category:	dropped
Size (bytes):	2577
Entropy (8bit):	4.968199064203569
Encrypted:	false
SSDEEP:	24:2dRt80nzDLQuTg7EvAsm1gPov2FvREGD4Ie9kvRKaHlq3EwAEu4sg+67LKt0njvw:c/3z/VTzAsRAiR5Dnl61bCAjxBsTZRf
MD5:	2D53121BE0902E7505602E269ADC3067
SHA1:	7E2E73D79772A3A608A6553F73CDF49B5EE7B196
SHA-256:	D5C50A6ADB324EDCBBDCD6CDEE990ACCFF3F7908F4A3B0E750DFBE3CF7E369CF
SHA-512:	C0DE678678F50B1A33C18174F0E9E467A4BAEAF0C1ECEC5C96EBC3328529A596B8ADB6BB29C5BE6694073040CB5364FD85915D612D5CB0F44BA0B7362C060EBE
Malicious:	false
Reputation:	unknown
Preview:	<?xml version="1.0" encoding="utf-8" ?>.<Win32Res>. <RT_DIALOG>. <res resid="#904">. <dtitle>. <xmbtext>Przywr.. z kopii zapasowej programu Picasa</xmbtext>. </dtitle>. <dlayout>rect(0 0 296 154)</dlayout>. <item itemid="1" itemtype="Button" layout="rect(177 133 227 147)">. <xmbtext>Dalej</xmbtext>. </item>. <item itemid="2" itemtype="Button" layout="rect(239 133 289 147)">. <xmbtext>Anuluj</xmbtext>. </item>. <item itemid="3" itemtype="Button" layout="rect(7 133 57 147)">. <xmbtext>Wysu.</xmbtext>. </item>. <item itemid="1010" itemtype="Button" layout="rect(25 47 236 59)">. <xmbtext>Pierwotne lokalizacje</xmbtext>. </item>. <item itemid="1011" itemtype="Button" layout="rect(25 83 241 95)">. <xmbtext>Ten folder</xmbtext>. </item>. <item itemid="1009" itemtype="Edit" layout="rect(41 100 221 113)"/>. <item itemid="4" itemtype="Button" layout="rect(227 100 277 114)">. <xmbtext>Zmie....</xmbtext>. </item>. <item itemid="-1" itemty

C:\Program Files (x86)\Google\Picasa3\cdautorun\Picasa Restore.app\Contents\Resources\pl.lproj\i18n\restore_stringres.xml

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 text
Category:	dropped
Size (bytes):	10047
Entropy (8bit):	4.906845726739575
Encrypted:	false
SSDEEP:	192:9e56j3I2+eweZtEe9eXecYTsSB+2VovFme56j3I2+eweZtEe9eXecYTsSB+2Vov5:e/SECK/SECSp0tzOeVX4hge
MD5:	E97F88C1A1CB94FD5272B4DD804ABF76
SHA1:	30C6F8B88A0F488D272E90F98FADC5676C19B320
SHA-256:	6447E5A80E4C478A2D01C58BA8A62BE6265B53909680EEB20FD2CD9BF8FB5F5B
SHA-512:	7C44F472310F5B307AD689A448A5BC8750CBF6C4F66D7A980BD7F75E49A9FD4DD00270B8E3A2D141FFB3276E664EEA64F48E9A07F54018B9B16669865356917A
Malicious:	false
Reputation:	unknown
Preview:	<?xml version="1.0" encoding="utf-8" ?>.<resources>. <stringres id="February">. <xmbtext>Luty</xmbtext>. </stringres>. <stringres id="March">. <xmbtext>Marzec</xmbtext>. </stringres>. <stringres id="April">. <xmbtext>Kwiecie.</xmbtext>. </stringres>. <stringres id="May">. <xmbtext>Maj</xmbtext>. </stringres>. <stringres id="June">. <xmbtext>Czerwiec</xmbtext>. </stringres>. <stringres id="July">. <xmbtext>Lipiec</xmbtext>. </stringres>. <stringres id="August">. <xmbtext>Sierpie.</xmbtext>. </stringres>. <stringres id="September">. <xmbtext>Wrzesie.</xmbtext>. </stringres>. <stringres id="October">. <xmbtext>Pa.dziernik</xmbtext>. </stringres>. <stringres id="November">. <xmbtext>Listopad</xmbtext>. </stringres>. <stringres id="December">. <xmbtext>Grudzie.</xmbtext>. </stringres>. <stringres id="Jan">. <xmbtext>Sty</xmbtext>. </stringres>. <stringres id="Feb">. <xmbtext>Lut</xmbtext>. </stringres>. <stringres id="Mar">. <xmbtext>Mar</xmbtext>. </stringres>. <stringre

C:\Program Files (x86)\Google\Picasa3\cdautorun\Picasa Restore.app\Contents\Resources\pt.lproj\PRMainMenu.nib\classes.nib

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe
File Type:	XML 1.0 document, ASCII text
Category:	dropped
Size (bytes):	1571
Entropy (8bit):	4.883604938493906
Encrypted:	false
SSDEEP:	24:2dfyiwqhtsd551XBeYSjV+NaBFh3gsX4DHLqaemns4:cfyghtc55DeHj3besX4DHZs4
MD5:	AFE57505E88B3C6CD5D7A27ED6539C66
SHA1:	CA6705B7559326C5C60F8A15DFC6751208DD0643
SHA-256:	BC6AF85CB27E3E742EA8E5519483ACA800F0D2C3C469C1E6AF2161CC5BE647F4
SHA-512:	D5EC7CCED627E987028E4EAB5030126D31E105C1EA91616A956D55552F19F2E71A1EA327D4039428959D661A33E4F072B806BA20BFB3CDD2D5EB0DF98CD4466C
Malicious:	false
Reputation:	unknown
Preview:	<?xml version="1.0" encoding="UTF-8"?>.<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">.<plist version="1.0">.<dict>..<key>IBClasses</key>..<array>...<dict>....<key>ACTIONS</key>....<dict>.....<key>cancelPromptForDestinationFolderChoice</key>.....<string>id</string>.....<key>cancelRestoration</key>.....<string>id</string>.....<key>finishPromptForDestinationFolderChoice</key>.....<string>id</string>.....<key>openManifestFile</key>.....<string>id</string>.....<key>openSourceInDefaultApplication</key>.....<string>id</string>.....<key>selectFolderForDestination</key>.....<string>id</string>.....<key>showDestinationInFinder</key>.....<string>id</string>.....<key>showInPreviewApplication</key>.....<string>id</string>.....<key>showSourceInFinder</key>.....<string>id</string>.....<key>startRestoration</key>.....<string>id</string>....</dict>....<key>CLASS</key>....<string>PRAppController</string>....<key>LANGUAGE</key>....<string>ObjC</stri

C:\Program Files (x86)\Google\Picasa3\cdautorun\Picasa Restore.app\Contents\Resources\pt.lproj\PRMainMenu.nib\info.nib

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe
File Type:	XML 1.0 document, ASCII text
Category:	dropped
Size (bytes):	530
Entropy (8bit):	5.250472465860794
Encrypted:	false
SSDEEP:	12:TMHdgo+tJVEdQiCXFbCGIfx2w0GeC6mwbn:2dfyiwFrIZ2ZC6pb
MD5:	0E168543FD71A479FA5AD0E0613A1BA5
SHA1:	9ACD86A59CE7EC341021D75817D082118D351C56
SHA-256:	7C87E946FB8E106D8856A962C780503F602FAE5B09A818F5AD3ACDFC6468546A
SHA-512:	DFFAB3A94B1994D3EC558F308729DED11A9759CC6B4C6E0022ECE502AE5D2BB8437211B37549454DDB43CCACF91F0989E61A1C173B4F59FBCFF423BAFBEAC44A
Malicious:	false
Reputation:	unknown
Preview:	<?xml version="1.0" encoding="UTF-8"?>.<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">.<plist version="1.0">.<dict>..<key>IBFramework Version</key>..<string>680</string>..<key>IBLastKnownRelativeProjectPath</key>..<string>../../../Mac/Picasa.xcodeproj</string>..<key>IBOldestOS</key>..<integer>4</integer>..<key>IBOpenObjects</key>..<array/>..<key>IBSystem Version</key>..<string>9L31a</string>..<key>targetFramework</key>..<string>IBCocoaFramework</string>.</dict>.</plist>.

C:\Program Files (x86)\Google\Picasa3\cdautorun\Picasa Restore.app\Contents\Resources\pt.lproj\PRMainMenu.nib\keyedobjects.nib

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe
File Type:	Apple binary property list
Category:	dropped
Size (bytes):	23489
Entropy (8bit):	6.840738018183572
Encrypted:	false
SSDEEP:	384:cFoV8vqcI+hk1HYA1EvlNqBksc0fWSaIJr+ZQBOmCLTPVSecujtppXRQb14UL4d9:QoV8ZI+O14A2DCZaIcZddTtSD6vOVL43
MD5:	FF958F5B8D2F976D077098DF57F7720F
SHA1:	6342001AFF1A9A53ECEBB5420954FFBF4A75F4C2
SHA-256:	7DEC8E52C467185FFC20ACC1EBB02BCAE8DEA0F8F05743FCB270488B82CDCE82
SHA-512:	91661D00B8DD73D554E40B1EBBFCE0F34287862D24328EC342C66550A49B8830125422742B07E3412DC38E298EE0F041C8DEC75911276664A0C127012BE8ECF8
Malicious:	false
Reputation:	unknown
Preview:	bplist00.................X$versionT$topY$archiverX$objects..........]IB.objectdata.._..NSKeyedArchiver.........1.5.6.<.=.A.E.h.p...............................................................................".&.'.(.).-.5.6.7.8.=.I.N.P.S.T.W.X.[.`.................................................................'.(.../.5.?.@.F.G.L.M.P.V.^._.e.f.l.t.u.{.\|...............................................................................................%.&.'.(.-.1.8.9.:.?.G.K.L.O.\.].^.a.i.j...n.o.r.w.~................................................................................. .!.".'.../.6.7.8.=.G.H.I.S.n.o.t............................................................................................. .!.$.'.....(.).../.4.5.:.;.E.F.G.H.K.R.S.T.U.^._.`...................................................!....+./.0...3.5.{................................................. .!.".#.$.%.&.'.(.)..+.,.-.../.0.1.2.3.4.5.6.7.8.9.:.;.<.=.>.?.@.A.B.C.D.E.F.G.H.I.J.K.L.M.P.S...!.".#.$.%.&.'.(.).*.+.,.-

C:\Program Files (x86)\Google\Picasa3\cdautorun\Picasa Restore.app\Contents\Resources\pt.lproj\i18n\restore_resexport.xml

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 text
Category:	dropped
Size (bytes):	2541
Entropy (8bit):	4.865110230066726
Encrypted:	false
SSDEEP:	24:2dRttIV0nzDLQul7EvAf1gjov/FvREGD9ye9kvLUKmHSc8YEwAEu4sFLK+0njvSz:c/xz/V2Aq0hR59ELE8ngblvLsTZRf
MD5:	1E4A31FD583AC28065E287F2CA36987E
SHA1:	4AE7782DEDB26F5C42680691F6CC3D2A19319E7B
SHA-256:	EEFAB7C4C76CCA5859BF2D0FD97A1AA68621D5B8C81BE1095043A4E535DFD402
SHA-512:	5F22289BC66E6C98DD797715959EC94D264423DFCFD037FEBF5798ECEA17C6BD1F8A97062C439F843E3DB386FF890D65FF09291FEF721B2591B16446538E015F
Malicious:	false
Reputation:	unknown
Preview:	<?xml version="1.0" encoding="utf-8" ?>.<Win32Res>. <RT_DIALOG>. <res resid="#904">. <dtitle>. <xmbtext>Restaurar a partir do backup do Picasa</xmbtext>. </dtitle>. <dlayout>rect(0 0 296 154)</dlayout>. <item itemid="1" itemtype="Button" layout="rect(177 133 227 147)">. <xmbtext>Pr.ximo</xmbtext>. </item>. <item itemid="2" itemtype="Button" layout="rect(239 133 289 147)">. <xmbtext>Cancelar</xmbtext>. </item>. <item itemid="3" itemtype="Button" layout="rect(7 133 57 147)">. <xmbtext>Ejetar</xmbtext>. </item>. <item itemid="1010" itemtype="Button" layout="rect(25 47 236 59)">. <xmbtext>Locais de origem</xmbtext>. </item>. <item itemid="1011" itemtype="Button" layout="rect(25 83 241 95)">. <xmbtext>Esta pasta</xmbtext>. </item>. <item itemid="1009" itemtype="Edit" layout="rect(41 100 221 113)"/>. <item itemid="4" itemtype="Button" layout="rect(227 100 277 114)">. <xmbtext>Alterar...</xmbtext>. </item>. <item itemid="-1" itemtype="B

C:\Program Files (x86)\Google\Picasa3\cdautorun\Picasa Restore.app\Contents\Resources\pt.lproj\i18n\restore_stringres.xml

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 text
Category:	dropped
Size (bytes):	10060
Entropy (8bit):	4.813981759312376
Encrypted:	false
SSDEEP:	192:9bmB4ZdyBge3eJtEeJefW/wYBHuBnBqV5oe4ZbmB4ZdyBge3eJtEeJefW/wYBHu7:0hgCMEKcCwmhgCMEKcCwAgzOhZHci4Qa
MD5:	094AD91620F0CC55387955C39990A480
SHA1:	52E698D1DD13CE8C9EBAA005D67787EFCFB99CA9
SHA-256:	1772CF9560EA27AB273A84C799FB904664678214ECD88236B8154D6F564472AE
SHA-512:	326E6D1EFD323C38E3848690B9DD66969F450268789524C3002E7120027767B58D05068986DBFAAC3AA20FB417B0FC9D22EE636B792F49A921B8C81895726615
Malicious:	false
Reputation:	unknown
Preview:	<?xml version="1.0" encoding="utf-8" ?>.<resources>. <stringres id="February">. <xmbtext>Fevereiro</xmbtext>. </stringres>. <stringres id="March">. <xmbtext>Mar.o</xmbtext>. </stringres>. <stringres id="April">. <xmbtext>Abril</xmbtext>. </stringres>. <stringres id="May">. <xmbtext>Maio</xmbtext>. </stringres>. <stringres id="June">. <xmbtext>Junho</xmbtext>. </stringres>. <stringres id="July">. <xmbtext>Julho</xmbtext>. </stringres>. <stringres id="August">. <xmbtext>Agosto</xmbtext>. </stringres>. <stringres id="September">. <xmbtext>Setembro</xmbtext>. </stringres>. <stringres id="October">. <xmbtext>Outubro</xmbtext>. </stringres>. <stringres id="November">. <xmbtext>Novembro</xmbtext>. </stringres>. <stringres id="December">. <xmbtext>Dezembro</xmbtext>. </stringres>. <stringres id="Jan">. <xmbtext>Jan</xmbtext>. </stringres>. <stringres id="Feb">. <xmbtext>Fev</xmbtext>. </stringres>. <stringres id="Mar">. <xmbtext>Mar</xmbtext>. </stringres>. <stringres id="Apr">.

C:\Program Files (x86)\Google\Picasa3\cdautorun\Picasa Restore.app\Contents\Resources\pt_BR.lproj\PRMainMenu.nib\classes.nib

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe
File Type:	XML 1.0 document, ASCII text
Category:	dropped
Size (bytes):	1571
Entropy (8bit):	4.883604938493906
Encrypted:	false
SSDEEP:	24:2dfyiwqhtsd551XBeYSjV+NaBFh3gsX4DHLqaemns4:cfyghtc55DeHj3besX4DHZs4
MD5:	AFE57505E88B3C6CD5D7A27ED6539C66
SHA1:	CA6705B7559326C5C60F8A15DFC6751208DD0643
SHA-256:	BC6AF85CB27E3E742EA8E5519483ACA800F0D2C3C469C1E6AF2161CC5BE647F4
SHA-512:	D5EC7CCED627E987028E4EAB5030126D31E105C1EA91616A956D55552F19F2E71A1EA327D4039428959D661A33E4F072B806BA20BFB3CDD2D5EB0DF98CD4466C
Malicious:	false
Reputation:	unknown
Preview:	<?xml version="1.0" encoding="UTF-8"?>.<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">.<plist version="1.0">.<dict>..<key>IBClasses</key>..<array>...<dict>....<key>ACTIONS</key>....<dict>.....<key>cancelPromptForDestinationFolderChoice</key>.....<string>id</string>.....<key>cancelRestoration</key>.....<string>id</string>.....<key>finishPromptForDestinationFolderChoice</key>.....<string>id</string>.....<key>openManifestFile</key>.....<string>id</string>.....<key>openSourceInDefaultApplication</key>.....<string>id</string>.....<key>selectFolderForDestination</key>.....<string>id</string>.....<key>showDestinationInFinder</key>.....<string>id</string>.....<key>showInPreviewApplication</key>.....<string>id</string>.....<key>showSourceInFinder</key>.....<string>id</string>.....<key>startRestoration</key>.....<string>id</string>....</dict>....<key>CLASS</key>....<string>PRAppController</string>....<key>LANGUAGE</key>....<string>ObjC</stri

C:\Program Files (x86)\Google\Picasa3\cdautorun\Picasa Restore.app\Contents\Resources\pt_BR.lproj\PRMainMenu.nib\info.nib

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe
File Type:	XML 1.0 document, ASCII text
Category:	dropped
Size (bytes):	530
Entropy (8bit):	5.250472465860794
Encrypted:	false
SSDEEP:	12:TMHdgo+tJVEdQiCXFbCGIfx2w0GeC6mwbn:2dfyiwFrIZ2ZC6pb
MD5:	0E168543FD71A479FA5AD0E0613A1BA5
SHA1:	9ACD86A59CE7EC341021D75817D082118D351C56
SHA-256:	7C87E946FB8E106D8856A962C780503F602FAE5B09A818F5AD3ACDFC6468546A
SHA-512:	DFFAB3A94B1994D3EC558F308729DED11A9759CC6B4C6E0022ECE502AE5D2BB8437211B37549454DDB43CCACF91F0989E61A1C173B4F59FBCFF423BAFBEAC44A
Malicious:	false
Reputation:	unknown
Preview:	<?xml version="1.0" encoding="UTF-8"?>.<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">.<plist version="1.0">.<dict>..<key>IBFramework Version</key>..<string>680</string>..<key>IBLastKnownRelativeProjectPath</key>..<string>../../../Mac/Picasa.xcodeproj</string>..<key>IBOldestOS</key>..<integer>4</integer>..<key>IBOpenObjects</key>..<array/>..<key>IBSystem Version</key>..<string>9L31a</string>..<key>targetFramework</key>..<string>IBCocoaFramework</string>.</dict>.</plist>.

C:\Program Files (x86)\Google\Picasa3\cdautorun\Picasa Restore.app\Contents\Resources\pt_BR.lproj\PRMainMenu.nib\keyedobjects.nib

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe
File Type:	Apple binary property list
Category:	dropped
Size (bytes):	23489
Entropy (8bit):	6.840738018183572
Encrypted:	false
SSDEEP:	384:cFoV8vqcI+hk1HYA1EvlNqBksc0fWSaIJr+ZQBOmCLTPVSecujtppXRQb14UL4d9:QoV8ZI+O14A2DCZaIcZddTtSD6vOVL43
MD5:	FF958F5B8D2F976D077098DF57F7720F
SHA1:	6342001AFF1A9A53ECEBB5420954FFBF4A75F4C2
SHA-256:	7DEC8E52C467185FFC20ACC1EBB02BCAE8DEA0F8F05743FCB270488B82CDCE82
SHA-512:	91661D00B8DD73D554E40B1EBBFCE0F34287862D24328EC342C66550A49B8830125422742B07E3412DC38E298EE0F041C8DEC75911276664A0C127012BE8ECF8
Malicious:	false
Reputation:	unknown
Preview:	bplist00.................X$versionT$topY$archiverX$objects..........]IB.objectdata.._..NSKeyedArchiver.........1.5.6.<.=.A.E.h.p...............................................................................".&.'.(.).-.5.6.7.8.=.I.N.P.S.T.W.X.[.`.................................................................'.(.../.5.?.@.F.G.L.M.P.V.^._.e.f.l.t.u.{.\|...............................................................................................%.&.'.(.-.1.8.9.:.?.G.K.L.O.\.].^.a.i.j...n.o.r.w.~................................................................................. .!.".'.../.6.7.8.=.G.H.I.S.n.o.t............................................................................................. .!.$.'.....(.).../.4.5.:.;.E.F.G.H.K.R.S.T.U.^._.`...................................................!....+./.0...3.5.{................................................. .!.".#.$.%.&.'.(.)..+.,.-.../.0.1.2.3.4.5.6.7.8.9.:.;.<.=.>.?.@.A.B.C.D.E.F.G.H.I.J.K.L.M.P.S...!.".#.$.%.&.'.(.).*.+.,.-

C:\Program Files (x86)\Google\Picasa3\cdautorun\Picasa Restore.app\Contents\Resources\pt_BR.lproj\i18n\restore_resexport.xml

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 text
Category:	dropped
Size (bytes):	2541
Entropy (8bit):	4.865110230066726
Encrypted:	false
SSDEEP:	24:2dRttIV0nzDLQul7EvAf1gjov/FvREGD9ye9kvLUKmHSc8YEwAEu4sFLK+0njvSz:c/xz/V2Aq0hR59ELE8ngblvLsTZRf
MD5:	1E4A31FD583AC28065E287F2CA36987E
SHA1:	4AE7782DEDB26F5C42680691F6CC3D2A19319E7B
SHA-256:	EEFAB7C4C76CCA5859BF2D0FD97A1AA68621D5B8C81BE1095043A4E535DFD402
SHA-512:	5F22289BC66E6C98DD797715959EC94D264423DFCFD037FEBF5798ECEA17C6BD1F8A97062C439F843E3DB386FF890D65FF09291FEF721B2591B16446538E015F
Malicious:	false
Reputation:	unknown
Preview:	<?xml version="1.0" encoding="utf-8" ?>.<Win32Res>. <RT_DIALOG>. <res resid="#904">. <dtitle>. <xmbtext>Restaurar a partir do backup do Picasa</xmbtext>. </dtitle>. <dlayout>rect(0 0 296 154)</dlayout>. <item itemid="1" itemtype="Button" layout="rect(177 133 227 147)">. <xmbtext>Pr.ximo</xmbtext>. </item>. <item itemid="2" itemtype="Button" layout="rect(239 133 289 147)">. <xmbtext>Cancelar</xmbtext>. </item>. <item itemid="3" itemtype="Button" layout="rect(7 133 57 147)">. <xmbtext>Ejetar</xmbtext>. </item>. <item itemid="1010" itemtype="Button" layout="rect(25 47 236 59)">. <xmbtext>Locais de origem</xmbtext>. </item>. <item itemid="1011" itemtype="Button" layout="rect(25 83 241 95)">. <xmbtext>Esta pasta</xmbtext>. </item>. <item itemid="1009" itemtype="Edit" layout="rect(41 100 221 113)"/>. <item itemid="4" itemtype="Button" layout="rect(227 100 277 114)">. <xmbtext>Alterar...</xmbtext>. </item>. <item itemid="-1" itemtype="B

C:\Program Files (x86)\Google\Picasa3\cdautorun\Picasa Restore.app\Contents\Resources\pt_BR.lproj\i18n\restore_stringres.xml

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 text
Category:	dropped
Size (bytes):	10060
Entropy (8bit):	4.813981759312376
Encrypted:	false
SSDEEP:	192:9bmB4ZdyBge3eJtEeJefW/wYBHuBnBqV5oe4ZbmB4ZdyBge3eJtEeJefW/wYBHu7:0hgCMEKcCwmhgCMEKcCwAgzOhZHci4Qa
MD5:	094AD91620F0CC55387955C39990A480
SHA1:	52E698D1DD13CE8C9EBAA005D67787EFCFB99CA9
SHA-256:	1772CF9560EA27AB273A84C799FB904664678214ECD88236B8154D6F564472AE
SHA-512:	326E6D1EFD323C38E3848690B9DD66969F450268789524C3002E7120027767B58D05068986DBFAAC3AA20FB417B0FC9D22EE636B792F49A921B8C81895726615
Malicious:	false
Reputation:	unknown
Preview:	<?xml version="1.0" encoding="utf-8" ?>.<resources>. <stringres id="February">. <xmbtext>Fevereiro</xmbtext>. </stringres>. <stringres id="March">. <xmbtext>Mar.o</xmbtext>. </stringres>. <stringres id="April">. <xmbtext>Abril</xmbtext>. </stringres>. <stringres id="May">. <xmbtext>Maio</xmbtext>. </stringres>. <stringres id="June">. <xmbtext>Junho</xmbtext>. </stringres>. <stringres id="July">. <xmbtext>Julho</xmbtext>. </stringres>. <stringres id="August">. <xmbtext>Agosto</xmbtext>. </stringres>. <stringres id="September">. <xmbtext>Setembro</xmbtext>. </stringres>. <stringres id="October">. <xmbtext>Outubro</xmbtext>. </stringres>. <stringres id="November">. <xmbtext>Novembro</xmbtext>. </stringres>. <stringres id="December">. <xmbtext>Dezembro</xmbtext>. </stringres>. <stringres id="Jan">. <xmbtext>Jan</xmbtext>. </stringres>. <stringres id="Feb">. <xmbtext>Fev</xmbtext>. </stringres>. <stringres id="Mar">. <xmbtext>Mar</xmbtext>. </stringres>. <stringres id="Apr">.

C:\Program Files (x86)\Google\Picasa3\cdautorun\Picasa Restore.app\Contents\Resources\pt_PT.lproj\PRMainMenu.nib\classes.nib

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe
File Type:	XML 1.0 document, ASCII text
Category:	dropped
Size (bytes):	1571
Entropy (8bit):	4.883604938493906
Encrypted:	false
SSDEEP:	24:2dfyiwqhtsd551XBeYSjV+NaBFh3gsX4DHLqaemns4:cfyghtc55DeHj3besX4DHZs4
MD5:	AFE57505E88B3C6CD5D7A27ED6539C66
SHA1:	CA6705B7559326C5C60F8A15DFC6751208DD0643
SHA-256:	BC6AF85CB27E3E742EA8E5519483ACA800F0D2C3C469C1E6AF2161CC5BE647F4
SHA-512:	D5EC7CCED627E987028E4EAB5030126D31E105C1EA91616A956D55552F19F2E71A1EA327D4039428959D661A33E4F072B806BA20BFB3CDD2D5EB0DF98CD4466C
Malicious:	false
Reputation:	unknown
Preview:	<?xml version="1.0" encoding="UTF-8"?>.<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">.<plist version="1.0">.<dict>..<key>IBClasses</key>..<array>...<dict>....<key>ACTIONS</key>....<dict>.....<key>cancelPromptForDestinationFolderChoice</key>.....<string>id</string>.....<key>cancelRestoration</key>.....<string>id</string>.....<key>finishPromptForDestinationFolderChoice</key>.....<string>id</string>.....<key>openManifestFile</key>.....<string>id</string>.....<key>openSourceInDefaultApplication</key>.....<string>id</string>.....<key>selectFolderForDestination</key>.....<string>id</string>.....<key>showDestinationInFinder</key>.....<string>id</string>.....<key>showInPreviewApplication</key>.....<string>id</string>.....<key>showSourceInFinder</key>.....<string>id</string>.....<key>startRestoration</key>.....<string>id</string>....</dict>....<key>CLASS</key>....<string>PRAppController</string>....<key>LANGUAGE</key>....<string>ObjC</stri

C:\Program Files (x86)\Google\Picasa3\cdautorun\Picasa Restore.app\Contents\Resources\pt_PT.lproj\PRMainMenu.nib\info.nib

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe
File Type:	XML 1.0 document, ASCII text
Category:	dropped
Size (bytes):	530
Entropy (8bit):	5.250472465860794
Encrypted:	false
SSDEEP:	12:TMHdgo+tJVEdQiCXFbCGIfx2w0GeC6mwbn:2dfyiwFrIZ2ZC6pb
MD5:	0E168543FD71A479FA5AD0E0613A1BA5
SHA1:	9ACD86A59CE7EC341021D75817D082118D351C56
SHA-256:	7C87E946FB8E106D8856A962C780503F602FAE5B09A818F5AD3ACDFC6468546A
SHA-512:	DFFAB3A94B1994D3EC558F308729DED11A9759CC6B4C6E0022ECE502AE5D2BB8437211B37549454DDB43CCACF91F0989E61A1C173B4F59FBCFF423BAFBEAC44A
Malicious:	false
Reputation:	unknown
Preview:	<?xml version="1.0" encoding="UTF-8"?>.<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">.<plist version="1.0">.<dict>..<key>IBFramework Version</key>..<string>680</string>..<key>IBLastKnownRelativeProjectPath</key>..<string>../../../Mac/Picasa.xcodeproj</string>..<key>IBOldestOS</key>..<integer>4</integer>..<key>IBOpenObjects</key>..<array/>..<key>IBSystem Version</key>..<string>9L31a</string>..<key>targetFramework</key>..<string>IBCocoaFramework</string>.</dict>.</plist>.

C:\Program Files (x86)\Google\Picasa3\cdautorun\Picasa Restore.app\Contents\Resources\pt_PT.lproj\PRMainMenu.nib\keyedobjects.nib

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe
File Type:	Apple binary property list
Category:	dropped
Size (bytes):	23090
Entropy (8bit):	6.932328255323398
Encrypted:	false
SSDEEP:	384:PPoV8vPJ5wsb1EinWfb3G8E01B0xrzEzFPmDuP9wGnQx+7qFLGVwM0ydFMa2IjMM:PPoV8n2iYC0wypeD8OGY+7qFLGVaydFj
MD5:	26872563AD9EF6747BD08E260E7C76EA
SHA1:	5026A4A97EB1FFF7401B9C27941DFF8AFD2860F2
SHA-256:	77B39DDF19E6CBB2680D54662BC30BDE20DCE9183A87EE1A8AA1C2C5706E8DDC
SHA-512:	B730032125BC544B413ACC0AA36C4A2C57E254C34E623E5DE56BA3EA32A4CB5A2FAB306DD05916C639D839B486585633B6B0961F9A2351E72783EA8DF9BF6F7B
Malicious:	false
Reputation:	unknown
Preview:	bplist00.................X$versionT$topY$archiverX$objects..........]IB.objectdata.._..NSKeyedArchiver.........1.5.6.<.=.A.E.h.p.s.t...................................................................................#.$.%.&.+.J.X.Y.`.i.j.m.r.......................................................................$.%.+.,.4.<.I.J.K.L.M.N.O.P.Q.U.V.Y.].b.c.f.h.n.v.}.~.........................................i...........................".#.&.'.,.-.2.:.;.G.H.K.N.O.T.W.X.].^.b.i.n.o.p.u.\|...........................................................................$.%.-...6.7.A...B.C.I...T.X.[.b.c.j.k.v...................................................................................................................!.%.&.'.(.,.3.4.5.:.;.E.F.G.H.K.R.S.T.U.^._.`.......................................................$.-.....2.3.5.{................................................. .!.".#.$.%.&.'.(.)..+.,.-.../.0.1.2.3.4.5.6.7.8.9.:.;.<.=.>.?.@.A.B.C.D.E.F.G.H.I.J.K.L.M.P.S...!.".#.$.%.&.'.(.)..+.,.-

C:\Program Files (x86)\Google\Picasa3\cdautorun\Picasa Restore.app\Contents\Resources\pt_PT.lproj\i18n\restore_resexport.xml

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 text
Category:	dropped
Size (bytes):	2648
Entropy (8bit):	4.8998243153616015
Encrypted:	false
SSDEEP:	24:2dRttETs0nzDLQuBq7EvAf1gqfovWFvREGD9ye9kvLUKEH7OXsEwAEu4svbnLKe0:c/yHz/VB1AqtCR59ELvT7HblUXRC0Rf
MD5:	2FFF7676C6F72B71F3E7EC7058670897
SHA1:	ED4EDD8DA6E2C3F9EA15F0FED621B3E8913F5B40
SHA-256:	96C8E39B65554897AF5D3BBA85E42021ED94842FE5F84E95283B5A844EF5AADA
SHA-512:	B276C58C4DDFBA14C309B2EB923E0BA7225D7CDBE567D74CFD63D418162330A29507C19251CBDCB1BE67F0AE4CA4EBC102B7C748C2936B39650CEF69097B6168
Malicious:	false
Reputation:	unknown
Preview:	<?xml version="1.0" encoding="utf-8" ?>.<Win32Res>. <RT_DIALOG>. <res resid="#904">. <dtitle>. <xmbtext>Restaurar a partir de uma c.pia de seguran.a do Picasa</xmbtext>. </dtitle>. <dlayout>rect(0 0 296 154)</dlayout>. <item itemid="1" itemtype="Button" layout="rect(177 133 227 147)">. <xmbtext>Seguinte</xmbtext>. </item>. <item itemid="2" itemtype="Button" layout="rect(239 133 289 147)">. <xmbtext>Cancelar</xmbtext>. </item>. <item itemid="3" itemtype="Button" layout="rect(7 133 57 147)">. <xmbtext>Ejectar</xmbtext>. </item>. <item itemid="1010" itemtype="Button" layout="rect(25 47 236 59)">. <xmbtext>Louserza..es originais</xmbtext>. </item>. <item itemid="1011" itemtype="Button" layout="rect(25 83 241 95)">. <xmbtext>Esta pasta</xmbtext>. </item>. <item itemid="1009" itemtype="Edit" layout="rect(41 100 221 113)"/>. <item itemid="4" itemtype="Button" layout="rect(227 100 277 114)">. <xmbtext>Alterar...</xmbtext>. </item>. <i

C:\Program Files (x86)\Google\Picasa3\cdautorun\Picasa Restore.app\Contents\Resources\pt_PT.lproj\i18n\restore_stringres.xml

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 text
Category:	dropped
Size (bytes):	10103
Entropy (8bit):	4.796131259120492
Encrypted:	false
SSDEEP:	192:9bmB4adyBge3eJtEeJefW/wYBHvBnBqV5oe4ZbmB4adyBge3eJtEeJefW/wYBHvY:0igCMEKcC3migCMEKcC3rjGGPZgc0aOb
MD5:	7E1EC56EBA20A9A6E2055F214ABF7706
SHA1:	E79BEF4DE5DEA4DFCC9E49895222FF21A0CAE547
SHA-256:	DDDD02A3BC7FE77BA23A909B2B54C7452440301D72D9B95C4E501A7EFB7B9F2C
SHA-512:	940AC3F3FD29E7FA954C1150AFC9AE8D5DBBCF9C8B68920FD36A6ECBE5E2CB8C64E67EA50C0647CF7588E90B05FDC691695B5DFE309F4ED683CF1A6CF2A09904
Malicious:	false
Reputation:	unknown
Preview:	<?xml version="1.0" encoding="utf-8" ?>.<resources>. <stringres id="February">. <xmbtext>Fevereiro</xmbtext>. </stringres>. <stringres id="March">. <xmbtext>Mar.o</xmbtext>. </stringres>. <stringres id="April">. <xmbtext>Abril</xmbtext>. </stringres>. <stringres id="May">. <xmbtext>Mai</xmbtext>. </stringres>. <stringres id="June">. <xmbtext>Junho</xmbtext>. </stringres>. <stringres id="July">. <xmbtext>Julho</xmbtext>. </stringres>. <stringres id="August">. <xmbtext>Agosto</xmbtext>. </stringres>. <stringres id="September">. <xmbtext>Setembro</xmbtext>. </stringres>. <stringres id="October">. <xmbtext>Outubro</xmbtext>. </stringres>. <stringres id="November">. <xmbtext>Novembro</xmbtext>. </stringres>. <stringres id="December">. <xmbtext>Dezembro</xmbtext>. </stringres>. <stringres id="Jan">. <xmbtext>Jan</xmbtext>. </stringres>. <stringres id="Feb">. <xmbtext>Fev</xmbtext>. </stringres>. <stringres id="Mar">. <xmbtext>Mar</xmbtext>. </stringres>. <stringres id="Apr">.

C:\Program Files (x86)\Google\Picasa3\cdautorun\Picasa Restore.app\Contents\Resources\ro.lproj\PRMainMenu.nib\classes.nib

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe
File Type:	XML 1.0 document, ASCII text
Category:	dropped
Size (bytes):	1571
Entropy (8bit):	4.883604938493906
Encrypted:	false
SSDEEP:	24:2dfyiwqhtsd551XBeYSjV+NaBFh3gsX4DHLqaemns4:cfyghtc55DeHj3besX4DHZs4
MD5:	AFE57505E88B3C6CD5D7A27ED6539C66
SHA1:	CA6705B7559326C5C60F8A15DFC6751208DD0643
SHA-256:	BC6AF85CB27E3E742EA8E5519483ACA800F0D2C3C469C1E6AF2161CC5BE647F4
SHA-512:	D5EC7CCED627E987028E4EAB5030126D31E105C1EA91616A956D55552F19F2E71A1EA327D4039428959D661A33E4F072B806BA20BFB3CDD2D5EB0DF98CD4466C
Malicious:	false
Reputation:	unknown
Preview:	<?xml version="1.0" encoding="UTF-8"?>.<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">.<plist version="1.0">.<dict>..<key>IBClasses</key>..<array>...<dict>....<key>ACTIONS</key>....<dict>.....<key>cancelPromptForDestinationFolderChoice</key>.....<string>id</string>.....<key>cancelRestoration</key>.....<string>id</string>.....<key>finishPromptForDestinationFolderChoice</key>.....<string>id</string>.....<key>openManifestFile</key>.....<string>id</string>.....<key>openSourceInDefaultApplication</key>.....<string>id</string>.....<key>selectFolderForDestination</key>.....<string>id</string>.....<key>showDestinationInFinder</key>.....<string>id</string>.....<key>showInPreviewApplication</key>.....<string>id</string>.....<key>showSourceInFinder</key>.....<string>id</string>.....<key>startRestoration</key>.....<string>id</string>....</dict>....<key>CLASS</key>....<string>PRAppController</string>....<key>LANGUAGE</key>....<string>ObjC</stri

C:\Program Files (x86)\Google\Picasa3\cdautorun\Picasa Restore.app\Contents\Resources\ro.lproj\PRMainMenu.nib\info.nib

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe
File Type:	XML 1.0 document, ASCII text
Category:	dropped
Size (bytes):	530
Entropy (8bit):	5.250472465860794
Encrypted:	false
SSDEEP:	12:TMHdgo+tJVEdQiCXFbCGIfx2w0GeC6mwbn:2dfyiwFrIZ2ZC6pb
MD5:	0E168543FD71A479FA5AD0E0613A1BA5
SHA1:	9ACD86A59CE7EC341021D75817D082118D351C56
SHA-256:	7C87E946FB8E106D8856A962C780503F602FAE5B09A818F5AD3ACDFC6468546A
SHA-512:	DFFAB3A94B1994D3EC558F308729DED11A9759CC6B4C6E0022ECE502AE5D2BB8437211B37549454DDB43CCACF91F0989E61A1C173B4F59FBCFF423BAFBEAC44A
Malicious:	false
Reputation:	unknown
Preview:	<?xml version="1.0" encoding="UTF-8"?>.<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">.<plist version="1.0">.<dict>..<key>IBFramework Version</key>..<string>680</string>..<key>IBLastKnownRelativeProjectPath</key>..<string>../../../Mac/Picasa.xcodeproj</string>..<key>IBOldestOS</key>..<integer>4</integer>..<key>IBOpenObjects</key>..<array/>..<key>IBSystem Version</key>..<string>9L31a</string>..<key>targetFramework</key>..<string>IBCocoaFramework</string>.</dict>.</plist>.

C:\Program Files (x86)\Google\Picasa3\cdautorun\Picasa Restore.app\Contents\Resources\ro.lproj\PRMainMenu.nib\keyedobjects.nib

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe
File Type:	Apple binary property list
Category:	dropped
Size (bytes):	24425
Entropy (8bit):	6.749073376186955
Encrypted:	false
SSDEEP:	384:/gz5oV8v8x1EBTw1a1vD/6c12w3L4D46st8duAltahkWr/C1lyYBhrcEhU3+58Ly:odoV8Y2Svg2w3U68dfiwyYDcEm3IkHS
MD5:	3527CF066668F29162548828E2C790FA
SHA1:	D237C66F6F2D13BE2074E9D71D0EE82E8D106B95
SHA-256:	F20C9A2A829DE7E8C403DA913B1F4088931BA9977D80CF99D34C827924CBC99A
SHA-512:	7831D2321CEBD716A05586F9A4EF668ABD70B756F8DA63A9C234111815AB47D0D9EA2D3F1F96AE01BF3C5DF3D9EC5C55F5DB0C10EDEF8D8F0A380993B7C24961
Malicious:	false
Reputation:	unknown
Preview:	bplist00.................X$versionT$topY$archiverX$objects..........]IB.objectdata.._..NSKeyedArchiver.........1.5.6.<.=.A.E.h.p...........................................................!.".%.-.@.A.M.N.U.V.Y.^.a.i.j.k.n.t.}....................................................................................... .$.)..-.0.3.4.5.8.<.C.G.H.I.J.O.W.\.].o.p.s.v.w.\|.......................................................................................#..+.,.-.2.8.@.G.H.P.Q.\.c.d.k.l.n.o.t.u.z.{...............................................r...........................%.&.8.B.F.G.H.I.O.G.Z.c.G.d.h.k.r.s.z.{.............................................................................................................".#.'.../.0.5.6.;.E.F.G.H.K.T.U.V.W.^._.`.......................................................&...'.+.2.3.5.{................................................. .!.".#.$.%.&.'.(.)..+.,.-.../.0.1.2.3.4.5.6.7.8.9.:.;.<.=.>.?.@.A.B.C.D.E.F.G.H.I.J.K.L.M.P.S...!.".#.$.%.&.'.(.)..+.,.-

C:\Program Files (x86)\Google\Picasa3\cdautorun\Picasa Restore.app\Contents\Resources\ro.lproj\i18n\restore_resexport.xml

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 text
Category:	dropped
Size (bytes):	2573
Entropy (8bit):	4.915695260989352
Encrypted:	false
SSDEEP:	48:c/Snz/VV1AsYjI2R5EUnMZ5GziIpnbXJgIkOu6TZRf:GuVosYbEJZ2JlxTZRf
MD5:	4457DBBF523CFABD6E776E97E76E6A41
SHA1:	F338AAEDD971DB5769CA3CEF8A9ED712D2806E63
SHA-256:	482AE6B4F9356C7084D8C951BBA911B3B33448A4CF65390D55AE8851F627374D
SHA-512:	5C7EC75AA9FEBB8AE51D65A2EAC266979FB638BAA86AFABD5BEABD43E2924825D9EE9F100046651911EB6FBCB3DF73130BF5BDC00A292220E65F67DCB548CAFC
Malicious:	false
Reputation:	unknown
Preview:	<?xml version="1.0" encoding="utf-8" ?>.<Win32Res>. <RT_DIALOG>. <res resid="#904">. <dtitle>. <xmbtext>Restabili.i dintr-un backup Picasa</xmbtext>. </dtitle>. <dlayout>rect(0 0 296 154)</dlayout>. <item itemid="1" itemtype="Button" layout="rect(177 133 227 147)">. <xmbtext>.nainte</xmbtext>. </item>. <item itemid="2" itemtype="Button" layout="rect(239 133 289 147)">. <xmbtext>Anula.i</xmbtext>. </item>. <item itemid="3" itemtype="Button" layout="rect(7 133 57 147)">. <xmbtext>Ejecta.i</xmbtext>. </item>. <item itemid="1010" itemtype="Button" layout="rect(25 47 236 59)">. <xmbtext>Loca.ii ini.iale</xmbtext>. </item>. <item itemid="1011" itemtype="Button" layout="rect(25 83 241 95)">. <xmbtext>Acest dosar</xmbtext>. </item>. <item itemid="1009" itemtype="Edit" layout="rect(41 100 221 113)"/>. <item itemid="4" itemtype="Button" layout="rect(227 100 277 114)">. <xmbtext>Modifica.i...</xmbtext>. </item>. <item itemid="-1" item

C:\Program Files (x86)\Google\Picasa3\cdautorun\Picasa Restore.app\Contents\Resources\ro.lproj\i18n\restore_stringres.xml

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 text
Category:	dropped
Size (bytes):	10295
Entropy (8bit):	4.819248036835321
Encrypted:	false
SSDEEP:	192:91hBMajUBCeaeJtEeReE2IqBMvICBGJJolJv1hBMajUBCeaeJtEeReE2IqBMvICS:zCCjMEs6mZCCjMEs6mAkOUUyo9
MD5:	FF343568C25ECCB6A0A6EF4CC67CFE43
SHA1:	C8674F80BE404E98CE0E6AABFA974B6B9F1E512D
SHA-256:	B96A9C124BA7A716683EA8A78D2F4F79B84DEA174111B8E6373CAA8B66299D3F
SHA-512:	830FF63A7C4B3F0B6DCEFAE4D7D8A4841890207BF4871F845DC4BE2FF3835A318B9A981C2568AD3E041689F85665488E4B52637669A6177224988BDEFD5AE2D2
Malicious:	false
Reputation:	unknown
Preview:	<?xml version="1.0" encoding="utf-8" ?>.<resources>. <stringres id="February">. <xmbtext>Februarie</xmbtext>. </stringres>. <stringres id="March">. <xmbtext>Martie</xmbtext>. </stringres>. <stringres id="April">. <xmbtext>Aprilie</xmbtext>. </stringres>. <stringres id="May">. <xmbtext>Mai</xmbtext>. </stringres>. <stringres id="June">. <xmbtext>Iunie</xmbtext>. </stringres>. <stringres id="July">. <xmbtext>Iulie</xmbtext>. </stringres>. <stringres id="August">. <xmbtext>August</xmbtext>. </stringres>. <stringres id="September">. <xmbtext>Septembrie</xmbtext>. </stringres>. <stringres id="October">. <xmbtext>Octombrie</xmbtext>. </stringres>. <stringres id="November">. <xmbtext>Noiembrie</xmbtext>. </stringres>. <stringres id="December">. <xmbtext>Decembrie</xmbtext>. </stringres>. <stringres id="Jan">. <xmbtext>Ianuarie</xmbtext>. </stringres>. <stringres id="Feb">. <xmbtext>Februarie</xmbtext>. </stringres>. <stringres id="Mar">. <xmbtext>Martie</xmbtext>. </stringres>.

C:\Program Files (x86)\Google\Picasa3\cdautorun\Picasa Restore.app\Contents\Resources\ru.lproj\PRMainMenu.nib\classes.nib

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe
File Type:	XML 1.0 document, ASCII text
Category:	dropped
Size (bytes):	1571
Entropy (8bit):	4.883604938493906
Encrypted:	false
SSDEEP:	24:2dfyiwqhtsd551XBeYSjV+NaBFh3gsX4DHLqaemns4:cfyghtc55DeHj3besX4DHZs4
MD5:	AFE57505E88B3C6CD5D7A27ED6539C66
SHA1:	CA6705B7559326C5C60F8A15DFC6751208DD0643
SHA-256:	BC6AF85CB27E3E742EA8E5519483ACA800F0D2C3C469C1E6AF2161CC5BE647F4
SHA-512:	D5EC7CCED627E987028E4EAB5030126D31E105C1EA91616A956D55552F19F2E71A1EA327D4039428959D661A33E4F072B806BA20BFB3CDD2D5EB0DF98CD4466C
Malicious:	false
Reputation:	unknown
Preview:	<?xml version="1.0" encoding="UTF-8"?>.<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">.<plist version="1.0">.<dict>..<key>IBClasses</key>..<array>...<dict>....<key>ACTIONS</key>....<dict>.....<key>cancelPromptForDestinationFolderChoice</key>.....<string>id</string>.....<key>cancelRestoration</key>.....<string>id</string>.....<key>finishPromptForDestinationFolderChoice</key>.....<string>id</string>.....<key>openManifestFile</key>.....<string>id</string>.....<key>openSourceInDefaultApplication</key>.....<string>id</string>.....<key>selectFolderForDestination</key>.....<string>id</string>.....<key>showDestinationInFinder</key>.....<string>id</string>.....<key>showInPreviewApplication</key>.....<string>id</string>.....<key>showSourceInFinder</key>.....<string>id</string>.....<key>startRestoration</key>.....<string>id</string>....</dict>....<key>CLASS</key>....<string>PRAppController</string>....<key>LANGUAGE</key>....<string>ObjC</stri

C:\Program Files (x86)\Google\Picasa3\cdautorun\Picasa Restore.app\Contents\Resources\ru.lproj\PRMainMenu.nib\info.nib

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe
File Type:	XML 1.0 document, ASCII text
Category:	dropped
Size (bytes):	530
Entropy (8bit):	5.250472465860794
Encrypted:	false
SSDEEP:	12:TMHdgo+tJVEdQiCXFbCGIfx2w0GeC6mwbn:2dfyiwFrIZ2ZC6pb
MD5:	0E168543FD71A479FA5AD0E0613A1BA5
SHA1:	9ACD86A59CE7EC341021D75817D082118D351C56
SHA-256:	7C87E946FB8E106D8856A962C780503F602FAE5B09A818F5AD3ACDFC6468546A
SHA-512:	DFFAB3A94B1994D3EC558F308729DED11A9759CC6B4C6E0022ECE502AE5D2BB8437211B37549454DDB43CCACF91F0989E61A1C173B4F59FBCFF423BAFBEAC44A
Malicious:	false
Reputation:	unknown
Preview:	<?xml version="1.0" encoding="UTF-8"?>.<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">.<plist version="1.0">.<dict>..<key>IBFramework Version</key>..<string>680</string>..<key>IBLastKnownRelativeProjectPath</key>..<string>../../../Mac/Picasa.xcodeproj</string>..<key>IBOldestOS</key>..<integer>4</integer>..<key>IBOpenObjects</key>..<array/>..<key>IBSystem Version</key>..<string>9L31a</string>..<key>targetFramework</key>..<string>IBCocoaFramework</string>.</dict>.</plist>.

C:\Program Files (x86)\Google\Picasa3\cdautorun\Picasa Restore.app\Contents\Resources\ru.lproj\PRMainMenu.nib\keyedobjects.nib

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe
File Type:	Apple binary property list
Category:	dropped
Size (bytes):	23933
Entropy (8bit):	6.892842649616157
Encrypted:	false
SSDEEP:	384:yCEoV88V+YSwN8Vrr1EshS8sXUr7M1fnT9QEOGu0af71vuasTPql6dRWMQgu6fab:yCEoV8K+9weR2nhaZvDsyEoRgFfadgPU
MD5:	8B892D8E767D6438302745D107EA1AD8
SHA1:	61B75938A9FBA29DFDBA81957A4CB36BA2AB0708
SHA-256:	181F58E699C538EA55BB3360B74A26BF8DFB77C2C0FDABF9458B2D90D7996BD5
SHA-512:	C84C075472996477A6A7ADDCAD00A3A43AC4E8C76C02088D168433AD70D058959EC4F1A79A2BF1F13876628EBE31E66BDAD756650F7C24A774EEE851ED309EE9
Malicious:	false
Reputation:	unknown
Preview:	bplist00.................X$versionT$topY$archiverX$objects..........]IB.objectdata.._..NSKeyedArchiver.........1.5.6.<.=.A.E.h.p.~.............................................................................#.$.%..1.2.9.:.;.@.A.F.M.S.T.U.Z.z...............................................................!.".(.)./.9.:.@.A.F.G.J.P.X.Y._.`.f.n.o.u.v.~............................................................................................. .)../.0.3.4.8.?.C.D.E.F.J.Q.R.S.X.l.m.n.o.y....................................................................... .&...1.:...;.?.B.I.J.Q.R.].f.g.h.i.j.k.l.m.w.{.\|......................................................................................................... .!.%.,.-.../.4.5.:.;.E.F.G.H.K.R.S.T.U.^._.`.........................................................!."...+.2.3.5.{................................................. .!.".#.$.%.&.'.(.)..+.,.-.../.0.1.2.3.4.5.6.7.8.9.:.;.<.=.>.?.@.A.B.C.D.E.F.G.H.I.J.K.L.M.P.S...!.".#.$.%.&.'.(.)..+.,

C:\Program Files (x86)\Google\Picasa3\cdautorun\Picasa Restore.app\Contents\Resources\ru.lproj\i18n\restore_resexport.xml

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 text
Category:	dropped
Size (bytes):	2875
Entropy (8bit):	5.22857340961115
Encrypted:	false
SSDEEP:	48:c/Kz/VcA+NmtR5+QKYqZT4YbsSg11Hy1dRf:G4VH+ozs8JSgYdRf
MD5:	43F090299A9C5F298F788D819726AB03
SHA1:	9B33844DBF35169DEF20983A1E142C0DB0961654
SHA-256:	BD99DC32485877D554C66E03A9C20B72A7332AE1231C2734100F93CC354DF6F0
SHA-512:	8D2AAF6CD491F21B70457C97B99DE0E5CF4605B3FC5456841068F477F4C3EB46F1911568CCF5F051033C2AE443A9ED397E001D328770EE4878054269791391A5
Malicious:	false
Reputation:	unknown
Preview:	<?xml version="1.0" encoding="utf-8" ?>.<Win32Res>. <RT_DIALOG>. <res resid="#904">. <dtitle>. <xmbtext>............ .. ......... ..... Picasa</xmbtext>. </dtitle>. <dlayout>rect(0 0 296 154)</dlayout>. <item itemid="1" itemtype="Button" layout="rect(177 133 227 147)">. <xmbtext>.....</xmbtext>. </item>. <item itemid="2" itemtype="Button" layout="rect(239 133 289 147)">. <xmbtext>......</xmbtext>. </item>. <item itemid="3" itemtype="Button" layout="rect(7 133 57 147)">. <xmbtext>.......</xmbtext>. </item>. <item itemid="1010" itemtype="Button" layout="rect(25 47 236 59)">. <xmbtext>........ ..............</xmbtext>. </item>. <item itemid="1011" itemtype="Button" layout="rect(25 83 241 95)">. <xmbtext>... .....</xmbtext>. </item>. <item itemid="1009" itemtype="Edit" layout="rect(41 100 221 113)"/>. <item itemid="4" itemtype="Button" layout="rect(227 100 277 114)">

C:\Program Files (x86)\Google\Picasa3\cdautorun\Picasa Restore.app\Contents\Resources\ru.lproj\i18n\restore_stringres.xml

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 text
Category:	dropped
Size (bytes):	11097
Entropy (8bit):	5.195192911556334
Encrypted:	false
SSDEEP:	192:9xFLtkMPte8eFtEeReqbpF0WVRv2yoon+MxFLtkMPte8eFtEeReqbpF0WVRv2yoA:3FGEO/FGEOBDx45rOqWzDkNk
MD5:	F8F48DEF890E978AA1128094DDB057EB
SHA1:	2736326377EBF8BA31548F97FF421B570DACBC6E
SHA-256:	CADB6DBF5CAD427CDE8CFB6A06478B64AFB0118BB6A9E1213D6D16ED50F6281E
SHA-512:	3832CA28B97A42D4730DE349B3CFDFD13241B47D377D8019297C6DDCADB13580694BAB000630E90214AD782493A93C6C0212444388ACA6C19BC051C6EDACCCDE
Malicious:	false
Reputation:	unknown
Preview:	<?xml version="1.0" encoding="utf-8" ?>.<resources>. <stringres id="February">. <xmbtext>.......</xmbtext>. </stringres>. <stringres id="March">. <xmbtext>....</xmbtext>. </stringres>. <stringres id="April">. <xmbtext>......</xmbtext>. </stringres>. <stringres id="May">. <xmbtext>...</xmbtext>. </stringres>. <stringres id="June">. <xmbtext>....</xmbtext>. </stringres>. <stringres id="July">. <xmbtext>....</xmbtext>. </stringres>. <stringres id="August">. <xmbtext>......</xmbtext>. </stringres>. <stringres id="September">. <xmbtext>........</xmbtext>. </stringres>. <stringres id="October">. <xmbtext>.......</xmbtext>. </stringres>. <stringres id="November">. <xmbtext>......</xmbtext>. </stringres>. <stringres id="December">. <xmbtext>.......</xmbtext>. </stringres>. <stringres id="Jan">. <xmbtext>....</xmbtext>. </stringres>. <stringres id="Feb">. <xmbtext>....</xmbtext>. </stringres>. <stringres id="Mar">.

C:\Program Files (x86)\Google\Picasa3\cdautorun\Picasa Restore.app\Contents\Resources\sk.lproj\PRMainMenu.nib\classes.nib

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe
File Type:	XML 1.0 document, ASCII text
Category:	dropped
Size (bytes):	1571
Entropy (8bit):	4.883604938493906
Encrypted:	false
SSDEEP:	24:2dfyiwqhtsd551XBeYSjV+NaBFh3gsX4DHLqaemns4:cfyghtc55DeHj3besX4DHZs4
MD5:	AFE57505E88B3C6CD5D7A27ED6539C66
SHA1:	CA6705B7559326C5C60F8A15DFC6751208DD0643
SHA-256:	BC6AF85CB27E3E742EA8E5519483ACA800F0D2C3C469C1E6AF2161CC5BE647F4
SHA-512:	D5EC7CCED627E987028E4EAB5030126D31E105C1EA91616A956D55552F19F2E71A1EA327D4039428959D661A33E4F072B806BA20BFB3CDD2D5EB0DF98CD4466C
Malicious:	false
Reputation:	unknown
Preview:	<?xml version="1.0" encoding="UTF-8"?>.<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">.<plist version="1.0">.<dict>..<key>IBClasses</key>..<array>...<dict>....<key>ACTIONS</key>....<dict>.....<key>cancelPromptForDestinationFolderChoice</key>.....<string>id</string>.....<key>cancelRestoration</key>.....<string>id</string>.....<key>finishPromptForDestinationFolderChoice</key>.....<string>id</string>.....<key>openManifestFile</key>.....<string>id</string>.....<key>openSourceInDefaultApplication</key>.....<string>id</string>.....<key>selectFolderForDestination</key>.....<string>id</string>.....<key>showDestinationInFinder</key>.....<string>id</string>.....<key>showInPreviewApplication</key>.....<string>id</string>.....<key>showSourceInFinder</key>.....<string>id</string>.....<key>startRestoration</key>.....<string>id</string>....</dict>....<key>CLASS</key>....<string>PRAppController</string>....<key>LANGUAGE</key>....<string>ObjC</stri

C:\Program Files (x86)\Google\Picasa3\cdautorun\Picasa Restore.app\Contents\Resources\sk.lproj\PRMainMenu.nib\info.nib

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe
File Type:	XML 1.0 document, ASCII text
Category:	dropped
Size (bytes):	530
Entropy (8bit):	5.250472465860794
Encrypted:	false
SSDEEP:	12:TMHdgo+tJVEdQiCXFbCGIfx2w0GeC6mwbn:2dfyiwFrIZ2ZC6pb
MD5:	0E168543FD71A479FA5AD0E0613A1BA5
SHA1:	9ACD86A59CE7EC341021D75817D082118D351C56
SHA-256:	7C87E946FB8E106D8856A962C780503F602FAE5B09A818F5AD3ACDFC6468546A
SHA-512:	DFFAB3A94B1994D3EC558F308729DED11A9759CC6B4C6E0022ECE502AE5D2BB8437211B37549454DDB43CCACF91F0989E61A1C173B4F59FBCFF423BAFBEAC44A
Malicious:	false
Reputation:	unknown
Preview:	<?xml version="1.0" encoding="UTF-8"?>.<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">.<plist version="1.0">.<dict>..<key>IBFramework Version</key>..<string>680</string>..<key>IBLastKnownRelativeProjectPath</key>..<string>../../../Mac/Picasa.xcodeproj</string>..<key>IBOldestOS</key>..<integer>4</integer>..<key>IBOpenObjects</key>..<array/>..<key>IBSystem Version</key>..<string>9L31a</string>..<key>targetFramework</key>..<string>IBCocoaFramework</string>.</dict>.</plist>.

C:\Program Files (x86)\Google\Picasa3\cdautorun\Picasa Restore.app\Contents\Resources\sk.lproj\PRMainMenu.nib\keyedobjects.nib

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe
File Type:	Apple binary property list
Category:	dropped
Size (bytes):	23951
Entropy (8bit):	6.781916092969079
Encrypted:	false
SSDEEP:	384:QgzGoV888y1EBTi1a1vKYHM12IIfbhIZwxTthduAltaMkzryC5p8sbqYTpHXBtwB:96oV8q2ESQ2IIzhcEhdfiIsbjTpHXnW
MD5:	C7F77874C08B39F514582D00BC3F65B3
SHA1:	7BD7217A7C6E0FA6E67D77015B56714CDB4149A9
SHA-256:	B86AB36B5E827FAC6A73CFD06A356B7B37B6B3B85628B56A2964EB6718A84AD7
SHA-512:	C9950C2108BE6D693040C0B0A838C71C22696C23742360EA46288EBE4937D2E3399114C4AD449B437D06BFDE38924E2AF183E04C722F8045F96356B1C76CFF7D
Malicious:	false
Reputation:	unknown
Preview:	bplist00.................X$versionT$topY$archiverX$objects..........]IB.objectdata.._..NSKeyedArchiver.........1.5.6.<.=.A.E.h.p...........................................................!.".%.-.@.A.M.N.U.V.Y.^.a.i.j.k.n.t.}....................................................................................... .$.)..-.0.3.4.5.8.<.C.G.H.I.J.O.W.\.].o.p.s.v.w.\|.......................................................................................#..+.,.-.2.8.@.G.H.P.Q.\.c.d.k.l.n.o.t.u.z.{...............................................r...........................%.&.8.B.F.G.H.I.O.G.Z.c.G.d.h.k.r.s.z.{.............................................................................................................".#.'.../.0.5.6.;.E.F.G.H.K.T.U.V.W.^._.`.........................................................&...'.+.2.3.5.{................................................. .!.".#.$.%.&.'.(.)..+.,.-.../.0.1.2.3.4.5.6.7.8.9.:.;.<.=.>.?.@.A.B.C.D.E.F.G.H.I.J.K.L.M.P.S...!.".#.$.%.&.'.(.)..+.,

C:\Program Files (x86)\Google\Picasa3\cdautorun\Picasa Restore.app\Contents\Resources\sk.lproj\i18n\restore_resexport.xml

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 text
Category:	dropped
Size (bytes):	2553
Entropy (8bit):	4.992812357313643
Encrypted:	false
SSDEEP:	48:c/mbz/VzAF1j/gR5C5/Hsbbi2jrC2kTZRf:Gm3VUF1jyoEC2jrvkTZRf
MD5:	90CC1049098CF25D13A4F077E1AA1770
SHA1:	944980C9D0CEF037BD7AC4C3C3C741B352A92CBE
SHA-256:	870853AC7065691C896D4749E8547F39AB65E894CE52CEDD153FDCD268DA60C2
SHA-512:	2DCF96A7ED70A55CE8E56EE340402D083E5CCD2D81243904F8F8354440A7082EB2E7C95114D730313CF7FD62F67DF327502D91B92D7AC3442A515ED13E9ECEBC
Malicious:	false
Reputation:	unknown
Preview:	<?xml version="1.0" encoding="utf-8" ?>.<Win32Res>. <RT_DIALOG>. <res resid="#904">. <dtitle>. <xmbtext>Obnovi. zo z.lohy programu Picasa</xmbtext>. </dtitle>. <dlayout>rect(0 0 296 154)</dlayout>. <item itemid="1" itemtype="Button" layout="rect(177 133 227 147)">. <xmbtext>.alej</xmbtext>. </item>. <item itemid="2" itemtype="Button" layout="rect(239 133 289 147)">. <xmbtext>Zru.i.</xmbtext>. </item>. <item itemid="3" itemtype="Button" layout="rect(7 133 57 147)">. <xmbtext>Vysun..</xmbtext>. </item>. <item itemid="1010" itemtype="Button" layout="rect(25 47 236 59)">. <xmbtext>P.vodn. umiestnenia</xmbtext>. </item>. <item itemid="1011" itemtype="Button" layout="rect(25 83 241 95)">. <xmbtext>Tento prie.inok</xmbtext>. </item>. <item itemid="1009" itemtype="Edit" layout="rect(41 100 221 113)"/>. <item itemid="4" itemtype="Button" layout="rect(227 100 277 114)">. <xmbtext>Zmeni....</xmbtext>. </item>. <item itemid="-1" it

C:\Program Files (x86)\Google\Picasa3\cdautorun\Picasa Restore.app\Contents\Resources\sk.lproj\i18n\restore_stringres.xml

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 text
Category:	dropped
Size (bytes):	10055
Entropy (8bit):	4.905844884975477
Encrypted:	false
SSDEEP:	192:9grB/sadBCeTeCtEehe9/8YBZN7FBg5HoeNXgrB/sadBCeTeCtEehe9/8YBZN7Ft:IjCANECwjFjCANECwjxNVCzaOeyfFztc
MD5:	1DAFBCA45534665B90389805BDDA08E9
SHA1:	041CF312F28DDB8767730717E4B0DC4FEBE6F690
SHA-256:	2E599152D9689C0559C3F5BB696C9C4CCE07547238A8E4CB7644FBD6BC7499E8
SHA-512:	45C26B0D4F1FF4F535DB7F80BD0DC414382C435A1DE414CC8CD83B70CCE77E52ACE5CA8B874A77424F22AE2785759BC94E76A94EA1C4EACF74E95C7094DF05A7
Malicious:	false
Reputation:	unknown
Preview:	<?xml version="1.0" encoding="utf-8" ?>.<resources>. <stringres id="February">. <xmbtext>Febru.r</xmbtext>. </stringres>. <stringres id="March">. <xmbtext>Marec</xmbtext>. </stringres>. <stringres id="April">. <xmbtext>Apr.l</xmbtext>. </stringres>. <stringres id="May">. <xmbtext>M.j</xmbtext>. </stringres>. <stringres id="June">. <xmbtext>J.n</xmbtext>. </stringres>. <stringres id="July">. <xmbtext>J.l</xmbtext>. </stringres>. <stringres id="August">. <xmbtext>August</xmbtext>. </stringres>. <stringres id="September">. <xmbtext>September</xmbtext>. </stringres>. <stringres id="October">. <xmbtext>Okt.ber</xmbtext>. </stringres>. <stringres id="November">. <xmbtext>November</xmbtext>. </stringres>. <stringres id="December">. <xmbtext>December</xmbtext>. </stringres>. <stringres id="Jan">. <xmbtext>Jan</xmbtext>. </stringres>. <stringres id="Feb">. <xmbtext>Feb</xmbtext>. </stringres>. <stringres id="Mar">. <xmbtext>Mar</xmbtext>. </stringres>. <stringres id="Apr">.

C:\Program Files (x86)\Google\Picasa3\cdautorun\Picasa Restore.app\Contents\Resources\sl.lproj\PRMainMenu.nib\classes.nib

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe
File Type:	XML 1.0 document, ASCII text
Category:	dropped
Size (bytes):	1571
Entropy (8bit):	4.883604938493906
Encrypted:	false
SSDEEP:	24:2dfyiwqhtsd551XBeYSjV+NaBFh3gsX4DHLqaemns4:cfyghtc55DeHj3besX4DHZs4
MD5:	AFE57505E88B3C6CD5D7A27ED6539C66
SHA1:	CA6705B7559326C5C60F8A15DFC6751208DD0643
SHA-256:	BC6AF85CB27E3E742EA8E5519483ACA800F0D2C3C469C1E6AF2161CC5BE647F4
SHA-512:	D5EC7CCED627E987028E4EAB5030126D31E105C1EA91616A956D55552F19F2E71A1EA327D4039428959D661A33E4F072B806BA20BFB3CDD2D5EB0DF98CD4466C
Malicious:	false
Reputation:	unknown
Preview:	<?xml version="1.0" encoding="UTF-8"?>.<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">.<plist version="1.0">.<dict>..<key>IBClasses</key>..<array>...<dict>....<key>ACTIONS</key>....<dict>.....<key>cancelPromptForDestinationFolderChoice</key>.....<string>id</string>.....<key>cancelRestoration</key>.....<string>id</string>.....<key>finishPromptForDestinationFolderChoice</key>.....<string>id</string>.....<key>openManifestFile</key>.....<string>id</string>.....<key>openSourceInDefaultApplication</key>.....<string>id</string>.....<key>selectFolderForDestination</key>.....<string>id</string>.....<key>showDestinationInFinder</key>.....<string>id</string>.....<key>showInPreviewApplication</key>.....<string>id</string>.....<key>showSourceInFinder</key>.....<string>id</string>.....<key>startRestoration</key>.....<string>id</string>....</dict>....<key>CLASS</key>....<string>PRAppController</string>....<key>LANGUAGE</key>....<string>ObjC</stri

C:\Program Files (x86)\Google\Picasa3\cdautorun\Picasa Restore.app\Contents\Resources\sl.lproj\PRMainMenu.nib\info.nib

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe
File Type:	XML 1.0 document, ASCII text
Category:	dropped
Size (bytes):	530
Entropy (8bit):	5.250472465860794
Encrypted:	false
SSDEEP:	12:TMHdgo+tJVEdQiCXFbCGIfx2w0GeC6mwbn:2dfyiwFrIZ2ZC6pb
MD5:	0E168543FD71A479FA5AD0E0613A1BA5
SHA1:	9ACD86A59CE7EC341021D75817D082118D351C56
SHA-256:	7C87E946FB8E106D8856A962C780503F602FAE5B09A818F5AD3ACDFC6468546A
SHA-512:	DFFAB3A94B1994D3EC558F308729DED11A9759CC6B4C6E0022ECE502AE5D2BB8437211B37549454DDB43CCACF91F0989E61A1C173B4F59FBCFF423BAFBEAC44A
Malicious:	false
Reputation:	unknown
Preview:	<?xml version="1.0" encoding="UTF-8"?>.<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">.<plist version="1.0">.<dict>..<key>IBFramework Version</key>..<string>680</string>..<key>IBLastKnownRelativeProjectPath</key>..<string>../../../Mac/Picasa.xcodeproj</string>..<key>IBOldestOS</key>..<integer>4</integer>..<key>IBOpenObjects</key>..<array/>..<key>IBSystem Version</key>..<string>9L31a</string>..<key>targetFramework</key>..<string>IBCocoaFramework</string>.</dict>.</plist>.

C:\Program Files (x86)\Google\Picasa3\cdautorun\Picasa Restore.app\Contents\Resources\sl.lproj\PRMainMenu.nib\keyedobjects.nib

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe
File Type:	Apple binary property list
Category:	dropped
Size (bytes):	23058
Entropy (8bit):	6.908877068923412
Encrypted:	false
SSDEEP:	384:+LxXoV8vPOL4TDxdF1EfHK81yvW89r7HEusj1RfmGBd4gjrXiiq0Cl6Hd4+gT6uf:8oV8H1Dx72Pa5zExLfmOdPiiW6HO+buf
MD5:	4D8697F3D25A7EEC96194BB73732FBFC
SHA1:	2CC410682F427DBFDED17A96D78953115F21B550
SHA-256:	02F3282A427E963A6B44E8BE3784E11391E96D9C4B4B956D6EA1F816BD7E8338
SHA-512:	E9CBCD570431D1ADF0AB5BD044D46EC64939D2E1D6CEEB66D9F4F992C39AD8C67507C765A478B601B847F6751E5DEFC449BE5E55A1ABB812A15C8728ECDF644B
Malicious:	false
Reputation:	unknown
Preview:	bplist00.................X$versionT$topY$archiverX$objects..........]IB.objectdata.._..NSKeyedArchiver.........1.5.6.<.=.A.E.h.p....................................................... .!.$.,.?.@.L.M.U.V.Y.^.a.i.j.k.n.t.}.........................................................................................#.(.).,./.0.3.@.A.B.E.M.N...R.S.V.^.e.f.m.n.y.............................................................!.0.1.5.6.5.:.=.@.I...J.K.r.L.S.T.Y.Z.].d.e.m.n.r.u.\|.}...........................................................................................$.(.)..+./.6.;.<.=.A.I.J.K.L.Q.V.W.\.a.b.g.s.t.u.\|.......................................................................................................%.&.'.,.-.1.8.9.:.;.E.F.G.H.K.T.U.V.W.^._.`.......................................................&.../.0...3.5.{................................................. .!.".#.$.%.&.'.(.)..+.,.-.../.0.1.2.3.4.5.6.7.8.9.:.;.<.=.>.?.@.A.B.C.D.E.F.G.H.I.J.K.L.M.P.S...!.".#.$.%.&.'.(.).*.+.,.-

C:\Program Files (x86)\Google\Picasa3\cdautorun\Picasa Restore.app\Contents\Resources\sl.lproj\i18n\restore_resexport.xml

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 text
Category:	dropped
Size (bytes):	2515
Entropy (8bit):	4.869986672782171
Encrypted:	false
SSDEEP:	24:2dRtGnzDLQuU7EvA11gkAqovpMFvREGDBUe9kvkK4SHhoG1wAEu4sc2RrLKhnjvP:c/Gz/VPAofpoR5I9LzCPblg1SiQy4rRf
MD5:	1404D3EF7D17165D3078C263AA3500EE
SHA1:	9C68DA02D221D627B5879E0ED7EE98FF73779255
SHA-256:	042366C55E9D5D72969813F88E11783DCB4FBF8A2D89AA2FCBAFF5AB5DFAC82B
SHA-512:	C3FFC9CFD24852ADFBF1EC254D729393900C9ECCE0696F2B4E9DA6CB41507DF34AC94FA9910A0964C53316065F76317CDAC00FDD9A4C113F7BB166C8A7D01D76
Malicious:	false
Reputation:	unknown
Preview:	<?xml version="1.0" encoding="utf-8" ?>.<Win32Res>. <RT_DIALOG>. <res resid="#904">. <dtitle>. <xmbtext>Obnovi iz Picasine varnostne kopije</xmbtext>. </dtitle>. <dlayout>rect(0 0 296 154)</dlayout>. <item itemid="1" itemtype="Button" layout="rect(177 133 227 147)">. <xmbtext>Naprej</xmbtext>. </item>. <item itemid="2" itemtype="Button" layout="rect(239 133 289 147)">. <xmbtext>Prekli.i</xmbtext>. </item>. <item itemid="3" itemtype="Button" layout="rect(7 133 57 147)">. <xmbtext>Izvrzi</xmbtext>. </item>. <item itemid="1010" itemtype="Button" layout="rect(25 47 236 59)">. <xmbtext>Prvotna mesta</xmbtext>. </item>. <item itemid="1011" itemtype="Button" layout="rect(25 83 241 95)">. <xmbtext>To mapo</xmbtext>. </item>. <item itemid="1009" itemtype="Edit" layout="rect(41 100 221 113)"/>. <item itemid="4" itemtype="Button" layout="rect(227 100 277 114)">. <xmbtext>Spremeni ...</xmbtext>. </item>. <item itemid="-1" itemtype="Button" l

C:\Program Files (x86)\Google\Picasa3\cdautorun\Picasa Restore.app\Contents\Resources\sl.lproj\i18n\restore_stringres.xml

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 text
Category:	dropped
Size (bytes):	10040
Entropy (8bit):	4.814823152301683
Encrypted:	false
SSDEEP:	192:9XLsDlBYLezeZtEeBedfc4jMhHPZno+tyXLsDlBYLezeZtEeBedfc4jMhHPZno+V:ZgYEiigYEi3k5p+IO/dT+vO
MD5:	EF52E27437B9B4CBAC5FC51B17ED0A95
SHA1:	548F507BB5BE720681E27358D2ED8EDD38516E05
SHA-256:	79B63139771A9DEA48B9E6AFA7095053D970403D69237A07A9AC6D0E4BAE55E3
SHA-512:	176D188D8E6A17862932FD907EEC7ACED386798BE2A2DA0821A48100B889916C46ACB729CFF9A6F6A3185E67C628496C4FB469EA8631411F239853CE7A2690EE
Malicious:	false
Reputation:	unknown
Preview:	<?xml version="1.0" encoding="utf-8" ?>.<resources>. <stringres id="February">. <xmbtext>februar</xmbtext>. </stringres>. <stringres id="March">. <xmbtext>marec</xmbtext>. </stringres>. <stringres id="April">. <xmbtext>april</xmbtext>. </stringres>. <stringres id="May">. <xmbtext>maj</xmbtext>. </stringres>. <stringres id="June">. <xmbtext>junij</xmbtext>. </stringres>. <stringres id="July">. <xmbtext>julij</xmbtext>. </stringres>. <stringres id="August">. <xmbtext>avgust</xmbtext>. </stringres>. <stringres id="September">. <xmbtext>september</xmbtext>. </stringres>. <stringres id="October">. <xmbtext>oktober</xmbtext>. </stringres>. <stringres id="November">. <xmbtext>november</xmbtext>. </stringres>. <stringres id="December">. <xmbtext>december</xmbtext>. </stringres>. <stringres id="Jan">. <xmbtext>jan</xmbtext>. </stringres>. <stringres id="Feb">. <xmbtext>feb</xmbtext>. </stringres>. <stringres id="Mar">. <xmbtext>mar</xmbtext>. </stringres>. <stringres id="Apr">. <

C:\Program Files (x86)\Google\Picasa3\cdautorun\Picasa Restore.app\Contents\Resources\sr.lproj\PRMainMenu.nib\classes.nib

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe
File Type:	XML 1.0 document, ASCII text
Category:	dropped
Size (bytes):	1571
Entropy (8bit):	4.883604938493906
Encrypted:	false
SSDEEP:	24:2dfyiwqhtsd551XBeYSjV+NaBFh3gsX4DHLqaemns4:cfyghtc55DeHj3besX4DHZs4
MD5:	AFE57505E88B3C6CD5D7A27ED6539C66
SHA1:	CA6705B7559326C5C60F8A15DFC6751208DD0643
SHA-256:	BC6AF85CB27E3E742EA8E5519483ACA800F0D2C3C469C1E6AF2161CC5BE647F4
SHA-512:	D5EC7CCED627E987028E4EAB5030126D31E105C1EA91616A956D55552F19F2E71A1EA327D4039428959D661A33E4F072B806BA20BFB3CDD2D5EB0DF98CD4466C
Malicious:	false
Reputation:	unknown
Preview:	<?xml version="1.0" encoding="UTF-8"?>.<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">.<plist version="1.0">.<dict>..<key>IBClasses</key>..<array>...<dict>....<key>ACTIONS</key>....<dict>.....<key>cancelPromptForDestinationFolderChoice</key>.....<string>id</string>.....<key>cancelRestoration</key>.....<string>id</string>.....<key>finishPromptForDestinationFolderChoice</key>.....<string>id</string>.....<key>openManifestFile</key>.....<string>id</string>.....<key>openSourceInDefaultApplication</key>.....<string>id</string>.....<key>selectFolderForDestination</key>.....<string>id</string>.....<key>showDestinationInFinder</key>.....<string>id</string>.....<key>showInPreviewApplication</key>.....<string>id</string>.....<key>showSourceInFinder</key>.....<string>id</string>.....<key>startRestoration</key>.....<string>id</string>....</dict>....<key>CLASS</key>....<string>PRAppController</string>....<key>LANGUAGE</key>....<string>ObjC</stri

C:\Program Files (x86)\Google\Picasa3\cdautorun\Picasa Restore.app\Contents\Resources\sr.lproj\PRMainMenu.nib\info.nib

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe
File Type:	XML 1.0 document, ASCII text
Category:	dropped
Size (bytes):	530
Entropy (8bit):	5.250472465860794
Encrypted:	false
SSDEEP:	12:TMHdgo+tJVEdQiCXFbCGIfx2w0GeC6mwbn:2dfyiwFrIZ2ZC6pb
MD5:	0E168543FD71A479FA5AD0E0613A1BA5
SHA1:	9ACD86A59CE7EC341021D75817D082118D351C56
SHA-256:	7C87E946FB8E106D8856A962C780503F602FAE5B09A818F5AD3ACDFC6468546A
SHA-512:	DFFAB3A94B1994D3EC558F308729DED11A9759CC6B4C6E0022ECE502AE5D2BB8437211B37549454DDB43CCACF91F0989E61A1C173B4F59FBCFF423BAFBEAC44A
Malicious:	false
Reputation:	unknown
Preview:	<?xml version="1.0" encoding="UTF-8"?>.<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">.<plist version="1.0">.<dict>..<key>IBFramework Version</key>..<string>680</string>..<key>IBLastKnownRelativeProjectPath</key>..<string>../../../Mac/Picasa.xcodeproj</string>..<key>IBOldestOS</key>..<integer>4</integer>..<key>IBOpenObjects</key>..<array/>..<key>IBSystem Version</key>..<string>9L31a</string>..<key>targetFramework</key>..<string>IBCocoaFramework</string>.</dict>.</plist>.

C:\Program Files (x86)\Google\Picasa3\cdautorun\Picasa Restore.app\Contents\Resources\sr.lproj\PRMainMenu.nib\keyedobjects.nib

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe
File Type:	Apple binary property list
Category:	dropped
Size (bytes):	23950
Entropy (8bit):	6.879518347397441
Encrypted:	false
SSDEEP:	384:dLx3oV88POLXTDxdF1EfSK81yvT8933qcxusjh9f0qBD4ijrX9mslJ/VqclY8Zn6:zoV82gDx72KRRacxx7f0yDN9mCJ/McC1
MD5:	94440689510A50E92038E7563ADC68B4
SHA1:	2CC516F1C94470D8C03DB8FA9D035754286E8C04
SHA-256:	E6C47557E0DDD9BD33DBEBB0B8869EA604FAF4A5B4FE4D192282FB5A7578D0A3
SHA-512:	3D6BA92FD6280E965712BCC8AE730D3DC60F30F6BCE1B6470F8ABA7AFEF9E64876A0FFC6CBF92A020FB88537D4FD8D77A934F193B122378408C1B634AED8235B
Malicious:	false
Reputation:	unknown
Preview:	bplist00.................X$versionT$topY$archiverX$objects..........]IB.objectdata.._..NSKeyedArchiver.........1.5.6.<.=.A.E.h.p....................................................... .!.$.,.?.@.L.M.U.V.Y.^.a.i.j.k.n.t.}.........................................................................................#.(.).,./.0.3.@.A.B.E.M.N...R.S.V.^.e.f.m.n.y.............................................................!.0.1.5.6.5.:.=.@.I...J.K.r.L.S.T.Y.Z.].d.e.m.n.r.u.\|.}...........................................................................................$.(.)..+./.6.;.<.=.A.I.J.K.L.Q.V.W.\.a.b.g.s.t.u.\|.......................................................................................................%.&.'.,.-.1.8.9.:.;.E.F.G.H.K.T.U.V.W.^._.`.t.......................................................&.../.0...3.5.{................................................. .!.".#.$.%.&.'.(.)..+.,.-.../.0.1.2.3.4.5.6.7.8.9.:.;.<.=.>.?.@.A.B.C.D.E.F.G.H.I.J.K.L.M.P.S...!.".#.$.%.&.'.(.).*.+.,

C:\Program Files (x86)\Google\Picasa3\cdautorun\Picasa Restore.app\Contents\Resources\sr.lproj\i18n\restore_resexport.xml

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 text
Category:	dropped
Size (bytes):	2840
Entropy (8bit):	5.198824108085184
Encrypted:	false
SSDEEP:	48:c/Yt/VgOAWRmszR5KEUyroXiiVMwODvITZRf:GoVyW3/8o3kTZRf
MD5:	932AAF49E309EAC097C9706899A142C5
SHA1:	F95052E0558D721C36A3CC414189196C7C6A33EA
SHA-256:	5F5676A1BA57A453E53DC0F9246053FFB9D2776F8BDFE4F11ED3375394F59EB7
SHA-512:	C7F910ED970CB02A6A1614B51EAFFD2A437D825E90808B23C02F4F3C17C43E372AD0C2A4D2F8E52C82DD5EBA33A74178416E6E32AA4A47A493240BC8006833A7
Malicious:	false
Reputation:	unknown
Preview:	<?xml version="1.0" encoding="utf-8" ?>.<Win32Res>. <RT_DIALOG>. <res resid="#904">. <dtitle>. <xmbtext>....... .. Picasa ........ ......</xmbtext>. </dtitle>. <dlayout>rect(0 0 296 154)</dlayout>. <item itemid="1" itemtype="Button" layout="rect(177 133 227 147)">. <xmbtext>.......</xmbtext>. </item>. <item itemid="2" itemtype="Button" layout="rect(239 133 289 147)">. <xmbtext>......</xmbtext>. </item>. <item itemid="3" itemtype="Button" layout="rect(7 133 57 147)">. <xmbtext>......</xmbtext>. </item>. <item itemid="1010" itemtype="Button" layout="rect(25 47 236 59)">. <xmbtext>.......... ........</xmbtext>. </item>. <item itemid="1011" itemtype="Button" layout="rect(25 83 241 95)">. <xmbtext>.... ............</xmbtext>. </item>. <item itemid="1009" itemtype="Edit" layout="rect(41 100 221 113)"/>. <item itemid="4" itemtype="Button" layout="rect(227 100 277 114)">

C:\Program Files (x86)\Google\Picasa3\cdautorun\Picasa Restore.app\Contents\Resources\sr.lproj\i18n\restore_stringres.xml

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 text
Category:	dropped
Size (bytes):	11222
Entropy (8bit):	5.2047622867847325
Encrypted:	false
SSDEEP:	192:9qlLXGOlNeXegtEeNeLWrl0X739h4goxyPqlLXGOlNeXegtEeNeLWrl0X739h4gz:CSfEaRSfEaDAqkOcOMJom
MD5:	486128F5A49B208BE810A4D4830989EC
SHA1:	AEF5C50276D7231F317573B00581B8574E94FE2E
SHA-256:	ADE562985251B20BCA8DC0E075B58DDFEBD1B8CCE2E87D76D97C4611E4B2493B
SHA-512:	8400C8C3191817EED3C6D64695EF2EBA2DF9C943700FAF93059C99E40ED72C6816B5D8A344E71F0F24EC7634C6151ACC16308D791D07FB66B4ADBCCA073FF67A
Malicious:	false
Reputation:	unknown
Preview:	<?xml version="1.0" encoding="utf-8" ?>.<resources>. <stringres id="February">. <xmbtext>.......</xmbtext>. </stringres>. <stringres id="March">. <xmbtext>....</xmbtext>. </stringres>. <stringres id="April">. <xmbtext>.....</xmbtext>. </stringres>. <stringres id="May">. <xmbtext>...</xmbtext>. </stringres>. <stringres id="June">. <xmbtext>...</xmbtext>. </stringres>. <stringres id="July">. <xmbtext>...</xmbtext>. </stringres>. <stringres id="August">. <xmbtext>......</xmbtext>. </stringres>. <stringres id="September">. <xmbtext>.........</xmbtext>. </stringres>. <stringres id="October">. <xmbtext>.......</xmbtext>. </stringres>. <stringres id="November">. <xmbtext>........</xmbtext>. </stringres>. <stringres id="December">. <xmbtext>........</xmbtext>. </stringres>. <stringres id="Jan">. <xmbtext>......</xmbtext>. </stringres>. <stringres id="Feb">. <xmbtext>.......</xmbtext>. </stringres>. <string

C:\Program Files (x86)\Google\Picasa3\cdautorun\Picasa Restore.app\Contents\Resources\sv.lproj\PRMainMenu.nib\classes.nib

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe
File Type:	XML 1.0 document, ASCII text
Category:	dropped
Size (bytes):	1571
Entropy (8bit):	4.883604938493906
Encrypted:	false
SSDEEP:	24:2dfyiwqhtsd551XBeYSjV+NaBFh3gsX4DHLqaemns4:cfyghtc55DeHj3besX4DHZs4
MD5:	AFE57505E88B3C6CD5D7A27ED6539C66
SHA1:	CA6705B7559326C5C60F8A15DFC6751208DD0643
SHA-256:	BC6AF85CB27E3E742EA8E5519483ACA800F0D2C3C469C1E6AF2161CC5BE647F4
SHA-512:	D5EC7CCED627E987028E4EAB5030126D31E105C1EA91616A956D55552F19F2E71A1EA327D4039428959D661A33E4F072B806BA20BFB3CDD2D5EB0DF98CD4466C
Malicious:	false
Reputation:	unknown
Preview:	<?xml version="1.0" encoding="UTF-8"?>.<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">.<plist version="1.0">.<dict>..<key>IBClasses</key>..<array>...<dict>....<key>ACTIONS</key>....<dict>.....<key>cancelPromptForDestinationFolderChoice</key>.....<string>id</string>.....<key>cancelRestoration</key>.....<string>id</string>.....<key>finishPromptForDestinationFolderChoice</key>.....<string>id</string>.....<key>openManifestFile</key>.....<string>id</string>.....<key>openSourceInDefaultApplication</key>.....<string>id</string>.....<key>selectFolderForDestination</key>.....<string>id</string>.....<key>showDestinationInFinder</key>.....<string>id</string>.....<key>showInPreviewApplication</key>.....<string>id</string>.....<key>showSourceInFinder</key>.....<string>id</string>.....<key>startRestoration</key>.....<string>id</string>....</dict>....<key>CLASS</key>....<string>PRAppController</string>....<key>LANGUAGE</key>....<string>ObjC</stri

C:\Program Files (x86)\Google\Picasa3\cdautorun\Picasa Restore.app\Contents\Resources\sv.lproj\PRMainMenu.nib\info.nib

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe
File Type:	XML 1.0 document, ASCII text
Category:	dropped
Size (bytes):	530
Entropy (8bit):	5.250472465860794
Encrypted:	false
SSDEEP:	12:TMHdgo+tJVEdQiCXFbCGIfx2w0GeC6mwbn:2dfyiwFrIZ2ZC6pb
MD5:	0E168543FD71A479FA5AD0E0613A1BA5
SHA1:	9ACD86A59CE7EC341021D75817D082118D351C56
SHA-256:	7C87E946FB8E106D8856A962C780503F602FAE5B09A818F5AD3ACDFC6468546A
SHA-512:	DFFAB3A94B1994D3EC558F308729DED11A9759CC6B4C6E0022ECE502AE5D2BB8437211B37549454DDB43CCACF91F0989E61A1C173B4F59FBCFF423BAFBEAC44A
Malicious:	false
Reputation:	unknown
Preview:	<?xml version="1.0" encoding="UTF-8"?>.<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">.<plist version="1.0">.<dict>..<key>IBFramework Version</key>..<string>680</string>..<key>IBLastKnownRelativeProjectPath</key>..<string>../../../Mac/Picasa.xcodeproj</string>..<key>IBOldestOS</key>..<integer>4</integer>..<key>IBOpenObjects</key>..<array/>..<key>IBSystem Version</key>..<string>9L31a</string>..<key>targetFramework</key>..<string>IBCocoaFramework</string>.</dict>.</plist>.

C:\Program Files (x86)\Google\Picasa3\cdautorun\Picasa Restore.app\Contents\Resources\sv.lproj\PRMainMenu.nib\keyedobjects.nib

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe
File Type:	Apple binary property list
Category:	dropped
Size (bytes):	23978
Entropy (8bit):	6.783788680960705
Encrypted:	false
SSDEEP:	384:rCioV8vV+6SwN2TirM1Esh08sXUrzMFfsTOcyhs4XpR7WuasT/dOdRqrsQzRnceK:rCioV89+PwUTZ23ht+DshIINzRPtq24t
MD5:	AA7078D28E88D711FA2913B3A7037511
SHA1:	9236F3AE0A438CD8D483319EA13478DD4C575212
SHA-256:	D3DD67AF69CB930CFFB7026AFD2AD7F3AE698280E65A0FFBD18C2D87CDB777BD
SHA-512:	303D061D6A98FC7AC6539E5E1F8068EB05603AFC06608F181038C5A3E5528BA8344F8CB5D56F8C9E6EABD73BEB5243F4C14A1D2AFA37B413ADA375CAAED510DD
Malicious:	false
Reputation:	unknown
Preview:	bplist00.................X$versionT$topY$archiverX$objects..........]IB.objectdata.._..NSKeyedArchiver.........1.5.6.<.=.A.E.h.p.~.............................................................................#.$.%..1.2.9.:.;.@.A.F.M.S.T.U.Z.z...............................................................!.".(.)./.9.:.@.A.F.G.J.P.X.Y._.`.f.n.o.u.v.~............................................................................................. .)../.0.3.4.8.?.C.D.E.F.J.Q.R.S.X.l.m.n.o.y....................................................................... .&...1.:...;.?.B.I.J.Q.R.].f.g.h.i.j.k.l.m.w.{.\|......................................................................................................... .!.%.,.-.../.4.5.:.;.E.F.G.H.K.R.S.T.U.^._.`.......................................................!."...+.2.3.5.{................................................. .!.".#.$.%.&.'.(.)..+.,.-.../.0.1.2.3.4.5.6.7.8.9.:.;.<.=.>.?.@.A.B.C.D.E.F.G.H.I.J.K.L.M.P.S...!.".#.$.%.&.'.(.)..+.,.-

C:\Program Files (x86)\Google\Picasa3\cdautorun\Picasa Restore.app\Contents\Resources\sv.lproj\i18n\restore_resexport.xml

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 text
Category:	dropped
Size (bytes):	2563
Entropy (8bit):	4.9254240736784585
Encrypted:	false
SSDEEP:	24:2dRtaxzDLQu0y7EvAs/1g4ovua4FvREGDbe9kvrKcHj/wAEu4sTBxLKSxjvw7Ekf:c/S/V0dAsKluaER5TLpwjsvas2lTZRf
MD5:	323DC05DE3E2A7CCE80B9185FCBF6323
SHA1:	FFEA3425CC0110E223AADF789F610E7B1C7F912C
SHA-256:	BA652FE95AE63FF6DE74C4DF193BEB0B213F425656EA7F2EF7F3206C0824A55E
SHA-512:	AD520158D27A4B33BE5D498C97EDDA468B6235DD8DE9E02303ACC4AB1F4EB3EF0B4FF35A5095A7A23A88E54868990D20533FC4513FF6320F58CF617BE381B58E
Malicious:	false
Reputation:	unknown
Preview:	<?xml version="1.0" encoding="utf-8" ?>.<Win32Res>. <RT_DIALOG>. <res resid="#904">. <dtitle>. <xmbtext>.terst.ll fr.n en Picasa-s.kerhetskopia</xmbtext>. </dtitle>. <dlayout>rect(0 0 296 154)</dlayout>. <item itemid="1" itemtype="Button" layout="rect(177 133 227 147)">. <xmbtext>N.sta</xmbtext>. </item>. <item itemid="2" itemtype="Button" layout="rect(239 133 289 147)">. <xmbtext>Avbryt</xmbtext>. </item>. <item itemid="3" itemtype="Button" layout="rect(7 133 57 147)">. <xmbtext>Mata ut</xmbtext>. </item>. <item itemid="1010" itemtype="Button" layout="rect(25 47 236 59)">. <xmbtext>Ursprungliga platser</xmbtext>. </item>. <item itemid="1011" itemtype="Button" layout="rect(25 83 241 95)">. <xmbtext>Den h.r mappen</xmbtext>. </item>. <item itemid="1009" itemtype="Edit" layout="rect(41 100 221 113)"/>. <item itemid="4" itemtype="Button" layout="rect(227 100 277 114)">. <xmbtext>.ndra...</xmbtext>. </item>. <item itemid="-1" i

C:\Program Files (x86)\Google\Picasa3\cdautorun\Picasa Restore.app\Contents\Resources\sv.lproj\i18n\restore_stringres.xml

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 text
Category:	dropped
Size (bytes):	9940
Entropy (8bit):	4.81827637049142
Encrypted:	false
SSDEEP:	192:9gMBSjpmBBeTe5tEehe9/8YBZsKnBg5HoeNXgMBSjpmBBeTe5tEehe9/8YBZsKnL:DDBA4ECw9oDBA4ECw9A5UMOMn0ke
MD5:	D5C4E8C67D77A5AE3C9FA9A569D0C054
SHA1:	2FCD963BEB1DDC6BCA70AE1C766D49538C89BD07
SHA-256:	4E17B881B0120C27655C65A7293BF7B2BF920BE834170AFC04D4BCBE80430CA1
SHA-512:	6E7AE908672DEAB169751C25B79D78B60AE7268346CE4E1D2FEAE0CBC423B7FA363053D63DC0662204C8E84E0A878B85CE0F818993C8605A624D71791473A91D
Malicious:	false
Reputation:	unknown
Preview:	<?xml version="1.0" encoding="utf-8" ?>.<resources>. <stringres id="February">. <xmbtext>Februari</xmbtext>. </stringres>. <stringres id="March">. <xmbtext>Mars</xmbtext>. </stringres>. <stringres id="April">. <xmbtext>April</xmbtext>. </stringres>. <stringres id="May">. <xmbtext>Maj</xmbtext>. </stringres>. <stringres id="June">. <xmbtext>Juni</xmbtext>. </stringres>. <stringres id="July">. <xmbtext>Juli</xmbtext>. </stringres>. <stringres id="August">. <xmbtext>Augusti</xmbtext>. </stringres>. <stringres id="September">. <xmbtext>September</xmbtext>. </stringres>. <stringres id="October">. <xmbtext>Oktober</xmbtext>. </stringres>. <stringres id="November">. <xmbtext>November</xmbtext>. </stringres>. <stringres id="December">. <xmbtext>December</xmbtext>. </stringres>. <stringres id="Jan">. <xmbtext>Jan</xmbtext>. </stringres>. <stringres id="Feb">. <xmbtext>Feb</xmbtext>. </stringres>. <stringres id="Mar">. <xmbtext>Mar</xmbtext>. </stringres>. <stringres id="Apr">. <x

C:\Program Files (x86)\Google\Picasa3\cdautorun\Picasa Restore.app\Contents\Resources\tl.lproj\PRMainMenu.nib\classes.nib

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe
File Type:	XML 1.0 document, ASCII text
Category:	dropped
Size (bytes):	1571
Entropy (8bit):	4.883604938493906
Encrypted:	false
SSDEEP:	24:2dfyiwqhtsd551XBeYSjV+NaBFh3gsX4DHLqaemns4:cfyghtc55DeHj3besX4DHZs4
MD5:	AFE57505E88B3C6CD5D7A27ED6539C66
SHA1:	CA6705B7559326C5C60F8A15DFC6751208DD0643
SHA-256:	BC6AF85CB27E3E742EA8E5519483ACA800F0D2C3C469C1E6AF2161CC5BE647F4
SHA-512:	D5EC7CCED627E987028E4EAB5030126D31E105C1EA91616A956D55552F19F2E71A1EA327D4039428959D661A33E4F072B806BA20BFB3CDD2D5EB0DF98CD4466C
Malicious:	false
Reputation:	unknown
Preview:	<?xml version="1.0" encoding="UTF-8"?>.<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">.<plist version="1.0">.<dict>..<key>IBClasses</key>..<array>...<dict>....<key>ACTIONS</key>....<dict>.....<key>cancelPromptForDestinationFolderChoice</key>.....<string>id</string>.....<key>cancelRestoration</key>.....<string>id</string>.....<key>finishPromptForDestinationFolderChoice</key>.....<string>id</string>.....<key>openManifestFile</key>.....<string>id</string>.....<key>openSourceInDefaultApplication</key>.....<string>id</string>.....<key>selectFolderForDestination</key>.....<string>id</string>.....<key>showDestinationInFinder</key>.....<string>id</string>.....<key>showInPreviewApplication</key>.....<string>id</string>.....<key>showSourceInFinder</key>.....<string>id</string>.....<key>startRestoration</key>.....<string>id</string>....</dict>....<key>CLASS</key>....<string>PRAppController</string>....<key>LANGUAGE</key>....<string>ObjC</stri

C:\Program Files (x86)\Google\Picasa3\cdautorun\Picasa Restore.app\Contents\Resources\tl.lproj\PRMainMenu.nib\info.nib

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe
File Type:	XML 1.0 document, ASCII text
Category:	dropped
Size (bytes):	530
Entropy (8bit):	5.250472465860794
Encrypted:	false
SSDEEP:	12:TMHdgo+tJVEdQiCXFbCGIfx2w0GeC6mwbn:2dfyiwFrIZ2ZC6pb
MD5:	0E168543FD71A479FA5AD0E0613A1BA5
SHA1:	9ACD86A59CE7EC341021D75817D082118D351C56
SHA-256:	7C87E946FB8E106D8856A962C780503F602FAE5B09A818F5AD3ACDFC6468546A
SHA-512:	DFFAB3A94B1994D3EC558F308729DED11A9759CC6B4C6E0022ECE502AE5D2BB8437211B37549454DDB43CCACF91F0989E61A1C173B4F59FBCFF423BAFBEAC44A
Malicious:	false
Reputation:	unknown
Preview:	<?xml version="1.0" encoding="UTF-8"?>.<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">.<plist version="1.0">.<dict>..<key>IBFramework Version</key>..<string>680</string>..<key>IBLastKnownRelativeProjectPath</key>..<string>../../../Mac/Picasa.xcodeproj</string>..<key>IBOldestOS</key>..<integer>4</integer>..<key>IBOpenObjects</key>..<array/>..<key>IBSystem Version</key>..<string>9L31a</string>..<key>targetFramework</key>..<string>IBCocoaFramework</string>.</dict>.</plist>.

C:\Program Files (x86)\Google\Picasa3\cdautorun\Picasa Restore.app\Contents\Resources\tl.lproj\PRMainMenu.nib\keyedobjects.nib

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe
File Type:	Apple binary property list
Category:	dropped
Size (bytes):	22657
Entropy (8bit):	6.986266005378583
Encrypted:	false
SSDEEP:	384:6voV88FA1EPrFNkGcGuHhYxd2rBnnGO1ype+EuM1qtnyRKv7KcBMOtDmaK6HMPdW:6oV8j2jzcGuBRoOIpe5xsNyRA7RB3mSb
MD5:	098C95E9C0EFE6BB873019090506232F
SHA1:	556C8CED1BC551546592187148C868DD05D351EA
SHA-256:	40F3A47007EDBCFFDC12F58817605E7DBD889350607B5631C848D3AB8D0D844A
SHA-512:	FE1E22EA92493C4878EA9E04F0BFD4B1C50B9D528B368C8B85535B33847DCAB9A6D333344518A5AA2A8A018960FDAA0E5C12B90D9FCC53EB987E6F38E3997BD3
Malicious:	false
Reputation:	unknown
Preview:	bplist00.................X$versionT$topY$archiverX$objects..........]IB.objectdata.._..NSKeyedArchiver.........1.5.6.<.=.A.E.h.p........................................... .%.(.0.1.2.5.;.D.I.N.O.R.W.X.Z.].e.f.l.m.s.}.~.............................................................................................&.'./.<.=.B.C.D.G.K.L.O.W.X.c.j.k.r.s.u.v.z.................................................................................#.(.).5.6.9.<.=.B.E.I.P.Q.R.S.W.^.b.c.d.e.j.~...............................&.....9......................................... .!.'...2.6.9.@.A.H.I.T.].^._.`.a.b.c.d.n.r.s.v.y.z.\|.}.~.......................................................................\|.}....................... .!.%.,.-.../.4.5.:.;.E.F.G.H.K.T.U.V.W.^._.`...........................................................(./.0...3.5.{................................................. .!.".#.$.%.&.'.(.)..+.,.-.../.0.1.2.3.4.5.6.7.8.9.:.;.<.=.>.?.@.A.B.C.D.E.F.G.H.I.J.K.L.M.P.S...!.".#.$.%.&.'.(.)..+.,

C:\Program Files (x86)\Google\Picasa3\cdautorun\Picasa Restore.app\Contents\Resources\tl.lproj\i18n\restore_resexport.xml

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe
File Type:	XML 1.0 document, ASCII text
Category:	dropped
Size (bytes):	2585
Entropy (8bit):	4.895470495619398
Encrypted:	false
SSDEEP:	48:c/QHz/VOdAjsepZR5E2NErJEc+2pKlxPTW6TZRf:GIVljXNE2+JEP2pmxPTZRf
MD5:	FAECB0F97A8BBE307B9F11B590F10234
SHA1:	30CDC238166E2B72EC8E3030FF0AD24DC0916D63
SHA-256:	47FE8A8AB57B70BB83528B8F03F6739CC5C658EA632F41043555F65995A6AB37
SHA-512:	09D7F99C0562A889067B4CA49AFD836ED914CD1882616CE82908DA74DD478E4A39932BC79BEB1B6270403A923ED7B2C56197BC2B6DD3791927BB9F82BDAA6C3A
Malicious:	false
Reputation:	unknown
Preview:	<?xml version="1.0" encoding="utf-8" ?>.<Win32Res>. <RT_DIALOG>. <res resid="#904">. <dtitle>. <xmbtext>Ibalik mula sa isang backup sa Picasa</xmbtext>. </dtitle>. <dlayout>rect(0 0 296 154)</dlayout>. <item itemid="1" itemtype="Button" layout="rect(177 133 227 147)">. <xmbtext>Susunod</xmbtext>. </item>. <item itemid="2" itemtype="Button" layout="rect(239 133 289 147)">. <xmbtext>Kanselahin</xmbtext>. </item>. <item itemid="3" itemtype="Button" layout="rect(7 133 57 147)">. <xmbtext>I-eject</xmbtext>. </item>. <item itemid="1010" itemtype="Button" layout="rect(25 47 236 59)">. <xmbtext>Mga orihinal na kinalalagyan</xmbtext>. </item>. <item itemid="1011" itemtype="Button" layout="rect(25 83 241 95)">. <xmbtext>Ang folder na ito</xmbtext>. </item>. <item itemid="1009" itemtype="Edit" layout="rect(41 100 221 113)"/>. <item itemid="4" itemtype="Button" layout="rect(227 100 277 114)">. <xmbtext>Baguhin...</xmbtext>. </item>. <item ite

C:\Program Files (x86)\Google\Picasa3\cdautorun\Picasa Restore.app\Contents\Resources\tl.lproj\i18n\restore_stringres.xml

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe
File Type:	XML 1.0 document, ASCII text
Category:	dropped
Size (bytes):	10100
Entropy (8bit):	4.813110271248783
Encrypted:	false
SSDEEP:	192:91VB4p6hBgeGettEe8eEWiYBHeLVBqVHoyxv81VB4p6hBgeGettEe8eEWiYBHeLQ:3VgR0ERaE8kVgR0ERaEQuamOfXm2
MD5:	77245F74542801720783902F87B05A82
SHA1:	B96C4A3B6F2860CD1C7501D0A24553FEF67A0DCC
SHA-256:	A468BC41EA437008CE5B6BF58BE5705E608F6FF335BB75C5DC59C2EFF2FD9640
SHA-512:	F536F66E943A0FA28FB2CCC9BC15F0E2289A5E30E3F3A9C56833C1FBE3EA21E4446BDD95D86B23473AF4C796411D2DEAF9F073A8ACE6B0BC452B796A52D69DA6
Malicious:	false
Reputation:	unknown
Preview:	<?xml version="1.0" encoding="utf-8" ?>.<resources>. <stringres id="February">. <xmbtext>Pebrero</xmbtext>. </stringres>. <stringres id="March">. <xmbtext>Marso</xmbtext>. </stringres>. <stringres id="April">. <xmbtext>Abril</xmbtext>. </stringres>. <stringres id="May">. <xmbtext>Mayo</xmbtext>. </stringres>. <stringres id="June">. <xmbtext>Hunyo</xmbtext>. </stringres>. <stringres id="July">. <xmbtext>Hulyo</xmbtext>. </stringres>. <stringres id="August">. <xmbtext>Agosto</xmbtext>. </stringres>. <stringres id="September">. <xmbtext>Setyembre</xmbtext>. </stringres>. <stringres id="October">. <xmbtext>Oktubre</xmbtext>. </stringres>. <stringres id="November">. <xmbtext>Nobyembre</xmbtext>. </stringres>. <stringres id="December">. <xmbtext>Disyembre</xmbtext>. </stringres>. <stringres id="Jan">. <xmbtext>Ene</xmbtext>. </stringres>. <stringres id="Feb">. <xmbtext>Peb</xmbtext>. </stringres>. <stringres id="Mar">. <xmbtext>Mar</xmbtext>. </stringres>. <stringres id="Apr">.

C:\Program Files (x86)\Google\Picasa3\cdautorun\Picasa Restore.app\Contents\Resources\tr.lproj\PRMainMenu.nib\classes.nib

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe
File Type:	XML 1.0 document, ASCII text
Category:	dropped
Size (bytes):	1571
Entropy (8bit):	4.883604938493906
Encrypted:	false
SSDEEP:	24:2dfyiwqhtsd551XBeYSjV+NaBFh3gsX4DHLqaemns4:cfyghtc55DeHj3besX4DHZs4
MD5:	AFE57505E88B3C6CD5D7A27ED6539C66
SHA1:	CA6705B7559326C5C60F8A15DFC6751208DD0643
SHA-256:	BC6AF85CB27E3E742EA8E5519483ACA800F0D2C3C469C1E6AF2161CC5BE647F4
SHA-512:	D5EC7CCED627E987028E4EAB5030126D31E105C1EA91616A956D55552F19F2E71A1EA327D4039428959D661A33E4F072B806BA20BFB3CDD2D5EB0DF98CD4466C
Malicious:	false
Reputation:	unknown
Preview:	<?xml version="1.0" encoding="UTF-8"?>.<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">.<plist version="1.0">.<dict>..<key>IBClasses</key>..<array>...<dict>....<key>ACTIONS</key>....<dict>.....<key>cancelPromptForDestinationFolderChoice</key>.....<string>id</string>.....<key>cancelRestoration</key>.....<string>id</string>.....<key>finishPromptForDestinationFolderChoice</key>.....<string>id</string>.....<key>openManifestFile</key>.....<string>id</string>.....<key>openSourceInDefaultApplication</key>.....<string>id</string>.....<key>selectFolderForDestination</key>.....<string>id</string>.....<key>showDestinationInFinder</key>.....<string>id</string>.....<key>showInPreviewApplication</key>.....<string>id</string>.....<key>showSourceInFinder</key>.....<string>id</string>.....<key>startRestoration</key>.....<string>id</string>....</dict>....<key>CLASS</key>....<string>PRAppController</string>....<key>LANGUAGE</key>....<string>ObjC</stri

C:\Program Files (x86)\Google\Picasa3\cdautorun\Picasa Restore.app\Contents\Resources\tr.lproj\PRMainMenu.nib\info.nib

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe
File Type:	XML 1.0 document, ASCII text
Category:	dropped
Size (bytes):	530
Entropy (8bit):	5.250472465860794
Encrypted:	false
SSDEEP:	12:TMHdgo+tJVEdQiCXFbCGIfx2w0GeC6mwbn:2dfyiwFrIZ2ZC6pb
MD5:	0E168543FD71A479FA5AD0E0613A1BA5
SHA1:	9ACD86A59CE7EC341021D75817D082118D351C56
SHA-256:	7C87E946FB8E106D8856A962C780503F602FAE5B09A818F5AD3ACDFC6468546A
SHA-512:	DFFAB3A94B1994D3EC558F308729DED11A9759CC6B4C6E0022ECE502AE5D2BB8437211B37549454DDB43CCACF91F0989E61A1C173B4F59FBCFF423BAFBEAC44A
Malicious:	false
Reputation:	unknown
Preview:	<?xml version="1.0" encoding="UTF-8"?>.<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">.<plist version="1.0">.<dict>..<key>IBFramework Version</key>..<string>680</string>..<key>IBLastKnownRelativeProjectPath</key>..<string>../../../Mac/Picasa.xcodeproj</string>..<key>IBOldestOS</key>..<integer>4</integer>..<key>IBOpenObjects</key>..<array/>..<key>IBSystem Version</key>..<string>9L31a</string>..<key>targetFramework</key>..<string>IBCocoaFramework</string>.</dict>.</plist>.

C:\Program Files (x86)\Google\Picasa3\cdautorun\Picasa Restore.app\Contents\Resources\tr.lproj\PRMainMenu.nib\keyedobjects.nib

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe
File Type:	Apple binary property list
Category:	dropped
Size (bytes):	23909
Entropy (8bit):	6.783782643524339
Encrypted:	false
SSDEEP:	384:/gz5oV8v8tx1EBTG1a1v2keX12MPgZnuKHOUcaLduAlta1GIkir/C1qUfjO2RKVC:odoV8c2Ag+2+mnoOLdfiRUqdO7ziqoKL
MD5:	D5DE6AC5F79706ECD85A47F343C94854
SHA1:	AC6D8A52F7119D5B8D69E656942EB6C7EEB4DAF3
SHA-256:	29E413DCC0FB75B1EB04DA087BFF2B634B67FA95287B0082BD618F80DDA7C46E
SHA-512:	E7FE0B6DC9622C4481616860C2673077C0FA0D1C43141B9D2981A00804388DBCF7E5DEA0DFCFD5BE89B1D32C902DB50A31815E772364A3030AE3035716428C07
Malicious:	false
Reputation:	unknown
Preview:	bplist00.................X$versionT$topY$archiverX$objects..........]IB.objectdata.._..NSKeyedArchiver.........1.5.6.<.=.A.E.h.p...........................................................!.".%.-.@.A.M.N.U.V.Y.^.a.i.j.k.n.t.}....................................................................................... .$.)..-.0.3.4.5.8.<.C.G.H.I.J.O.W.\.].o.p.s.v.w.\|.......................................................................................#..+.,.-.2.8.@.G.H.P.Q.\.c.d.k.l.n.o.t.u.z.{...............................................r...........................%.&.8.B.F.G.H.I.O.G.Z.c.G.d.h.k.r.s.z.{.............................................................................................................".#.'.../.0.5.6.;.E.F.G.H.K.T.U.V.W.^._.`.......................................................&...'.+.2.3.5.{................................................. .!.".#.$.%.&.'.(.)..+.,.-.../.0.1.2.3.4.5.6.7.8.9.:.;.<.=.>.?.@.A.B.C.D.E.F.G.H.I.J.K.L.M.P.S...!.".#.$.%.&.'.(.)..+.,.-

C:\Program Files (x86)\Google\Picasa3\cdautorun\Picasa Restore.app\Contents\Resources\tr.lproj\i18n\restore_resexport.xml

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 text
Category:	dropped
Size (bytes):	2560
Entropy (8bit):	4.9610583343884365
Encrypted:	false
SSDEEP:	24:2dRt2zDLQum7EvA071gFovcdK4FvREGDwKe9kv5TKKK0v7HktEwAEu4sv+LKNjvi:c/w/VZAnWiKER57VKaHETpNtTZRf
MD5:	FE24DE35D31C3619A73BD1E061A39A1A
SHA1:	97D59640AC8DFC1FA8942572A8F3354C85E1E548
SHA-256:	C00014033B45C3205927391616B13367B076AC5A8174D7D68AE434AD9695AFB3
SHA-512:	6364DFED50F56948B8910D41C87FAB03F9E7BBA463CA0DBD4B1D2FC1184E8E6EA5D81DEAF7D55F1C9F0687C40C0385E300B24EA5C89AC9D21C780038B483D28B
Malicious:	false
Reputation:	unknown
Preview:	<?xml version="1.0" encoding="utf-8" ?>.<Win32Res>. <RT_DIALOG>. <res resid="#904">. <dtitle>. <xmbtext>Picasa yedeklemesinden geri y.kle</xmbtext>. </dtitle>. <dlayout>rect(0 0 296 154)</dlayout>. <item itemid="1" itemtype="Button" layout="rect(177 133 227 147)">. <xmbtext>.leri</xmbtext>. </item>. <item itemid="2" itemtype="Button" layout="rect(239 133 289 147)">. <xmbtext>.ptal et</xmbtext>. </item>. <item itemid="3" itemtype="Button" layout="rect(7 133 57 147)">. <xmbtext>..kar</xmbtext>. </item>. <item itemid="1010" itemtype="Button" layout="rect(25 47 236 59)">. <xmbtext>.zg.n konumlar</xmbtext>. </item>. <item itemid="1011" itemtype="Button" layout="rect(25 83 241 95)">. <xmbtext>Bu klas.r</xmbtext>. </item>. <item itemid="1009" itemtype="Edit" layout="rect(41 100 221 113)"/>. <item itemid="4" itemtype="Button" layout="rect(227 100 277 114)">. <xmbtext>De.i.tir.</xmbtext>. </item>. <item itemid="-1" itemtype="Bu

C:\Program Files (x86)\Google\Picasa3\cdautorun\Picasa Restore.app\Contents\Resources\tr.lproj\i18n\restore_stringres.xml

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 text
Category:	dropped
Size (bytes):	9998
Entropy (8bit):	4.882507921686698
Encrypted:	false
SSDEEP:	192:95TrIiCBVeLeTtEeWeBsnbYO5DsBifIoYBZj5TrIiCBVeLeTtEeWeBsnbYO5DsBX:EVSkEBiJBwVSkEBiJBFFWHYOVj5WV
MD5:	D934D5F80598E624499AC721313795C7
SHA1:	E49E84E89655D957DC2F39604D3EC1D449BA7677
SHA-256:	DB97A8E3E4F81FD6B73A2C4D192C0C1FB4882E3C4E9EC648BB7EAA424C92594D
SHA-512:	7546D320427C1F9D511C7A1F0F0A39DD2861CD98529D5FE3CC125F7D5AF203BD135586378852713E60EE2C332E142375060F83487CB41D2B24E19FD0E4D001E7
Malicious:	false
Reputation:	unknown
Preview:	<?xml version="1.0" encoding="utf-8" ?>.<resources>. <stringres id="February">. <xmbtext>.ubat</xmbtext>. </stringres>. <stringres id="March">. <xmbtext>Mart</xmbtext>. </stringres>. <stringres id="April">. <xmbtext>Nisan</xmbtext>. </stringres>. <stringres id="May">. <xmbtext>May.s</xmbtext>. </stringres>. <stringres id="June">. <xmbtext>Haziran</xmbtext>. </stringres>. <stringres id="July">. <xmbtext>Temmuz</xmbtext>. </stringres>. <stringres id="August">. <xmbtext>A.ustos</xmbtext>. </stringres>. <stringres id="September">. <xmbtext>Eyl.l</xmbtext>. </stringres>. <stringres id="October">. <xmbtext>Ekim</xmbtext>. </stringres>. <stringres id="November">. <xmbtext>Kas.m</xmbtext>. </stringres>. <stringres id="December">. <xmbtext>Aral.k</xmbtext>. </stringres>. <stringres id="Jan">. <xmbtext>Oca</xmbtext>. </stringres>. <stringres id="Feb">. <xmbtext>.ub</xmbtext>. </stringres>. <stringres id="Mar">. <xmbtext>Mar</xmbtext>. </stringres>. <stringres id="Apr">. <xm

C:\Program Files (x86)\Google\Picasa3\cdautorun\Picasa Restore.app\Contents\Resources\uk.lproj\PRMainMenu.nib\classes.nib

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe
File Type:	XML 1.0 document, ASCII text
Category:	dropped
Size (bytes):	1571
Entropy (8bit):	4.883604938493906
Encrypted:	false
SSDEEP:	24:2dfyiwqhtsd551XBeYSjV+NaBFh3gsX4DHLqaemns4:cfyghtc55DeHj3besX4DHZs4
MD5:	AFE57505E88B3C6CD5D7A27ED6539C66
SHA1:	CA6705B7559326C5C60F8A15DFC6751208DD0643
SHA-256:	BC6AF85CB27E3E742EA8E5519483ACA800F0D2C3C469C1E6AF2161CC5BE647F4
SHA-512:	D5EC7CCED627E987028E4EAB5030126D31E105C1EA91616A956D55552F19F2E71A1EA327D4039428959D661A33E4F072B806BA20BFB3CDD2D5EB0DF98CD4466C
Malicious:	false
Reputation:	unknown
Preview:	<?xml version="1.0" encoding="UTF-8"?>.<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">.<plist version="1.0">.<dict>..<key>IBClasses</key>..<array>...<dict>....<key>ACTIONS</key>....<dict>.....<key>cancelPromptForDestinationFolderChoice</key>.....<string>id</string>.....<key>cancelRestoration</key>.....<string>id</string>.....<key>finishPromptForDestinationFolderChoice</key>.....<string>id</string>.....<key>openManifestFile</key>.....<string>id</string>.....<key>openSourceInDefaultApplication</key>.....<string>id</string>.....<key>selectFolderForDestination</key>.....<string>id</string>.....<key>showDestinationInFinder</key>.....<string>id</string>.....<key>showInPreviewApplication</key>.....<string>id</string>.....<key>showSourceInFinder</key>.....<string>id</string>.....<key>startRestoration</key>.....<string>id</string>....</dict>....<key>CLASS</key>....<string>PRAppController</string>....<key>LANGUAGE</key>....<string>ObjC</stri

C:\Program Files (x86)\Google\Picasa3\cdautorun\Picasa Restore.app\Contents\Resources\uk.lproj\PRMainMenu.nib\info.nib

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe
File Type:	XML 1.0 document, ASCII text
Category:	dropped
Size (bytes):	530
Entropy (8bit):	5.250472465860794
Encrypted:	false
SSDEEP:	12:TMHdgo+tJVEdQiCXFbCGIfx2w0GeC6mwbn:2dfyiwFrIZ2ZC6pb
MD5:	0E168543FD71A479FA5AD0E0613A1BA5
SHA1:	9ACD86A59CE7EC341021D75817D082118D351C56
SHA-256:	7C87E946FB8E106D8856A962C780503F602FAE5B09A818F5AD3ACDFC6468546A
SHA-512:	DFFAB3A94B1994D3EC558F308729DED11A9759CC6B4C6E0022ECE502AE5D2BB8437211B37549454DDB43CCACF91F0989E61A1C173B4F59FBCFF423BAFBEAC44A
Malicious:	false
Reputation:	unknown
Preview:	<?xml version="1.0" encoding="UTF-8"?>.<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">.<plist version="1.0">.<dict>..<key>IBFramework Version</key>..<string>680</string>..<key>IBLastKnownRelativeProjectPath</key>..<string>../../../Mac/Picasa.xcodeproj</string>..<key>IBOldestOS</key>..<integer>4</integer>..<key>IBOpenObjects</key>..<array/>..<key>IBSystem Version</key>..<string>9L31a</string>..<key>targetFramework</key>..<string>IBCocoaFramework</string>.</dict>.</plist>.

C:\Program Files (x86)\Google\Picasa3\cdautorun\Picasa Restore.app\Contents\Resources\uk.lproj\PRMainMenu.nib\keyedobjects.nib

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe
File Type:	Apple binary property list
Category:	dropped
Size (bytes):	24165
Entropy (8bit):	6.867243871189948
Encrypted:	false
SSDEEP:	384:QgzGoV888ej1EBTC1a1vruM12ikCqtnjQe5tfiduAltaXkWryC5If1npABJsbAOZ:96oV8M2cJQ2ik1hzvfidfiAf1npABqbL
MD5:	5630D7ED2FB7133A2B80C3331B0402D5
SHA1:	3502CD36A85BF75DBF996F0575F04F881AA2F5C4
SHA-256:	D8DE846961E009B55E909C142146E63E1BD0AB5EC7ABBFAE1FBE9586C35D3CE2
SHA-512:	4DE7CB1F5D45C4D97CF2AB896DC706080DBE05D50B94162FC8CA338A5C43B9245209E3CD0DFA419F6D3928084F5EC3F2D2848188CCE42337DACC87E7879B33A6
Malicious:	false
Reputation:	unknown
Preview:	bplist00.................X$versionT$topY$archiverX$objects..........]IB.objectdata.._..NSKeyedArchiver.........1.5.6.<.=.A.E.h.p...........................................................!.".%.-.@.A.M.N.U.V.Y.^.a.i.j.k.n.t.}....................................................................................... .$.)..-.0.3.4.5.8.<.C.G.H.I.J.O.W.\.].o.p.s.v.w.\|.......................................................................................#..+.,.-.2.8.@.G.H.P.Q.\.c.d.k.l.n.o.t.u.z.{...............................................r...........................%.&.8.B.F.G.H.I.O.G.Z.c.G.d.h.k.r.s.z.{.............................................................................................................".#.'.../.0.5.6.;.E.F.G.H.K.T.U.V.W.^._.`.........................................................&...'.+.2.3.5.{................................................. .!.".#.$.%.&.'.(.)..+.,.-.../.0.1.2.3.4.5.6.7.8.9.:.;.<.=.>.?.@.A.B.C.D.E.F.G.H.I.J.K.L.M.P.S...!.".#.$.%.&.'.(.)..+.,

C:\Program Files (x86)\Google\Picasa3\cdautorun\Picasa Restore.app\Contents\Resources\uk.lproj\i18n\restore_resexport.xml

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 text
Category:	dropped
Size (bytes):	2804
Entropy (8bit):	5.232872930629356
Encrypted:	false
SSDEEP:	48:c/4MVz/V2A1hR7R58AMg3HAdKRMaxMVbVMJGS2nkTZRf:G9VR133H2KRNxGSDTZRf
MD5:	341316549B4906E08C248A61106ED11C
SHA1:	3A3570E35BF882926B47083566938502B6CA8FC6
SHA-256:	5024A50A0CBCEA2901D7E7E1DF72D1EE31D6A15B76992779986B3F5A7F730236
SHA-512:	835908436912E6E6D6D938016195F85B34A6FFC0E25B7B9FE372F6B43B8C4336E15A306221A4A933E7BBC544F3BD9F9447643C98ADF3732A1C2FD3F2D62F34B2
Malicious:	false
Reputation:	unknown
Preview:	<?xml version="1.0" encoding="utf-8" ?>.<Win32Res>. <RT_DIALOG>. <res resid="#904">. <dtitle>. <xmbtext>......... . ......... ..... Picasa</xmbtext>. </dtitle>. <dlayout>rect(0 0 296 154)</dlayout>. <item itemid="1" itemtype="Button" layout="rect(177 133 227 147)">. <xmbtext>.........</xmbtext>. </item>. <item itemid="2" itemtype="Button" layout="rect(239 133 289 147)">. <xmbtext>.........</xmbtext>. </item>. <item itemid="3" itemtype="Button" layout="rect(7 133 57 147)">. <xmbtext>.........</xmbtext>. </item>. <item itemid="1010" itemtype="Button" layout="rect(25 47 236 59)">. <xmbtext>....... ..............</xmbtext>. </item>. <item itemid="1011" itemtype="Button" layout="rect(25 83 241 95)">. <xmbtext>.. .....</xmbtext>. </item>. <item itemid="1009" itemtype="Edit" layout="rect(41 100 221 113)"/>. <item itemid="4" itemtype="Button" layout="rect(227 100 277

C:\Program Files (x86)\Google\Picasa3\cdautorun\Picasa Restore.app\Contents\Resources\uk.lproj\i18n\restore_stringres.xml

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 text
Category:	dropped
Size (bytes):	11118
Entropy (8bit):	5.215482658579279
Encrypted:	false
SSDEEP:	192:9oVf7dl0eueFtEeEezicb60c5AArNoF/QoVf7dl0eueFtEeEezicb60c5AArNoFK:NnmEzJtnmEzJ4BNix7JO4pyRa7Md7TlE
MD5:	5A657B7A305D157460AC62C39DA8DE1F
SHA1:	00384F275D91D8C69CFCD9203520F5AD1745E829
SHA-256:	C5A7E4D2EE70634737075409D4EC326BD71BF72A9F2DEF44C5E290E74B7EFFC1
SHA-512:	0E83EA5389FE20ED8BC904F2703EBE6896970F299AC275BAECD8D13B3D5926F50F6370184716A85BADA06CE638ECC78D821BE7B8862A648AD9D7E51686CD80BA
Malicious:	false
Reputation:	unknown
Preview:	<?xml version="1.0" encoding="utf-8" ?>.<resources>. <stringres id="February">. <xmbtext>.....</xmbtext>. </stringres>. <stringres id="March">. <xmbtext>........</xmbtext>. </stringres>. <stringres id="April">. <xmbtext>.......</xmbtext>. </stringres>. <stringres id="May">. <xmbtext>.......</xmbtext>. </stringres>. <stringres id="June">. <xmbtext>.......</xmbtext>. </stringres>. <stringres id="July">. <xmbtext>......</xmbtext>. </stringres>. <stringres id="August">. <xmbtext>.......</xmbtext>. </stringres>. <stringres id="September">. <xmbtext>........</xmbtext>. </stringres>. <stringres id="October">. <xmbtext>.......</xmbtext>. </stringres>. <stringres id="November">. <xmbtext>........</xmbtext>. </stringres>. <stringres id="December">. <xmbtext>.......</xmbtext>. </stringres>. <stringres id="Jan">. <xmbtext>....</xmbtext>. </stringres>. <stringres id="Feb">. <xmbtext>....</xmbtext>. </str

C:\Program Files (x86)\Google\Picasa3\cdautorun\Picasa Restore.app\Contents\Resources\zh_CN.lproj\PRMainMenu.nib\classes.nib

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe
File Type:	XML 1.0 document, ASCII text
Category:	dropped
Size (bytes):	1571
Entropy (8bit):	4.883604938493906
Encrypted:	false
SSDEEP:	24:2dfyiwqhtsd551XBeYSjV+NaBFh3gsX4DHLqaemns4:cfyghtc55DeHj3besX4DHZs4
MD5:	AFE57505E88B3C6CD5D7A27ED6539C66
SHA1:	CA6705B7559326C5C60F8A15DFC6751208DD0643
SHA-256:	BC6AF85CB27E3E742EA8E5519483ACA800F0D2C3C469C1E6AF2161CC5BE647F4
SHA-512:	D5EC7CCED627E987028E4EAB5030126D31E105C1EA91616A956D55552F19F2E71A1EA327D4039428959D661A33E4F072B806BA20BFB3CDD2D5EB0DF98CD4466C
Malicious:	false
Reputation:	unknown
Preview:	<?xml version="1.0" encoding="UTF-8"?>.<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">.<plist version="1.0">.<dict>..<key>IBClasses</key>..<array>...<dict>....<key>ACTIONS</key>....<dict>.....<key>cancelPromptForDestinationFolderChoice</key>.....<string>id</string>.....<key>cancelRestoration</key>.....<string>id</string>.....<key>finishPromptForDestinationFolderChoice</key>.....<string>id</string>.....<key>openManifestFile</key>.....<string>id</string>.....<key>openSourceInDefaultApplication</key>.....<string>id</string>.....<key>selectFolderForDestination</key>.....<string>id</string>.....<key>showDestinationInFinder</key>.....<string>id</string>.....<key>showInPreviewApplication</key>.....<string>id</string>.....<key>showSourceInFinder</key>.....<string>id</string>.....<key>startRestoration</key>.....<string>id</string>....</dict>....<key>CLASS</key>....<string>PRAppController</string>....<key>LANGUAGE</key>....<string>ObjC</stri

C:\Program Files (x86)\Google\Picasa3\cdautorun\Picasa Restore.app\Contents\Resources\zh_CN.lproj\PRMainMenu.nib\info.nib

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe
File Type:	XML 1.0 document, ASCII text
Category:	dropped
Size (bytes):	530
Entropy (8bit):	5.250472465860794
Encrypted:	false
SSDEEP:	12:TMHdgo+tJVEdQiCXFbCGIfx2w0GeC6mwbn:2dfyiwFrIZ2ZC6pb
MD5:	0E168543FD71A479FA5AD0E0613A1BA5
SHA1:	9ACD86A59CE7EC341021D75817D082118D351C56
SHA-256:	7C87E946FB8E106D8856A962C780503F602FAE5B09A818F5AD3ACDFC6468546A
SHA-512:	DFFAB3A94B1994D3EC558F308729DED11A9759CC6B4C6E0022ECE502AE5D2BB8437211B37549454DDB43CCACF91F0989E61A1C173B4F59FBCFF423BAFBEAC44A
Malicious:	false
Reputation:	unknown
Preview:	<?xml version="1.0" encoding="UTF-8"?>.<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">.<plist version="1.0">.<dict>..<key>IBFramework Version</key>..<string>680</string>..<key>IBLastKnownRelativeProjectPath</key>..<string>../../../Mac/Picasa.xcodeproj</string>..<key>IBOldestOS</key>..<integer>4</integer>..<key>IBOpenObjects</key>..<array/>..<key>IBSystem Version</key>..<string>9L31a</string>..<key>targetFramework</key>..<string>IBCocoaFramework</string>.</dict>.</plist>.

C:\Program Files (x86)\Google\Picasa3\cdautorun\Picasa Restore.app\Contents\Resources\zh_CN.lproj\PRMainMenu.nib\keyedobjects.nib

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe
File Type:	Apple binary property list
Category:	dropped
Size (bytes):	22623
Entropy (8bit):	6.941702296653146
Encrypted:	false
SSDEEP:	384:VGoV88qLI+SrHYA1EvNNqBJcfzSaIGrf4Q7BL7LKD+mujtkD96pIj0isqSaa61:koV8DI+w4A2HGaIo4wbKD+m9D9j0eY6
MD5:	B97EF104684D2610CA5E31531FA07DFC
SHA1:	CE0A13CDE02BEA7103522119D8A557D90C835456
SHA-256:	ADB99A74AAEAEADF7A08A1C89E0EBD0E5DD3FC3D13D1BB7775ABDA34F1F074C3
SHA-512:	4387B846464BBF931FA30F0BE7A4372DE82EBD8C6DA007B91998FFD6289C3115217DF718178504691C098B9785ED7585CF66CC569CB1E6375D44F33348C23C4A
Malicious:	false
Reputation:	unknown
Preview:	bplist00.................X$versionT$topY$archiverX$objects..........]IB.objectdata.._..NSKeyedArchiver.........1.5.6.<.=.A.E.h.p...............................................................................".&.'.(.).-.5.6.7.8.=.I.N.P.S.T.W.X.[.`.................................................................'.(.../.5.?.@.F.G.L.M.P.V.^._.e.f.l.t.u.{.\|...............................................................................................%.&.'.(.-.1.8.9.:.?.G.K.L.O.\.].^.a.i.j...n.o.r.w.~................................................................................. .!.".'.../.6.7.8.=.G.H.I.S.n.o.t............................................................................................. .!.$.'.....(.).../.4.5.:.;.E.F.G.H.K.R.S.T.U.^._.`.....................................................!....+./.0...3.5.{................................................. .!.".#.$.%.&.'.(.)..+.,.-.../.0.1.2.3.4.5.6.7.8.9.:.;.<.=.>.?.@.A.B.C.D.E.F.G.H.I.J.K.L.M.P.S...!.".#.$.%.&.'.(.).*.+.,

C:\Program Files (x86)\Google\Picasa3\cdautorun\Picasa Restore.app\Contents\Resources\zh_CN.lproj\i18n\restore_resexport.xml

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 text
Category:	dropped
Size (bytes):	2486
Entropy (8bit):	5.253478623727306
Encrypted:	false
SSDEEP:	48:c/VD/VmANC3R5umB+K87rrhwVkT/mTZRf:GlVBNyXUpwVkzmTZRf
MD5:	ABDB709B69C5384C317980CCEDEE31E9
SHA1:	50F77C9C37A3332E46BDC4FA56C88A853F607100
SHA-256:	E5B974326ADACC84E3A41DE93E12CD469C833B562553246EB7D7246C74AE0F67
SHA-512:	E9DE952F7C2671ACF832088105042ACF880A2549D7901C0F539CE86E847CAA7B4D419C9EF084734B416B09B88A03C2119D8E8E12F5103A48C40A9F02899D7628
Malicious:	false
Reputation:	unknown
Preview:	<?xml version="1.0" encoding="utf-8" ?>.<Win32Res>. <RT_DIALOG>. <res resid="#904">. <dtitle>. <xmbtext>. Picasa ....</xmbtext>. </dtitle>. <dlayout>rect(0 0 296 154)</dlayout>. <item itemid="1" itemtype="Button" layout="rect(177 133 227 147)">. <xmbtext>...</xmbtext>. </item>. <item itemid="2" itemtype="Button" layout="rect(239 133 289 147)">. <xmbtext>..</xmbtext>. </item>. <item itemid="3" itemtype="Button" layout="rect(7 133 57 147)">. <xmbtext>..</xmbtext>. </item>. <item itemid="1010" itemtype="Button" layout="rect(25 47 236 59)">. <xmbtext>....</xmbtext>. </item>. <item itemid="1011" itemtype="Button" layout="rect(25 83 241 95)">. <xmbtext>....</xmbtext>. </item>. <item itemid="1009" itemtype="Edit" layout="rect(41 100 221 113)"/>. <item itemid="4" itemtype="Button" layout="rect(227 100 277 114)">. <xmbtext>.....</xmbtext>. </item>. <item itemid="-1" itemtype="Button" layout="rect

C:\Program Files (x86)\Google\Picasa3\cdautorun\Picasa Restore.app\Contents\Resources\zh_CN.lproj\i18n\restore_stringres.xml

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 text
Category:	dropped
Size (bytes):	9912
Entropy (8bit):	5.207709621074104
Encrypted:	false
SSDEEP:	192:9SCC+x3FedeMtEeDerXjJCDyHZKMoTSQSCC+x3FedeMtEeDerXjJCDyHZKMoTWbu:P2XEAt2XEA3OSog
MD5:	D7EAA6C2D47D0945DA1782237586B8EF
SHA1:	B48299D6637EB96C252094402D6A099E68CB6E6A
SHA-256:	DD8CC17D62705EE5F2CC8419A34CF9F2F505C403CF12A4E4D389808AAF77EBF7
SHA-512:	F98F980D5B68F9B512B081231E9C25360E54AA975112DFCD50D1748A2958E9BBD6788A001E4160267FECD4C7B79D42246E722FB91CE999589F66074BE55F2E4E
Malicious:	false
Reputation:	unknown
Preview:	<?xml version="1.0" encoding="utf-8" ?>.<resources>. <stringres id="February">. <xmbtext>2 .</xmbtext>. </stringres>. <stringres id="March">. <xmbtext>3 .</xmbtext>. </stringres>. <stringres id="April">. <xmbtext>4 .</xmbtext>. </stringres>. <stringres id="May">. <xmbtext>5 .</xmbtext>. </stringres>. <stringres id="June">. <xmbtext>6 .</xmbtext>. </stringres>. <stringres id="July">. <xmbtext>7 .</xmbtext>. </stringres>. <stringres id="August">. <xmbtext>8 .</xmbtext>. </stringres>. <stringres id="September">. <xmbtext>9 .</xmbtext>. </stringres>. <stringres id="October">. <xmbtext>10 .</xmbtext>. </stringres>. <stringres id="November">. <xmbtext>11 .</xmbtext>. </stringres>. <stringres id="December">. <xmbtext>12 .</xmbtext>. </stringres>. <stringres id="Jan">. <xmbtext>1 .</xmbtext>. </stringres>. <stringres id="Feb">. <xmbtext>2 .</xmbtext>. </stringres>. <stringres id="Mar">. <xmbtext>3 .</xmbtext>. </stringres>. <stringres id="Apr">. <xmbt

C:\Program Files (x86)\Google\Picasa3\cdautorun\Picasa Restore.app\Contents\Resources\zh_TW.lproj\PRMainMenu.nib\classes.nib

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe
File Type:	XML 1.0 document, ASCII text
Category:	dropped
Size (bytes):	1571
Entropy (8bit):	4.883604938493906
Encrypted:	false
SSDEEP:	24:2dfyiwqhtsd551XBeYSjV+NaBFh3gsX4DHLqaemns4:cfyghtc55DeHj3besX4DHZs4
MD5:	AFE57505E88B3C6CD5D7A27ED6539C66
SHA1:	CA6705B7559326C5C60F8A15DFC6751208DD0643
SHA-256:	BC6AF85CB27E3E742EA8E5519483ACA800F0D2C3C469C1E6AF2161CC5BE647F4
SHA-512:	D5EC7CCED627E987028E4EAB5030126D31E105C1EA91616A956D55552F19F2E71A1EA327D4039428959D661A33E4F072B806BA20BFB3CDD2D5EB0DF98CD4466C
Malicious:	false
Reputation:	unknown
Preview:	<?xml version="1.0" encoding="UTF-8"?>.<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">.<plist version="1.0">.<dict>..<key>IBClasses</key>..<array>...<dict>....<key>ACTIONS</key>....<dict>.....<key>cancelPromptForDestinationFolderChoice</key>.....<string>id</string>.....<key>cancelRestoration</key>.....<string>id</string>.....<key>finishPromptForDestinationFolderChoice</key>.....<string>id</string>.....<key>openManifestFile</key>.....<string>id</string>.....<key>openSourceInDefaultApplication</key>.....<string>id</string>.....<key>selectFolderForDestination</key>.....<string>id</string>.....<key>showDestinationInFinder</key>.....<string>id</string>.....<key>showInPreviewApplication</key>.....<string>id</string>.....<key>showSourceInFinder</key>.....<string>id</string>.....<key>startRestoration</key>.....<string>id</string>....</dict>....<key>CLASS</key>....<string>PRAppController</string>....<key>LANGUAGE</key>....<string>ObjC</stri

C:\Program Files (x86)\Google\Picasa3\cdautorun\Picasa Restore.app\Contents\Resources\zh_TW.lproj\PRMainMenu.nib\info.nib

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe
File Type:	XML 1.0 document, ASCII text
Category:	dropped
Size (bytes):	530
Entropy (8bit):	5.250472465860794
Encrypted:	false
SSDEEP:	12:TMHdgo+tJVEdQiCXFbCGIfx2w0GeC6mwbn:2dfyiwFrIZ2ZC6pb
MD5:	0E168543FD71A479FA5AD0E0613A1BA5
SHA1:	9ACD86A59CE7EC341021D75817D082118D351C56
SHA-256:	7C87E946FB8E106D8856A962C780503F602FAE5B09A818F5AD3ACDFC6468546A
SHA-512:	DFFAB3A94B1994D3EC558F308729DED11A9759CC6B4C6E0022ECE502AE5D2BB8437211B37549454DDB43CCACF91F0989E61A1C173B4F59FBCFF423BAFBEAC44A
Malicious:	false
Reputation:	unknown
Preview:	<?xml version="1.0" encoding="UTF-8"?>.<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">.<plist version="1.0">.<dict>..<key>IBFramework Version</key>..<string>680</string>..<key>IBLastKnownRelativeProjectPath</key>..<string>../../../Mac/Picasa.xcodeproj</string>..<key>IBOldestOS</key>..<integer>4</integer>..<key>IBOpenObjects</key>..<array/>..<key>IBSystem Version</key>..<string>9L31a</string>..<key>targetFramework</key>..<string>IBCocoaFramework</string>.</dict>.</plist>.

C:\Program Files (x86)\Google\Picasa3\cdautorun\Picasa Restore.app\Contents\Resources\zh_TW.lproj\PRMainMenu.nib\keyedobjects.nib

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe
File Type:	Apple binary property list
Category:	dropped
Size (bytes):	22639
Entropy (8bit):	6.956664556433957
Encrypted:	false
SSDEEP:	384:cFoV8vqZHI+mHYA1EvjNqBtzfjSaIjr+SQzHzLxIEHoujtIcb6OmEBSTi2h+L3:QoV80HI+m4A2M2aI+SW/xIEHohcb9rS0
MD5:	4A729AC8B94538472C41F5E1C2C5C03C
SHA1:	79DD192430409590BC86761031401E50CF7A2DF5
SHA-256:	6AA262BF007A80733A5C1B16848479C577FC9A35DDB5C78D550D7CDAE5ABC079
SHA-512:	A76FCB6FCDEE95B2BB492F9AC06F28C3FC39FCED8643B7380AD4439138F3AC2954C9C9846EAD348837A40134B11FB2782CA548B9BB647190163ACF761BBC5379
Malicious:	false
Reputation:	unknown
Preview:	bplist00.................X$versionT$topY$archiverX$objects..........]IB.objectdata.._..NSKeyedArchiver.........1.5.6.<.=.A.E.h.p...............................................................................".&.'.(.).-.5.6.7.8.=.I.N.P.S.T.W.X.[.`.................................................................'.(.../.5.?.@.F.G.L.M.P.V.^._.e.f.l.t.u.{.\|...............................................................................................%.&.'.(.-.1.8.9.:.?.G.K.L.O.\.].^.a.i.j...n.o.r.w.~................................................................................. .!.".'.../.6.7.8.=.G.H.I.S.n.o.t............................................................................................. .!.$.'.....(.).../.4.5.:.;.E.F.G.H.K.R.S.T.U.^._.`...................................................!....+./.0...3.5.{................................................. .!.".#.$.%.&.'.(.)..+.,.-.../.0.1.2.3.4.5.6.7.8.9.:.;.<.=.>.?.@.A.B.C.D.E.F.G.H.I.J.K.L.M.P.S...!.".#.$.%.&.'.(.).*.+.,.-

C:\Program Files (x86)\Google\Picasa3\cdautorun\Picasa Restore.app\Contents\Resources\zh_TW.lproj\i18n\restore_resexport.xml

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 text
Category:	dropped
Size (bytes):	2471
Entropy (8bit):	5.245982940363404
Encrypted:	false
SSDEEP:	24:2dRt39zDLQuWq7EvA/K1ggovVFvREGDVALe9kvKnKCQHG7wAEu4s9aLKc9jvA7EP:c/1/VW1AN93R5VADKN0YSzAoTZRf
MD5:	686547BBAC4F05D4A6683EB5837B7BDD
SHA1:	04C0840F45B1DED0B3A201CCB96C56A15E6BB130
SHA-256:	67CF17DEC017403734598BDC1262E8A541C448D0CD22ACCCC727701AEB178CA6
SHA-512:	FA3CCDAA8E58DE3E1BCB4ACCA2ACAD3AE52452E2F4F5D7E9AD813289282BDFC3E5A496E72A16CDBD4EBF8B24A136DC1B0E929770386014F3FE7F382BC89CD403
Malicious:	false
Reputation:	unknown
Preview:	<?xml version="1.0" encoding="utf-8" ?>.<Win32Res>. <RT_DIALOG>. <res resid="#904">. <dtitle>. <xmbtext>. Picasa ....</xmbtext>. </dtitle>. <dlayout>rect(0 0 296 154)</dlayout>. <item itemid="1" itemtype="Button" layout="rect(177 133 227 147)">. <xmbtext>...</xmbtext>. </item>. <item itemid="2" itemtype="Button" layout="rect(239 133 289 147)">. <xmbtext>..</xmbtext>. </item>. <item itemid="3" itemtype="Button" layout="rect(7 133 57 147)">. <xmbtext>..</xmbtext>. </item>. <item itemid="1010" itemtype="Button" layout="rect(25 47 236 59)">. <xmbtext>....</xmbtext>. </item>. <item itemid="1011" itemtype="Button" layout="rect(25 83 241 95)">. <xmbtext>.....</xmbtext>. </item>. <item itemid="1009" itemtype="Edit" layout="rect(41 100 221 113)"/>. <item itemid="4" itemtype="Button" layout="rect(227 100 277 114)">. <xmbtext>.....</xmbtext>. </item>. <item itemid="-1" itemtype="Button" layout="r

C:\Program Files (x86)\Google\Picasa3\cdautorun\Picasa Restore.app\Contents\Resources\zh_TW.lproj\i18n\restore_stringres.xml

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 text
Category:	dropped
Size (bytes):	10010
Entropy (8bit):	5.246340053472624
Encrypted:	false
SSDEEP:	192:9KOXTg5yeCeetEeEePmL9X8dp2xeomu/KOXTg5yeCeetEeEePmL9X8dp2xeomKb9:b7dEJx7dEJloOxlb
MD5:	0932F04875CB24A30CA29F0D36CB1697
SHA1:	E96F74345308BD2EBF9018F4649D14D9D15D1AF6
SHA-256:	17F5A17C481F191EB08B9E894F2425F1678D5B4A3E072F0682E77FC78DB36E78
SHA-512:	78601C1CA586796294A3AB3D70EBDBA69F762EC887C09A7CC0AD5F08005B7630AB153865E2874FDFF4C25706E0ADCA34F3DEA93293E0AFA0829BCDA006BE2E57
Malicious:	false
Reputation:	unknown
Preview:	<?xml version="1.0" encoding="utf-8" ?>.<resources>. <stringres id="February">. <xmbtext>..</xmbtext>. </stringres>. <stringres id="March">. <xmbtext>..</xmbtext>. </stringres>. <stringres id="April">. <xmbtext>..</xmbtext>. </stringres>. <stringres id="May">. <xmbtext>..</xmbtext>. </stringres>. <stringres id="June">. <xmbtext>..</xmbtext>. </stringres>. <stringres id="July">. <xmbtext>..</xmbtext>. </stringres>. <stringres id="August">. <xmbtext>..</xmbtext>. </stringres>. <stringres id="September">. <xmbtext>..</xmbtext>. </stringres>. <stringres id="October">. <xmbtext>..</xmbtext>. </stringres>. <stringres id="November">. <xmbtext>...</xmbtext>. </stringres>. <stringres id="December">. <xmbtext>...</xmbtext>. </stringres>. <stringres id="Jan">. <xmbtext>..</xmbtext>. </stringres>. <stringres id="Feb">. <xmbtext>..</xmbtext>. </stringres>. <stringres id="Mar">. <xmbtext>..</xmbtext>. </stringres>. <stringres

C:\Program Files (x86)\Google\Picasa3\cdautorun\PicasaCD.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1898824
Entropy (8bit):	6.744094206042407
Encrypted:	false
SSDEEP:	24576:slq+TZtG00f3GQgYHhDZRkPKIHJ4uyFte6diOcOyTBlfrD:MNTZ0VDVRkP3pediOcjTvfrD
MD5:	1905DAA36AC5D7B30ED79A232766E510
SHA1:	60E0495A78513CDA4959289AE3CDFB19C0E782F6
SHA-256:	B96BF61562A551184301E26AE475D63421DC8F22C6CA574F12942439EFD59023
SHA-512:	379F5A389A7C5783CA9E08A46A08E4C526AB41104ADF5E1BA61E50FEB66A49DD8BA502952805E779382D5C7AB278971DBF9FBCF871497A6B48A0A256EA07D1BF
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........]..3...3...3...3...3..$]...3..$N...3..$^.#.3.L.l...3.L.n...3...2.X.3..$A.C.3..$O...3..$K...3.Rich..3.........PE..L...G..V.....................p......@,............@.................................5........................................H..,.......P`..............H...........p...................................@...............4............................text............................... ..`.rdata..8\.......`..................@..@.data........p.......p..............@....rsrc...P`.......p...p..............@..@................................................................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Google\Picasa3\cdautorun\PicasaRestore.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1091912
Entropy (8bit):	6.603449385067101
Encrypted:	false
SSDEEP:	12288:TBNHVckf3ekdbpDQsOnql1yFtcgO/JqnMc2UARzkSE816WRh:3/ekdbpDQsOn4yFtwJrHhkSE813Rh
MD5:	1EB33C69E49E96119A36696A62258112
SHA1:	EAA612CE4C193B856B2B380FB53EE72CE544B303
SHA-256:	588F76D589E16F1475E95C29C7321EE1FE128F2A4AE6A390A6E2D454227E17C2
SHA-512:	EF3DC10E12C32026A09C698C816526911E7430C4FB4591A0152DC92E5E3E1D7F4A873899E79E727FCBD6FAC441451328DE89154FB7CADBF7EFED93204735ED32
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........1].`_..`_..`_...1..`_..."..`_...2..`_.qo...`_..`^.a_...-..`_...#..`_...'..`_.Rich.`_.................PE..L......V.................p...`...................@.................................#........................................^..........0$..............H........... ................................F..@...............(............................text....g.......p.................. ..`.rdata..............................@..@.data....-..........................@....rsrc...0$.......0...`..............@..@........................................................................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Google\Picasa3\cdautorun\cdgo.tre

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	5877
Entropy (8bit):	4.8316640081993185
Encrypted:	false
SSDEEP:	96:fvClZi6000bjIOQMhJM6or1ICRtrmWDR40:fvoZb1QSMhJM6orKCRtrmWDz
MD5:	AA68131599E73CFA3BD45F168988543B
SHA1:	43B1FC7F337F7D739CB9A148DD4E6230858FD807
SHA-256:	409AAAE1B188F303C9DE32DD16702957E5F364184E765F8E1893C9D3A3961A72
SHA-512:	E621A7D41B13A06F89A06ACB45CDA7A4B27B00FF8ABEDBC07C1EF533932190D99874BD0A266179CEFF040A83F6F04A42833F6C6C5636EC917F4B6B06F9A35D55
Malicious:	false
Reputation:	unknown
Preview:	#-----------------------------------------------------------.# Macros .#-----------------------------------------------------------..#define m_scaleX.XConstraint 0, 0, 0.XConstraint 1, 1, 0..#define m_offsetLT.MaintainOffset left.MaintainOffset top ..#define m_offsetLB.MaintainOffset left.MaintainOffset bottom..#define m_offsetRB.MaintainOffset right.MaintainOffset bottom..#define m_offsetRT.MaintainOffset right.MaintainOffset top..#define m_hidden.Property setvisible 0..#define m_centerX.XConstraint 0.5, 0.5, 0..#define m_offsetT.MaintainOffset top..#define m_disabled.Property disable 1..#define m_displayfont12.Property fonttrack -1.Property fontsize 12..#----------------------------------------------------------- ..cdgo/grad: root.Property sethiquality 1.XConstraint 0, -0.1, 0.YConstraint 0, -0.1, 0.XConstraint 1, 1.1, 0.YConstraint 1, 1.1, 0..cdgo/top: root.MaintainOffset top.XConstraint 0, 0, 0.XConstraint 1, 1, 0..cdgo/picasa: root.m_offsetLT..cdgo/google: root.m_offsetRT..#i18n--

C:\Program Files (x86)\Google\Picasa3\cdautorun\cdgo.ui

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe
File Type:	Adobe Photoshop Image, 800 x 600, RGB, 3x 8-bit channels
Category:	dropped
Size (bytes):	268503
Entropy (8bit):	5.385549457615012
Encrypted:	false
SSDEEP:	3072:/ddZeZCfn6xxp036LpffEw3CVII10ozOW3V4:1dZeZC+465cw3CT0ozN3V4
MD5:	FD5A138B5C1F8711D2F2382EAE37A4A5
SHA1:	E7844C29EA688F3AD3C032690B6884519E3AA361
SHA-256:	CB20F2A39E8AE2A1706D8BC38F6D5DC9088D2F04C5C6A5BE838D46D11835262A
SHA-512:	637CDA6B420EA19DF36AEFEF93277A83203E5AB11C400BE4CA2BD6BA9A3E1F1EE2C0D903708B5084A10C3ABE1F6995D73CD7EAD948C40EB0D50EC03EEDE908D2
Malicious:	false
Reputation:	unknown
Preview:	8BPS.............X... ..........*(8BIM................8BIM.%......F..&.V.......w8BIM.$.....3<?xpacket begin='.' id='W5M0MpCehiHzreSzNTczkc9d'?>.<x:xmpmeta xmlns:x='adobe:ns:meta/' x:xmptk='XMP toolkit 3.0-28, framework 1.6'>.<rdf:RDF xmlns:rdf='http://www.w3.org/1999/02/22-rdf-syntax-ns#' xmlns:iX='http://ns.adobe.com/iX/1.0/'>.. <rdf:Description rdf:about='uuid:eab203c8-7505-11db-9e7a-c1060aa41081'. xmlns:exif='http://ns.adobe.com/exif/1.0/'>. <exif:ColorSpace>4294967295</exif:ColorSpace>. <exif:PixelXDimension>800</exif:PixelXDimension>. <exif:PixelYDimension>600</exif:PixelYDimension>. </rdf:Description>.. <rdf:Description rdf:about='uuid:eab203c8-7505-11db-9e7a-c1060aa41081'. xmlns:pdf='http://ns.adobe.com/pdf/1.3/'>. </rdf:Description>.. <rdf:Description rdf:about='uuid:eab203c8-7505-11db-9e7a-c1060aa41081'. xmlns:photoshop='http://ns.adobe.com/photoshop/1.0/'>. <photoshop:History></photoshop:History>. </rdf:Description>.. <rdf:Description rdf:about='uuid:eab203c8-7505-

C:\Program Files (x86)\Google\Picasa3\i18n\uninstall.html

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe
File Type:	HTML document, ASCII text
Category:	dropped
Size (bytes):	1905
Entropy (8bit):	5.4852227850012625
Encrypted:	false
SSDEEP:	48:iZag0WM+UYCtZr1wM+UYCfqncyYwAzGZBBEQUwK82rLS5QKH:ipM+5CuM+5CScydlZAQUwNQ2LH
MD5:	B13948789ED12B6D2213CA8CBC4D1FB0
SHA1:	0452AB31B260C181A6D7E363BE49C200DC84E265
SHA-256:	942DF00BAB84EC6CF81073439B8FBF6E787AE3D9913B7BB9D3336C0A1A2B0B58
SHA-512:	D4DAAF7109B821435B2B488D439B39F30FE584A400CC125DDD3D0A9F9FA525ECB087F875243B3270A01B2A146B4DAC5AE68C8A4FD06EAF11259A734808CCA04A
Malicious:	false
Reputation:	unknown
Preview:	<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN">.<HTML>..<HEAD>...<TITLE></TITLE>...<META HTTP-EQUIV="CONTENT-TYPE" CONTENT="text/html; charset=windows-1252">...<META NAME="GENERATOR" CONTENT="OpenOffice.org 1.1.1 (Win32)">...<META NAME="CREATED" CONTENT="20050909;12392766">...<META NAME="CHANGED" CONTENT="20050909;12403943">..</HEAD>..<BODY LANG="en-US" DIR="ltr">...<P STYLE="BORDER-RIGHT: medium none; PADDING-RIGHT: 0in; BORDER-TOP: medium none; PADDING-LEFT: 0in; PADDING-BOTTOM: 0in; BORDER-LEFT: medium none; PADDING-TOP: 0in; BORDER-BOTTOM: medium none"><B><FONT SIZE="3">How ......do I uninstall Picasa? </FONT></B>...</P>...<P STYLE="BORDER-RIGHT: medium none; PADDING-RIGHT: 0in; BORDER-TOP: medium none; PADDING-LEFT: 0in; PADDING-BOTTOM: 0in; BORDER-LEFT: medium none; PADDING-TOP: 0in; BORDER-BOTTOM: medium none"><FONT SIZE="2">You .....can uninstall Picasa from either the Windows Add/Remove Programs control panel .....or by using the Uninstall option within the Pic

C:\Program Files (x86)\Google\Picasa3\i18n\uninstall_bg.html

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe
File Type:	HTML document, ISO-8859 text
Category:	dropped
Size (bytes):	1961
Entropy (8bit):	5.84921556921754
Encrypted:	false
SSDEEP:	48:iZar0tM+UYCtZLlsFB1wM+UYCfmSsFQDmFiQZzTFpZbsFIg40FyIFymjsFJD6ks:itM+5CGqM+5C+piiYyTZQFNV4X6ks
MD5:	1DA03FDCC5479DEE8D837D9B88E9628E
SHA1:	264E84B3B58758803F49C303ED292064D8CC40B4
SHA-256:	D140EA53F92469B46BC779D64DC5F1E1E87EC9C24E44E262F5F8FAFE0F5C5094
SHA-512:	718245BF1F466D9DEADCB5FE3604BE2B9EC342D57A98C47D978FB8ABB333709D819877EFB36A042E5F6075A64D82E4D2621B36BD62E25D15E3688753B752AFA7
Malicious:	false
Reputation:	unknown
Preview:	<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN">.<HTML>..<HEAD>...<TITLE></TITLE>...<META HTTP-EQUIV="CONTENT-TYPE" CONTENT="text/html; charset=windows-1251">...<META NAME="GENERATOR" CONTENT="OpenOffice.org 1.1.1 (Win32)">...<META NAME="CREATED" CONTENT="20050909;12392766">...<META NAME="CHANGED" CONTENT="20050909;12403943">..</HEAD>..<BODY LANG="bg" DIR="ltr">...<P STYLE="BORDER-RIGHT: medium none; PADDING-RIGHT: 0in; BORDER-TOP: medium none; PADDING-LEFT: 0in; PADDING-BOTTOM: 0in; BORDER-LEFT: medium none; PADDING-TOP: 0in; BORDER-BOTTOM: medium none"><B><FONT SIZE="3">... ........ ............ Picasa 3? </FONT></B>...</P>...<P STYLE="BORDER-RIGHT: medium none; PADDING-RIGHT: 0in; BORDER-TOP: medium none; PADDING-LEFT: 0in; PADDING-BOTTOM: 0in; BORDER-LEFT: medium none; PADDING-TOP: 0in; BORDER-BOTTOM: medium none"><FONT SIZE="2">...... ....... ............. Picasa ... .. Add/Remove Programs . .......... ..... .. Windows,........ .... ....... ............ . ..........

C:\Program Files (x86)\Google\Picasa3\i18n\uninstall_ca.html

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe
File Type:	HTML document, ISO-8859 text, with very long lines (395)
Category:	dropped
Size (bytes):	1993
Entropy (8bit):	5.468961679538535
Encrypted:	false
SSDEEP:	48:iZag0WM+UYCtZtn1wM+UYCfkR8UIZQpnt7Eznm6NpCNr9DN:ipM+5CBWM+5C8MZgt4zm8MNr9DN
MD5:	4033679EBA375EBF0E9C8138A40B3F99
SHA1:	3C695C88E53D9B97A428662EF3AF509624D95FEB
SHA-256:	04CF792087A2F97208899B647E615EEE1170BFA87C74DF1F60956CF3B520F216
SHA-512:	2F6575B38D5337C15CA24C4A9662B76EBF9211E1CDF630443E909E4983F4E0FF039BD1FCC0ACB155AC420152D81B31FADE0B003E483AE51C114E6BBBCDFC3FB6
Malicious:	false
Reputation:	unknown
Preview:	<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN">.<HTML>..<HEAD>...<TITLE></TITLE>...<META HTTP-EQUIV="CONTENT-TYPE" CONTENT="text/html; charset=windows-1252">...<META NAME="GENERATOR" CONTENT="OpenOffice.org 1.1.1 (Win32)">...<META NAME="CREATED" CONTENT="20050909;12392766">...<META NAME="CHANGED" CONTENT="20050909;12403943">..</HEAD>..<BODY LANG="en-US" DIR="ltr">...<P STYLE="BORDER-RIGHT: medium none; PADDING-RIGHT: 0in; BORDER-TOP: medium none; PADDING-LEFT: 0in; PADDING-BOTTOM: 0in; BORDER-LEFT: medium none; PADDING-TOP: 0in; BORDER-BOTTOM: medium none"><B><FONT SIZE="3">Com puc desinstal.lar Picasa 3? </FONT></B>...</P>...<P STYLE="BORDER-RIGHT: medium none; PADDING-RIGHT: 0in; BORDER-TOP: medium none; PADDING-LEFT: 0in; PADDING-BOTTOM: 0in; BORDER-LEFT: medium none; PADDING-TOP: 0in; BORDER-BOTTOM: medium none"><FONT SIZE="2">Podeu desinstal.lar Picasa des de l'opci. Afegeix/Elimina programes del panell de control del Windows o b. des de l'opci. de desinstal.laci.

C:\Program Files (x86)\Google\Picasa3\i18n\uninstall_cs.html

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe
File Type:	HTML document, Non-ISO extended-ASCII text
Category:	dropped
Size (bytes):	1931
Entropy (8bit):	5.677119456686002
Encrypted:	false
SSDEEP:	48:iZag0WM+UYCtZk1wM+UYCfUAqaRbvIZdf+ojVggkpxB04LEZ9sF5lzB5F6SNs:ipM+5CNM+5CJgZdiBB4QF5jT6SNs
MD5:	6A95B237DF7676DA982343B278697935
SHA1:	66D62642C5DAC1FA4D4C35C6ACECCEC09A52F28C
SHA-256:	FFECD5FB95A6BF28FEEDDEB2D50EFC3EC9EB90E21D387C0D35269BE8C5CB1CCD
SHA-512:	C9F442B158D093BF1906579D25BCF45008559C213F5C2C2169E57C743EFD24F0640A9E0C1D8CB4749F7735F5A6414806D49888CBFD891EF058527FD2B663D6B7
Malicious:	false
Reputation:	unknown
Preview:	<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN">.<HTML>..<HEAD>...<TITLE></TITLE>...<META HTTP-EQUIV="CONTENT-TYPE" CONTENT="text/html; charset=windows-1252">...<META NAME="GENERATOR" CONTENT="OpenOffice.org 1.1.1 (Win32)">...<META NAME="CREATED" CONTENT="20050909;12392766">...<META NAME="CHANGED" CONTENT="20050909;12403943">..</HEAD>..<BODY LANG="en-US" DIR="ltr">...<P STYLE="BORDER-RIGHT: medium none; PADDING-RIGHT: 0in; BORDER-TOP: medium none; PADDING-LEFT: 0in; PADDING-BOTTOM: 0in; BORDER-LEFT: medium none; PADDING-TOP: 0in; BORDER-BOTTOM: medium none"><B><FONT SIZE="3">Jak odinstaluji ......Picasa 3? </FONT></B>...</P>...<P STYLE="BORDER-RIGHT: medium none; PADDING-RIGHT: 0in; BORDER-TOP: medium none; PADDING-LEFT: 0in; PADDING-BOTTOM: 0in; BORDER-LEFT: medium none; PADDING-TOP: 0in; BORDER-BOTTOM: medium none"><FONT SIZE="2">Picasa .....m..ete odinstalovat bu. z ovl.dac.ho panelu Windows, .....nebo pou.it.m funkce Odinstalovat v programov. skupin. Picasa ("Start"

C:\Program Files (x86)\Google\Picasa3\i18n\uninstall_da.html

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe
File Type:	HTML document, ISO-8859 text, with very long lines (387)
Category:	dropped
Size (bytes):	1920
Entropy (8bit):	5.531748611898017
Encrypted:	false
SSDEEP:	48:iZag0WM+UYCtZ8GqwM+UYCf6NDLMUE3UAoZaRCWnFZyFvNRThi6FkNVhimSrSpFE:ipM+5C7M+5CCQNKZuZWvvkhfF47f
MD5:	16E63F6835DB8FC8C9A07AE473B85BEC
SHA1:	F5A800B83ECABC58A06B6D44A754C05CA158C551
SHA-256:	E5675D3755DBDF7EC757EFD35F584AB188130C8E9935354780397934D5550CD8
SHA-512:	2B0E160EA518DE1FBC476A0A01995D7EADEA29EAA1DB24170B8A66325BAB53A90A4C221D9B1B99EB0E43ECA31BC967B97A16F1AB583C0EF3376524F38014399A
Malicious:	false
Reputation:	unknown
Preview:	<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN">.<HTML>..<HEAD>...<TITLE></TITLE>...<META HTTP-EQUIV="CONTENT-TYPE" CONTENT="text/html; charset=windows-1252">...<META NAME="GENERATOR" CONTENT="OpenOffice.org 1.1.1 (Win32)">...<META NAME="CREATED" CONTENT="20050909;12392766">...<META NAME="CHANGED" CONTENT="20050909;12403943">..</HEAD>..<BODY LANG="en-US" DIR="ltr">...<P STYLE="BORDER-RIGHT: medium none; PADDING-RIGHT: 0in; BORDER-TOP: medium none; PADDING-LEFT: 0in; PADDING-BOTTOM: 0in; BORDER-LEFT: medium none; PADDING-TOP: 0in; BORDER-BOTTOM: medium none"><B><FONT SIZE="3">Hvordan afinstallerer jeg Picasa 2? </FONT></B>...</P>...<P STYLE="BORDER-RIGHT: medium none; PADDING-RIGHT: 0in; BORDER-TOP: medium none; PADDING-LEFT: 0in; PADDING-BOTTOM: 0in; BORDER-LEFT: medium none; PADDING-TOP: 0in; BORDER-BOTTOM: medium none"><FONT SIZE="2">Du kan enten afinstallere Picasa ved at v.lge Tilf.j/Fjern programmer i Windows Kontrolpanel eller ved at bruge afinstallationsfunktionen

C:\Program Files (x86)\Google\Picasa3\i18n\uninstall_de.html

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe
File Type:	HTML document, ISO-8859 text
Category:	dropped
Size (bytes):	1853
Entropy (8bit):	5.313802477782147
Encrypted:	false
SSDEEP:	48:iZag06l0ilRGMtfpAg6L0Eiuh15+q+cCfNl2yGO:ieirqg6prhPyFfNltGO
MD5:	6267CB121F07589C1692580300332A8A
SHA1:	ED64721FFCA130051D2F89ED25FEA5449CDA2333
SHA-256:	886DBC4C609B0DFE4374FCFF24DB524D4EF2BB01CC8A6603DAB760ACAF3D0316
SHA-512:	70891AC01434B149615DE5B6336F410E6B399E0C97327D9B15EE558C1F8E8B8B9ECFB751FE6AAD28EC661D4B2C0CB1201C500F76E04956C0026EC7FE91AB89A6
Malicious:	false
Reputation:	unknown
Preview:	<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN">.<HTML>..<HEAD>...<TITLE></TITLE>...<META HTTP-EQUIV="CONTENT-TYPE" CONTENT="text/html; charset=windows-1252">...<META NAME="GENERATOR" CONTENT="OpenOffice.org 1.1.1 (Win32)">...<META NAME="CREATED" CONTENT="20050909;12392766">...<META NAME="CHANGED" CONTENT="20050909;12403943">..</HEAD>..<BODY LANG="en-US" DIR="ltr">...<P><FONT size="+0"><B>Wie deinstalliere ich Picasa 3? </B></FONT>....<BR>....<BR>....<DIV class="i"><FONT size="-1">Sie k.nnen Picasa deinstallieren, indem Sie entweder in ......der "Systemsteuerung" die Option "Software" verwenden oder indem Sie die Option ......"Deinstallieren" in der Programmgruppe von Picasa verwenden ("Start" > ......"Programme" > "Picasa 3" > "Deinstallieren").......<BR>......<BR>......W.hrend des Deinstallationsvorgangs werden Sie gefragt, ob Sie auch die ......Picasa-Datenbank l.schen wollen. W.hlen Sie "Ja", wenn Sie die gesamte ......Organisation und alle Bearbeitungen l.s

C:\Program Files (x86)\Google\Picasa3\i18n\uninstall_el.html

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe
File Type:	HTML document, Unicode text, UTF-8 (with BOM) text, with very long lines (458)
Category:	dropped
Size (bytes):	2675
Entropy (8bit):	5.4244436578500945
Encrypted:	false
SSDEEP:	48:JZag0WM+UYCtZn3RwM+UYCfSF628WUnaZLZZRQ1oquXlX0JM63X0Xyj0ma3DCcUi:JpM+5CmM+5CKFFPXZqwCGa0ChaTClC64
MD5:	8C77B7927D928309265D5B2F25EE0BE1
SHA1:	9786DE0F863E4D54736107553AA0C7B6039CF746
SHA-256:	07A70E59FC38167C405441260B069ACA10559233B6AC9F5F7872A63A96F299C6
SHA-512:	BCBBAC97E975692466CCCDA313C81501E56FDF2D3197F386148C252E5801C7E31F0327E25AE40B77F1E8460FBC78CED9C95471DBBE76316326403F3D46484F0C
Malicious:	false
Reputation:	unknown
Preview:	.<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN">.<HTML>..<HEAD>...<TITLE></TITLE>...<META HTTP-EQUIV="CONTENT-TYPE" CONTENT="text/html; charset=windows-1252">...<META NAME="GENERATOR" CONTENT="OpenOffice.org 1.1.1 (Win32)">...<META NAME="CREATED" CONTENT="20050909;12392766">...<META NAME="CHANGED" CONTENT="20050909;12403943">..</HEAD>..<BODY LANG="en-US" DIR="ltr">...<P STYLE="BORDER-RIGHT: medium none; PADDING-RIGHT: 0in; BORDER-TOP: medium none; PADDING-LEFT: 0in; PADDING-BOTTOM: 0in; BORDER-LEFT: medium none; PADDING-TOP: 0in; BORDER-BOTTOM: medium none"><B><FONT SIZE="3">... ........... .. Picasa 3; </FONT></B>...</P>...<P STYLE="BORDER-RIGHT: medium none; PADDING-RIGHT: 0in; BORDER-TOP: medium none; PADDING-LEFT: 0in; PADDING-BOTTOM: 0in; BORDER-LEFT: medium none; PADDING-TOP: 0in; BORDER-BOTTOM: medium none"><FONT SIZE="2">........ .. ............... .. Picasa .... ... ... ............. .....

C:\Program Files (x86)\Google\Picasa3\i18n\uninstall_es.html

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe
File Type:	HTML document, ISO-8859 text
Category:	dropped
Size (bytes):	1646
Entropy (8bit):	5.299623117649288
Encrypted:	false
SSDEEP:	48:iZag06c50ilAu5D7BCggbGfmeDR0RVGy7K7Hsqirx:i42ix5IggauuGj7Csqk
MD5:	E076C1C6678C124672C7FEEF929BD331
SHA1:	42D16AB7D608CA9E4601D492A05F079E6CBC2474
SHA-256:	9682536C8EC6C1A4BEF0F0CE6FC2DA36435E67B83B7C07966F8E44565FF5A1B5
SHA-512:	87C87B2A847D87C5FC9671F97BD6916473A6D6FF780235D030054C99A1E403C70A58806C34A0C6607450047AC4D6BAB45E9AC0FC6AA770517F80A40E3E1F6703
Malicious:	false
Reputation:	unknown
Preview:	<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN">.<HTML>..<HEAD>...<TITLE></TITLE>...<META HTTP-EQUIV="CONTENT-TYPE" CONTENT="text/html; charset=windows-1252">...<META NAME="GENERATOR" CONTENT="OpenOffice.org 1.1.1 (Win32)">...<META NAME="CREATED" CONTENT="20050909;12392766">...<META NAME="CHANGED" CONTENT="20050909;12403943">..</HEAD>..<BODY LANG="en-US" DIR="ltr">...<P><FONT size="+0"><B>.Qu. debo hacer para desinstalar Picasa 3? </B></FONT>....<BR>....<BR>....<DIV class="i"><FONT size="-1">Picasa puede desinstalarse desde la opci.n Agregar o ......quitar programas del Panel de control de Windows o mediante la opci.n ......Desinstalar del grupo de programas de Picasa ("Inicio" > "Programas" > ......"Picasa 3" > "Desinstalar").......<BR>......<BR>......Durante el proceso de desinstalaci.n, tambi.n deber. eliminar la base de datos ......del programa. Seleccione "S." si desea borrar cualquier organizaci.n o ......modificaci.n que haya hecho en Picasa (si no tiene

C:\Program Files (x86)\Google\Picasa3\i18n\uninstall_fi.html

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe
File Type:	Unicode text, UTF-8 (with BOM) text
Category:	dropped
Size (bytes):	1475
Entropy (8bit):	5.212260551460327
Encrypted:	false
SSDEEP:	24:zmAFt+AFNYAFVPNEsVJOmAFt+AFNYAFVP/ZU2fzc3th16GqwiavbS/Cr2ss7ssOa:qM+UYCN3VzM+UYC/x46JwXSu2f7fJ3j7
MD5:	81389D000F742F093071C3C133258483
SHA1:	25A0ADAB42B1169D8C2904CA1942F8898FA04A82
SHA-256:	DED8DCD191B770E7D9DF09E760528E2CF7FE94A87C4917467877FC70DEAA4B19
SHA-512:	FBC39C03797341FC2FA7E236289B6F18200029EA2C51ADA9E89999B9016AD36AE29D9ED8E8EC882498783060B6C741704EA09E35F6084EF81EE3D5609483EDD3
Malicious:	false
Reputation:	unknown
Preview:	.<P style="BORDER-RIGHT: medium none; PADDING-RIGHT: 0in; BORDER-TOP: medium none; PADDING-LEFT: 0in; PADDING-BOTTOM: 0in; BORDER-LEFT: medium none; PADDING-TOP: 0in; BORDER-BOTTOM: medium none"><B><FONT size="3">Miten ....poistan Picasa 3-asennuksen tietokoneeltani?</FONT></B></P>.<P style="BORDER-RIGHT: medium none; PADDING-RIGHT: 0in; BORDER-TOP: medium none; PADDING-LEFT: 0in; PADDING-BOTTOM: 0in; BORDER-LEFT: medium none; PADDING-TOP: 0in; BORDER-BOTTOM: medium none"><FONT size="2">Voit ...poistaa Picasan joko Windowsin Lis../Poista ohjauspaneelista tai k.ytt.m.ll. ...Poista asennus-vaihtoehtoa Picasa-ohjelmiston sis.ll. ...("Aloita">"Ohjelmat">"Picasa 3">"Poista")....<BR>...Poiston aikana saat kehoitteen my.s Picasa-tietokannan poistoa varten. Valitse ..."kyll." jos haluat poistaa j.rjestelyj. tai muokkauksia joita olet tehnyt ...Picasan avulla (jos et aio uudelleenasentaa Picasa 3:ta). Valitse "ei" jos ...haluat s.ilytt.. muokkauksiasi (jos aiot asentaa

C:\Program Files (x86)\Google\Picasa3\i18n\uninstall_fr.html

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe
File Type:	HTML document, ISO-8859 text
Category:	dropped
Size (bytes):	1900
Entropy (8bit):	5.302723828080714
Encrypted:	false
SSDEEP:	48:iZag06Hnbb6illev0NwbKgB9w03MZCsVgnYvRe7amN4pVEBJQOhYj:iHb6iTgB7MMsdvRePM6BqkYj
MD5:	F5BED76BFFC8EE9EA4143256148F3919
SHA1:	B287DD2566220FA2DED28180B770374DB6D14015
SHA-256:	19EF66C05CC0DB6FA1C035AA9BB94765BE40E61288DB992B5CFD8F349C6394C2
SHA-512:	D26C55848EA0BB92E5509A8058867BD7A287AF3C6A91586DEAD81F1A248A76D080FE4D17C13FB1DB581C7B58D291CD10C92C0F17954E99A30C4494479A13B188
Malicious:	false
Reputation:	unknown
Preview:	<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN">.<HTML>..<HEAD>...<TITLE></TITLE>...<META HTTP-EQUIV="CONTENT-TYPE" CONTENT="text/html; charset=windows-1252">...<META NAME="GENERATOR" CONTENT="OpenOffice.org 1.1.1 (Win32)">...<META NAME="CREATED" CONTENT="20050909;12392766">...<META NAME="CHANGED" CONTENT="20050909;12403943">..</HEAD>..<BODY LANG="en-US" DIR="ltr">...<P><FONT size="+0"><B>Comment puis-je d.sinstaller Picasa 3 ? </B></FONT>....<BR>....<BR>....<DIV class="i"><FONT size="-1">Vous pouvez d.sinstaller Picasa . partir du Panneau de ......configuration Windows (option Ajout/Suppression de programmes) ou . l'aide de ......l'option de d.sinstallation dans le groupe de programmes Picasa (. D.marrer . ......> . Programmes . > . Picasa 3 . > . D.sinstaller .).......<BR>......<BR>......Pendant la proc.dure de d.sinstallation, un message vous demande si vous ......souhaitez supprimer .galement la base de donn.es de Picasa. Cliquez sur . Oui . ......si vous vo

C:\Program Files (x86)\Google\Picasa3\i18n\uninstall_hi.html

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe
File Type:	Unicode text, UTF-8 (with BOM) text
Category:	dropped
Size (bytes):	2621
Entropy (8bit):	4.725103671166666
Encrypted:	false
SSDEEP:	48:qM+UYCNkgLM+UYC/VcRUWvlhT7J2UdIENPWG8x65Q25GT7D6qDqWqT77F2vt:qM+5CygLM+5COT7UCxNPp55r4T7D6qDR
MD5:	8371845862895F07C7267E900F12204A
SHA1:	254F7345FB7DAE1326C790A1AB6DC77E4974101F
SHA-256:	B4BA7766D072F0DA32790F6BDCFC787E4254BA3CDFE9F83501CD46B3746C281A
SHA-512:	5F9FB8087052CB279E089E1F7AF5B61CC35047F0B9DF9DC269A6D585A80D5176C59A033CE1949A9253B2E1D2C71FC8DE34DD81885CCDA8CF5F57A061F17BE093
Malicious:	false
Reputation:	unknown
Preview:	.<P style="BORDER-RIGHT: medium none; PADDING-RIGHT: 0in; BORDER-TOP: medium none; PADDING-LEFT: 0in; PADDING-BOTTOM: 0in; BORDER-LEFT: medium none; PADDING-TOP: 0in; BORDER-BOTTOM: medium none"><B><FONT size="3">...... ..... .. .......... .... ....? </FONT></B></P>.<P style="BORDER-RIGHT: medium none; PADDING-RIGHT: 0in; BORDER-TOP: medium none; PADDING-LEFT: 0in; PADDING-BOTTOM: 0in; BORDER-LEFT: medium none; PADDING-TOP: 0in; BORDER-BOTTOM: medium none"><FONT size="2">.. ......... ......... .. ... .. .. ...... .. Add/Remove control panel .. ...... ............ .... .. .... .. ......... ...... ...... .. .... ... ("Start" > ..."Programs" > "Picasa 3" > "Uninstall")....<BR>...<BR>............ ........

C:\Program Files (x86)\Google\Picasa3\i18n\uninstall_hr.html

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe
File Type:	HTML document, Non-ISO extended-ASCII text
Category:	dropped
Size (bytes):	1981
Entropy (8bit):	5.488498548806033
Encrypted:	false
SSDEEP:	48:iZag0WM+UYCtZBT1wM+UYCfEOh6FzpyZDyc7RuRRPhRr3cBHsiLN:ipM+5CgM+5C2AZr7IBh9MBHV5
MD5:	FCFEB79900E3D0C5A0ADDCA49D32EF65
SHA1:	56DF168C191276ADFA8B605EAD1116C2CF43B36C
SHA-256:	F9F7F66494C6C88A9D4A45084C8E146D824CA75E1030A464BC72CB75D3AFF170
SHA-512:	BA7435BD05DCB8E5330051A3F953FA3F433D0CFF9950BB6AA6A85C10A6E641026BC9F32E43DB03E7578F9701C635A1EA0421164D1414D99B3D976E6317525E3B
Malicious:	false
Reputation:	unknown
Preview:	<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN">.<HTML>..<HEAD>...<TITLE></TITLE>...<META HTTP-EQUIV="CONTENT-TYPE" CONTENT="text/html; charset=windows-1252">...<META NAME="GENERATOR" CONTENT="OpenOffice.org 1.1.1 (Win32)">...<META NAME="CREATED" CONTENT="20050909;12392766">...<META NAME="CHANGED" CONTENT="20050909;12403943">..</HEAD>..<BODY LANG="en-US" DIR="ltr">...<P STYLE="BORDER-RIGHT: medium none; PADDING-RIGHT: 0in; BORDER-TOP: medium none; PADDING-LEFT: 0in; PADDING-BOTTOM: 0in; BORDER-LEFT: medium none; PADDING-TOP: 0in; BORDER-BOTTOM: medium none"><B><FONT SIZE="3">Kako ......mogu ukloniti program Picasa 3? </FONT></B>...</P>...<P STYLE="BORDER-RIGHT: medium none; PADDING-RIGHT: 0in; BORDER-TOP: medium none; PADDING-LEFT: 0in; PADDING-BOTTOM: 0in; BORDER-LEFT: medium none; PADDING-TOP: 0in; BORDER-BOTTOM: medium none"><FONT SIZE="2">Program .....Picasa mo.ete ukloniti s upravlja.ke plo.e sustava Windows Dodaj/Ukloni Programe .....ili putem opcije Deinstalacije

C:\Program Files (x86)\Google\Picasa3\i18n\uninstall_hu.html

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe
File Type:	HTML document, ISO-8859 text
Category:	dropped
Size (bytes):	2176
Entropy (8bit):	5.589925329354156
Encrypted:	false
SSDEEP:	48:iZag0WM+UYCtZixWwM+UYCfBZyczbyGZFjVxpLG0ROWXtLBqwGXam/7GQzZN:ipM+5CGLM+5CRZFBxNOWJBAhZN
MD5:	6BDF548B3740EEF2ADEED7FF745ED117
SHA1:	296B2C03C60977F6E1A1CFC00DB3AC8475704BBE
SHA-256:	55B13E1C6321EED2347227BFBB63F1F969ED4FED7F7953E4024CC8225611FBE3
SHA-512:	01AD617AB1611714484912481095D815EB54FD1B64B18E6E7296E90B8604711C03CA3F445B7543207683408DE6CBC441D3A4EF8C151D24ED843DE66E76B4B446
Malicious:	false
Reputation:	unknown
Preview:	<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN">.<HTML>..<HEAD>...<TITLE></TITLE>...<META HTTP-EQUIV="CONTENT-TYPE" CONTENT="text/html; charset=windows-1252">...<META NAME="GENERATOR" CONTENT="OpenOffice.org 1.1.1 (Win32)">...<META NAME="CREATED" CONTENT="20050909;12392766">...<META NAME="CHANGED" CONTENT="20050909;12403943">..</HEAD>..<BODY LANG="en-US" DIR="ltr">...<P STYLE="BORDER-RIGHT: medium none; PADDING-RIGHT: 0in; BORDER-TOP: medium none; PADDING-LEFT: 0in; PADDING-BOTTOM: 0in; BORDER-LEFT: medium none; PADDING-TOP: 0in; BORDER-BOTTOM: medium none"><B><FONT SIZE="3">Hogyan ......tudom elt.vol.tani a Picasa 3-t? </FONT></B>...</P>...<P STYLE="BORDER-RIGHT: medium none; PADDING-RIGHT: 0in; BORDER-TOP: medium none; PADDING-LEFT: 0in; PADDING-BOTTOM: 0in; BORDER-LEFT: medium none; PADDING-TOP: 0in; BORDER-BOTTOM: medium none"><FONT SIZE="2">A .....Picasa-t vagy a Windows Programok telep.t.se .s t.rl.se eszk.zzel t.r.lheti, mely a vez.rk.pulton tal.lhat., .....vagy a

C:\Program Files (x86)\Google\Picasa3\i18n\uninstall_id.html

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe
File Type:	HTML document, ASCII text
Category:	dropped
Size (bytes):	2071
Entropy (8bit):	5.431970364762762
Encrypted:	false
SSDEEP:	48:iZag0WM+UYCtZ7zQ8M+UYCf9rNmkqtZp0PXnNXnmvTlEg0D5Ff:ipM+5Cvz/M+5CVrNmtZ37Sgyf
MD5:	2F190EB7D1EF34BC57B41D08BADB9B6C
SHA1:	4C3A3ECFD45955D200219B0E4F382F85BF58FD93
SHA-256:	A7D0171F5B0360B638FAD8A74717201A2F2DF3E9EA18A57BE394FA3CEA36EE0D
SHA-512:	C428C466A7EDF387C324C7E9079B995E86397EF165CE22CF12B77DFCE9CD16307D01B2BEBE3158DA02678F32CEBF0A43EB3835DB7AFEFB13B5EB2CBC1A3B2780
Malicious:	false
Reputation:	unknown
Preview:	<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN">.<HTML>..<HEAD>...<TITLE></TITLE>...<META HTTP-EQUIV="CONTENT-TYPE" CONTENT="text/html; charset=windows-1252">...<META NAME="GENERATOR" CONTENT="OpenOffice.org 1.1.1 (Win32)">...<META NAME="CREATED" CONTENT="20050909;12392766">...<META NAME="CHANGED" CONTENT="20050909;12403943">..</HEAD>..<BODY LANG="en-US" DIR="ltr">...<P STYLE="BORDER-RIGHT: medium none; PADDING-RIGHT: 0in; BORDER-TOP: medium none; PADDING-LEFT: 0in; PADDING-BOTTOM: 0in; BORDER-LEFT: medium none; PADDING-TOP: 0in; BORDER-BOTTOM: medium none"><B><FONT SIZE="3">Bagaimana menghapus instalasi Picasa 3?</FONT></B></P>...<P STYLE="BORDER-RIGHT: medium none; PADDING-RIGHT: 0in; BORDER-TOP: medium none; PADDING-LEFT: 0in; PADDING-BOTTOM: 0in; BORDER-LEFT: medium none; PADDING-TOP: 0in; BORDER-BOTTOM: medium none"><FONT SIZE="2">Anda.....dapat menghapus instalasi Picasa baik dari 'Add/Remove Programs' di control panel Windows.....maupun dengan menggunakan opsi Hap

C:\Program Files (x86)\Google\Picasa3\i18n\uninstall_it.html

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe
File Type:	HTML document, ISO-8859 text
Category:	dropped
Size (bytes):	1728
Entropy (8bit):	5.236961529244799
Encrypted:	false
SSDEEP:	48:iZag06hy0ilreHfuASjzgIOjkFn463AsyBzAJyVzTPzL9eGeHeqDl:ijio/8gu463AZA4HrL9eGeHeqDl
MD5:	F11720770315AA502321159F72EB9C59
SHA1:	7A3E0C361E15A2B6D8F93F3AFEA8EB7E988176DE
SHA-256:	10D9ACD2CDAC4D78C365E7287B8781905B6437B73510A158C53E04963CC02C37
SHA-512:	5C89EC2549536C71B048255652231C1F50C88D28A96A9D60D3570943B9FAF90B67FD931171F724C8B38F146089A8FA26C8D462B709622A6E28D43682BEABDE6C
Malicious:	false
Reputation:	unknown
Preview:	<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN">.<HTML>..<HEAD>...<TITLE></TITLE>...<META HTTP-EQUIV="CONTENT-TYPE" CONTENT="text/html; charset=windows-1252">...<META NAME="GENERATOR" CONTENT="OpenOffice.org 1.1.1 (Win32)">...<META NAME="CREATED" CONTENT="20050909;12392766">...<META NAME="CHANGED" CONTENT="20050909;12403943">..</HEAD>..<BODY LANG="en-US" DIR="ltr">...<P><FONT size="+0"><B>Come faccio a disinstallare Picasa 3? </B></FONT>....<BR>....<BR>....<DIV class="i"><FONT size="-1">Puoi disinstallare Picasa da Installazione applicazioni ......nel Pannello di controllo di Windows o utilizzando l'opzione Disinstalla nel ......gruppo di programmi Picasa ("Start" > "Programmi" > "Picasa 3" > ......"Disinstalla").......<BR>......<BR>......Durante la procedura di disinstallazione ti verr. chiesto di rimuovere anche il ......database di Picasa. Seleziona "S." se desideri eliminare tutte le ......organizzazioni dei file e le modifiche che hai apportato in Picasa (s

C:\Program Files (x86)\Google\Picasa3\i18n\uninstall_ja.html

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe
File Type:	HTML document, ASCII text, with very long lines (318)
Category:	dropped
Size (bytes):	4133
Entropy (8bit):	4.483128203947697
Encrypted:	false
SSDEEP:	96:ie+aiiQy5YRSbq6rkXgRafNqEdqtWRcDYBiB5w1y7fQ:i/yGRSbitNkhEQBS1yDQ
MD5:	2647D8A24F59A2833F6487D1CCDDE271
SHA1:	FBB538B1322494590C8131B41036FF504CC02D52
SHA-256:	6264BB7CF678FB179C2A8C7DC6E348A32AAAC7819F4143192018A5E96723AE48
SHA-512:	3A5359A90BB8FD02D0A596647A3653A329F174F2752A6232BCF5FF801962A345E32BDE746342A13EC012302F353C7C59BA53710E1B97C6C50AF60B93F2577D4D
Malicious:	false
Reputation:	unknown
Preview:	<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN">.<HTML>..<HEAD>...<TITLE></TITLE>...<META HTTP-EQUIV="CONTENT-TYPE" CONTENT="text/html; charset=windows-1252">...<META NAME="GENERATOR" CONTENT="OpenOffice.org 1.1.1 (Win32)">...<META NAME="CREATED" CONTENT="20050909;12392766">...<META NAME="CHANGED" CONTENT="20050909;12403943">..</HEAD>..<BODY LANG="en-US" DIR="ltr">...<P><FONT size="+0"><B>Picasa 3 ......をアンインストールする方法を教えてください。.....</B></FONT>....<BR>....<BR>....<DIV class="i"><FONT size="-1">Windows の ......[アプリケーションの追加と削除] ......コントロール ......パネル、または Picasa Program ......グループ ([スタ&#12540

C:\Program Files (x86)\Google\Picasa3\i18n\uninstall_ko.html

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe
File Type:	HTML document, ASCII text
Category:	dropped
Size (bytes):	3230
Entropy (8bit):	4.714877551871677
Encrypted:	false
SSDEEP:	96:iaVD7iiQfDoVVIDTGDUfmFVlggTVmsVnja5WV0TV2SVcVIMKOzDb5VsKV8mXLqn:ikgf8HIugfm3lxmCuEA2fpzH4n
MD5:	E9FE52500641FF8ED11B7498FCB0D030
SHA1:	6794141E02AAB7A659385DF755F9120C5FCE734D
SHA-256:	5A84CB7925B67FF33F9FEEC6AEBD0772C4AF0A347778C070454F8D83F15B5A4A
SHA-512:	F52412FF4C7453871F61103479214561807768E9B561023CE9E157E15A60C4996677F1FAFEDD39FD538C51A3EB2474835ECFEA6BB17724C5348698DF27339F29
Malicious:	false
Reputation:	unknown
Preview:	<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN">.<HTML>..<HEAD>...<TITLE></TITLE>...<META HTTP-EQUIV="CONTENT-TYPE" CONTENT="text/html; charset=windows-1252">...<META NAME="GENERATOR" CONTENT="OpenOffice.org 1.1.1 (Win32)">...<META NAME="CREATED" CONTENT="20050909;12392766">...<META NAME="CHANGED" CONTENT="20050909;12403943">..</HEAD>..<BODY LANG="en-US" DIR="ltr">...<P><FONT size="+0"><B>Picasa 3는 어떻게 ......제거합니까? </B></FONT>....<BR>....<BR>....<DIV class="i"><FONT size="-1">Windows 프로그램 ......추가/제거 ......제어판에서나 Picasa ......프로그램 그룹("시작" > ......"프로그램" > "Picasa 3" > "제거") ......내의 제거 옵션을 ......사용하여 Picasa를 ......제&#4

C:\Program Files (x86)\Google\Picasa3\i18n\uninstall_lt.html

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe
File Type:	HTML document, ISO-8859 text
Category:	dropped
Size (bytes):	1907
Entropy (8bit):	5.567980319027537
Encrypted:	false
SSDEEP:	48:iZah0WM+UYCtZp1wM+UYCfUoyn98DVAzoZopjcmP0umpV+c9/ogKZyuc:ikM+5CMM+5CdynCZdvz99glNc
MD5:	913135DA16F1E59DC245DDD0F15E64C2
SHA1:	DE028140D9E4E06869DEE2814CEC8EA21A37A005
SHA-256:	E1D806D2730B601A63BB4CE734A907EC0850D6CFB2BA5E625D4A806CFD4D520B
SHA-512:	E351BA517358B24AEB64F3BB36238A08EB4C2EE5A3649143FDFBE28FF9EE2BFBB19E52147D16D3D1573BA81A54BA8D7774EB93D6BAAC5C828444A0987AE41E4F
Malicious:	false
Reputation:	unknown
Preview:	<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN">.<HTML>..<HEAD>...<TITLE></TITLE>...<META HTTP-EQUIV="CONTENT-TYPE" CONTENT="text/html; charset=windows-1257">...<META NAME="GENERATOR" CONTENT="OpenOffice.org 1.1.1 (Win32)">...<META NAME="CREATED" CONTENT="20050909;12392766">...<META NAME="CHANGED" CONTENT="20050909;12403943">..</HEAD>..<BODY LANG="en-US" DIR="ltr">...<P STYLE="BORDER-RIGHT: medium none; PADDING-RIGHT: 0in; BORDER-TOP: medium none; PADDING-LEFT: 0in; PADDING-BOTTOM: 0in; BORDER-LEFT: medium none; PADDING-TOP: 0in; BORDER-BOTTOM: medium none"><B><FONT SIZE="3">Kaip ......man i.instaliuoti Picasa 3? </FONT></B>...</P>...<P STYLE="BORDER-RIGHT: medium none; PADDING-RIGHT: 0in; BORDER-TOP: medium none; PADDING-LEFT: 0in; PADDING-BOTTOM: 0in; BORDER-LEFT: medium none; PADDING-TOP: 0in; BORDER-BOTTOM: medium none"><FONT SIZE="2">Picasa .....i.instaliuoti galite per Windows Add/Remove Programs control panel arba .....pasirinkdami Pa.alinimo funkcij. i. Picasa Pr

C:\Program Files (x86)\Google\Picasa3\i18n\uninstall_lv.html

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe
File Type:	HTML document, ISO-8859 text
Category:	dropped
Size (bytes):	2090
Entropy (8bit):	5.614625483654198
Encrypted:	false
SSDEEP:	48:tTxZag0WM+UYCtZsHVwM+UYCf2sJrBZMf2rGf0dHGAitdYByPiEfO:PpM+5CnM+5COCZMJ9hKyPX2
MD5:	F2B1D9530610D2F162F47AB03EFB0852
SHA1:	3FFFE7AA3794385C47ED24609FE92FCC87B5FA95
SHA-256:	2207A803EE2F103EB61514ACB6628AC74BCD74465D0941F51C47861A35B02AAD
SHA-512:	F0B0846B85FFD97AF339769114CFC9FEEFF72891631ABD42016741C5E86A1A36789B8251137BC3C463648B85FCE3CDFC6C7156621B68F1764EE42AD0E2ADBED7
Malicious:	false
Reputation:	unknown
Preview:	saved from url=(0022)http://internet.e-mail -->.<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN">.<HTML>..<HEAD>...<TITLE></TITLE>...<META HTTP-EQUIV="CONTENT-TYPE" CONTENT="text/html; charset=windows-1252">...<META NAME="GENERATOR" CONTENT="OpenOffice.org 1.1.1 (Win32)">...<META NAME="CREATED" CONTENT="20050909;12392766">...<META NAME="CHANGED" CONTENT="20050909;12403943">..</HEAD>..<BODY LANG="en-US" DIR="ltr">...<P STYLE="BORDER-RIGHT: medium none; PADDING-RIGHT: 0in; BORDER-TOP: medium none; PADDING-LEFT: 0in; PADDING-BOTTOM: 0in; BORDER-LEFT: medium none; PADDING-TOP: 0in; BORDER-BOTTOM: medium none"><B><FONT SIZE="3">K. ......atinstal.t programmu "Picasa 3"? </FONT></B>...</P>...<P STYLE="BORDER-RIGHT: medium none; PADDING-RIGHT: 0in; BORDER-TOP: medium none; PADDING-LEFT: 0in; PADDING-BOTTOM: 0in; BORDER-LEFT: medium none; PADDING-TOP: 0in; BORDER-BOTTOM: medium none"><FONT SIZE="2">Programmu ....."Picasa" iesp.jams atinstal.t div.j.di: 1) izmantojot Windows k

C:\Program Files (x86)\Google\Picasa3\i18n\uninstall_nl.html

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe
File Type:	HTML document, ASCII text
Category:	dropped
Size (bytes):	1715
Entropy (8bit):	5.349791002088673
Encrypted:	false
SSDEEP:	48:iZag0677S+Slil87AcS7eVsg57LqsJvSPlKA8wmLe7RL4dvl:iTKiEg3g5fSjIL8R8dt
MD5:	0651B87B2A5EF8D5FE98B6541F5AE17A
SHA1:	021BFB48F0B25623D14B37AD344776E790002095
SHA-256:	265B1804FF569678F575CD9F480DAEED8C436C53EE2BCE21D373ED512A085B4D
SHA-512:	DBD6C1378F3B7FFFFD246E4AF578541ECEC55ACB89429C2C706B50CE95F69210440AB11459AEA786E46BD139DCAEA6740DB9849DD507422F6C1C091860ADC5A4
Malicious:	false
Reputation:	unknown
Preview:	<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN">.<HTML>..<HEAD>...<TITLE></TITLE>...<META HTTP-EQUIV="CONTENT-TYPE" CONTENT="text/html; charset=windows-1252">...<META NAME="GENERATOR" CONTENT="OpenOffice.org 1.1.1 (Win32)">...<META NAME="CREATED" CONTENT="20050909;12392766">...<META NAME="CHANGED" CONTENT="20050909;12403943">..</HEAD>..<BODY LANG="en-US" DIR="ltr">...<P><FONT size="+0"><B>Hoe moet ik de installatie van Picasa 3 ongedaan maken? </B></FONT>....<BR>....<BR>....<DIV class="i"><FONT size="-1">U kunt de installatie van Picasa ongedaan maken via ......'Software' in het Configuratiescherm van Windows of met de optie 'Uninstall' ......(Installatie ongedaan maken) in de programmagroep Picasa ('Start' > ......'Programma's' > Picasa 3' > 'Uninstall').......<BR>......<BR>......Wanneer de installatie ongedaan wordt gemaakt, wordt u gevraagd of u de ......Picasa-database wilt verwijderen. Kies 'Ja' als u alle organisaties of ......bewerkingen wilt verwijderen

C:\Program Files (x86)\Google\Picasa3\i18n\uninstall_no.html

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe
File Type:	Unicode text, UTF-8 (with BOM) text
Category:	dropped
Size (bytes):	1493
Entropy (8bit):	5.3224160101336055
Encrypted:	false
SSDEEP:	24:zmAFt+AFNYAFVPNH75iSOmAFt+AFNYAFVP/upDevEgH2E+/QvJssQ6FHelMpDsKP:qM+UYCNb5iCM+UYC/uaHcQvJtFHKMiKP
MD5:	1C947B0AE0FCBB7F9982837AFE4A0B8D
SHA1:	A0B541D39317FC8D55BB6A73D8505B66B1DFF3B5
SHA-256:	07098E6C09B3D92301FFD03F9DF1BAA360E322C1762A22449FE274CA332FBC1C
SHA-512:	A5D97077D67E178CCF1E585A57D91EDD74D67098D5A867E18AD97D5638B86A4A60E074B781BED92B40F367F72B565815F8EB459CC9ADB10FA840F7205B4E050F
Malicious:	false
Reputation:	unknown
Preview:	.<P style="BORDER-RIGHT: medium none; PADDING-RIGHT: 0in; BORDER-TOP: medium none; PADDING-LEFT: 0in; PADDING-BOTTOM: 0in; BORDER-LEFT: medium none; PADDING-TOP: 0in; BORDER-BOTTOM: medium none"><B><FONT size="3">Hvordan ....avinstallerer jeg picasa 3?</FONT></B></P>.<P style="BORDER-RIGHT: medium none; PADDING-RIGHT: 0in; BORDER-TOP: medium none; PADDING-LEFT: 0in; PADDING-BOTTOM: 0in; BORDER-LEFT: medium none; PADDING-TOP: 0in; BORDER-BOTTOM: medium none"><FONT size="2">Du ...kan avinstallere Picasa enten fra Windows' legg til/fjern ...programvare-funksjonen i kontrollpanelet, eller ved . bruke ...avinstaller-funksjonen i Picasa programgruppen ("Start" > "Programmer" > ..."Picasa 3" > "Avinstaller"). Under avinstalleringsprosessen vil du bli spurt ...om . fjerne Picasa-databasen ogs.. Velg "Ja" hvis du hvis du vil slette ...organiseringer eller redigeringer du har gjort i Picasa (hvis du ikke akter . ...reinstallere Picasa 3)....<BR>...Velg "Nei" hvis du vil beholde no

C:\Program Files (x86)\Google\Picasa3\i18n\uninstall_pl.html

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe
File Type:	HTML document, Unicode text, UTF-8 (with BOM) text, with very long lines (495)
Category:	dropped
Size (bytes):	2194
Entropy (8bit):	5.790606903662454
Encrypted:	false
SSDEEP:	48:JZapA0WM+UYCtZg1wM+UYCfTxfYYyXkfWp+DF3ZRz+3yVwUDZ8EmZsaokmn3bb:JpM+5CxM+5ClQY6k+Q3Z6Gw6ZwZsagrb
MD5:	BD0DE5AF231A723F05BD89C1F87FD162
SHA1:	7FF4D78838EC4F555673E27DB6E5AFD47A918E93
SHA-256:	6EFF3C18D1BD60E2BB95B44D6978E39840E9AD7D6E6F82A85B9FC328C84B5AFB
SHA-512:	3FFD45F9ED88AAB04FA645C28B31552A7D67B55666BE7CAA7329063382BA7012B65F0A44FFE6C6C1C07748685FA810B1D56B444ED469EFAD1EF63E0137600712
Malicious:	false
Reputation:	unknown
Preview:	.<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN">.<HTML>..<HEAD>...<TITLE></TITLE>...<META HTTP-EQUIV="CONTENT-TYPE" CONTENT="text/html; charset=utf-8">...<META NAME="GENERATOR" CONTENT="OpenOffice.org 1.1.1 (Win32)">...<META NAME="CREATED" CONTENT="20050909;12392766">...<META NAME="CHANGED" CONTENT="20050909;12403943">..</HEAD>..<BODY LANG="en-US" DIR="ltr">...<P STYLE="BORDER-RIGHT: medium none; PADDING-RIGHT: 0in; BORDER-TOP: medium none; PADDING-LEFT: 0in; PADDING-BOTTOM: 0in; BORDER-LEFT: medium none; PADDING-TOP: 0in; BORDER-BOTTOM: medium none"><B><FONT SIZE="3">Jak usun.. program Picasa 3? </FONT></B>...</P>...<P STYLE="BORDER-RIGHT: medium none; PADDING-RIGHT: 0in; BORDER-TOP: medium none; PADDING-LEFT: 0in; PADDING-BOTTOM: 0in; BORDER-LEFT: medium none; PADDING-TOP: 0in; BORDER-BOTTOM: medium none"><FONT SIZE="2">Program Picasa mo.na odinstalowa. albo z panelu sterowania Windows, korzystaj.c z opcji .Dodaj / Usu. Programy. (.Add / Remove Programs.

C:\Program Files (x86)\Google\Picasa3\i18n\uninstall_pt-BR.html

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe
File Type:	HTML document, ISO-8859 text
Category:	dropped
Size (bytes):	1586
Entropy (8bit):	5.364799507779394
Encrypted:	false
SSDEEP:	48:iZag06cht0il48s3BCggQW0g7ewV2xU7txv17PMC:iRiR9ggjb144L7kC
MD5:	0ABFCCB6874D5640D92C47A7E8AE55C9
SHA1:	095A3E95FB567B7570C936204DAAFA2215DD86EA
SHA-256:	9CBFE3D6A70CDD3231A291B23E9B33486C6C98670AFF0FFC2433DF45824F4281
SHA-512:	7D505480D42307BDCA077A242817FCAE463EAB89F15CBD93ACC1DDF05EA4508CA36BFE7BB9D1439FAE3994D9DD6487C487BF35B9B6DAA6267FABC7E0DD7F6371
Malicious:	false
Reputation:	unknown
Preview:	<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN">.<HTML>..<HEAD>...<TITLE></TITLE>...<META HTTP-EQUIV="CONTENT-TYPE" CONTENT="text/html; charset=windows-1252">...<META NAME="GENERATOR" CONTENT="OpenOffice.org 1.1.1 (Win32)">...<META NAME="CREATED" CONTENT="20050909;12392766">...<META NAME="CHANGED" CONTENT="20050909;12403943">..</HEAD>..<BODY LANG="en-US" DIR="ltr">...<P><FONT size="+0"><B>Como desinstalo o Picasa 3? </B></FONT>....<BR>....<BR>....<DIV class="i"><FONT size="-1">Voc. pode desinstalar o Picasa em Adicionar/remover ......programas no painel de controle do Windows ou por meio da op..o Uninstall ......(desinstalar) no grupo de programas do Picasa ("Iniciar" > "Programas" > ......"Picasa 3" > "Desinstalar").......<BR>......<BR>......Durante a desinstala..o, ser. solicitado que voc. remova tamb.m o banco de ......dados do Picasa. Selecione "Sim" para apagar todas as edi..es e organiza..es ......que voc. fez no Picasa (caso n.o pretenda reinstalar o Pica

C:\Program Files (x86)\Google\Picasa3\i18n\uninstall_ro.html

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe
File Type:	HTML document, ISO-8859 text
Category:	dropped
Size (bytes):	2206
Entropy (8bit):	5.53907679961087
Encrypted:	false
SSDEEP:	48:iZag0WM+UYCtZIo1wM+UYF+8FyAUMIDqeBiXgoobGZozmF7BNV3S:ipM+5C0lM+5F+8Yf5iwiZimF1NxS
MD5:	690D0B1F93AC6B7E3B203B811638E647
SHA1:	5BD29FD4817860C665F6DF9FF360485BE60C421F
SHA-256:	3B578BE1BD7E58ABFF17AED43962D6BE87F2F57C218D0857A72E7B725A424E00
SHA-512:	0C9A69869615E302F478CE6A628F26725576B2A39559E034F9E7F82E2F7BF71689A05A4F00FF438A9FFA468E3E14F9898261CB4F0EC932726D6283C568749E25
Malicious:	false
Reputation:	unknown
Preview:	<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN">.<HTML>..<HEAD>...<TITLE></TITLE>...<META HTTP-EQUIV="CONTENT-TYPE" CONTENT="text/html; charset=windows-1252">...<META NAME="GENERATOR" CONTENT="OpenOffice.org 1.1.1 (Win32)">...<META NAME="CREATED" CONTENT="20050909;12392766">...<META NAME="CHANGED" CONTENT="20050909;12403943">..</HEAD>..<BODY LANG="en-US" DIR="ltr">...<P STYLE="BORDER-RIGHT: medium none; PADDING-RIGHT: 0in; BORDER-TOP: medium none; PADDING-LEFT: 0in; PADDING-BOTTOM: 0in; BORDER-LEFT: medium none; PADDING-TOP: 0in; BORDER-BOTTOM: medium none"><B><FONT SIZE="3">Cum ......pot dezinstala Picasa 3? </FONT></B>...</P>...<P STYLE="BORDER-RIGHT: medium none; PADDING-RIGHT: 0in; BORDER-TOP: medium none; PADDING-LEFT: 0in; PADDING-BOTTOM: 0in; BORDER-LEFT: medium none; PADDING-TOP: 0in; BORDER-BOTTOM: mediumnone">....Puteţi dezinstala Picasa din Add/Remove Programs, aflat .n panoul de ....control al Windows sau folosind opţiunea Dezinstalaţi din prog

C:\Program Files (x86)\Google\Picasa3\i18n\uninstall_ru.html

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe
File Type:	HTML document, ASCII text
Category:	dropped
Size (bytes):	6112
Entropy (8bit):	4.132963197397122
Encrypted:	false
SSDEEP:	96:iDriTLMJ+gSnW9whu9fV9kI0CsbW9JG2bh0m93Yl5:iDqLMOnWoI9kk/ieV9K5
MD5:	7BF066E01688A46B5C4704A8B9541C68
SHA1:	E82DC81930B14556E6F6305D6AE2D069BC8AFED2
SHA-256:	02D7534F11BD0BF7D9A05E2927DF29AB98A383EB3A4A4CA199C6E28823104963
SHA-512:	4A5232362AE188BC50D07AD71900F6E30A809AC621315DBB05064442885F1299A1262187BDB9168FF7DCB97EA4C5C17816669E09684635162E24396075344073
Malicious:	false
Reputation:	unknown
Preview:	<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN">.<HTML>..<HEAD>...<TITLE></TITLE>...<META HTTP-EQUIV="CONTENT-TYPE" CONTENT="text/html; charset=windows-1252">...<META NAME="GENERATOR" CONTENT="OpenOffice.org 1.1.1 (Win32)">...<META NAME="CREATED" CONTENT="20050909;12392766">...<META NAME="CHANGED" CONTENT="20050909;12403943">..</HEAD>..<BODY LANG="en-US" DIR="ltr">...<P><FONT size="+0"><B>Как ......удалить ......программное ......обеспечение ......Picasa 3? </B></FONT>....<BR>....<BR>....<DIV class="i"><FONT size="-1">Для ......удаления Picasa ......можно ......использовать ......компо&#1

C:\Program Files (x86)\Google\Picasa3\i18n\uninstall_sk.html

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe
File Type:	HTML document, Unicode text, UTF-8 text
Category:	dropped
Size (bytes):	1965
Entropy (8bit):	5.700610817218972
Encrypted:	false
SSDEEP:	48:iZapA0WM+UYCtZYB/1wM+UYCfUEi3m9SVbvqeZJJkzuXg//Isv8q/q5DA+Q0XZk3:ipM+5CGuM+5C+/VZJmL/AcBCpVQ2ZAOu
MD5:	52FD5B38829943087B4A5DB1783EAD9F
SHA1:	0A058BBAAED2DC61DE578901381E6371B82EF85B
SHA-256:	F797089559FF5DEF4E6D4B777867BD0E8887D1DFC1392FFC97D8929614CCE321
SHA-512:	BE8E5A35BAEE322FBFF2C6C7EABC5F3FB59D497FD6220D1941F6D6E838A17433F24115D8A6CA81CE198E9DC7276BCA1B7731DCE19282EE7EBDED8ED7A0761D5E
Malicious:	false
Reputation:	unknown
Preview:	<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN">.<HTML>..<HEAD>...<TITLE></TITLE>...<META HTTP-EQUIV="CONTENT-TYPE" CONTENT="text/html; charset=utf-8">...<META NAME="GENERATOR" CONTENT="OpenOffice.org 1.1.1 (Win32)">...<META NAME="CREATED" CONTENT="20050909;12392766">...<META NAME="CHANGED" CONTENT="20050909;12403943">..</HEAD>..<BODY LANG="en-US" DIR="ltr">...<P STYLE="BORDER-RIGHT: medium none; PADDING-RIGHT: 0in; BORDER-TOP: medium none; PADDING-LEFT: 0in; PADDING-BOTTOM: 0in; BORDER-LEFT: medium none; PADDING-TOP: 0in; BORDER-BOTTOM: medium none"><B><FONT SIZE="3">...... Ako odin.talova. Picasa 3? </FONT></B>...</P>...<P STYLE="BORDER-RIGHT: medium none; PADDING-RIGHT: 0in; BORDER-TOP: medium none; PADDING-LEFT: 0in; PADDING-BOTTOM: 0in; BORDER-LEFT: medium none; PADDING-TOP: 0in; BORDER-BOTTOM: medium none"><FONT SIZE="2">Picasa .....m..ete odin.talova. bu. z Windows kontroln.ho panela Prida./Odstr.ni. programy, .....alebo pou.it.m mo.nosti Odin.

C:\Program Files (x86)\Google\Picasa3\i18n\uninstall_sl.html

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe
File Type:	HTML document, Unicode text, UTF-8 text
Category:	dropped
Size (bytes):	1933
Entropy (8bit):	5.526437249082592
Encrypted:	false
SSDEEP:	48:iZapA0WM+UYCtZh1wM+UYCfmud5mFzuWZWM+fajKfkmTFTpQR0xm:ipM+5CsM+5COuvm6WZL+feKlxTpbs
MD5:	9713E9CDC2443A779CC9886843F76440
SHA1:	AD128277D9E052FBDE83106E79D74CDFD1407174
SHA-256:	E7A50A0B40DBCDCDC446CDD267636C4797AF0B9828B89D12E15D178D17C07E8C
SHA-512:	CD4EB6DD89FCDD6B6BD07E0DAB05BA29BAE8A5E55DA1FB3838E439BD20BDF30E34BA5529851A6DC60121B7A2B630B326A9D7600103A8915092275EC903DCCDE2
Malicious:	false
Reputation:	unknown
Preview:	<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN">.<HTML>..<HEAD>...<TITLE></TITLE>...<META HTTP-EQUIV="CONTENT-TYPE" CONTENT="text/html; charset=utf-8">...<META NAME="GENERATOR" CONTENT="OpenOffice.org 1.1.1 (Win32)">...<META NAME="CREATED" CONTENT="20050909;12392766">...<META NAME="CHANGED" CONTENT="20050909;12403943">..</HEAD>..<BODY LANG="en-US" DIR="ltr">...<P STYLE="BORDER-RIGHT: medium none; PADDING-RIGHT: 0in; BORDER-TOP: medium none; PADDING-LEFT: 0in; PADDING-BOTTOM: 0in; BORDER-LEFT: medium none; PADDING-TOP: 0in; BORDER-BOTTOM: medium none"><B><FONT SIZE="3">Kako ......odstranim program Picasa 3? </FONT></B>...</P>...<P STYLE="BORDER-RIGHT: medium none; PADDING-RIGHT: 0in; BORDER-TOP: medium none; PADDING-LEFT: 0in; PADDING-BOTTOM: 0in; BORDER-LEFT: medium none; PADDING-TOP: 0in; BORDER-BOTTOM: medium none"><FONT SIZE="2">Program .....Picasa lahko odstranite ali na nadzorni plo..i v mo.nosti Dodaj/odstrani programe, .....ali z mo.nostjo Odstranitev programa

C:\Program Files (x86)\Google\Picasa3\i18n\uninstall_sr.html

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe
File Type:	HTML document, Unicode text, UTF-8 (with BOM) text
Category:	dropped
Size (bytes):	2663
Entropy (8bit):	5.379057068363324
Encrypted:	false
SSDEEP:	48:JZapA0WM+UYCtZwwM+UYCfmfqGeKZavr3srzeEUeYgVbMl3PtQvocYn:JpM+5C3M+5CsZs4Ce9Vbq1rcYn
MD5:	FE1E5FDFE5CE9CC2F1D7EAC5E90BDD5B
SHA1:	372ED051F54724091063075D730B065874DD391A
SHA-256:	629218122F8055F0400960F8DB9012ABE63705D7D58E236A7D7E4A95BD73D805
SHA-512:	A98E95B37B9EFE615A4A62D27645EDF03E8B396A7A3043AC1978D25FA33F5D59C548A740410A5A1BCDE0228D3B07ADCE46266E71056C6E1FBD48AAE92E79096C
Malicious:	false
Reputation:	unknown
Preview:	.<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN">.<HTML>..<HEAD>...<TITLE></TITLE>...<META HTTP-EQUIV="CONTENT-TYPE" CONTENT="text/html; charset=utf-8">...<META NAME="GENERATOR" CONTENT="OpenOffice.org 1.1.1 (Win32)">...<META NAME="CREATED" CONTENT="20050909;12392766">...<META NAME="CHANGED" CONTENT="20050909;12403943">..</HEAD>..<BODY LANG="en-US" DIR="ltr">...<P STYLE="BORDER-RIGHT: medium none; PADDING-RIGHT: 0in; BORDER-TOP: medium none; PADDING-LEFT: 0in; PADDING-BOTTOM: 0in; BORDER-LEFT: medium none; PADDING-TOP: 0in; BORDER-BOTTOM: medium none"><B><FONT SIZE="3">.... ......d. ............ Picasa-. 3? </FONT></B>...</P>...<P STYLE="BORDER-RIGHT: medium none; PADDING-RIGHT: 0in; BORDER-TOP: medium none; PADDING-LEFT: 0in; PADDING-BOTTOM: 0in; BORDER-LEFT: medium none; PADDING-TOP: 0in; BORDER-BOTTOM: medium none"><FONT SIZE="2">...... .................. Picasa-. ... .. ...../...... ........ . .....

C:\Program Files (x86)\Google\Picasa3\i18n\uninstall_sv.html

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe
File Type:	Unicode text, UTF-8 (with BOM) text
Category:	dropped
Size (bytes):	1459
Entropy (8bit):	5.328926560195653
Encrypted:	false
SSDEEP:	24:zmAFt+AFNYAFVPNk5sSOmAFt+AFNYAFVP/sFJ++EcBdlCeWmKvQDzcJziFOCqKWq:qM+UYCNkyCM+UYC/s2yd08KQDzcJeEqv
MD5:	E8377E0AAEBC92F2D278322241F68703
SHA1:	8E124E62398E34B4F5005DA94308F9906FCA8953
SHA-256:	51771177FEF469CC74C73E8FEEBA88B23637E17052AD6A59C77925053017E2BF
SHA-512:	75DC93AC8358093244B97F0447D403F310B5426BA6013DA117DFEA3C7484A12EAFE4B8782793B29E69B4914B51A9FFA37481F02265183C30D39E6B69CF0A0289
Malicious:	false
Reputation:	unknown
Preview:	.<P style="BORDER-RIGHT: medium none; PADDING-RIGHT: 0in; BORDER-TOP: medium none; PADDING-LEFT: 0in; PADDING-BOTTOM: 0in; BORDER-LEFT: medium none; PADDING-TOP: 0in; BORDER-BOTTOM: medium none"><B><FONT size="3"> Hur ....avinstallerar jag Picasa 3?</FONT></B></P>.<P style="BORDER-RIGHT: medium none; PADDING-RIGHT: 0in; BORDER-TOP: medium none; PADDING-LEFT: 0in; PADDING-BOTTOM: 0in; BORDER-LEFT: medium none; PADDING-TOP: 0in; BORDER-BOTTOM: medium none"><FONT size="2">Du ...kan antingen avinstallera Picasa fr.n Windows Kontrollpanelen L.gg till/Ta bort ...Program eller genom valet Avinstallera i Picasa Programgruppen ("Start" > ..."Program" > "Picasa 3" > "Avinstallera")....<BR>...Under avinstallationen kommer du .ven att ombes att ta bort Picasa-databasen. ...V.lj "Ja" om du vill radera organiseringar eller .ndringar du gjort i Picasa ...(om du inte avser att .terinstallera Picasa 3). V.lj "Nej" om du vill beh.lla ....ndringar du gjort (om du avser att .teri

C:\Program Files (x86)\Google\Picasa3\i18n\uninstall_th.html

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe
File Type:	HTML document, ASCII text, with very long lines (387)
Category:	dropped
Size (bytes):	5843
Entropy (8bit):	4.499105116783674
Encrypted:	false
SSDEEP:	96:iXM+5Cm8M+5CmYZrnywLJNWZNfY6rYnYvaUv8YAYaYiFXYHZrqY/2vQsjcnB2KC/:icsQdsi1w5K8hXjMOXvQsjS4rRuK
MD5:	94CE35CE6C4A185796CB2EC7CEDD5BA4
SHA1:	18F924B89CA325427501BE26E82D0E0CC674A330
SHA-256:	42A16FF239565B2DD6ED4B6A7F60E0D633B8FAC2530B2DA74E752A28A1F1DC21
SHA-512:	C5F90BB581A48C1684A32CB23066246E334E1A2102714D7A677EC182B1B0F639529AA1B1A7CD0710B662858005291C83C43ABC1C0C1DB13DFD453BA077DEF830
Malicious:	false
Reputation:	unknown
Preview:	<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN">.<HTML>..<HEAD>...<TITLE></TITLE>...<META HTTP-EQUIV="CONTENT-TYPE" CONTENT="text/html; charset=windows-1258">...<META NAME="GENERATOR" CONTENT="OpenOffice.org 1.1.1 (Win32)">...<META NAME="CREATED" CONTENT="20050909;12392766">...<META NAME="CHANGED" CONTENT="20050909;12403943">..</HEAD>..<BODY LANG="en-US" DIR="ltr">...<P STYLE="BORDER-RIGHT: medium none; PADDING-RIGHT: 0in; BORDER-TOP: medium none; PADDING-LEFT: 0in; PADDING-BOTTOM: 0in; BORDER-LEFT: medium none; PADDING-TOP: 0in; BORDER-BOTTOM: medium none"><B><FONT SIZE="3"> จะยกเลิกการติดตั้ง ......Picasa 3 ได้อย่างไร </FONT>....</B>...</P>...<P STYLE="BORDER-RIGHT: medium none; PADDING-RIGHT: 0in; BORDER-TOP: medium none; PADDING-LEFT: 0in; PADDING-BOTTOM: 0in; BORDER-LEFT: medium none; PADDING-TOP

C:\Program Files (x86)\Google\Picasa3\i18n\uninstall_tr.html

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (373)
Category:	dropped
Size (bytes):	1992
Entropy (8bit):	5.648037324647249
Encrypted:	false
SSDEEP:	48:iZapA0WM+UYCtZ13oqwM+UYCfUmTc9rLZU35ODFLvvj5zv9BvNlaSW7:ipM+5CuM+5CzTeLZUJ6zL5zv9BvJW7
MD5:	E015887326C5F0FADA63FB5FBBC55711
SHA1:	A820C6EA9389DAAC7B8BE94852A1710F1895D37D
SHA-256:	06B7925E0588DDD42102B4BEC7D826489B825102AC54A7207BCE9CE660C20A0C
SHA-512:	AFA56D8DADB069C348C948DB671A84213847884756466C9FE79A68BAD732E6FFDD37A7E9AE91458FCE883766E2B7A8B2F45F6377BF5F809B040FF1F09400A942
Malicious:	false
Reputation:	unknown
Preview:	<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN">.<HTML>..<HEAD>...<TITLE></TITLE>...<META HTTP-EQUIV="CONTENT-TYPE" CONTENT="text/html; charset=utf-8">...<META NAME="GENERATOR" CONTENT="OpenOffice.org 1.1.1 (Win32)">...<META NAME="CREATED" CONTENT="20050909;12392766">...<META NAME="CHANGED" CONTENT="20050909;12403943">..</HEAD>..<BODY LANG="en-US" DIR="ltr">...<P STYLE="BORDER-RIGHT: medium none; PADDING-RIGHT: 0in; BORDER-TOP: medium none; PADDING-LEFT: 0in; PADDING-BOTTOM: 0in; BORDER-LEFT: medium none; PADDING-TOP: 0in; BORDER-BOTTOM: medium none"><B><FONT SIZE="3">Picasa 3'yi bilgisayar.mdan nas.l kald.r.r.m? </FONT></B>...</P>...<P STYLE="BORDER-RIGHT: medium none; PADDING-RIGHT: 0in; BORDER-TOP: medium none; PADDING-LEFT: 0in; PADDING-BOTTOM: 0in; BORDER-LEFT: medium none; PADDING-TOP: 0in; BORDER-BOTTOM: medium none"><FONT SIZE="2">Picasa'y. Windows'un Kontrol Panelindeki Program Ekle/Kald.r arac. ile, veya Picasa Program grubundaki ("Ba.lat" > ....."P

C:\Program Files (x86)\Google\Picasa3\i18n\uninstall_uk.html

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe
File Type:	HTML document, Unicode text, UTF-8 text
Category:	dropped
Size (bytes):	2646
Entropy (8bit):	5.523592983394731
Encrypted:	false
SSDEEP:	48:iZapA0WM+UYCtZbMX1wM+UYCfnMA88/rVJZQCSjgiQMVuFvVCpMqiS4Lx4YmGkQT:ipM+5ClM+5C/88/rDZQCSjgioFdkiS4X
MD5:	661ABDBB98C768DDFD70DAFDEA038B74
SHA1:	4A2828ED353106BC3F8C3901B749DC4DEFEA2D9B
SHA-256:	37AD75F828D6E21230695867EA313234AFC258B495A7EE666BDD9EA7FD816801
SHA-512:	72377497D94911FF1FEEAD9B1029C8846CCCFD80865C57B90B2176DE43BC3AB7E67D1B39E75443F3FCE908213DCE671D19620DF14EC083243464A807BF2D5BA5
Malicious:	false
Reputation:	unknown
Preview:	<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN">.<HTML>..<HEAD>...<TITLE></TITLE>...<META HTTP-EQUIV="CONTENT-TYPE" CONTENT="text/html; charset=utf-8">...<META NAME="GENERATOR" CONTENT="OpenOffice.org 1.1.1 (Win32)">...<META NAME="CREATED" CONTENT="20050909;12392766">...<META NAME="CHANGED" CONTENT="20050909;12403943">..</HEAD>..<BODY LANG="en-US" DIR="ltr">...<P STYLE="BORDER-RIGHT: medium none; PADDING-RIGHT: 0in; BORDER-TOP: medium none; PADDING-LEFT: 0in; PADDING-BOTTOM: 0in; BORDER-LEFT: medium none; PADDING-TOP: 0in; BORDER-BOTTOM: medium none"><B><FONT SIZE="3">.. .... ............. Picasa 3? </FONT></B>...</P>...<P STYLE="BORDER-RIGHT: medium none; PADDING-RIGHT: 0in; BORDER-TOP: medium none; PADDING-LEFT: 0in; PADDING-BOTTOM: 0in; BORDER-LEFT: medium none; PADDING-TOP: 0in; BORDER-BOTTOM: medium none"><FONT SIZE="2">.. ...... ................Picasa .. . ...... ......... ............/.....

C:\Program Files (x86)\Google\Picasa3\i18n\uninstall_vi.html

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe
File Type:	HTML document, ISO-8859 text, with very long lines (1543)
Category:	dropped
Size (bytes):	2246
Entropy (8bit):	5.60812518960065
Encrypted:	false
SSDEEP:	48:iZae0WM+UYCtZ7v1wM+UYCf824313uCfnCjXH/MwbsI5MmneJ:iXM+5CWM+5Ci1+EgEkfnK
MD5:	145B3D3E5DA3DB1F617123F6E9A4D4DF
SHA1:	40EB3AE0FA41AF1C67B7567323F4618204EEEDB7
SHA-256:	0E8F2AF9406387BC2898317897798C361A0FC33C058484C4BFFD10DD59C4E382
SHA-512:	A8036D9D9EAE777EBCAD75196FBEC18853D17055E5185403449535A010FBECD8C40D98D04DB9161FB945E50290AE47994510D73CB1E6100A2C5E57FA7953D2A4
Malicious:	false
Reputation:	unknown
Preview:	<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN">.<HTML>..<HEAD>...<TITLE></TITLE>...<META HTTP-EQUIV="CONTENT-TYPE" CONTENT="text/html; charset=windows-1258">...<META NAME="GENERATOR" CONTENT="OpenOffice.org 1.1.1 (Win32)">...<META NAME="CREATED" CONTENT="20050909;12392766">...<META NAME="CHANGED" CONTENT="20050909;12403943">..</HEAD>..<BODY LANG="en-US" DIR="ltr">...<P STYLE="BORDER-RIGHT: medium none; PADDING-RIGHT: 0in; BORDER-TOP: medium none; PADDING-LEFT: 0in; PADDING-BOTTOM: 0in; BORDER-LEFT: medium none; PADDING-TOP: 0in; BORDER-BOTTOM: medium none"><B><FONT SIZE="3">La.m thê. na.o .ê. g.. ca.i ...t Picasa 3? </FONT></B>...</P>...<P STYLE="BORDER-RIGHT: medium none; PADDING-RIGHT: 0in; BORDER-TOP: medium none; PADDING-LEFT: 0in; PADDING-BOTTOM: 0in; BORDER-LEFT: medium none; PADDING-TOP: 0in; BORDER-BOTTOM: medium none"><FONT SIZE="2">Ba.n co. thê. g.. ca.i ...t Picasa t.. ba.ng .iê.u khiê.n Add/Remove Programs cu.a Windows ho..c b..

C:\Program Files (x86)\Google\Picasa3\i18n\uninstall_zh-CN.html

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe
File Type:	HTML document, ASCII text
Category:	dropped
Size (bytes):	2466
Entropy (8bit):	4.862243905608034
Encrypted:	false
SSDEEP:	48:iZag06ecYWilWKzuX2EA3X3Yx2rmnic+QdNhmxdZGMlF4/A8ByfFPKn85:iC4iE5GdIx26icXMxuMl81BuF485
MD5:	4B8F8AB5297008B78E59D4735DC556F0
SHA1:	B9DBB1DE440E0576302A39E952F217671D781B9D
SHA-256:	33FB9AF8A9001F4FB863BD5E84F9560DD419865ED046E844AB8039D6E7C0F056
SHA-512:	CB1D8A98562CDEB9FA6A340D24C3CAA1735C3B2BD752B51FC9EB3CE1600A1BF193ED4554C4EF4B6E806F328901B75A0B3A4B6FB3705680AB7912FDC73BFE2A2D
Malicious:	false
Reputation:	unknown
Preview:	<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN">.<HTML>..<HEAD>...<TITLE></TITLE>...<META HTTP-EQUIV="CONTENT-TYPE" CONTENT="text/html; charset=windows-1252">...<META NAME="GENERATOR" CONTENT="OpenOffice.org 1.1.1 (Win32)">...<META NAME="CREATED" CONTENT="20050909;12392766">...<META NAME="CHANGED" CONTENT="20050909;12403943">..</HEAD>..<BODY LANG="en-US" DIR="ltr">...<P><FONT size="+0"><B>如何卸载 Picasa 3？ </B></FONT>....<BR>....<BR>....<DIV class="i"><FONT size="-1">可以从 Windows ......的"添加/删除程序"控制面板卸载 ......Picasa，或使用 Picasa ......程序组中的"卸载"选项（"开始">"程序">"Picasa 3">"卸载"）。<BR>......<BR>......在卸载过程中，系统会&#

C:\Program Files (x86)\Google\Picasa3\i18n\uninstall_zh-TW.html

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe
File Type:	HTML document, ASCII text
Category:	dropped
Size (bytes):	2704
Entropy (8bit):	4.872481450634161
Encrypted:	false
SSDEEP:	48:iZag06OzYBNil5Q2EXB/0xogUtXgkhbQVQekxl75TotP7ffkgP5O79C+EXb:itidaBbgUukiyvxl50tDffkgP5O7/EXb
MD5:	D6FD5D1737A11EF3CB414C4378509450
SHA1:	BFD1585C114B8D7B7D106678F083396BED6CACC1
SHA-256:	7B3587787BC63B19B11348962246C3C59D3CE3F01535D9469EA3578F46854850
SHA-512:	EA2BEBBF72BE6C1CB4E0AA46A46CF2885CE401BCAA5A1C86BEA8EA270C23E27BB6A8336D82E8A9E8A0BE82191A26475E0E628A9061FF3A2EE8C84EAB5B765A47
Malicious:	false
Reputation:	unknown
Preview:	<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN">.<HTML>..<HEAD>...<TITLE></TITLE>...<META HTTP-EQUIV="CONTENT-TYPE" CONTENT="text/html; charset=windows-1252">...<META NAME="GENERATOR" CONTENT="OpenOffice.org 1.1.1 (Win32)">...<META NAME="CREATED" CONTENT="20050909;12392766">...<META NAME="CHANGED" CONTENT="20050909;12403943">..</HEAD>..<BODY LANG="en-US" DIR="ltr">...<P><FONT size="+0"><B>我要如何移除 Picasa 3？ </B>....</FONT>....<BR>....<BR>....<DIV class="i"><FONT size="-1">您可以從 Windows ......[新增/移除程式] ......控制台、或使用 Picasa ......程式群組的 [移除] 選項 ......([開始] > [程式集] > [Picasa 3] > ......[移除]) 來移除 Picasa。......<BR>......<BR>......在移除 Picasa ......&

C:\Program Files (x86)\Google\Picasa3\licenses\adobe_xmp_toolkit.txt

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe
File Type:	Algol 68 source, ASCII text
Category:	dropped
Size (bytes):	1535
Entropy (8bit):	5.131256502954819
Encrypted:	false
SSDEEP:	24:XP/DUn8Dof9+bOOUFT6+JYUFTzbzFwHfBTXN94Os43sEskuTkWROt32sByxtdfyE:X3NOOUJ+UJz1MX34943JZ32sBEtI33tG
MD5:	17EA2E1749A9D1D905753DE4C26BEC16
SHA1:	39675A18A6F7FE6AF0C8499D10DBF85036209CA3
SHA-256:	14E29DCE2F51C7F30DD80C5304B69F39F45F5C640BE7711026F8D1BA78F45C6C
SHA-512:	8BD74914970586A390200F5A9DED0BCD62E37BFA059C22BB4C71A946A980D56C66BE58FB8124B80D018F6F36927C728E887AE837B3D8A1DF4AEEC15656186091
Malicious:	false
Reputation:	unknown
Preview:	The BSD License..Copyright (c) 1999 - 2010, Adobe Systems Incorporated.All rights reserved...Redistribution and use in source and binary forms, with or .without modification, are permitted provided that the following .conditions are met:..* Redistributions of source code must retain the above copyright notice, .this list of conditions and the following disclaimer.. .* Redistributions in binary form must reproduce the above copyright notice, .this list of conditions and the following disclaimer in the documentation .and/or other materials provided with the distribution.. .* Neither the name of Adobe Systems Incorporated, nor the names of its .contributors may be used to endorse or promote products derived from this .software without specific prior written permission. ..THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS."AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT.LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR.A PARTICULAR PURP

C:\Program Files (x86)\Google\Picasa3\licenses\lcms.txt

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe
File Type:	ASCII text, with very long lines (460)
Category:	dropped
Size (bytes):	1078
Entropy (8bit):	5.081845278989711
Encrypted:	false
SSDEEP:	24:ywnDr4JHBH0yPP3gtAHw1hl9QHcsUv48Ok4/+dbo3oqxFD:ywnD8JplPvEDvQHcs5ITc3omFD
MD5:	EB9AFB9537766815499B6B20C72411E8
SHA1:	565D52C31B7BDA09FFBC0C69EBD2B98953E663F3
SHA-256:	91AC8AE445D9D6E2D5BE01747EB2BD459119FE446C6FC69CC618FB0D7FF32005
SHA-512:	BD8824BE7BD91282C68D6B2F939745415FBFCD5F10F05EE85EF6E49FFB1A454929466F4255393E5B28F45350ED247886A8B4824D510987E19620C763BE08EA86
Malicious:	false
Reputation:	unknown
Preview:	Little CMS.Copyright (c) 1998-2010 Marti Maria Saguer..Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the "Software"), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions:..The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software...THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR

C:\Program Files (x86)\Google\Picasa3\npPicasa3.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	59720
Entropy (8bit):	5.562267546144717
Encrypted:	false
SSDEEP:	768:/fJnHXSo67K4ny7rRCL6h3k9ESiF0Vtf2uvqj:3RTPFh3yAWtfRvK
MD5:	BAA4AF6F2C77F7FA54368DE5C0018667
SHA1:	5E111DAA9EB99AE278FA118DB1E9CF52663563CC
SHA-256:	1F9B11B901E42A5CBAF55BF306F2A05187D202B545485673138FC8E81F59048F
SHA-512:	D6A71FA841EE3C1E11F2E96F9E0B606B333AE339AA114D344F74615305480A66460FCD529DA66E5313FC3CC72DAFFC4F8182B523E3F844DC5A824B8F9B01E41B
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......>..Kz...z...z...]...j...]...c...]...2......y...z...1...]...{...]...{...]...{...]...{...Richz...................PE..L......V...........!.....p...`...................................................................................... ...........(.......P...............H...........0...............................@...@............................................text....d.......p.................. ..`.rdata........... ..................@..@.data...\|...........................@....rsrc...P...........................@..@.reloc..............................@..B........................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Google\Picasa3\plugins\CDVDR\CDVDR.yti

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	405504
Entropy (8bit):	6.322231694213041
Encrypted:	false
SSDEEP:	6144:rAPVkqWHXMgswRChKqCb9rq4xMQOWyFtIAvlVxQD4gAOmvEopXI1:rAPVkqWHYCb9rwWyFtIGlTQkgUS1
MD5:	536779DEFA7EBB2165D41122BD8ACE87
SHA1:	4E7D6E127D0A94532AAB4659F6B5A42A8022F3CB
SHA-256:	B7FA5F052F405C8AA098F50F1C5CE9F3C3896004F9255B1E34A3409AEAB703F4
SHA-512:	D709BC613B053DE587A6BB96D640559459E7DDB08A8313F38203DE8209F2F58095E85D275C68B1CCAA7934B6251808D2ED0C46E185BD216EF3244ECFD5459992
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 2% Antivirus: Virustotal, Detection: 0%, Browse
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........fO...!..!..!..\..!..L...!..O..!.l.~..!.l.\|..!.. ...!..S..!..[..!..Y..!.Rich..!.........................PE..L......V...........!..... ...................0......................................Z...................................K...\................................ ..T5.. 6..............................@...@............0...............................text............ .................. ..`.rdata.......0.......0..............@..@.data...x...........................@....rsrc...............................@..@.reloc...V... ...`..................@..B................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Google\Picasa3\plugins\Red.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2351104
Entropy (8bit):	6.782935917009126
Encrypted:	false
SSDEEP:	24576:5pm7OVW8292q5PwTdM9iLAlRmb6q2ZCn6x+rKopy0Vp5GjmxSsDgG1m26m/fembw:u7OPqDse3+dT5YfsDNvdHeysS8bjFT
MD5:	7F489AE88F13612300CA86E338A1F79B
SHA1:	659C51448D183D337BF646DE85AF68B3920CFBD2
SHA-256:	DA370693B59D89E7D48646D9617F5F595E371F8E1828CB1AA9F12530A17C8233
SHA-512:	A89BBA59C1AC0EE0E1A2FB9594040BA858C1B4DAC15170C30ACCE594A35747F28D1C6E250CD67848BB5A51A11CBB63AB299701A6B770978A8226DB1C4829E2CF
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........qNpT. #T. #T. #..^#S. #s.N#`. #s.]#m. #s.M#.. #..}#Q. #T.!#<. #s.R#.. #s.Z#U. #s.X#U. #RichT. #........PE..L....d.L...........!.........P...............................................@$.......$..............................p!.C....h!.<....P"......................`".....@................................S..@...............l............................text...8v.......................... ..`.rdata..#...........................@..@.data...(.....!..p....!.............@....rsrc........P".......!.............@..@.reloc.......`".......".............@..B................................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Google\Picasa3\plugins\expwebsites\expwebsites.psd

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe
File Type:	Adobe Photoshop Image, 32 x 31, RGBA, 4x 8-bit channels
Category:	dropped
Size (bytes):	24820
Entropy (8bit):	6.129932446531006
Encrypted:	false
SSDEEP:	384:EMw7x4X3ccY7EQbC4D1X+by77Nq/4PrwDqnWtbbP8GCh1wW:/wyXMcY7EQbPOMZs4PIbbP6wW
MD5:	83AA79EA82945B31039A8D48E706AB78
SHA1:	17A91DD4020FA61D49D8EA0A84B3CCC471B01375
SHA-256:	29E2EB81BBB616AC40CA0B2F627D35D53FE60EC702471A1028D24CE46E0B57AE
SHA-512:	573F2A9DAD5A4D45A937840BF2CF060551BE92A019F7FA289B1EFE5D645EF49AEA45274D351FE00516E86A55222F26489D66771B8C404550A1D4EA2DE023042B
Malicious:	false
Reputation:	unknown
Preview:	8BPS................. ............8BIM.%......................8BIM.$.....)<?xpacket begin='.' id='W5M0MpCehiHzreSzNTczkc9d'?>.<?adobe-xap-filters esc="CR"?>.<x:xapmeta xmlns:x='adobe:ns:meta/' x:xaptk='XMP toolkit 2.8.2-33, framework 1.5'>.<rdf:RDF xmlns:rdf='http://www.w3.org/1999/02/22-rdf-syntax-ns#' xmlns:iX='http://ns.adobe.com/iX/1.0/'>.. <rdf:Description about='uuid:d54b89ca-c61b-11d8-9eb2-e646ffd5c8c6'. xmlns:xapMM='http://ns.adobe.com/xap/1.0/mm/'>. <xapMM:DocumentID>adobe:docid:photoshop:771862d2-c618-11d8-9eb2-e646ffd5c8c6</xapMM:DocumentID>. </rdf:Description>..</rdf:RDF>.</x:xapmeta>. . . .

C:\Program Files (x86)\Google\Picasa3\plugins\expwebsites\expwebsites.yti

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1679360
Entropy (8bit):	6.769201356838606
Encrypted:	false
SSDEEP:	24576:9HsetgvWGZcJeiOqOXH++DyFtmLIv2TKfUYXbxdLxxZdyt/jdrtfWG+:SYmZcFOqO7L82TQXbxdLxxZdyt/
MD5:	FE8B28BE09159D582285F78239905B35
SHA1:	ECBC2529F7FD03E192FDDA941DDB8E3840A228B0
SHA-256:	D6EFD4AA7ADFD0642ECAEAE12EDF2452AA6566FB7D2D806286571F6F49DD9D04
SHA-512:	04D21E6FA8B426F1819CB792E41538FF8660B8D591A577B038CF05CB99CDF2ECE7B20C53ACBAE496FF05E4776B15F62D61857F87685D3F4FA9EDF67BBD233A89
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......................................b.....b........E.............................Rich...........PE..L......V...........!.................R..............................................'g..............................p...............................................@................................A..@............................................text............................... ..`.rdata.............................@..@.data....C..........................@....rsrc...............................@..@.reloc..Z...........................@..B........................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Google\Picasa3\plugins\red.cfg

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe
File Type:	data
Category:	dropped
Size (bytes):	2281657
Entropy (8bit):	7.177594470383832
Encrypted:	false
SSDEEP:	49152:/YJOdmwffPZBfm2rXIOK/bEXxFHUzJLe:/YJOAms2TzT0zJLe
MD5:	45C46C36A1CBFFDCC831AA311C6E1142
SHA1:	CF81328DC9631AA7350A3A8A67C971858BE15A5B
SHA-256:	916D69FD9A412EA937B49F3B0B1401076193DC9BE096B3AF71921AEBA6F51835
SHA-512:	429A6EC751324FDB815BBA633AA9B9F225A1DD927009EC84E34F5BD6487C179A9B34078B6C1D8601A5C9586382BDD85E0B332C6FEE3AC9FACEC9AF3B5C8BDEBF
Malicious:	false
Reputation:	unknown
Preview:	...........@..........h.............PB.d......PB.d.............pA.$tI..4...4B......HB.8.?..........L?.<......>..HB33.>...?...........p..e..............?...............?...............?.......p.............A..0A........p.............A..0A........p..-.........`A...A........p............`A...A........p.............@...A...A....p.............A...A...A................PB.d.......................PB.d.......................PB.d............/.:..;......................%.;._...............>...F...C..........5...o<..\>...>. .?..........>Y.?Ad.?...?.o.?...?.t.?.].?Ra.?.d.?.e.?...PB.d..................A...B..pA. @............. .............................Y.8:<:52(..................C.@5)...................Xj..[..........."+19EE.......T/...GE7)..........$0......pof.8......................p.................................1;;8+....................E;A:9%....$28?HG......p.x.F.%'!.........!/7A........L............................5.<-'.......,9LXZe......pG..=........................:.N.?1)....

C:\Program Files (x86)\Google\Picasa3\plugins\ytITivo.yti

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	430080
Entropy (8bit):	6.322520673970636
Encrypted:	false
SSDEEP:	6144:3v8AsP0oaouw5XejylN2/MfEIyiGk2yFtXBNSvKqCDDoHwTRAOmibm4HmDn:/8AAaMeMcIV2yFtxNSv/CDEHCRUQG
MD5:	6D00695B79BE2BA620701BDA4B800CC0
SHA1:	0E7C85A9AD7B170C5DD924582F3C837E2D454BC4
SHA-256:	38CA2493379AAF59BE3613AD67C25FBE6955DCF54D850D43F753B10A407088AD
SHA-512:	5D6189302A25513CDE277D623EF9AE471652A530FB90D1D619FD2D9D53E622FAA25A56560ED63CF037874BE552E34A1DA512FF736A02807AA1BABECCAEDCF4EA
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 2% Antivirus: Virustotal, Detection: 0%, Browse
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........a.bX..1X..1X..1...1w..1...1v..1...1...1...1E..1X..1...1...1d..1...1Y..1...1Y..1...1Y..1RichX..1........PE..L......V...........!.........P......................................................,................................U..M...D=.......p...........................9..@...............................@)..@...............H............................text...zu.......................... ..`.rdata..............................@..@.data...\|....`.......`..............@....rsrc........p....... ..............@..@.reloc...V.......`...0..............@..B................................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Google\Picasa3\qtsupport.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	100680
Entropy (8bit):	5.666296196187939
Encrypted:	false
SSDEEP:	1536:1EeX1/IyNO5nZKl6hFJgL4uXgmRJ1Tt5pM:/XZNO5ZmgQRJRt5S
MD5:	73886A3846D300C89621A115CF1B70DF
SHA1:	9D8B37EE0636B05D3F1DC71B1A4DC1C9CFFDE0AF
SHA-256:	A898A0BF3F8396E6DBDFDED66F0F96B09A00A04B912F9CD4F6B70E399D7B8047
SHA-512:	81DBECE1726B925EF66FB778EDCADC269DCDDEA364463598A9A23F254FC8A4C2AC57285ED3C9164D6053D199E6AF52191007E7F89870602F94234D1A239EB43F
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......0o.t...t...t...S...k...S...a...S...,.......w.......}......r...t.......S...u...S...u...S...u...Richt...........................PE..L......V...........!................t3.......................................p...... ...............................`...H...$...d.... ...............p..H....0......p...................................@...............@............................text............................... ..`.rdata...'.......0..................@..@.data............ ..................@....rsrc........ ....... ..............@..@.reloc...=...0...@...0..............@..B........................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Google\Picasa3\runtime\HelveticaNeue Condensed-20-1.000000-400-0.ytf

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe
File Type:	data
Category:	dropped
Size (bytes):	94937
Entropy (8bit):	5.24159676220654
Encrypted:	false
SSDEEP:	1536:DdddddddddddddddddddddddddddddddlSgeIHn1H8/D/75ULZddc5j7mdq9AIAN:Dddddddddddddddddddddddddddddddf
MD5:	207BAA9A9405B3F8AFD007FC75CE053F
SHA1:	718A3C751ECBABA085E2603334C631D51AFC0D8D
SHA-256:	ACA9511F9C55B19F28DE87B8182DFA13B43D7B8E1A1BE809E00DD73B57DC84E1
SHA-512:	EC4D64B5EC9033F8E67C0DFBA04437062C8110822E12B72EA62755EBC21271A16D81F7EA7467C10F972E126CF85E9ED00F93E8CF5074E05C3E8316B9CC71EB7C
Malicious:	false
Reputation:	unknown
Preview:	d......................?.V..........}.......HelveticaNeue Condensedy.,.....a.t.....W.e.....y.......a.v.......s.....g.y.....a.w.....V.,.....V.-.....V.o.....L.......V.......P.,.....R.T.....R.U.....L.......P.o.....P.......L.T.....F.a.....W.,.....R.W.....W.-.....L.V....... .....W.o.....W.......V.u.....R.Y.....L.W.....F.e.....:. .....L.Y.....K.o.....A.......A.Q.....F.i.....A.......V.:....... .....c.l.....A.T.....V.;.....A.V.....F.,.....K.u.....A.W.....n.y.....f.......Y.a.....F.o.....F.......A.Y.....V.A.....f.......o.w.....K.y.....F.r.....P.A.....Y.e.............o.y..... .A.....W.A.....T.a.....Y.i.....c.y.....v.,.............T.e.....Y.,.....v.......Y.-.....Y.o.....d.y.....Y.......T.i.....w.,.....,.......w.......F.A.....,.......T.,.....Y.u.....T.-..... .......O.X.....T.o.....T.......O.Y.....L.y..... .......A.p.....r.,.....T.r.....r.-..... .T.....r.......Y.:.....Y.;..... .V.....T.u..... .W.....a.g.....T.w.....y.a..... .Y.....T.y.....D.Y.....r.v.....Y.A.....V.a.....T.:.....,. .....T.;.....r.y..

C:\Program Files (x86)\Google\Picasa3\runtime\HelveticaNeue MediumCond-14-1.000000-400-0.ytf

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe
File Type:	data
Category:	dropped
Size (bytes):	51692
Entropy (8bit):	6.444778792550886
Encrypted:	false
SSDEEP:	1536:VyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyydZ4W4OFei+DyyVwryK6jIGnmmtfA7IQO:qDNFei+RAgPtfA7IQF4
MD5:	8E7BF87E9F01E89463636ABAFE29837F
SHA1:	07E71BDBBEC02E8B942701CDC3D91F620F028A15
SHA-256:	EFF1CEEC80A6170FF5571D67B167B2B87B586A8AA267F3AE875DF617B9397C91
SHA-512:	706FB5D6ADA45614B714107A7E7CAFE219B855CB19FADCE2BD1B545E7D2075E36C25B7C185FCEFDBDE9021736531149542D65D943C2287859460F0580D8EA381
Malicious:	false
Reputation:	unknown
Preview:	d......................?<...................HelveticaNeue MediumCondb.,.....y.,.....U.......O.,.....W.e.....b.................r.....y.......O.......a.v.......s.............V.,.....V.-.....Y.O.....V.o.....L.......V.......P.,.....R.T.....L.......P.......J.,.....L.T.....Y.S.....W.,.....J.......D.,.....W.-.....L.V....... .....W.o.....b.y.....W.......Q.,.....V.u.....R.Y.....L.W.....D.........A.....T.O.....Q.......:. .....L.Y.....c.h.....o.,.....A.......o.......A.......c.k.....V.:.....A.T.....r.......V.;.....c.,.....A.V.....p.,.....W.y.....O.A.....F.,.....v.a.....A.W.....c.......f.......p.......Y.a.....F.......A.Y.....h.y.....o.v.....V.A.....f.......o.w.....P.A.....w.a.....Y.e.............o.y..... .A.....W.A.....T.a.....e.,.....Y.i.....c.y.....p.y.....e.......v.,.............r.a.....T.e.....Y.,.....k.e.....v.......Y.-.....r.c.....Y.o.....d.y.....Y.......S.,.....r.d.......A.....r.e.....T.i.....w.,.....S.......O.T.....r.g.....,.......w.o.....w.......G.,.....e.x.....O.V.....F.A.....,.......T.,.

C:\Program Files (x86)\Google\Picasa3\runtime\HelveticaNeue MediumCond-28-1.000000-400-0.ytf

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe
File Type:	data
Category:	dropped
Size (bytes):	172470
Entropy (8bit):	4.391350045543404
Encrypted:	false
SSDEEP:	1536:5+CwjzVGQ4zjh3IjZQNg3yeeNdJ7POhU+suWr5xpkkB0IqjudsKTHdYf+G:wC4cjjh3IjZQqyt9OhCprxT0vuo
MD5:	8C8C3866571A187367F141A277DE4F73
SHA1:	277E8385D90DF64ACD50465DA9F4901F517B045B
SHA-256:	5D771287F1936C9FC24FC4B689F6D94C72D1596AC977A5FF7183905EF8FB00BE
SHA-512:	C420ABB8E681895DEA94C49645F68DC49A09F58BA38485D038487EA75B9173EA819917CE74F5D080ABB6389917BB377CD272F6922B9B3E78547C16872D60272B
Malicious:	false
Reputation:	unknown
Preview:	d......................?....................HelveticaNeue MediumCondb.,.....y.,.....U.......O.,.....W.e.....b.................r.....y.......O.......a.v.......s.............V.,.....V.-.....Y.O.....V.o.....L.......V.......P.,.....R.T.....L.......P.......J.,.....L.T.....Y.S.....W.,.....J.......D.,.....W.-.....L.V....... .....W.o.....b.y.....W.......Q.,.....V.u.....R.Y.....L.W.....D.........A.....T.O.....Q.......:. .....L.Y.....c.h.....o.,.....A.......o.......A.......c.k.....V.:.....A.T.....r.......V.;.....c.,.....A.V.....p.,.....W.y.....O.A.....F.,.....v.a.....A.W.....c.......f.......p.......Y.a.....F.......A.Y.....h.y.....o.v.....V.A.....f.......o.w.....P.A.....w.a.....Y.e.............o.y..... .A.....W.A.....T.a.....e.,.....Y.i.....c.y.....p.y.....e.......v.,.............r.a.....T.e.....Y.,.....k.e.....v.......Y.-.....r.c.....Y.o.....d.y.....Y.......S.,.....r.d.......A.....r.e.....T.i.....w.,.....S.......O.T.....r.g.....,.......w.o.....w.......G.,.....e.x.....O.V.....F.A.....,.......T.,.

C:\Program Files (x86)\Google\Picasa3\runtime\Praxis LT Regular-18-1.000000-400-0.ytf

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe
File Type:	data
Category:	dropped
Size (bytes):	84678
Entropy (8bit):	5.1891239292343725
Encrypted:	false
SSDEEP:	1536:I9gfl+lFFIw50zqpxEbuG6B1hAFGLENYfffffffffffffffffffffffffffffffR:nlgFd5OqzB1hVCQ
MD5:	C4EB1660D0346FED620A3B944FFB6B3E
SHA1:	AEE1DF703F84227A7C17F753363A5A6EF27E3D44
SHA-256:	34DBC906133C2261B1EC33B1DB60AC74530330086F9B006A30847CB1590E37C4
SHA-512:	969CA47FC216E2E49DDB5016A5AA0D1C70F4E7F1F39872B468136EC9D8B996E9FE6959D4433E710F25F96ACE5148199CB4F05FCE64CC1EC1541A75D73FAE7FE1
Malicious:	false
Reputation:	unknown
Preview:	d......................?.$..................Praxis LT RegularF.r.......U.....T.o.....N.e.....T.......A.v.....L.-.......V.....W.u.....K.a.....v.e.....A.w.......p.....5.1.....w.........W.....k.-.....X.C.....F.u.......1.....k.o.....T.r.....-.1.....A.y.....w.........Y.....T.s.....y.,.....Y.a.............W.y.....K.e.....y.-.....e.v.....U.A.....x.a.....T.u.....y.o.....y.......e.w.....U.......2.1.....k.s.......j.....D.A.....L.u.....g.a.....x.c.....n.y.....T.w.....D.......B.Y.....e.y.....Y.e.......A.............v.,.....V.a.....x.e.....T.y.....N.o.....y.s.....v.-.....Y.g.....R.A.....v.o.....v.......R.......L.y.....g.e.....T.:.....A.A.....m.p.....R.C.......b.....A.......Y.......T.;.....b.y.....V.e.......c.......T.....W.......W.A.....A.C.....X.O.....Z.y.....W.........d.....K.o.....V.g.....O.A.....r.a.....F.......F.A.......e.......V.....W.......N.u.....W.C.....O.......Y.,.....p.y.....R.G.....F.......,.1.....f.........W.....Y.-.....r.c.....F.......h.y.......g.....V.......Y.o.....A.G.....Y.......g.l

C:\Program Files (x86)\Google\Picasa3\runtime\Praxis Semi Bold-Heavy-11-1.000000-400-0.ytf

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe
File Type:	data
Category:	dropped
Size (bytes):	41793
Entropy (8bit):	6.4359215451298315
Encrypted:	false
SSDEEP:	768:l0X/uTc+sgaQVT8DW9I4jZKpS0AFDiVR+sBAeOCJ78N7HYFfLVX:Yf+c28DWfjEnA8lw5N7m5X
MD5:	B6679D7C353CA592680F00DEDA97BF19
SHA1:	699EDCDE7E7E7F460DAEF36357E917CA85620FC4
SHA-256:	4BD40350BE4D3E29E32B233107B12B6D463E48C87784E7D8BA05BDBE91A69022
SHA-512:	3959637C47950EB1F1A9354D6F096B788F041488BBDAD56088EEDDBD3278BDA43233520C7F36B7FC2DEF1B96D705502A44B1A4592F75B1359EA11E442A03ABDC
Malicious:	false
Reputation:	unknown
Preview:	d......................?;}..................Praxis Semi Bold/Heavy..O.....O.V.....r.y.......Y.....p.y.....c.h.....A.......O.A.....r.d.....T.r.....V.r.......u.....U.......U.m.....f.i.............y.e.....w.e.....a.y.....r.u.....R.-.......W.......q.....i.j.......1.....m.p.....A.W.....Y.......W.......A.......1.6.....T.Y.....f.e.....y.a.....w.a.....Y.o.....W.o.....C.H.............-.V.....R.y.......n.......Y.......G.....0.1.....,.1.....A.-.....O.......-.A.....1.......F.......R.O.....,.......1.2.....r.......f.a.....F.o.....A.y.....N.u.......C.............r.m.....D.T.....e.w.....A.d.....R.......Y.A.....W.A.....7.......A.O.....1.........T.....7.4.....Y.,.....W.,.....v.......Y.g.....A.u.....r.......v.......T.w.....x.o.....-.......L.V.....o.y.....m.y.......e.....A.......L.A.....F.A.....R.G.....N.G.....P.......O.W.............F.,.....A.q.....r.e.....v.e.....t.e.....T.s.......v.....k.o.....q.u.....8.1.......a.....Y.......W.......U.n.....A.G.....R.C.....N.C.....n.p.....7.,.......V.....V.......T.....

C:\Program Files (x86)\Google\Picasa3\runtime\Praxis Semi Bold-Heavy-12-1.000000-400-0.ytf

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe
File Type:	data
Category:	dropped
Size (bytes):	47614
Entropy (8bit):	6.3865708350761965
Encrypted:	false
SSDEEP:	768:MxN2TmTEVMqi3PEjzfbYr5d7J+dSou3QkbSy5pHg8BFCR:QXQM5kXYFd78dVkGy5pHg8E
MD5:	B9B1FB694D8B9BB80AA95F6616C12FE5
SHA1:	804E25542D43F22E6260BB97B45B455E18BCCA6D
SHA-256:	8A9B0A34B7882AADCB8F115D1D4AFD2853920008DA9F1325ABE7433D6E1E9476
SHA-512:	4F4676D4281AFF8FA5848C75D0FF3657B2A9D9F71AC76BF567CBE28B0566EA995F378E8E335563419C0F6515D775736777EE1B9010EAC003DCC8DDFF0B06743F
Malicious:	false
Reputation:	unknown
Preview:	d......................?....................Praxis Semi Bold/Heavy..O.....O.V.....r.y.......Y.....p.y.....c.h.....A.......O.A.....r.d.....T.r.....V.r.......u.....U.......U.m.....f.i.............y.e.....w.e.....a.y.....r.u.....R.-.......W.......q.....i.j.......1.....m.p.....A.W.....Y.......W.......A.......1.6.....T.Y.....f.e.....y.a.....w.a.....Y.o.....W.o.....C.H.............-.V.....R.y.......n.......Y.......G.....0.1.....,.1.....A.-.....O.......-.A.....1.......F.......R.O.....,.......1.2.....r.......f.a.....F.o.....A.y.....N.u.......C.............r.m.....D.T.....e.w.....A.d.....R.......Y.A.....W.A.....7.......A.O.....1.........T.....7.4.....Y.,.....W.,.....v.......Y.g.....A.u.....r.......v.......T.w.....x.o.....-.......L.V.....o.y.....m.y.......e.....A.......L.A.....F.A.....R.G.....N.G.....P.......O.W.............F.,.....A.q.....r.e.....v.e.....t.e.....T.s.......v.....k.o.....q.u.....8.1.......a.....Y.......W.......U.n.....A.G.....R.C.....N.C.....n.p.....7.,.......V.....V.......T.....

C:\Program Files (x86)\Google\Picasa3\runtime\Praxis Semi Bold-Heavy-12-1.000000-700-0.ytf

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe
File Type:	data
Category:	dropped
Size (bytes):	51166
Entropy (8bit):	6.264056663464892
Encrypted:	false
SSDEEP:	768:zhmqSLek6WIc1lXR/68cjDuXyh4ZCGKHmEWkB1zCB:zQxGWIElXRy9uXLcRPB9CB
MD5:	391D358C894789891DDEC8AC4D4A7E51
SHA1:	C225D6F7B0B6CE4A0323CF094B2F63F63BD3C6B7
SHA-256:	00FC4217ADEBD994435A3D93728214645AFA6C9A7B4CC2CE269E11432FAA4A28
SHA-512:	CF347D422B7B516D4BBE3D866B281E0072532AE624108265C4D4BFE751EE785E48E0593BC8720AADD70388C4AC771AC7E27F70730EFEC54A48B221B4D43C066C
Malicious:	false
Reputation:	unknown
Preview:	d......................?...........u.......Praxis Semi Bold/HeavyV.i.....y.,.....t.f.....W.e.....1.1.....y.........s.....V.,.....V.-.....W.i.....V.o.....L.......V.......P.,.....P.......V.r.....R.V.....L.T.....p.a.....W.,.....R.W.....W.-.....L.V.....W.o.....W.......V.u.....R.Y.....L.W.....p.d.....T.O.....t.s.....L.Y.....p.f.....W.r.....A.......V.y.....W.u.....V.:.....A.T.....r.......V.;.....A.V.....W.y.....F.,.....A.W.....L. .....f.......Y.a.....Y. .....W.:.....F.......A.Y.....W.;.....V.A.....P.A.....p.s.....Y.e.............d.p..... .A.....W.A.....T.a.....Y.i.....A. .....d.t.....T.c.....v.,.............T.e.....Y.,.....v.......Y.-.....Y.o.....Y.......Y.p.....T.i.....Y.q.....w.,.....S.p.....w.......G.,.....F.A.....T.,.....Y.u.....G.......T.-.....Y.v.....S.t.....T.o.....T.......L.y.....r.,.....T.r.....T.s.....r.......Y.:....... .....Y.;.....T.u.....A.v.....T.w..... .Y.....A.w.....f.p.....T.y.....A.y.....Y.A.....V.a.....T.:.....T.;.....f.t.....P. .....t.a.....V.e.....W.a.....t.d.....T.A...

C:\Program Files (x86)\Google\Picasa3\runtime\Praxis Semi Bold-Heavy-13-1.000000-700-0.ytf

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe
File Type:	data
Category:	dropped
Size (bytes):	55131
Entropy (8bit):	6.125849608497826
Encrypted:	false
SSDEEP:	768:Y5ALPy1xX9WnI8IPF7sde6knm5jw1K8L2fjXlwLgIbD3aIL7JJ3AiwMrX:YyLK1xXB8s8uK8LaD2gS/AWD
MD5:	A0E4502904F87F990A4A6DE55318980C
SHA1:	5885DC7410A9846E9792C1F7E7544F74BCAF14FA
SHA-256:	17D3E7EA6F6A326149D1E989E73333E93C8C0C23131B15E173247365FE057E1C
SHA-512:	7697DDB833C59B1D992D153933D3D1EB82CCB02ECBA05DC94C35864378499C8D8FC141ED5C8E09CCD2C2DFDD1415E2E0FA00EA3073FA656B0B364D91B9FC48CE
Malicious:	false
Reputation:	unknown
Preview:	d......................?m...........u.......Praxis Semi Bold/HeavyV.i.....y.,.....t.f.....W.e.....1.1.....y.........s.....V.,.....V.-.....W.i.....V.o.....L.......V.......P.,.....P.......V.r.....R.V.....L.T.....p.a.....W.,.....R.W.....W.-.....L.V.....W.o.....W.......V.u.....R.Y.....L.W.....p.d.....T.O.....t.s.....L.Y.....p.f.....W.r.....A.......V.y.....W.u.....V.:.....A.T.....r.......V.;.....A.V.....W.y.....F.,.....A.W.....L. .....f.......Y.a.....Y. .....W.:.....F.......A.Y.....W.;.....V.A.....P.A.....p.s.....Y.e.............d.p..... .A.....W.A.....T.a.....Y.i.....A. .....d.t.....T.c.....v.,.............T.e.....Y.,.....v.......Y.-.....Y.o.....Y.......Y.p.....T.i.....Y.q.....w.,.....S.p.....w.......G.,.....F.A.....T.,.....Y.u.....G.......T.-.....Y.v.....S.t.....T.o.....T.......L.y.....r.,.....T.r.....T.s.....r.......Y.:....... .....Y.;.....T.u.....A.v.....T.w..... .Y.....A.w.....f.p.....T.y.....A.y.....Y.A.....V.a.....T.:.....T.;.....f.t.....P. .....t.a.....V.e.....W.a.....t.d.....T.A...

C:\Program Files (x86)\Google\Picasa3\runtime\Praxis Semi Bold-Heavy-14-1.000000-400-0.ytf

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe
File Type:	data
Category:	dropped
Size (bytes):	59670
Entropy (8bit):	6.241236211796885
Encrypted:	false
SSDEEP:	1536:HdppJvsQtB6+ZvW42r+7O7ZQHI4bq+adOP8:fpJvsQtw+Ze+76ZQjq+W
MD5:	487A4D5862BCF560873A344B7767070F
SHA1:	C78E60DA12D40ABEE0A63E5180B374A30884EBC2
SHA-256:	9F8B160FD8C86C6A4FA4AB625482C17112887390B82C0FFC7AC08896F0BF3FA5
SHA-512:	8A2FFCB06858A3CF8F84761AF0E48405D7B128656934FAA960A723DFA5A4D66E09F6AAE0E99258C9F50C20BCC88D3C3470E64023C7F0A15277486394B4C9C5F0
Malicious:	false
Reputation:	unknown
Preview:	d......................?....................Praxis Semi Bold/Heavy..O.....O.V.....r.y.......Y.....p.y.....c.h.....A.......O.A.....r.d.....T.r.....V.r.......u.....U.......U.m.....f.i.............y.e.....w.e.....a.y.....r.u.....R.-.......W.......q.....i.j.......1.....m.p.....A.W.....Y.......W.......A.......1.6.....T.Y.....f.e.....y.a.....w.a.....Y.o.....W.o.....C.H.............-.V.....R.y.......n.......Y.......G.....0.1.....,.1.....A.-.....O.......-.A.....1.......F.......R.O.....,.......1.2.....r.......f.a.....F.o.....A.y.....N.u.......C.............r.m.....D.T.....e.w.....A.d.....R.......Y.A.....W.A.....7.......A.O.....1.........T.....7.4.....Y.,.....W.,.....v.......Y.g.....A.u.....r.......v.......T.w.....x.o.....-.......L.V.....o.y.....m.y.......e.....A.......L.A.....F.A.....R.G.....N.G.....P.......O.W.............F.,.....A.q.....r.e.....v.e.....t.e.....T.s.......v.....k.o.....q.u.....8.1.......a.....Y.......W.......U.n.....A.G.....R.C.....N.C.....n.p.....7.,.......V.....V.......T.....

C:\Program Files (x86)\Google\Picasa3\runtime\Praxis Semi Bold-Heavy-14-1.000000-700-0.ytf

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe
File Type:	data
Category:	dropped
Size (bytes):	65839
Entropy (8bit):	6.101636668196128
Encrypted:	false
SSDEEP:	768:k9W74PC7/KbpgxPVwdF79GSI3gn6fWn43pFdkrIqvHOLgnsLb6vwnSrSi/NcSi2t:2q7SsPVwz9Y3g6fo45F/qvOLsh/GS/4Y
MD5:	F9CABFB2D0CB90C8413BD7543057B5BD
SHA1:	EB0242772F8E762EDE4B82EF61285CBEB5ABB2E2
SHA-256:	0401330442BB4A9E8A4919D60067E947A0A84E1D79B2F0A4AF0254F98539C58D
SHA-512:	EDB666B2957C58F541B9751DADFCDB838AF9B0A44554EBB22FF10B9B215BE0BC3D7311B6356B8ACAAC4373CF322814BC0B39E391A7863B1679DB76D2DC0236E2
Malicious:	false
Reputation:	unknown
Preview:	d......................?A...........u.......Praxis Semi Bold/Heavyt.d.....p.d.....T.r.....V.r.....A. .....R.W.....A.W.....A.......W.o.....Y.o.....A.y.....W.A.....Y.A.....W.,.....Y.,.....r.......v.......T.w.....L.V.....F.A.....F.,.....T.s.....P.......t.a.....p.a.....T.o.....V.o.....Y.p.....Y. .....A.T.....T.A.....V.A.....L. .....T.,.....V.,.....W.-.....Y.-.....A.v..... .Y.....L.W.....G.,.....L.......T.c.....W.y.......s.....t.f.....p.f.....R.Y.....w.,.....y.,.....W.:.....Y.:.....L.y.....W.u.....Y.u.....A.Y.....Y.q.....t.s.....p.s.....T.-.....V.-.....d.t.....f.t.....W.......Y.......W.i.....Y.i.....A.w.....T.y.....V.y.....S.t.....d.p.....f.p.....T.O.....F.......W.e.....Y.e.....r.,.....v.,.....T.:.....V.:.....T.u.....V.u.....L.T..... .A.....W.;.....Y.;.....S.p.....Y.v.....W.a.....Y.a.....f......... .....R.V.....P.A.....W.r.............P.,.............A.V.....T.......V.......T.i.....V.i.....1.1.....L.Y.....G.......T.e.....V.e.....r.......T.;.....V.;.....P. .....T.a.....V.a.....w.......y.....

C:\Program Files (x86)\Google\Picasa3\runtime\Praxis Semi Bold-Heavy-16-1.000000-700-0.ytf

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe
File Type:	GLS_BINARY_LSB_FIRST
Category:	dropped
Size (bytes):	84032
Entropy (8bit):	5.70097677164489
Encrypted:	false
SSDEEP:	1536:DvZ3HMgDsYJfqZXXfI/oPRVQGJNAIM00NwTY7XwfY+Y2Y/YSVoYW1r/irlAnP94:DVHT9mf7XN/MNwTY7F6m
MD5:	03BD4F1BAC7BAE7DEA48FD482C487191
SHA1:	2F89C8FA6A70E4B50D8AA6BF7AF73D8E320DCCE5
SHA-256:	6F8A091C35861D53AB45DA9CDD7D68C7EA62B93825F3A196018ABC8B0783A7C3
SHA-512:	C3F1168ACCA82340C2F2BE552739CBBC363921933AE7D37E80AFD225A5C636F44CD079F314A933A975988B64F561DC84CD20357A5778024C678650D95B1D0172
Malicious:	false
Reputation:	unknown
Preview:	d......................?R,..........u.......Praxis Semi Bold/HeavyV.i.....y.,.....t.f.....W.e.....1.1.....y.........s.....V.,.....V.-.....W.i.....V.o.....L.......V.......P.,.....P.......V.r.....R.V.....L.T.....p.a.....W.,.....R.W.....W.-.....L.V.....W.o.....W.......V.u.....R.Y.....L.W.....p.d.....T.O.....t.s.....L.Y.....p.f.....W.r.....A.......V.y.....W.u.....V.:.....A.T.....r.......V.;.....A.V.....W.y.....F.,.....A.W.....L. .....f.......Y.a.....Y. .....W.:.....F.......A.Y.....W.;.....V.A.....P.A.....p.s.....Y.e.............d.p..... .A.....W.A.....T.a.....Y.i.....A. .....d.t.....T.c.....v.,.............T.e.....Y.,.....v.......Y.-.....Y.o.....Y.......Y.p.....T.i.....Y.q.....w.,.....S.p.....w.......G.,.....F.A.....T.,.....Y.u.....G.......T.-.....Y.v.....S.t.....T.o.....T.......L.y.....r.,.....T.r.....T.s.....r.......Y.:....... .....Y.;.....T.u.....A.v.....T.w..... .Y.....A.w.....f.p.....T.y.....A.y.....Y.A.....V.a.....T.:.....T.;.....f.t.....P. .....t.a.....V.e.....W.a.....t.d.....T.A...

C:\Program Files (x86)\Google\Picasa3\runtime\Praxis Semi Bold-Heavy-18-1.000000-700-0.ytf

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe
File Type:	data
Category:	dropped
Size (bytes):	92968
Entropy (8bit):	5.122140854276171
Encrypted:	false
SSDEEP:	1536:r6juuFLri8SALOkknLibsbBnFa20xVF0TD/HenRsQb:rGFbOi9
MD5:	493FACA543B7783093B2F6548E9CB0A5
SHA1:	33E4A28677BA57B3EB3E5E824CBA93B7052F4A3F
SHA-256:	09325511858ABA3C6D5E07577C34A9A07AE7B3655276466840A85658699FCABE
SHA-512:	395E154A85D862BA36223707865424D3D6EA8E9E4A634BB008D473D8197B8CC80806DABEDA3960058F7ABCC40819E40930B7087507F89495495AA9F0455AD01A
Malicious:	false
Reputation:	unknown
Preview:	d......................?"E..................Praxis Semi Bold/Heavy..O.....O.V.....r.y.......Y.....p.y.....c.h.....A.......O.A.....r.d.....T.r.....V.r.......u.....U.......U.m.....f.i.............y.e.....w.e.....a.y.....r.u.....R.-.......W.......q.....i.j.......1.....m.p.....A.W.....Y.......W.......A.......1.6.....T.Y.....f.e.....y.a.....w.a.....Y.o.....W.o.....C.H.............-.V.....R.y.......n.......Y.......G.....0.1.....,.1.....A.-.....O.......-.A.....1.......F.......R.O.....,.......1.2.....r.......f.a.....F.o.....A.y.....N.u.......C.............r.m.....D.T.....e.w.....A.d.....R.......Y.A.....W.A.....7.......A.O.....1.........T.....7.4.....Y.,.....W.,.....v.......Y.g.....A.u.....r.......v.......T.w.....x.o.....-.......L.V.....o.y.....m.y.......e.....A.......L.A.....F.A.....R.G.....N.G.....P.......O.W.............F.,.....A.q.....r.e.....v.e.....t.e.....T.s.......v.....k.o.....q.u.....8.1.......a.....Y.......W.......U.n.....A.G.....R.C.....N.C.....n.p.....7.,.......V.....V.......T.....

C:\Program Files (x86)\Google\Picasa3\runtime\about.fen

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	836
Entropy (8bit):	4.650087042137562
Encrypted:	false
SSDEEP:	24:9URSKRSxK/4KcRLKSh9H4PKZPnXGciKciUb:9WSKF/tc09CZPnXGc/c9b
MD5:	9912FCCAA18D92F02E9756A3FB3886E6
SHA1:	B802A9EAD6D9449A6A9B66AE8FFC88A4F4381EB5
SHA-256:	50A3B0EFD00E739FA03E4597B84D16CBBACC69D2E2DC59ABA69E2D25B9AE9019
SHA-512:	1D900756F530E1DFEA96D86537ED01D91D42A5824C36F63106E97AC5242B7DEF8E9ED05B3B0C66A449F32E80F93F3B355B8D88519F294E6624DA86C9DD8C0C4D
Malicious:	false
Reputation:	unknown
Preview:	<window title="About Picasa" width="300">. <appicon align="center"/>. <spacer amount="1em"/>. <label title="Picasa" text-align="center" width="fill" name="appname"/>. <label title="" text-align="center" width="fill" name="version" size="small"/>. <label title="All other product, service names, brands, or trademarks are the property of their respective owners." text-align="center" width="fill" size="small" name="trademarks"/>. <label title="This software is based in part on the work of the Independent JPEG Group. This program is protected by U.S. and international copyright law." text-align="center" width="fill" size="small" name="notices"/>. <label title="" text-align="center" width="fill" size="small" name="copyright"/>. <button title="Third-party licenses..." size="small" align="center" name="licenses"/>.</window>.

C:\Program Files (x86)\Google\Picasa3\runtime\addtogroup.fen

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	441
Entropy (8bit):	4.634550085107193
Encrypted:	false
SSDEEP:	12:/9fHoL4zSELnOLrqO1iswvxSELn8IJqi5GlAUjKo+:1gL4zSELnOL2O1AxSELn8Yog
MD5:	D71481FA8A529A8D25392F66B9D02920
SHA1:	F041A9791C48213F4F58C88A8BE15B05250FFF4E
SHA-256:	BA52F9AB25AA2B0A3273AE5A8DE96E6FB3CE2CB3619A7A5257881F2409F97361
SHA-512:	0747C810BD0F7E9FA1F9097D6B43C77AF1B3DDEB1B5A6CD8B80E4973D99B73ED3BB440AAA0CD9476F9AFBA620F0AC42AA762438A872F1BA23937305893016FD4
Malicious:	false
Reputation:	unknown
Preview:	<window title="Add to group" width="fill">. <labelgroup title="Name:">. <label title="" width="25em" name="name"/>. </labelgroup>. <labelgroup title="Groups:">. <check title="Friends" name="friends"/>. <check title="Family" name="family"/>. <check title="Coworkers" name="coworkers"/>. </labelgroup>. <buttongroup>. <button title="OK" type="accept"/>. <button title="Cancel" type="cancel"/>. </buttongroup>.</window>.

C:\Program Files (x86)\Google\Picasa3\runtime\album.fen

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1017
Entropy (8bit):	4.6743223411174375
Encrypted:	false
SSDEEP:	24:CLE+/mSELnOL+a1II9TuELnOLLPaK6udTuELnOLFXSELnOL75nRmSELn8Eog:CTeODLJPO5NhPO5zOP7G8E
MD5:	B36FE4E4E3380064D2AF3DC0E4F94F92
SHA1:	EB0BE0DA771254466FC3D805C25CBFECAC5EF5AA
SHA-256:	28474A5E73F5945A63C3965F360FC9DF75E6B119904E55D0DEBE6797661B9238
SHA-512:	E4EE6855E928E40E75E01D262E6E933D7150EB7482166B6382BBAB04E569CCFA8B2F8FFA77928C5697EDE87E3C0E67011F7EE444ABA0DCEC9D0B25E577D4BA5F
Malicious:	false
Reputation:	unknown
Preview:	<window width="fit">. <labelgroup title="Name:" name="namelabel">. <edit name="name" filter="filename"/>. </labelgroup>. <labelgroup title="Date:">. <group layout="row">. <date name="date"/>. <button title="Automatic date" name="autodate"/>. </group>. </labelgroup>. <labelgroup title="Music:">. <check title="Use music for Slideshow and Movie presentation:" name="usemusic"/>. <group layout="row" width="fill">. <spacer amount="indent"/>. <browse title="Browse..." name="music" win_filter="Music files\|.mp3;.wma" mac_filter="Music files\|.mp3;.m4a">. <bind attr="enabled" source="usemusic"/>. </browse>. </group>. </labelgroup>. <labelgroup title="Place taken (optional):">. <edit name="location"/>. </labelgroup>. <labelgroup title="Description (optional):">. <edit height="3li" name="caption"/>. </labelgroup>. <buttongroup>. <button title="OK" type="accept" name="ok"/>. <button title="Cancel" type="cancel"/>. </button

C:\Program Files (x86)\Google\Picasa3\runtime\auto_backup_prompt.fen

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	973
Entropy (8bit):	4.671753883380847
Encrypted:	false
SSDEEP:	24:mloGFjT5bOq1MM6bDTdi2o5/UuRtFmBJpXLoQdOmog:1GFpSCH6XA39R2BJdEQd/
MD5:	D3221BC70BD9334BF55DD534B8F68AAA
SHA1:	F0DEE915BF7249237FDFEA52FD81E0AC47AF088E
SHA-256:	29BCCCBBD8542DF192E1444EBB253E2017F4AB0F285B7266BE2FC0E873BDD18D
SHA-512:	B76D87BD19C88F6FE80A40356F9942D7C232AFD5FA6FF2993BF9EFAF5AE3F2BB627090A884ED5B822F5646B248D52B9866F50DE0C75F5C5F0A3569B88D9FFFD5
Malicious:	false
Reputation:	unknown
Preview:	<window name="window" title="Google Photos Backup" width="30em">. <group layout="row">. <group layout="column">. <spacer amount="1em"/>. <image width="72" height="72" name="main_image" align="start"/>. </group>. <spacer amount="1em"/>. <group layout="column">. <spacer amount="1em"/>. <label name="welcomelabel1" title="Back up your Picasa photos" win_fontsize="20" mac_fontsize="18" fontweight="bold" height="1.5li" width="fill"/>. <label name="welcomelabel2" height="fit" width="fill". title="Automatically save your photos and videos online with Google Photos Backup. Your items are accessible from any of your devices and everything stays private until you choose to share."/>. </group>. </group>. <buttongroup align="end" default="accept">. <button name="yesbutton" title="Get Google Photos Backup" type="accept"/>. <button name="ignorebutton" title="No Thanks" type="cancel"/>. </buttongroup>.</window>.

C:\Program Files (x86)\Google\Picasa3\runtime\autocomplete_errors.fen

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	527
Entropy (8bit):	4.574345208546025
Encrypted:	false
SSDEEP:	12:k+jL4aizETZ190dHWWZCRmA/EtNDpnfHSJqtQZgr0d+:k+jp4ETZBf+aE
MD5:	D3EE64A31CD30C94AF9D1178E96E1651
SHA1:	B09CD80B23A13F7B8E02F7888BB4C734A6E46238
SHA-256:	BE241FFC36910998166F0D33464072A75B47C349EBE4BC5EA44FAF12C231F903
SHA-512:	068F5E1476088832B927AF6DFA44C2F338B3A5B0E41031EB58315A936E1F14DE6622E9C5B9DD63269056333D7ADCF29E4F5BB4D2D241137229F2BB43653CA129
Malicious:	false
Reputation:	unknown
Preview:	<window title="Autocomplete Errors">. <group layout="column">. <label title="The following contacts found in the clipboard text could not be pasted correctly" text-align="left"/>. <list name="errorlist" scroll="v" height="5li" header="show" width="fill">. <column title="Contact" width="12em"/>. <column title="Error" width="24em"/>. <column title="Status" width="8em"/>. </list>. <buttongroup width="fill">. <button title="OK" type="accept" name="ok"/>. </buttongroup>. </group>.</window>.

C:\Program Files (x86)\Google\Picasa3\runtime\bezier.txt

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	229
Entropy (8bit):	3.753916351048744
Encrypted:	false
SSDEEP:	6:QFIAVLcHHQv6CRDLDPQ1XsU+CSCunX+tDJ3t4IqpQRv:QFIAVLyHI6CRDLKRlJ9SpEv
MD5:	40D0CD8A448EC9DAFD6DB15C68D0A689
SHA1:	89C520372B9DE935BAD349562A301AA7D6F39368
SHA-256:	4AD481E882F1140C8FF63D5C3A2FC247BDFB9216F24571826B6897CBD8E17162
SHA-512:	A87EB4BAFBD7FA6D3B3F14A651E9D9E6EF941DFC0EB63D4D45B96B7CD104E41B4143677A4084DD7768F7E30ED8EAD7271BB995F227722514E9CBB5274A8D0CEE
Malicious:	false
Reputation:	unknown
Preview:	-3 -3 10.-1 -0.5 4.-0.3 0.9 0.6.0.9 0.75 1.1..#-2 2.4 5.4.#-0.2 1.21 1.7.#0.5 1.22 1.65.#1.2 1.21 1.7.#3 2.4 5.4..#-3.158472 2.926414 7.990301.#-0.097193 1.195776 1.627851.#0.231698 0.707630 -0.012869.#1.961033 1.648414 3.387254.

C:\Program Files (x86)\Google\Picasa3\runtime\cdchoose.fen

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	486
Entropy (8bit):	4.577513701714945
Encrypted:	false
SSDEEP:	12:dDQFKjLaAL7gsdHKZwKQoPU+wA/ZZB8IJqi5GlAUjKo+:pQCXL04oc+wAxZB8Yog
MD5:	44EECD5753CC2493ADB8B8977330CED7
SHA1:	D5A22A50B05E2C7507D1CD1EB03967831DFCC589
SHA-256:	CD383A0F2D4F6B56A9C9D873941B6CA5785E5F7A9773D4A9EDA9AEA4B74BF678
SHA-512:	68898FA96D11A80641D85E4912DB17F87842C78D6D597FE410C006163FA40F521458B716C666EB6B3B3ABE1E2395705B0529FDD95BD0516F3813F4FBDCCCB7B5
Malicious:	false
Reputation:	unknown
Preview:	<window title="Choose Recordable Disc Drive" width="fit">. <group>. <appicon/>. <group layout="column">. <label title="Picasa has found more than one recordable drive.\nWhich drive would you like to use?" width="fill"/>. <group>. <label title="Drives:"/>. <popup name="drive" width="20em"/>. </group>. </group>. </group>. <buttongroup>. <button title="OK" type="accept"/>. <button title="Cancel" type="cancel"/>. </buttongroup>.</window>.

C:\Program Files (x86)\Google\Picasa3\runtime\compacting.fen

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	453
Entropy (8bit):	4.521744643568014
Encrypted:	false
SSDEEP:	12:9QFKjLQTJJEUA/wKQCfhKZkmHXs/ZZB8xGlAUjKo+:9QCEJJ9AQYKf8ZB8pog
MD5:	D313DDDCBB87A6955B70E8C65A4A352C
SHA1:	340FBC361E67651952E116B354C29C8A3A743A5E
SHA-256:	D72B5689A13EAE1F55A15CFD22A6AA6921DF5349CD48B9A4FA70C8D84BE2C68E
SHA-512:	54777A96826CBF19246A5129B4EE97520786CAB7B1CBA919B80D229ED78249B3A8A15B0E0B3EBF0F8AE34E75FEFA4A6FE69EB57D1987A9BBFA07FE2DECD86E03
Malicious:	false
Reputation:	unknown
Preview:	<window title="Compacting" width="fit">. <group>. <appicon/>. <group layout="column">. <label title="Picasa is compacting its database to save disk space. This may take several minutes." width="20em"/>. <group>. <spacer amount="indent"/>. <label width="fill" name="status" title="Compacting..."/>. </group>. </group>. </group>. <buttongroup>. <button title="Cancel" type="cancel"/>. </buttongroup>.</window>.

C:\Program Files (x86)\Google\Picasa3\runtime\confirm.fen

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	442
Entropy (8bit):	4.516275683173169
Encrypted:	false
SSDEEP:	12:zdQFKjLe6amAJf9zZBBfzMtvDqKFu5GlA/eAUjKo+:zdQC0d9jBfio/fog
MD5:	17EDE5C803D8BFACD82A6A561634AC7F
SHA1:	D6E5DCABFC1A3226AA6CBF554D51078813A37B82
SHA-256:	DA5D9F02F558E65B3A38EB3F0BDFFF28BAE8CF9CFF56CEA031F94EA8083F90CD
SHA-512:	491E27043E027FAEE32EC0C47F694656F15618A7A6BBD91AD19F8C55F1817DD608AE89D95E70D9A9BB7AB31F7F06686D181B6CC36CA9986775BC6F7C6E34F4A5
Malicious:	false
Reputation:	unknown
Preview:	<window width="fit" focus="buttons">. <group>. <appicon/>. <group layout="column">. <label name="message" width="24em" title="Message"/>. <check title="Don't ask again" name="remember"/>. </group>. </group>. <buttongroup name="buttons">. <button title="Yes" type="accept" name="yes"/>. <button title="No" type="other" name="no"/>. <button title="Cancel" type="cancel" name="cancel"/>. </buttongroup>.</window>.

C:\Program Files (x86)\Google\Picasa3\runtime\confirmsync.fen

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	967
Entropy (8bit):	4.58709447871829
Encrypted:	false
SSDEEP:	12:uhsRYi9QTSKuGaTjbHI/oKjLLHCXHCSHKZjLnAQtemHpwHKZjLn8F82xfHKZBBme:osUSKATjG6SnA6eynUPSBmiPTjRHLIE
MD5:	950A6F44F485789A5E73F747C1A3253E
SHA1:	E8587BF5D0FE03E09834FA77545C96A4CE444284
SHA-256:	6C07D0EA5B0DC55D0DBA4908949B02D951506158A8B75816F311976DD9A2762C
SHA-512:	F51A64EDEFF21FCEBA70BAE11478A5C402BEC771ED3B4B2F8529897B7221ED22139C19F697F90A25ED1D615093B72080DD64F461F74A807D253EDE3100C8067E
Malicious:	false
Reputation:	unknown
Preview:	<window title="Sync Album to Web" width="fit">. <label title="Upload this album to Web Albums and keep it in sync?" name="msg"/>. <label title="Current settings:"/>. <group layout="row" width="fill">. <spacer amount="3em"/>. <group layout="column" width="fill">. <labelgroup title="Size:" width="fill">. <label title="default size goes here" name="size" width="fill"/>. </labelgroup>. <labelgroup title="Visibility:" width="fill">. <label title="Unlisted" name="visibility" width="fill"/>. </labelgroup>. <label title="Sync starred photos only" name="starred" width="fill"/>. </group>. </group>. <check title="Don't ask me again (always use current settings)" name="dontask"/>. <group layout="row" width="fill">. <button title="Change Settings..." name="change"/>. <buttongroup>. <button title="Sync" type="accept"/>. <button title="Cancel" type="cancel"/>. </buttongroup>. </group>.</window>.

C:\Program Files (x86)\Google\Picasa3\runtime\constants.ui

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1723
Entropy (8bit):	4.88171404015582
Encrypted:	false
SSDEEP:	48:B/kZSc9SD16ghgkf02zZeJamVLV0JVJughVyD8h:Jk0DA3oeSJ06
MD5:	868ABFE7F82C10BBC0E344F7121D2E4B
SHA1:	CD725B907CAC43D4E189719E3544CF5C81AC562F
SHA-256:	D18A2E2A29FBE16A3A94BDE0F441860F80416FE3B1D6BD01107666428D2C12B5
SHA-512:	8D92626670F30F4C83FA428C09B0C1F18CAD8818FFBF44701756F509986BB00E4B96CC062554CA2C0BAC1D261AC34B4BE210F42E7E3A39E3B02D322BF9984072
Malicious:	false
Reputation:	unknown
Preview:	[Picasa2].;-----------------------------.; Album List.;-----------------------------.alist_height=22.alist_fontsize_mac=14.alist_fontsize_win=14.alist_indent=17.alist_bgcolor=0xFFF3F3F3.; Windows and Linux.alist_hicolor_win=0xFF83A7BD.alist_hicolor2_win=0xFFE5E2DA.alist_selcolor_win=0xFF25648B.; Mac OS X (Aqua Blue).alist_hicolor_mac=0xFF3D75D7.alist_hicolor2_mac=0xFFD0D0D0.alist_selcolor_mac=0xFF3D75D7.; Both platforms.alist_dragcolor=0xFF82A6BD.alist_catcolor=0xFFEDEAE4.alist_scatcolor=0xFF25648B.alist_dotcolor=0xFFBEBEBE.alist_stickycolor=0xFFEAE7DC.;-----------------------------.; Album Label.;-----------------------------.alabel_hicol=#f2f2f2.;alabel_fldrcol=#E0E0E0.alabel_fldrcol=#e2e2e2.alabel_fldrhicol=#f2f2f2.alabel_albumcol=#e2e2e2.alabel_albumhicol=#f2f2f2.;alabel_actionsOffset=-16.alabel_webpubOffset=-16.alabel_burncdOffset=-224.alabel_buttfont_mac=Praxis Semi Bold/Heavy.alabel_buttfont_win=Praxis Semi Bold/Heavy.alabel_buttfontSize_mac=12.alabel_buttfontSize_win=12.alabel_

C:\Program Files (x86)\Google\Picasa3\runtime\contactmgr.fen

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	2904
Entropy (8bit):	4.499312849184926
Encrypted:	false
SSDEEP:	48:tXbmi6/wwzEfaUZnnUP8CcaobVo4NOelbVlobaUrfSZjQoAE:tLDul1Vqv
MD5:	49147B162CC0B66204E95BEC9DBFF9DD
SHA1:	5BE1B06D8E73B931A9CADB991F096A584556217F
SHA-256:	F46809CA5C4D62C053A4D816CF39A9F05E2EE606E4092EB67B9AB6771F76AD95
SHA-512:	75D895884A26F3548E252CEDCAF4528DF700689E595CAFCB6BFFD41816A88E30BF2D060B083310D749B6915CA09FEF04D4E40E913A54D9357B6D6C0A2C5FAC06
Malicious:	false
Reputation:	unknown
Preview:	<window title="People" width="fit">.. <group layout="row">. <group layout="column">. <labelgroup title="Search:" width="fill">. <edit width="fill" name="search"/>. </labelgroup>.. <labelgroup title="" width="fill">. <list name="contacts" width="250" height="17li" scroll="v". header="hide">. <column width="fill"/>. </list>. </labelgroup>. <group align="end">. <button title="Delete Person" name="delete"/>. <button title="New Person" name="create"/>. </group>. </group>.. <group layout="column">. <labelgroup title="" width="fill">. <label/>. </labelgroup>. <labelgroup title="" width="fill">. <group>. <printpreview width="32" height="32" name="thumb"/>. <group layout="column">. <label width="fill" name="count"/>. <label title="Online Contact" width="100" name="online_contact"/>. </group>. <printpreview width="

C:\Program Files (x86)\Google\Picasa3\runtime\customaspectratio.fen

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	690
Entropy (8bit):	4.498394723358974
Encrypted:	false
SSDEEP:	12:/ctLYjLAc8VHqKj+sOneKZjLnIVHR3LLnIIfHHZEOLLnGnfHaJqtQZ5GlA/eAUjg:HjM9XI3nI7nIb+nGy/fog
MD5:	6C7A970379A8C5BF2E723C14614E729C
SHA1:	9EDAF0EC2F79020AF1CE65A059132CE715FAEB89
SHA-256:	41754F4942379689DE06675E75F4FD2CB20A34AFB9301A21C7439CADA82DA3E6
SHA-512:	FC472ECE4D9334301A421748BE45EADF81BF6EBDFA40A966567C367A73964A8CBCDDC4A7919FFF61E348B5E647B3B842B645AE14204B0CF915C7B0E9209352EE
Malicious:	false
Reputation:	unknown
Preview:	<window title="Add Custom Aspect Ratio" width="fit">. <group layout="column">. <labelgroup title="Dimensions:" width="fill">. <group layout="row">. <edit width="3em" name="width"/>. <label title=" x "/>. <edit width="3em" name="height"/>. </group>. </labelgroup>. <labelgroup title="Name:" width="fill">. <edit width="13em" name="title"/>. </labelgroup>. <labelgroup title="Example:" width="fill">. <label title=" 4 x 6 Small print"/>. </labelgroup>. </group>.. <buttongroup width="fill">. <button title="OK" type="accept" name="ok"/>. <button title="Cancel" type="cancel" name="cancel"/>. </buttongroup>.</window>.

C:\Program Files (x86)\Google\Picasa3\runtime\defaults.ini

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	356
Entropy (8bit):	4.733150167385274
Encrypted:	false
SSDEEP:	6:yGLz3qz3duVSVKM2DzzH+VAlZzK85dzzH+VAlZzKlKT/2fzxeMdkAddGeMdkvd9z:TLWDcYKhX+0zK859+0zKBryoIVy162
MD5:	4488879C5B32982F7D98C274348E6A7B
SHA1:	61F5897A43B9EA291A137BE8B500A2E5D731EB65
SHA-256:	DC04FCFFA784ADE6AB0226450158DC6BD76E2DEC6AFA7E27EF1B9EC2FFD8435D
SHA-512:	5339C8156964C7AF8B830C711EDEA3B2BC612A85387C4EE40797F10664861B03E32B453E80FEE0F56AF2A739526A0FD406FF1CD0BE4B71A3EC979A9492FC310E
Malicious:	false
Reputation:	unknown
Preview:	[LifeScapeUpdater].versionFileURL=http://updates.picasasoftware.com/picasa2/public/currentversion.ini.readmeURL=http://picasa-readme.blogspot.com/.readmefeedURL=http://picasa-readme.blogspot.com/feeds/posts/default.printerURL=https://client4.google.com/providers/printers2.html.printerXmlURL=https://client4.google.com/providers/xml..[Track].name=public...

C:\Program Files (x86)\Google\Picasa3\runtime\eula.fen

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	820
Entropy (8bit):	4.6981904125991525
Encrypted:	false
SSDEEP:	24:m/Mw/X9+NMKRCpMvQRCNihMvdSga24BYHog:6INMKaM4QihM0tqv
MD5:	EB03C83D8CCFD47D49962B0A9DA630E2
SHA1:	38C4E633CAE636AD02B1DFD5D3F803A970A9034F
SHA-256:	048B4712F27022DDA20B67229019C5BDB49C3A88F0594D7C62E4C7F6283D6EBC
SHA-512:	556E9FAA2CACB3E479708DA435B4F5488FA26C7BBB4458FEA71FBD41AE3DEFE71B5AF13BAC5879EA413E68FD540D26446B1E97B03286C341976CB3412F9BA99F
Malicious:	false
Reputation:	unknown
Preview:	<window name="window" title="Please review the license terms before using Picasa" width="32em">. <label name="label2" title="By using Picasa you agree to the Google Terms of Service and Privacy Policy." width="fill" align="center" text-align="center"/>. <link name="toslink" title="Terms of Service" text-align="center" align="center" url="https://www.google.com/intl/en/policies/terms/"/>. <link name="privacylink" title="Privacy Policy" text-align="center" align="center" url="https://www.google.com/intl/en/policies/privacy/"/>. <spacer amount="2em"/>. <check title="Send anonymous usage statistics to Google (You can always change this setting later)" name="sendstats"/>. <buttongroup>. <button title="I Agree" type="accept" name="ok"/>. <button title="Cancel" type="cancel"/>. </buttongroup>.</window>.

C:\Program Files (x86)\Google\Picasa3\runtime\export.fen

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	2411
Entropy (8bit):	4.609772871110002
Encrypted:	false
SSDEEP:	48:GcvPOtqRaOpNBD0POo+gta+xFSPOIPO/ifKR6P8hC:GbtqhNFoRtN/x/ifwe
MD5:	CB6C0F8FFF4B60CE159E77FE6428BCD4
SHA1:	3B8BD5263B69A6384EBBCBBE4A3CC40A36035A05
SHA-256:	77CCA2DC6A787313E9A9484D81416A325A8AAD41FFF11D09EF8974E58E89C3F8
SHA-512:	11D0E5606F4A8AAF30B30EDC66288338E5B95AB0C5DAC7D158E7C6619A406502FB396434EFC2CB3FCD3CD29F3460EC0C7F7693E628901A40794110A7438BFEF4
Malicious:	false
Reputation:	unknown
Preview:	<window title="Export to Folder" width="fit" focus="name">. <labelgroup title="Export location:">. <group>. <pathbox name="location"/>. <button title="Browse..." name="changeloc"/>. </group>. </labelgroup>. <labelgroup title="Name of exported folder:">. <edit width="fill" name="name" filter="filename"/>. <check name="addnumbers" title="Add numbers to file names to preserve order"/>. </labelgroup>. <labelgroup title="Image size:">. <radiogroup name="sizeradio">. <radio title="Use original size"/>. <radio title="Resize to:"/>. </radiogroup>. <group width="fill">. <bind attr="enabled" source="sizeradio"/>. <spacer amount="indent"/>. <edit width="4em" name="sizetext" filter="digits">. <bind source="size" attr="title" list="320\|480\|640\|800\|1024\|1200\|1600"/>. </edit>. <label width="fit" title="pixels"/>. <slider min="0" max="6" ticks="7" width="fill" name="size"/>. </group>. </labelgroup>. <labelgroup tit

C:\Program Files (x86)\Google\Picasa3\runtime\favicon.ico

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe
File Type:	MS Windows icon resource - 9 icons, 48x48, 16 colors, 4 bits/pixel, 32x32, 16 colors, 4 bits/pixel
Category:	dropped
Size (bytes):	25214
Entropy (8bit):	4.50689303113866
Encrypted:	false
SSDEEP:	384:dzPA5fXydNt3+BG4DPSYPsGb3paLoJ9OXaWNgWdw0trk8Y:FyPWMBEGbUoJ0LNggtrk8Y
MD5:	16F2DEBD59C4F4B5DAF07BE31D0FCE1B
SHA1:	88FF8C5577A457D3D0363D6D3F18DEAFD74E3DB6
SHA-256:	EC9D4952FA4FEAA1329A70869D7CBB52D8BD4F43C0BB5BEA4E212519C539C73D
SHA-512:	C47E063E6DE4BD8DA58301C079F863C0CCFD7433BD6A4455768F3A14A23D6C4C90CE8E6988ABDB8859F3723BB5CF888CF22D49B2EBA6F189B231D15980DB2C70
Malicious:	false
Reputation:	unknown
Preview:	......00......h....... ......................(.......00.............. ......................h...^"..00.... ..%...'.. .... .....nM........ .h....^..(...0...`......................................................"..."..........................."..."............................................................w...x.....................wp..................p.."""(p...............p..."""""px..............\|.."""""(..................""""""'................."""""""px..............."""""""'..........p.....""""""""p...............""""""""'x.............."""""""""..............."""""""""p.........x....x."""""""'x...............x."""""(.......p..........w.""""w........p\|.........w."".......................x..........p..............x........p................................................p........................................................................p................................................p........................................................................p.....p..........

C:\Program Files (x86)\Google\Picasa3\runtime\filterdesc.xml

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe
File Type:	exported SGML document, ASCII text, with very long lines (398)
Category:	dropped
Size (bytes):	63005
Entropy (8bit):	5.026275000057705
Encrypted:	false
SSDEEP:	1536:6C5DB1L+e91sreSrY4TPOKPjE7jtgUkPDiv3SRzIwOQ30eDvH29roEv:3B1L+e91sreSrY4TPOKPjE7jtgUkPDi5
MD5:	2CDD163F7AB2CEC09D0F6990F2A179BC
SHA1:	596EF286C13DC4A83DA3C89FA70E6D3CCAFEF943
SHA-256:	34373E60269BF1FD6AB0ADEA02E848784F018CBBCD3F2F72B9BA4653E3AC640A
SHA-512:	3CC3D6A361F270111CE1D45690C6C7D8761EC3A09838224ECBEF6B6EB3D9636571C10D44A43EBB6CA9AA5983ECA655E9F070BD9211FC7B18B1C025EC4249120F
Malicious:	false
Reputation:	unknown
Preview:	<filters>. SAVE HISTORY -->. <filter id="save" mode="history" zerostate="none">. <label>Save</label>. </filter>.. CROP HISTORY -->. <filter id="crop64" mode="history" zerostate="none">. <label>Crop</label>. </filter>.. OLD CROP HISTORY -->. <filter id="crop" mode="history" zerostate="none">. <label>Crop</label>. </filter>.. REDEYE.HISTORY -->. <filter id="redeye" mode="history" zerostate="none" persist="1">. <label>Red Eye</label>. </filter>.. RETOUCH HISTORY -->. <filter id="retouch" mode="history" zerostate="none" persist="1">. <label>Retouches</label>. </filter>.. PICNIK HISTORY -->. <filter id="picnik" mode="history" zerostate="none" persist="1">. <label>Creative Kit</label>. </filter>.. ROTATE HISTORY -->. <filter id="rot" mode="history" zerostate="none">. <label>Rotate</label>. </filter>.. DEBUG FILTER -->. <filter id="debug" mode="effect" zerostate="none">. <label>Debug</label>. <tooltip>Fo

C:\Program Files (x86)\Google\Picasa3\runtime\filters.txt

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	107
Entropy (8bit):	4.18353689252713
Encrypted:	false
SSDEEP:	3:eW3D81SQVVv1XKCU4aqXD0AWh0AE3wOq5Dn:eRv1XIqdWh5DOq5Dn
MD5:	585E25BB4A4D3A4B576E701C37812DA2
SHA1:	1896186835F60DC42205AD75766FCAE9B795BFD8
SHA-256:	283404AD7D36459AFF05B33843939158279BD42055080FF47E30D686AD134EA5
SHA-512:	F29FCA1E10D37B9A4CABA67A28504BCF09F601A91D9923D909A65E9EDCB9CFBDE523E2DE2AC8EB804E1F25C2E66E08EA3C8B0C81C510FCC2192A66F2C1AEB2AA
Malicious:	false
Reputation:	unknown
Preview:	DirectoryFilters..windows.winnt.temp.Program Files.Originals..DirectoryIncludes..FileFilters..FileIncludes.

C:\Program Files (x86)\Google\Picasa3\runtime\fliprtl.txt

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	2917
Entropy (8bit):	4.484534593889198
Encrypted:	false
SSDEEP:	24:TVuYJGu30W5NbhWLOpDAOiOvIonOmEwuoalkKoIvKOXgoxSO5X/y9OIMkSOsE8wP:TgYJv30e6JMH0Z17g2bC/HhHG6X0E
MD5:	8A1CA7381CA83F1D564A8009685A6357
SHA1:	A21CBC795D3CA4B42A9B035EA3D02EF5164B04C7
SHA-256:	2A5275E4F3B232C360A8E5C05A4629C046AECC7A94C99AA0294D0168F2D808C2
SHA-512:	F8FE00166654A9D35BE82367D064F59DF56A1EADE3B7C916C070528C9C2BC57B082C53E4A3BF694C4E1E4CC7B1BEFC1E9AC9A8E9C69D6FA74E3C98EAFC4814A9
Malicious:	false
Reputation:	unknown
Preview:	arrows/right.arrows2/down.arrows2/right.arrows2/xdown.arrows2/xright.category/category.thumbui/size.searchcontainer/search_icon.searchcontainer/searchclr.compose_mail/navright_icon.compose_mail/navleft_icon.compose_mail/rtl_icon.compose_mail/ltr_icon.foldermgr/size.gedialog/next.gedialog/prev.globalbuttons/hierarchyon_h.globalbuttons/hierarchyon_n.globalbuttons/hierarchyon_p.globalbuttons/hierarchyoff_h.globalbuttons/hierarchyoff_n.globalbuttons/hierarchyoff_p.globalbuttons/right_p.globalbuttons/right_h.globalbuttons/right_n.globalbuttons/left_p.globalbuttons/left_h.globalbuttons/left_n.globalbuttons/nextpress.globalbuttons/nexthover.globalbuttons/nextnormal.globalbuttons/prevpress.globalbuttons/prevhover.globalbuttons/prevnormal.globalbuttons/rh_p.globalbuttons/rh_h.globalbuttons/rh_n.globalbuttons/lh_p.globalbuttons/lh_h.globalbuttons/lh_n.globalbuttons/lfs_n.globalbuttons/lfs_p.globalbuttons/lfs_h.globalbuttons/rfs_n.globalbuttons/rfs_p.globalbuttons/rfs_h.# Once these are superbutt

C:\Program Files (x86)\Google\Picasa3\runtime\genericlogin.fen

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	894
Entropy (8bit):	4.654127372078749
Encrypted:	false
SSDEEP:	12:6mHXplfI1HLgKkE6cZ70MVSELAF2jHiJsKkE6cKxyp70i5goKQipsyGqFcLuBuEA:64plQpRZQqSELAFpzrpQODiFNuELsbo4
MD5:	DDDFB51243A2D45813B430F4782DEA51
SHA1:	C349ED96546D51063C79C827596B21E04DFF8D73
SHA-256:	C7CAB7405D2FBC905EE54F5B03ABC6352C0C038A6B532DE06135853A0D311FEC
SHA-512:	AB15BF748285596039EF80606AFE0C4C2D4638D3F9C66A7846AE724D6414E8878EFD909486BBC9898619B76F2918AF82BCD18404098F9B9BA18B426A9C32DC9B
Malicious:	false
Reputation:	unknown
Preview:	<window title="Login" width="fit">. <label align="start" width="fill" name="status"/>.. <labelgroup title="Email:" name="emaillabel">. <edit width="fill" name="username"/>. <spacer amount=".2em"/>. <link align="end" size="small" title="Create an account..." url="http://www.google.com" name="createlink"/>. </labelgroup>.. <labelgroup title="Password:">. <password width="fill" name="password"/>. <spacer amount=".2em"/>. <link align="end" size="small" title="Forgot your password?" url="http://www.google.com" name="forgotlink"/>. <group>. <check title="Save Password" name="savepassword"/>. <spacer amount="4em"/>. <label align="end" title="Login secured by SSL" size="small"/>. </group>. </labelgroup>.. <buttongroup>. <button title="Log in" type="accept" name="accept"/>. <button title="Cancel" type="cancel"/>. </buttongroup>..</window>.

C:\Program Files (x86)\Google\Picasa3\runtime\geotag.kml

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 (with BOM) text
Category:	dropped
Size (bytes):	2359
Entropy (8bit):	4.651084611884283
Encrypted:	false
SSDEEP:	48:3aGQtPmh90/ghpnPHNSN6dzGOp1AChRxaTktzhEN:NgmUIbPHkai8A03du
MD5:	90FA0A1EEE2B2A059EFD3A357F91190B
SHA1:	D8734E76B48D1E94A65AA6862DFCC3AA1B482854
SHA-256:	07607174EBCF5B91ECDC55211EFCE3876E68B50273E4D332E20B13AD264A6B40
SHA-512:	CD3E9863642F03864CEBF8F287A80616AD3B270F9ECB4F6D670E72957E3DC90C56E326603FBF4C4F4A3E882603B80B54B08F06BCA3E55D565CEA2A8717112C22
Malicious:	false
Reputation:	unknown
Preview:	.<?xml version="1.0" encoding="UTF-8"?>.<kml xmlns="http://earth.google.com/kml/2.0">.<Document>. <name>My Picasa Pictures</name>. <open>1</open> . %<FOR_EACH_IMAGE>%. <Style id="picasaDisplayNormal_%UID%"> . <IconStyle>. <Icon>. <href>%IMAGE_ROLL%</href>. </Icon>. </IconStyle>. <BalloonStyle>. <text>$[description]</text>. </BalloonStyle>. <LabelStyle> . <scale>0</scale>. </LabelStyle>. </Style>. <Style id="picasaDisplayHighlight_%UID%"> . <IconStyle>. <scale>2</scale>. <Icon>. <href>%IMAGE_ROLL%</href>. </Icon>. </IconStyle>. <BalloonStyle>. <text>$[description]</text>. </BalloonStyle>. </Style>. <StyleMap id="picasaDisplayStyleMap_%UID%"> . <Pair>. <key>normal</key>. <styleUrl>#picasaDisplayNormal_%UID%</styleUrl>. </Pair>. <Pair>. <key>highlight</key>. <styleUrl>#picasaDisplayHighlight_%UID%</styleUrl>. </Pair>. </StyleMap>. %</FOR_EACH_IMAGE>%

C:\Program Files (x86)\Google\Picasa3\runtime\geotag\addmarker.png

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe
File Type:	PNG image data, 27 x 26, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	885
Entropy (8bit):	7.67951744750863
Encrypted:	false
SSDEEP:	24:6oQgkZMVQ5uwyqddnKwcparrQq7b1vBo0ppbzUgL2Bt:6oz4dx9YarrQiXoQwgW
MD5:	A45CC57C1AE0B70A04586AB6A6A47646
SHA1:	CD8DD5ED8953F4E4D3E21F8A8DD86B094DF73A2B
SHA-256:	2DD6DD62A49825BF2A59A41D056E227EF904D3E0C3AC37516A8055B1EB93F4B7
SHA-512:	B548E5AA2BA00A7C1DDFCF5F35A4C4F2221BEAEC6E68F261721DF435176662AADDEEACCA0BBCFF13BD4E41EE46F0C63EF27CF210CD71E50CE4616DD657017692
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR.............F.'.....gAMA....7.......tEXtSoftware.Adobe ImageReadyq.e<....IDATx.V_HSQ.....z.1q.e.H..D....8....T.......'......$.(...`.2..4\..Q...u)$..^....9.Cm.2.{8.s.w....{.?ty.%.tt.D$...Cu. d###...x. :..c.d....&Ciii\w..~x<.,--I...\444...".9.{tt.L.e. .....Jn&j.5..Q4^1.)L.....,F"..:.,...,r:.........V0..i...b..,z{{..<....z...q\|\|.'..3l.mH7.c.....!.L..V........z.......>M..c9.....sX..Jsn..........`\..n\YY.....Y..w..:...}l....Y..`.e..P.`0...Z.....(....np.. ..?.%..7"CQTbdEEE.~=..\..g.D.E0tm...:T=......y...!.\-H.566B{J+.P..P._..........).$....lFww7.'.....B..M.U..'...........ZZZ......N.X#.............M^V..A...lR....6}l.S..bII..q\...B.-.n......=.X.^...=.\.h4...+XVV...j._..@/..Fmm...F).&/..`......z.T..r.u..nW\...egg.d2.a....+&....0%...h.Zddd$..@.....u......999...-..nU4.333e."J@.B..i.j$2..MN...-....5G.....`..?....ZY.......IEND.B`.

C:\Program Files (x86)\Google\Picasa3\runtime\geotag\bottom_image.gif

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe
File Type:	GIF image data, version 89a, 24 x 24
Category:	dropped
Size (bytes):	341
Entropy (8bit):	5.330429487202681
Encrypted:	false
SSDEEP:	6:HQHdUXPzXoFaJjIMxkSSHwvN/Et0IaoZC:HQHWXPHNPiVHwGGWC
MD5:	A7A5CB1FB24E4F3EA7D4FCEB93693444
SHA1:	D668D23BDDCA8A397101A21460C4C342C497C87C
SHA-256:	F5ECD5AAACA795F893BF7358E46B85DC7EA89FF0E9460E607362F5EE764EBC15
SHA-512:	254C6CF19C69F9077BAEC4852354A37C2345DDAF35B500A1E682040FD4D525E3D55CE3E0C04D380754A26FF60D11D52CCF72C0E7EE582EB894B0AC6AAA20780D
Malicious:	false
Reputation:	unknown
Preview:	GIF89a.................................................................................~~~rrr```TTTEEE<<<333'''.............................................................................................!.....!.,..........r@.pH...Hc..j:...T.\|>..)rQ.B.Z#..mF....,m...[..:....N...xp.I..p.H..pH..e..G.}.G....F.......j..........p......t.eA.;

C:\Program Files (x86)\Google\Picasa3\runtime\geotag\close.gif

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe
File Type:	GIF image data, version 89a, 14 x 13
Category:	dropped
Size (bytes):	78
Entropy (8bit):	4.970422410781627
Encrypted:	false
SSDEEP:	3:CSt/QpoESxlUlln6dHw4OB9Izqe:QpoESjUl96du9IJ
MD5:	021997FB0FC16E5AAB4E1EA5E4CF8BB3
SHA1:	3F6E0C57F8F65954ECCE06CA00D1CCD6B257C5C2
SHA-256:	D50B17924289190A39372837A258CE16C8458B63A06B6BA3E6F848274277862F
SHA-512:	4AACDC1F4B0A7B165E21CC88AD61664761F0EC493CF04D1A615F257ACAC1BDFA6B1CF5ED4140E6E059BF895C80CB5CBE1396D6016798F6217FCF4EBE8F1AA597
Malicious:	false
Reputation:	unknown
Preview:	GIF89a...................!.......,................b.S4J....d...c.q.*...F..;

C:\Program Files (x86)\Google\Picasa3\runtime\geotag\geopanelscript.html

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe
File Type:	HTML document, Unicode text, UTF-8 (with BOM) text
Category:	dropped
Size (bytes):	2515
Entropy (8bit):	4.9580375551856815
Encrypted:	false
SSDEEP:	48:wL0pJ8zOzTN1RFBGs/227eTKx3kqjoVNw3HciG8saqBz6lTu:wG86HFFB7YO1jonwq8q6tu
MD5:	75F709C21C24633041E0E21B82E4901B
SHA1:	EA951C4BB65FB72311D38EBE9779CEDA3BF27684
SHA-256:	BDB29D22BB68BF6F16C2252237CA1CA6223921D6103E0A7D026966F4FDB0E8FC
SHA-512:	05EFFF6ABC26E1EC4FB2839DD66498C55CAC2218A46C3957DF6EF168F350E097E0BD7231746FBC98E971680E596F9575F1DB7799647E489D9C9D34CD721147C7
Malicious:	false
Reputation:	unknown
Preview:	.<!DOCTYPE html>.<html xmlns:v="urn:schemas-microsoft-com:vml">. . Copyright 2009 Google Inc.. All Rights Reserved.-->.<head>. <meta http-equiv="content-type" content="text/html; charset=utf-8" />. <title>Google Map for Picasa Locations</title>. <link rel="stylesheet" type="text/css" href="picasa_infowindow.css" />. <style>. html,. body {. width: 100%;. height: 100%;. margin: 0;. overflow: hidden;. }. #map_canvas {. width: 100%;. height: 100%;. margin: 0;. border: 1px solid #979797;. }. #errorDiv {. font-color: black;. font-family: arial;. font-size: 12px;. position: absolute;. top: 10px;. left: 5px;. width: 98%;. height: 200px;. }. #searchErrorDiv {. font-color: black;. font-family:Arial;. font-weight:bold;. font-size:12pt;. text-align:center;. position: absolute;. bottom: 0px;. left: 0px;. right: 0px;. height: 100px;.

C:\Program Files (x86)\Google\Picasa3\runtime\geotag\geopanelscript_v3.html

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe
File Type:	HTML document, Unicode text, UTF-8 (with BOM) text
Category:	dropped
Size (bytes):	2251
Entropy (8bit):	4.9366373377080635
Encrypted:	false
SSDEEP:	48:wZpJ8zOzTN1RFBGs/227yzTKxDWhNCciG8saqBz6FzTu:wF86HFFB7yHOab58q6Nu
MD5:	D4B60735C7E36B68396BCDF4D633814A
SHA1:	51E9C0F16FDCE38AFA44E4495FFE3373B33B8C5E
SHA-256:	A31D2F24DEE6CEADF5A65492C7DDA4DBF8C0723D12BB49A9A5FF13BB0B7B9432
SHA-512:	B03EB701CC3EF0BA34CA034027E63B91F8AC90EA90428516DA09F1EFE75FF99FE95C208410E263A8D9E994CB81C65234F995DD37E43BBEBAD3A400F140BB1557
Malicious:	false
Reputation:	unknown
Preview:	.<!DOCTYPE html>.<html xmlns:v="urn:schemas-microsoft-com:vml">. . Copyright 2013 Google Inc.. All Rights Reserved.-->.<head>. <meta http-equiv="content-type" content="text/html; charset=utf-8" />. <title>Google Map for Picasa Locations</title>. <link rel="stylesheet" type="text/css" href="picasa_infowindow.css" />. <style>. html,. body {. width: 100%;. height: 100%;. margin: 0;. overflow: hidden;. }. #map_canvas {. width: 100%;. height: 100%;. margin: 0;. border: 1px solid #979797;. }. #errorDiv {. font-color: black;. font-family: arial;. font-size: 12px;. position: absolute;. top: 10px;. left: 5px;. width: 98%;. height: 200px;. }. #searchErrorDiv {. font-color: black;. font-family:Arial;. font-weight:bold;. font-size:12pt;. text-align:center;. position: absolute;. bottom: 0px;. left: 0px;. right: 0px;. height: 100px;.

C:\Program Files (x86)\Google\Picasa3\runtime\geotag\mm_20_green.png

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe
File Type:	PNG image data, 12 x 20, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	3312
Entropy (8bit):	7.886759369227145
Encrypted:	false
SSDEEP:	96:fSDZ/I09Da01l+gmkyTt6Hk8nT3G8XIyE:fSDS0tKg9E05TW8X3E
MD5:	073AAFF0F69D376958813A4124CFC006
SHA1:	2474FAEB60B160B968BC9B5BFEF78F816DD21A15
SHA-256:	5A706BBDEAFB0C52BD7FBE95BE662B2AA7D6D60281BE0945B9C6E6868C55257F
SHA-512:	DC08CF648419067A87574753D13405CF53750A8E0DBA4CC5D8BD1669FF8590333F83A1877032E87AF8D608DA2AE9539EF36766A860D3629888A4A7CC00E550E2
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR.....................pHYs................OiCCPPhotoshop ICC profile..x.SgTS..=...BK...KoR.. RB....&!..J.!...Q..EE..........Q,......!.........{.k.......>........H3Q5...B..........@..$p....d!s.#...~<<+".....x.....M..0.....B.\.....t.8K....@z.B..@F....&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH.............0Q..)..{.`.##x.....F.W<.+.....x..<.$9E.[.-q.WW..(.I.+.6a.a.@..y..2.4..............x.....6..._-..."bb....p@...t~..,/...;..m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<.....$.2].G......L.....b..G.......".Ib.X..Q.q.D...2.".B.).%..d..,..>.5..j>.{.-.]c..K'.Xt......o..(...h...w..?.G.%..fI.q..^D$.T.?....D...A....,.........`6.B$..B.B.d..r`)..B(...*`/.@.4.Qh..p...U..=p..a...(....A...a!..b.X#......!.H...$ ..Q"K.5H1R.T UH..=r.9.\F..;..2....G1...Q=...C..7..F...dt1......r..=.6...h..>C.0....3.l0...B.8,..c."......V.....c.w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.XH,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,

C:\Program Files (x86)\Google\Picasa3\runtime\geotag\mm_20_red.png

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe
File Type:	PNG image data, 12 x 20, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	585
Entropy (8bit):	7.3001128207335215
Encrypted:	false
SSDEEP:	12:6v/76Lj99do2R9cDSMC4DZsDapNP5LLpCI4dYDB6UZ:xJ9cDTD8apNxHbIYDVZ
MD5:	F286C1D8CC7F0E2357AB04E4B4E66E4D
SHA1:	982C4479FA72FB8625B2453F7DA1221F415378F5
SHA-256:	0930CF5506595FCE5D805EDEC6341CDA87908A44B62DDCE19C987EF92769AA09
SHA-512:	3A97BBBC943927323DC1828E0ACA0BF158EA5F6DD8BBAB1FD6E81A2AA181CF5665D5FC645955528BC362E5B0B25DDE58D7DE197CB0F489545557A82F2F07660C
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR.....................gAMA....7.......tEXtSoftware.Adobe ImageReadyq.e<....IDATx.bd@.V@...P.= ^....10..$ ......IP............. fF.0.$.%..........`.......2L.l...; ..-..0U....(...P...nV6..1Y.O.~0..............P.``......@.?...r.,. .`...}....N..b..G.....c.g.d0....dA..........?.X..H. q.......\|b....j..p........:P... ........Qq.2...-..H..aW....... ..Pz....\|.....W..qY......!..9../..xe@.....A._...^..b.B.@...?..P{..H......n.(...#...iv.PH..bV..f4.7~..........w.S....@.x..a.<...M.^..../......a ..../..Sb4...>...b>tI.,.@.....@5..............I.....$.. _......IEND.B`.

C:\Program Files (x86)\Google\Picasa3\runtime\geotag\mm_20_shadow.png

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe
File Type:	PNG image data, 22 x 20, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	436
Entropy (8bit):	7.256940442228976
Encrypted:	false
SSDEEP:	12:6v/7lcLTI8VkwpUi4VdcBZ6hyFsGtTWbipt7:Pj2k4VdcBAhF6Tiiv
MD5:	F77B225F35020617F2748D004158AC4C
SHA1:	2D4F1D1BD47038E9E29FE7B3F9AEDA8263456CD1
SHA-256:	406736A3BF2105B8774876DC50EDED3D78E7CECFA5821041F24F177E769885E2
SHA-512:	800EEB0408261F3013D560EFAD23AC7D93DD086BBCA63A9B47A972A03185BD03D2E30A7247047F35FEFA3C61B35300715B9A492E698EB62187F4E414F6E4FDE5
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR..............\|.0....gAMA....7.......tEXtSoftware.Adobe ImageReadyq.e<...FIDATx..MK.@..3..VDA.z(.A...O..]...R.?.i..#.. Mj...x.M.}fvv.J.1i.J....q...d...\|...wWXR.:..).s..-.,.cJ..Cq.....q,...:/.=..+.M.....W.1.HS.V.c..Rn.)x..`\.q..`.....=.m.2\|2..x.@aN..}..].I..Y..$..q..8c.{`.m.&+XS-....qtr.mq.......\..........=(.5../,.8......'.f.E...)..y.......U.A]Wd<i.r..9.v........3p.-..M.....c.N.......h.w.&.Y.....IEND.B`.

C:\Program Files (x86)\Google\Picasa3\runtime\geotag\picasa_geopanel_bin.js

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe
File Type:	ASCII text, with very long lines (840)
Category:	dropped
Size (bytes):	18132
Entropy (8bit):	5.2720105759327645
Encrypted:	false
SSDEEP:	384:sP6q67Dz4FqTrTNCG0V7yV7ymW3tfzpr32zYrpuskAmual:syBsqYYYjrdrppMN
MD5:	3AEF4BA567BE2312E12789DA02EEB39C
SHA1:	A33DCE703E6206A6204A5EF54F0CD61953740CB3
SHA-256:	CBEBCFEC4CD30DA7FB9188F1917C8EEFA96531B6F6E0A3E351956D544C7B0FC8
SHA-512:	C3273963DCBC274884E4691455698C367DF34008839D3EAA89B156E34FE215BCFBD5C641B43B33AF4A06BBF3F70F3D5DE484C08BD0666106C33C9C5CE1D20442
Malicious:	false
Reputation:	unknown
Preview:	var a,picasaInfoWindow$style=function(b,d,e,c){this.bottomImage_=b;this.bottomImageSize_=d;this.styleClass_=e;this.infoWindowOffsetX_=c;this.browserAdjustment_=0;var f=navigator.userAgent.toLowerCase(),h=5;if(f.indexOf("macintosh")>-1)h=4;if(f.indexOf("msie")>-1&&f.indexOf("opera")<1)h=0;this.browserAdjustment_=h},picasaInfoWindow$window=function(b,d){this.doc_=b;this.style_=d;this.infoWindowWidth_=180;this.isIE_=this.visible_=false;this.autoPanning_=true;this.infoWindowOffset_=new GPoint(0,0);var e=.navigator.userAgent.toLowerCase();this.isIE_=e.indexOf("msie")>-1&&e.indexOf("opera")<1};try{picasaInfoWindow$window.prototype=new GOverlay}catch(err){}a=picasaInfoWindow$window.prototype;a.initialize=function(b){this.map_=b;this.infoWindowDiv_=this.createInfoWindowDiv(this.infoWindowWidth_);this.bottomImageDiv_=this.createInfoWindowDiv(this.style_.bottomImageSize_.width)};.a.createInfoWindowDiv=function(b){var d=this.doc_.createElement("div");d.style.position="absolute";d.style.width=b+"p

C:\Program Files (x86)\Google\Picasa3\runtime\geotag\picasa_geopanel_bin_v3.js

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe
File Type:	ASCII text, with very long lines (724)
Category:	dropped
Size (bytes):	22008
Entropy (8bit):	5.248251579531508
Encrypted:	false
SSDEEP:	384:r7Yc9LxUcMxJlztffyIGsfjXiryIyhCWkwx6Sf9uee7Aaf:rEuUT1fjX53p6Sep
MD5:	06E81F997DE305886014077C255E8AC4
SHA1:	E820115E3AB3F67F9456242BA1A52DA0F469ABD1
SHA-256:	8ACE64039582B54275CD2417E5477DB6EDA894DE5B7191731299C9377027A7BA
SHA-512:	C3E167F62B163B9CCA641CAFC1F4FBE6DAADA0B7A0F232E59B95B67C204D48322536FA3459533BCEC15E7DF5E745D3CC0BE141BCC65B5B34CD487BE2F7B15CC8
Malicious:	false
Reputation:	unknown
Preview:	var picasa=picasa\|\|{};picasa.initLog=picasa.initLog\|\|function(){picasa.log="undefined"!==typeof console&&null!==console?function(a){window.console.log(a)}:function(){}};picasa.initLog();.var picasaInfoWindow$style=function(a,b,d,c){this.bottomImage_=a;this.bottomImageSize_=b;this.styleClass_=d;this.infoWindowOffsetX_=c;this.browserAdjustment_=0;a=navigator.userAgent.toLowerCase();b=5;-1<a.indexOf("macintosh")&&(b=4);-1<a.indexOf("msie")&&1>a.indexOf("opera")&&(b=0);this.browserAdjustment_=b},picasaInfoWindow$window=function(a,b){this.doc_=a;this.style_=b;this.infoWindowWidth_=180;this.isIE_=this.visible_=!1;this.autoPanning_=!0;this.infoWindowOffset_=new google.maps.Point(0,0);var d=.navigator.userAgent.toLowerCase();this.isIE_=-1<d.indexOf("msie")&&1>d.indexOf("opera");this.infoWindowDiv_=this.createInfoWindowDiv(this.infoWindowWidth_);this.bottomImageDiv_=this.createInfoWindowDiv(this.style_.bottomImageSize_.width)};try{picasaInfoWindow$window.prototype=new google.maps.OverlayView}ca

C:\Program Files (x86)\Google\Picasa3\runtime\geotag\picasa_infowindow.css

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1242
Entropy (8bit):	4.8278194125418095
Encrypted:	false
SSDEEP:	24:samVStYzisG7Y9zqMCFUSLSngzqDQFz9gUSQBZACzPUSQBKj0ngztx6zSzbj:lmVSyfG72OLpODQFpyQBZACxQBKbGm3j
MD5:	4D187698F15D8985A0B4D3DC68DF06C5
SHA1:	359BD656A2E65E0A496D1FF6AB4C7BDD1D379398
SHA-256:	4D51D019BAFC62F3ABFACAE92ED6318F0EB004F35B91F936BE8B515D52C74D55
SHA-512:	253D8CE2993CB5F267416587BA9E2E448C77409D6790E5DD53717033824F857E8D71867EFE98404109391E9C7603D751D89E9B66AE3BA7955E210A801863DE49
Malicious:	false
Reputation:	unknown
Preview:	a {. text-decoration:none;.}.a:link {. color:#4488ff;. text-decoration:none;.}.a:visited {. color:#4488ff;. text-decoration:none;.}..a img { border: none ; }...info_window_bottom_image {. background-color:#ffffff;. border:1px #cdcdcd solid;.}..info_window_title {. /* background-color:#aaaaff;/ / default white background for now */. font-family:Arial;. font-weight:bold;. font-size:10pt;. border-bottom:1px solid #bbbbbb;. text-align:center;. white-space:normal;.}..info_window_close {. float:right;. padding-right:6px;. padding-top:1px;. border:0;.}..info_window_footer {. font-family:Arial;. font-style:normal;. font-size:11px;. font-weight:lighter;. border-top:1px solid #bbbbbb;. text-indent:5px;.}..info_window_footer_button {. font-family:Arial;. font-style:normal;. font-size:11px;. font-weight:normal;. margin: 1px;. padding:1px;. border:1px solid #bbbbbb;. text-align:center;. cursor:pointer;. width:92%;. white-space:normal;.}..info_window_thumb {. t

C:\Program Files (x86)\Google\Picasa3\runtime\gpuploader_about.fen

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1003
Entropy (8bit):	4.706534373620304
Encrypted:	false
SSDEEP:	24:mloGijhJCR42iKDDeomWlcPnXGDZZnPsE:1GiRvKDTmgcPnXGDZdPsE
MD5:	B3E3743AA4A8FB243C64DE119795DEFA
SHA1:	0B5C0998CB90E3578D607BBD75B43FE2E682B2C3
SHA-256:	A12D19326CB032BEE6F8075213F7C1700F029ED99FEE216909CD6CB680A876A2
SHA-512:	128C9E643BB58E2625BF44EAC1015966F0CDD0C3BBDD94583ED14480D616290C704939311433437084BF710FB79E9D403EC7293D41B5BFC908E19BBBE0988382
Malicious:	false
Reputation:	unknown
Preview:	<window name="window" title="Google Photos Backup" width="35em">. <group layout="column" width="fill">. <group layout="row" width="fill" height="fit">. <group layout="column" align="start">. <image width="48" height="96" name="about_image" align="center"/>. </group>. <spacer amount="2em"/>. <group layout="column" width="fill">. <label title="Google Photos Backup version %1$s" text-align="start" width="fill" name="version" fontweight="bold"/>. <label title="Copyright 2015, Google Inc. All rights reserved." text-align="start" width="fill" name="trademarks"/>. <label title="This software is based in part on the work of the Independent JPEG Group. This program is protected by U.S. and international copyright law." text-align="start" width="fill" name="notices"/>. </group>. </group>. <spacer amount="2em"/>. <buttongroup align="end">. <button name="okbutton" type="accept" title="OK"/>. </buttongroup>. </group>.</windo

C:\Program Files (x86)\Google\Picasa3\runtime\gpuploader_advoptions.fen

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	686
Entropy (8bit):	4.616421938040835
Encrypted:	false
SSDEEP:	12:mdxoMndL+Q/K+iXOAoKQafhKZv8pDNBygu8F5R4t5lKg85pLsAFhGAGGlA6gr0d+:md1dtTgKQDbrFP4Di5PfXkuE
MD5:	2E7F6410ECAB77A533E35F8478B8E9C9
SHA1:	8AB500AE43A92A5413B222CA1C099FFCE3D319D4
SHA-256:	F2B9268AACC88BFCDA7B18B1254723D4949821F50DF3580BABAAAB2CA62AAE29
SHA-512:	B4977CFFDDC3D9C41B685285A0F143D98618AA41E103E401133C18922793523F3AC469F59B1F29820B58396BEEC70A066F0AA90F9DEEF6F62AD464CF71F2451F
Malicious:	false
Reputation:	unknown
Preview:	<window name="adv_setup_window" title="Advanced Settings" width="35em">. <group name="more_options" layout="column">. <check name="local_folder_chk" title="Also copy photos/videos from cameras and storage cards to"/>. <group>. <spacer amount="indent"/>. <browse name="local_folder" title="Browse..." prompt=""/>. </group>. <spacer amount="2em"/>. <check name="send_to_google" title="Send anonymous usage statistics to Google."/>. <spacer amount="2em"/>. <buttongroup>. <button name="okbutton" type="accept" title="OK" align="end"/>. <button name="cancelbutton" type="cancel" title="Cancel" align="end"/>. </buttongroup>. </group>.</window>.

C:\Program Files (x86)\Google\Picasa3\runtime\gpuploader_confirm.fen

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1044
Entropy (8bit):	4.604025236055417
Encrypted:	false
SSDEEP:	24:mloGFjhJCRgnKDDZdWAFd31ZQQK9GZZnPWXkVE:1GFLKD1dlF8QPZdPWqE
MD5:	319FFE78FDEAB40CEC894A71663683FE
SHA1:	A1F2371BFB2849469716FADEC2B60BB45A5D4708
SHA-256:	68BDAE56AB20BAE6F97C929388F275BB9ADEA1A5E4B7BF1770F97C4C3ECDF872
SHA-512:	C0C684AF732D27B6DBBFA7C592C6B3D26243ECC051E5FAE0424464498CF1A152DCCE66F8B2862F87AED510087EA09D171CC3701DF95ECD7000F860538E02EB97
Malicious:	false
Reputation:	unknown
Preview:	<window name="window" title="Google Photos Backup" width="30em">. <group layout="column" width="fill">. <group layout="row" width="fill" height="fit">. <group layout="column" align="start">. <image name="confirm_icon" width="72" height="72" align="center"/>. </group>. <spacer amount="2em"/>. <group layout="column" width="fill">. <label name="confirm_header" title="Bold and large header text" text-align="start" width="fill" height="1.2li" fontweight="bold" win_fontsize="24" mac_fontsize="14"/>. <label name="confirm_text" title="Normal confirmation description text" text-align="start" width="fill" height="2li"/>. <label name="confirm_optional" title="Optional text to supplement description" text-align="start" width="fill" height="3li"/>. </group>. </group>. <spacer amount="2em"/>. <buttongroup align="end">. <button name="okbutton" type="accept" title="OK"/>. <button name="cancelbutton" type="cancel" title="Cancel

C:\Program Files (x86)\Google\Picasa3\runtime\gpuploader_debug.fen

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1379
Entropy (8bit):	4.5412236529056775
Encrypted:	false
SSDEEP:	24:mRCfXg9F002wCfhXJyOIyFFedL2O9Z2sNAnYEJbaD/fG:kgZfhZRodSO9Z2sNAnYEJbO+
MD5:	79DF737E3ED81C3268E6BC224D865DB6
SHA1:	340B71AD7E0223D65BE46C44F62E75A5A37D5AEC
SHA-256:	EAAD4C6FD84B0FC4D8DBC8C01F84C439838790DA29004FA4FEFA535763640775
SHA-512:	A2E4E6614BE4A9BD26A3190C03E704C9B6E7FBECA1142F909C5DC0372F72903117CFD2BAAAA7A3D12FAE0242D4CA77A7BED78B5AD58C133273F195E5BCBA476C
Malicious:	false
Reputation:	unknown
Preview:	<window name="window" title="Backup Debug Window" width="60em">. <tabs name="tabs" width="fill">. <tab name="trace_tab" title="Trace">. <list name="debug" max-width="fill" height="20li" scroll="v">. <column name="debugcolumn" title="Debug" width="fill"/>. </list>. <spacer amount="1em"/>. <radiogroup name="enable_upload">. <radio name="realserver" title="Backup to real server"/>. <radio name="mockserver" title="Use mock server"/>. </radiogroup>. <spacer amount="1em"/>. <buttongroup>. <button title="Simulate Mock Server Error" name="simulate_error"/>. </buttongroup>. <separator/>. </tab>. <tab name="queue_tab" title="Queue">. <list name="queue" max-width="fill" height="fill" scroll="hv">. <column name="type" title="File Type" width="0"/>. <column name="size" title="File Size" width="0"/>. <column name="date" title="Date" width="0"/>. <column name="name" title="File Path" w

C:\Program Files (x86)\Google\Picasa3\runtime\gpuploader_download.fen

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe
File Type:	exported SGML document, ASCII text
Category:	dropped
Size (bytes):	1330
Entropy (8bit):	4.56217625568955
Encrypted:	false
SSDEEP:	24:mlokjCbqVmH/DHEBwHlN154ZmvAg6SMElgvX21yKxZE:1kuIUrHEBwXcWAgLMEl0G8KxZE
MD5:	0AEE6234C6CF3AC8F53ADF5EF3D43F5B
SHA1:	EF7D23388F963E8D72A3D9407257F1D7CAE341DB
SHA-256:	A105F25A835F0A5B725D9498E14DA715D216256550EE6AFEEBC43FA6AA353F8B
SHA-512:	ABDC5AA0646CF1CC1F0440C40AB6B35F25667F98516490ED6A1F33000DEF756DF8FDA8A33C703BA8A41FAF21D7FDC273E170C510BCE0CEBF920340ABC46F47F6
Malicious:	false
Reputation:	unknown
Preview:	<window name="window" title="Google Photos Backup">. <group layout="row">. <image width="72" height="72" name="main_image" align="start"/>. <group layout="column" win_width="24em" mac_width="30em">. <label name="device_name" fontweight="bold" win_fontsize="24" mac_fontsize="16" title="Back up photos from %1$s?" width="fill" height="1.5li"/>. <label name="action_prompt" title="Save photos and videos from this device to Google Photos" width="fill"/>. <spacer amount="3em"/>. <group layout="row" width="fill">. <group layout="column">. <spacer height="fill"/>. <button name="never_btn" title="Never"/>. <spacer height="fill"/>. </group>. <buttongroup default="accept">. <button name="once_btn" title="Just once" type="accept"/>. <button name="always_btn" title="Always"/>.. To allow the ESC key to cancel (like hitting the system close window control) we. need to have a cancel

C:\Program Files (x86)\Google\Picasa3\runtime\gpuploader_file_errors.fen

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe
File Type:	exported SGML document, ASCII text
Category:	dropped
Size (bytes):	765
Entropy (8bit):	4.656313387183674
Encrypted:	false
SSDEEP:	12:mHq6oGthjCbmoKjLpdl6zaBT9muyRBg/B1H9PCe1UeyjYbl/FOrOB+XUlAJpGAuO:mHRoGthjCbetdOat9mDcBvse5h3B+Xth
MD5:	A9912CDF7B9CA671DC15AE6ADF5914CF
SHA1:	50B0971ED2F78D93E85F65019B63BD6C61003B3A
SHA-256:	46D1D7FA106D4EE639D72E7174CE7FFF3191996A6BD2FE4D7B798787C63BB56A
SHA-512:	8A213B3F8A337DB26AA0A62BED3B562228D54B434C968D9D23E3C2BD0D90E51742208A4CC30A32A3F72253080449D933F93A1086B7DC4BE9E7B2F8CA31179FFF
Malicious:	false
Reputation:	unknown
Preview:	<window name="file_errors" title="Google Photos Backup" width="25em">. <group layout="row">. <image width="72" height="72" name="main_image"/>. <group layout="column" width="25em" height="2li">. <label name="error_label" width="25em" title="Couldn't back up these files:"/>. <spacer amount="1em"/>. <list name="error_list" width="fill" height="4li" scroll="hv" header="hide">. A zero width in a horizontal scrolled list should auto-size to the content -->. <column name="namecolumn" title="Name" width="0"/>. </list>. </group>. </group>. <buttongroup default="accept">. <button name="accept" type="accept" title="Try again"/>. <button name="cancel" type="cancel" title="Dismiss"/>. </buttongroup>.</window>.

C:\Program Files (x86)\Google\Picasa3\runtime\gpuploader_filestatus.fen

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	3021
Entropy (8bit):	4.648577624197659
Encrypted:	false
SSDEEP:	48:JqH54kHbEzKqTr46gJiSDE31g0+J2qAZE:UCNrmY+3
MD5:	7B4EAA7739B776EF79DC3ADF33408E68
SHA1:	95ABD48DD1A4CD8537F36C4685F2B7CFF04E9414
SHA-256:	2BAF21F42DF0C3108D68BFB632DAB1677E95B7CE7CF248F53D1CEFEBA12DA87C
SHA-512:	2E5E3DA70B4C1B62C33ACE9A3640DEFBC445D39696533CB54A6D3F3626E9CCBA9629151D84BCE4B85AD7A21553E3025B8E29B2ED36E5FD1085E4511A07C4B475
Malicious:	false
Reputation:	unknown
Preview:	<window name="window" title="Show File Status">. <group layout="column" width="fill">. <group layout="row" width="fill">. <label name="path_prompt" title="Full Path to Image/Video File" />. <edit name="path" width="28em"/>. <button name="get_status" title="Get Status" type="accept"/>. </group>. <spacer amount="1em"/>. <separator width="fill"/>. <spacer amount="1em"/>. <group layout="row" width="fill">. <group layout="column" width="8em">. <label name="file_status_label" title="Status :" text-align="right" width="fill"/>. <label name="size_label" title="Size :" text-align="right" width="fill"/>. <label name="mime_label" title="Mime Type :" text-align="right" width="fill"/>. <label name="create_label" title="Create Date :" text-align="right" width="fill"/>. <label name="write_label" title="Last Write :" text-align="right" width="fill"/>. <label name="type_label" title="Type :" text-align="right" width="fill"

C:\Program Files (x86)\Google\Picasa3\runtime\gpuploader_instructions.fen

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	943
Entropy (8bit):	4.597305606339744
Encrypted:	false
SSDEEP:	24:m2okjPziA9owcD1MKxhfxOIMKRvw0OaKXPPsZ2g:YkizwQ1MKTfxhMKapaK/PsZd
MD5:	1A5E253D56543050173857BB42E4365C
SHA1:	D1E46DA8A45604FDDC0CB23644C807D6DCA8E7C2
SHA-256:	FFB035CD6820665EFC587995579914D173146963FC36DF7D6886804D525D30D8
SHA-512:	DB750B909AAA67620C190AA98A004FE357D5DF6AD7893ECF65E2BAF923BA712D137E61DC7DCFFACE343C24FAC9F20ECDC24B056C5CB88B3D6C2B457774F156F8
Malicious:	false
Reputation:	unknown
Preview:	<window name="instruction_window" title="Google Photos Backup">. <group layout="row" width="fit" height="fit">. <spacer amount="1em"/>. <group name="instruction_group" layout="column" width="20em">. <label name="instruction_header". title="Google Photos Backup is a go!". fontweight="bold" win_fontsize="24" mac_fontsize="16". width="fill" height="1.5li" align="center" text-align="center"/>. <label name="instruction_label". title="Click the Photos icon to pause, change preferences, or check on progress.". width="fill" height="3li" align="center" text-align="center"/>. <image mac_width="336" mac_height="219" win_width="335" win_height="201" name="instruction_image" align="center"/>. <buttongroup align="end">. <button name="okbutton" type="accept" title="OK"/>. </buttongroup>. </group>. <spacer amount="1em"/>. </group>.</window>.

C:\Program Files (x86)\Google\Picasa3\runtime\gpuploader_manage_devices.fen

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	2522
Entropy (8bit):	4.545965585684963
Encrypted:	false
SSDEEP:	48:tnBDk5y5MsdEXlxwYBhQGdDGZqWGQ3GzUqRT3GZHIE:VBQnuukGk
MD5:	5806D9DCD332C2E04CE55EE5ACA65C98
SHA1:	95F8B8297E73B03098F5AA256D6219186BDBEF6F
SHA-256:	1CA4C6B0BE95D974AAB5C2C87A8D7E6874998B836947C9B374543CD3A20E76A7
SHA-512:	63D6F69BADD2BF0717166A8BFF9DAD9DAB13AFCF0C2007AE676FE48DF1D9AEE684505F0AA24FA0E70970F5402126DD76040A734F757F1B994D8F5E397FE36883
Malicious:	false
Reputation:	unknown
Preview:	<window name="manage_devices" title="Manage Devices" width="fit">. <group layout="column">. <label name="device_list_description" width="fill" height="4li". title="You can choose to always import or ignore photos and videos from listed devices. You'll get prompted each time for devices that don't appear in either list.". win_fontsize="22" mac_fontsize="14"/>. <spacer amount="2em"/>. <group name="attached_devices_group" layout="row" width="fill">. <group layout="column" width="fit">. <label name="attached_devices_label" title="Attached Devices" fontweight="bold" width="fill"/>. <list name="attached_devices" max-width="fill" height="6li" scroll="hv">. <column name="devicecolumn" title="Device" width="fit"/>. <column name="namecolumn" title="Device Type" width="fit"/>. <column name="uniquecolumn" title="Unique Identification" width="fill"/>. </list>. </group>. <group layout="column" width="fit">.

C:\Program Files (x86)\Google\Picasa3\runtime\gpuploader_onboard.fen

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	2182
Entropy (8bit):	4.684086474308031
Encrypted:	false
SSDEEP:	48:9GFsqm/O3Cu3UBiI14MixN7N9xAkl4dJgkxZE:9GqVuG912Nl
MD5:	9A635D3DF90598275CBF44C5ED477A12
SHA1:	F245792A579DF18D2DB5F3DFE7C9BF4AE90E6B52
SHA-256:	0D80F6B01D965E744DD314A5A64E6D1B7829D0F1229EFC27BC90676498A0E123
SHA-512:	559132483F7395E7E0AF44F8B4431CCE46C377018F495B5B4D70953A76579ADB42F21F850D1A5D94B8F4E46843FC26ACB85D7B2DA11E4CCB7CEFAF3CB0D51279
Malicious:	false
Reputation:	unknown
Preview:	<window name="onboard_window" title="Google Photos Backup" width="30em">. <group layout="column" width="fill">. <group name="onboard_desc" layout="column" width="fill">. <label name="select_text_1" text-align="left" title="Choose backup sources" fontweight="bold" width="25em"/>. <label name="select_text_2" text-align="left" width="fill" title="Google Photos automatically backs up photos and videos from selected sources to your Photos library."/>. <spacer amount="1em"/>. </group>. <list name="watched_folders" width="fill" height="5li" checkboxes="true" scroll="v" header="hide">. <column name="watch_column" type="check"/>. </list>. <buttongroup align="end">. <button name="add_folder_btn" title="Add..." mac_minsize="120,20"/>. </buttongroup>. <label name="upload_size_label" title="Photo size" fontweight="bold" width="fill"/>. <radiogroup name="upload_size_group">. <radio name="free_size" title="High quality (free unlimited storage)" w

C:\Program Files (x86)\Google\Picasa3\runtime\gpuploader_pinwheel_72.png

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe
File Type:	PNG image data, 72 x 72, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	2682
Entropy (8bit):	7.8926169257534395
Encrypted:	false
SSDEEP:	48:9/6BFO6ueuVShxNxGKhAzV9WYZeER/bPqIayHwduFpkAzzXi2kMGbv:9SBF5u9ShxNx8uVERxHxWAS2kBL
MD5:	A4CF8181AC41B8385CADF99EB31E7A40
SHA1:	D8A91CB24C732E59FF768EDD5E27B30839ED2ED2
SHA-256:	550994CE091E70C46C769DB5E657F4C83B18DEB126E0D84C0FF8F67E2B166CFC
SHA-512:	3299E6DDA4B46F0B2A5A9EBC6F7EE61103CEC2721B6B52C9E222BDB4FAC5442FA8AD9339AFD4D8C99C1E13ABF419CC435090FEA3CB383C90E7369A5272F6883D
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR...H...H.....U.G....pHYs.................tEXtSoftware.Adobe ImageReadyq.e<....IDATx..kl.W...3.....BI..IJ.B<..T..Tm.G-."...T\|..GQK..S.@.TD.%..$$.... (.M..J.....;iI.8.C.Mvwf<s..9;....]O...jg..x....?..5...G.......9.,].......z..2..=...VP.(...G.sg6..?....~...j.W&..(.!+.2.A..ae.R.M..OA:.....H.)H.....){....&../...XRE...R6.a.O....cm.N.....VA..acIa.Z.)...iJ..))S."...$..\|s!e..[..........]..x4.s.>..4.....5.k.c.u.$?.2$N@.....H.@\|..Y..@.,.JNK?.~..s..H....../.s."s....O.KFv..O...s..:....U..~.~.n.x....pz.K.e...Z.E'7.t..].%p.\HN!.G.n.(8g.....7f.....p.S../.......VBb.d.Ub.....g.....'6.t.r ...a...'7..$.tx.!U....nKY8....#.. .G)..v.. ..R....7j.l..9.:.'3..Ol..z.1..;.p.........i.3^.m..9.........P).:SL...9..DU...!Ei.Y5^..z.Y1......O...a..../p.U..w.(....G.......'c...=...c!X.\|..&...)H....Bv...........z..@..Px.....4.D...T..z.&..p[..Q..4...>..l.....Z....O..!..q.B&..........o!%......k.s..P.......c.'<G.!.o.)..0bOB...3.2.n(...d.G../....c...kQQ>.

C:\Program Files (x86)\Google\Picasa3\runtime\gpuploader_pinwheel_72x2.png

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe
File Type:	PNG image data, 144 x 144, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	4464
Entropy (8bit):	7.91120366637601
Encrypted:	false
SSDEEP:	96:MSB2BtrD03cyAr1pWrHedd2uSj9Z+q1O3BsqjK61:MS8VI3cyc1oqHSj9Aq14Bsqe61
MD5:	9C88914270B030664CF2761B7B6A2722
SHA1:	30A4DC06A419742E2ADB22CB350934286E21FE29
SHA-256:	47764B8336AE7F654EC36CC2CEAA08314E349F000539AEB7BEAF1AB1246CBBAA
SHA-512:	6053648EDFAF8AE414986ECBF4E831F1980C1C3640E1CE1C9F51BD4669B0E71BD5A3BC82950C6F457F6D63F8BCEE88D4C16135739C4FA6A93DD1A8A81C8F208E
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR..............F.....pHYs.................tEXtSoftware.Adobe ImageReadyq.e<....IDATx...[..U...szfs.bA.....FK.\|..%X.....DM.R\|.B..!.,PP.....y......J...4.%.$...r..d7.$...\v..................v...}.t.,....G.A........@@8..........Fd.........".~W...=.{D......>.99{......m.........'/.M.Y.'..s.@D.Hj@..aBD...v..! D...M.RD....`..~....C:..D..<...PjD..!...j....3..Q....O..".$.4....$B@...!B@Y...c....)..D{.};...J.A.........'......s.s....ID.h.el..! .r.....!B@.,c..D.(.2&.h.\..!.~..XD.G....OEG..r...P?..Xd...v......@....gb......_\!f...%k...........{..?Z..2.\......c..+....(..%.z..o...g..z....,...i.w..N4..VcS...+F@...>.... ../..>.[Mr. ..._.o.......K....Y..%u.........-;..\1..b.:2;7u.L..fl.%.zp..J..I.n....P...kjP..h...Q7.........i.g....Ly3.jk..j.D.A<....d&O...^.&...I@.Gj.....n<`...G.<.Sjy.Y."q@>dH.5....O..Yx..OZ3...!..<M&;.k<D..~..:....0.O..>e.xv......U.....%Q.L..X.iIfQ.O.^J......e.x....o........1D....:....E..<.,[C.d.9..0sI..x.4..Im.D.V..9..%(SI..

C:\Program Files (x86)\Google\Picasa3\runtime\gpuploader_prefs.fen

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	3010
Entropy (8bit):	4.709763955480458
Encrypted:	false
SSDEEP:	48:j/NG78BySu6kzFDvTMEpmwfGUT3iI14MixN7N9xAkludJPP5xZE:jFG7qunIEx3912Nt
MD5:	3417B185F374E99BFB55E68D57C46C85
SHA1:	BF386D6D07279FF4A1B793BCEAB1EAC1AABB1DE2
SHA-256:	D18923995219559B070C435DFCE76591208524E8D4D1E03DEAB9B2176E8C8A73
SHA-512:	F148C00E6B0376A6E99536F81F3541038FB2BECBC9D8C362EE4A05B1D1B8159C9F9C5F4A1F610AD33963DE3FB20D4BD5271C022D2CD529C3079B2894059FEFAD
Malicious:	false
Reputation:	unknown
Preview:	<window name="prefs_window" mac_title="Preferences - Google Photos Backup" win_title="Settings - Google Photos Backup" width="28em">. <group layout="column" width="fill">. <group layout="row" height="fill" width="fill">. <label name="account_name" title="Obtaining Account name..." width="fill"/>. <button name="log_off" title="Sign out"/>. </group>. <separator width="fill"/>. <spacer amount="1em"/>. <label name="source_lbl" text_align="left" title="Backup sources" fontweight="bold" width="fill"/>. <group layout="row" width="fill">. <check name="auto_import" win_title="Cameras && storage cards" mac_title="Cameras & storage cards" width="fill"/>. <button name="devices_btn" title="Devices..." mac_minsize="120,20"/>. </group>. <group layout="row" width="fill">. <spacer amount="1em"/>. <check name="local_folder_chk" title="Also copy photos/videos from external media to"/>. </group>. <group layout="row" width="fill">.

C:\Program Files (x86)\Google\Picasa3\runtime\gpuploader_quota_error1.fen

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1095
Entropy (8bit):	4.725591687611751
Encrypted:	false
SSDEEP:	24:m3hoGij9MdFFO8DtmV8fcEdOdXodZ47gnTBugTQC7U7XtgU:ZGihMDEVyEXoznTBnQCYXtb
MD5:	09DC6A45C4A8C975AE6C26C18CC46C8E
SHA1:	A9D395FF1CB3638120125270F22F6782F738888A
SHA-256:	0126CC0903D8EF3B82F689F671CA5909118A9E9346C79B381F4E035A5696AC30
SHA-512:	285529D8CAD831FC95390EFAAD396D7849315EA3D6AD0F042224C15366452A10A61689D0C82AF53AA66F079C6C1DFEE8FDDFFCAABB62DADBB39409693EFA96F8
Malicious:	false
Reputation:	unknown
Preview:	<window name="quota_error1" title="Google Photos Backup" width="35em">. <group layout="row">. <spacer amount="1em"/>. <image width="64" height="64" name="main_image"/>. <spacer amount="2em"/>. <group layout="column" width="fill" height="2li">. <label name="error_label" mac_height="1.5li" win_height="2li" width="fill" fontweight="bold" win_fontsize="24" mac_fontsize="20" title="1 GB of Google Drive storage left" />. <spacer amount="1em"/>. <label name="error_text" width="fill" height="fit" title="Get more storage to keep backing up your original photos at full resolution. Or, switch to high quality for free unlimited storage: great visual quality at a reduced file size."/>. <spacer amount="0"/>. <link name="help_decide_link" title="Get help deciding" url="https://support.google.com/photos/?p=storage"/>. </group>. </group>. <spacer amount="2em"/>. <group>. <label width="fill"/>. <button name="add_more_storage" title="Get more storage"/>.

C:\Program Files (x86)\Google\Picasa3\runtime\gpuploader_quota_error2.fen

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1089
Entropy (8bit):	4.7225354265522554
Encrypted:	false
SSDEEP:	24:m3qoGij9MdFFO8DtmV8huOEdOdXodZ47gnTBugTQC7U7XtgU:UGihMDEVuFXoznTBnQCYXtb
MD5:	2679C60C15F0DC9F2CE7F335B0591A81
SHA1:	54A42F08D81BFB56844A20EBF5FE60129E6B3679
SHA-256:	C21AB9758C1E4D1EB272585529529BCEA3EE794628966CDAFB8C2672170CBFB6
SHA-512:	5FAE456DBE57A02372F6730E6B6B00BAECC67E34331B3DE0D1626F2E772F3AEFFE2CE2181A4E11F64E4404D473C8EBF1EAA8618E3F40155D73DE137AD3C1A3B9
Malicious:	false
Reputation:	unknown
Preview:	<window name="quota_error2" title="Google Photos Backup" width="35em">. <group layout="row">. <spacer amount="1em"/>. <image width="64" height="64" name="main_image"/>. <spacer amount="2em"/>. <group layout="column" width="fill" height="2li">. <label name="error_label" mac_height="1.5li" win_height="2li" width="fill" fontweight="bold" win_fontsize="24" mac_fontsize="20" title="Out of Google Drive storage" />. <spacer amount="1em"/>. <label name="error_text" width="fill" height="fit" title="Get more storage to keep backing up your original photos at full resolution. Or, switch to high quality for free unlimited storage: great visual quality at a reduced file size."/>. <spacer amount="0"/>. <link name="help_decide_link" title="Get help deciding" url="https://support.google.com/photos/?p=storage"/>. </group>. </group>. <spacer amount="2em"/>. <group>. <label width="fill"/>. <button name="add_more_storage" title="Get more storage"/>. <bu

C:\Program Files (x86)\Google\Picasa3\runtime\gpuploader_storage_notify.fen

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	2119
Entropy (8bit):	4.644954670887638
Encrypted:	false
SSDEEP:	48:1GFXPW779SSINRi4V4MihdrMBdhw+ZdP8E:1Gu9WvdV2MBB
MD5:	DA5E2FFCBA53D6901807405FBB3C184A
SHA1:	1140A55A82D8087EAC2C8F4379A85836BB81FE46
SHA-256:	1006F8FC04512C7CBEE535138F29EDF1BAAC78990FFCD2FFD84D2286A2E52632
SHA-512:	4F6C00BA91D2D99CA43859D32C5F6AD453050D1D0AAF4784EC190DFFDBDEDD9FF32933A513E34AC9272AEBF3BC53F07BEAB5AA7DB483B0407F2D503A1A5EB0F5
Malicious:	false
Reputation:	unknown
Preview:	<window name="window" title="Google Photos Backup" width="30em">. <group layout="column" width="fill">. <group layout="row" width="fill" height="fit">. <group layout="column" align="top">. <image name="notify_icon" width="72" height="72" align="top"/>. </group>. <spacer amount="2em"/>. <group layout="column" width="fill">. <label name="notify_header" title="The new Google Photos Backup" text-align="start" width="fill" height="1.5li" fontweight="bold" win_fontsize="28" mac_fontsize="16"/>. <label name="notify_text" title="Storage options for your photos and videos just got a lot better." text-align="start" width="fill" height="fit"/>. <link name="notify_learnmore" title="Learn more" url="https://support.google.com/plus/answer/1647509#cost" align="end"/>. <spacer amount="1li"/>. <radiogroup layout="column" name="upload_size_group">. <radio name="free_size" title="High quality (free unlimited storage)" width="fill"

C:\Program Files (x86)\Google\Picasa3\runtime\gpuploader_welcome.fen

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe
File Type:	exported SGML document, ASCII text
Category:	dropped
Size (bytes):	1970
Entropy (8bit):	4.68904968698914
Encrypted:	false
SSDEEP:	48:1wXuZK1+7FVaMxMY5b/4ngObvM3odnKcVyLA3Vk:1dZj7FSCAJM4VoY6
MD5:	E004F18B00670C3BAC66BB6F036E6335
SHA1:	69D535593747A5B52BF9A0DFD3ECB664733FD0A7
SHA-256:	8642323412E19A8632B62B5351EC3440F6DB82D43EB78C75977A001846571342
SHA-512:	7965A1A6E02419776AD7E50D706AE8036D5E5CF479D415BDC75435E10F3507C07CDD7F91DF8FA1B0C2B40744909C6164BE40EF9B72BDFFBA84035FFEC7BED4E3
Malicious:	false
Reputation:	unknown
Preview:	<window name="window" title="Google Photos Backup" win_width="488" mac_width="414">. <group layout="column" align="center">. <image name="main_image" width="244" height="198" align="center"/>. <spacer amount="1li"/>. <group layout="row" height="3li" width="fill" align="center">. <spacer amount="2em" height="fill"/>. <label name="welcometext" height="fill" width="fill" align="center" title="Automatically back up photos and videos from your computer, including hard drives and memory cards"/>. <spacer amount="2em" height="fill"/>. </group>. <group layout="row" width="fill" align="center">. <spacer amount="2em" height="fill"/>. <label name="tos_text" height="fit" width="fill" align="left" win_fontsize="14" mac_fontsize="10" title="By using Google Photos Backup, you agree to the"/>. <spacer amount="2em" height="fill"/>. </group>. <spacer amount="0"/>. <group layout="row" width="fill" align="center">. <spacer amount="2em" height="fi

C:\Program Files (x86)\Google\Picasa3\runtime\imageproperties.fen

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	940
Entropy (8bit):	4.650911060844433
Encrypted:	false
SSDEEP:	24:+LDlmS9SELnOLtM+SSELnOL+gDTh6NTuELnGEBvY+GLSMY5o8ofSVN9Zog:+HlmyOwOtsPy5rY58KNX
MD5:	0C64BEE0E4B9573CF9A79B2B7DA9735D
SHA1:	62ADBF0BEBDD435F29BE380E5AF6618777E17C2F
SHA-256:	DC1AC4638FB07AC83C6ED35F3D5DB84A06525B52C372324CF99D514335EDF231
SHA-512:	6F2620B379EFF24A78DD371117B4270FF8FFB8C92D6FBF08BCA9634A027ECC7D5DF3F3C50410459EC45DE0A2D3160B36FFDEF3AD14BCBE927304508F9882F5D8
Malicious:	false
Reputation:	unknown
Preview:	<window>. <labelgroup title="Filename:" width="fill">. <label title="photo.jpg" name="name" width="fill"/>. </labelgroup>. <labelgroup title="Location:" width="fill">. <pathbox title="" width="fill" name="path"/>. </labelgroup>. <labelgroup title="Size:" width="fill">. <group width="fill">. <label title="120k" width="6em" max-width="fill" name="size"/>. <label title="Date:"/>. <label title="WWW 00, 0000 00:00 WW" name="date"/>. </group>. </labelgroup>. <list name="list" width="fill" height="20li" max-height="fill">. <column title="Property" width="15em"/>. <column title="Value" width="15em"/>. </list>. <group align="center" name="nav">. <button title="Prev" name="prev"/>. <label title="x of x files" name="navlabel"/>. <button title="Next" name="next"/>. </group>. <buttongroup align="center" default="cancel">. <button title="OK" type="cancel"/>. </buttongroup>.</window>.

C:\Program Files (x86)\Google\Picasa3\runtime\importweb.fen

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1082
Entropy (8bit):	4.657877314538346
Encrypted:	false
SSDEEP:	24:q3L7mxFNmmWJPxKRhHHFEXjVnHdKJIFFLebBOAJs67oYEog:q3ymmsP8/CXpoGebBOkHE
MD5:	114DE70845C05F345927658499BE19CE
SHA1:	96ED084D20EF7FB99DE3CCBD74F4363D540DF550
SHA-256:	F24DD7B3683F42135207D3C0206FD790DABCEFA8683734445AE6E535A1F4813C
SHA-512:	06516584EBD34899209D3926DCFD2172BC0F9C7CEF1E81D0E56EB14B330634448A51F8B30986C0F61DBDCD7997016CF9C8E3CCEB1A58BCC4E0784C440F411112
Malicious:	false
Reputation:	unknown
Preview:	<window title="Import Albums from Web Albums" width="fit">. <label width="fill" title="Pictures in the web albums checked below will download to your computer once you click the OK button. They will automatically be organized into folders based on the album names."/>. <label title="You have 100 web albums online." name="albumcount" width="fill"/>. <radiogroup name="importall">. <radio title="Import all albums"/>. <radio title="Import selected albums:"/>. </radiogroup>. <group layout="row" width="fill">. <bind attr="enabled" source="importall"/>. <spacer amount="indent"/>. <group layout="column">. <list name="albums" max-width="fill" height="6li" scroll="v" checkboxes="true">. <column title="Name" width="15em"/>. <column title="Date" width="15em"/>. </list>. </group>. </group>. <label title="(NOTE: Only pictures that are not already on your computer will be downloaded)" width="fill"/>. <buttongroup>. <button title="OK" type="accept"

C:\Program Files (x86)\Google\Picasa3\runtime\input.fen

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	304
Entropy (8bit):	4.682380121912277
Encrypted:	false
SSDEEP:	6:+HAQRvaj2XIAIl5CRhJHKxju7nwJDJRiAIl5CRhJHKxjeXv+JqEN/YklGEyAUjcX:+v12FAuMRfHKFu7nwJDfiAuMRfHKFKmh
MD5:	373C986590539566D56CC6797267B158
SHA1:	D972323105DCEF26DB6490977BD3219E931C69AC
SHA-256:	EE675ACA1D1E4F626D1B943256DFE332B3C03318370CD19E352B92CC041CD604
SHA-512:	CC4924A99F909E8FB486EF38F9E68D9F8ACF9B521DB8A0F2351D9EFDD92C2FB9F604D055742415E4F0C9BE0F5F2EA5E8F8E4C705717B00A0199CE5B5C3172E4E
Malicious:	false
Reputation:	unknown
Preview:	<window>. <label title="Prompt:" name="prompt"/>. <edit name="value" width="20em" max-width="fill"/>. <password name="password" width="20em" max-width="fill"/>. <buttongroup default="accept">. <button title="OK" type="accept"/>. <button title="Cancel" type="cancel"/>. </buttongroup>.</window>

C:\Program Files (x86)\Google\Picasa3\runtime\missing.jpg

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe
File Type:	JPEG image data, JFIF standard 1.02, aspect ratio, density 100x100, segment length 16, baseline, precision 8, 96x72, components 3
Category:	dropped
Size (bytes):	3875
Entropy (8bit):	7.816377723125142
Encrypted:	false
SSDEEP:	96:E35k1hBCFwMFbnsQhR+zTMxZkrqCIQ9gi16K53ssk2x:Eu1cwMFYQhR+PMoqCIQb16uH
MD5:	F0BCBEFFF3F9DB02F017C8BE7877E98E
SHA1:	357B7BFBFA3657E31F3DEDA54AD899CDC3885A65
SHA-256:	7E8CF318263A84EBB4279231D54A6250F2C2286F0BF13246CD940BB736E140FC
SHA-512:	8EEF4AEA8CC3684160865F51A86BEAF842461B8CCE88F7978727F2781F5225FB70EEDA1A1034A5CCCFC397C5302D585048707AE64222DFFFB04BC758CDE5814B
Malicious:	false
Reputation:	unknown
Preview:	......JFIF.....d.d......Ducky.......d......Adobe.d.................................................................................................................................................H.`............................................................................................!1.....WAQ.".#....aRb..r.v7...........................!1a..A2.Qq."b....R4.5.............?...&.."h..&.."h..&.."h..&..Lnc..c.].U..c.Xf8^9.3O.g..=$<...m.hWr.1#..5.Qh...(..&..}./..1.../...=./..1.../...=./..1.../...=./..1.../...=./..1.../...=./..1.../...}I.<.N=.[..9-....y....y...........)...C..^$.L<... .h...7.2.~.#..........DtY.>0..;..;.E..&..G..zn..TM.x.....b.gDP.M...6Y...0.c.."x.p....;..$.t...$.%...a.B........u$.:....[aq.e/.-.aq.....@.J..&..q.r6?.....G=Dj.+...m.Z.V...stT...w.mT......O..s..c.}.^...tTf{z.'c._.s..<Kc.......s.R.z('.......6.WWrN.,I..`.5..#.P....w.IbX.Hi....Q..d..]..>? .3j.v....h....<.*iQNjs.~R~.e.+(.G.,.K...,n4.4..!......U....0.).I].. .a.SD\..I......&N.%...G.1.2d8-0.

C:\Program Files (x86)\Google\Picasa3\runtime\move_database.fen

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	945
Entropy (8bit):	4.638764016221849
Encrypted:	false
SSDEEP:	24:2I47QBQ2vq7KijVXQ25dVzvNzzG1DVOLXDAtuELnOLmAtl7GhuELn8UUoq:2jKQ2S7BXQ2LVzVXG1hOQtPOrtlGP8UW
MD5:	7BFFBCAD5732F87C23D955A865C025C4
SHA1:	861777F0C650A12199351885C247DE45417A0BC6
SHA-256:	CC7DA14FD99CBD67CC7054D434569FC18F44FECC479E3B6414724749BAFB3D47
SHA-512:	A83DAF65E825407E99996D3CC5266DD2CE0CF1F3FF529FADC032A08E54243A1F0270CE54EC8797756B9C63243F145E2FF43D83317E03992316CA77C9A0DD9494
Malicious:	false
Reputation:	unknown
Preview:	<window title="Move Database" width="fit" focus="new_location">. <group>. <label width="fill" title="You will need to restart Picasa for the changes to take effect."/>. </group>. <group>. <label width="fill" title="Please Note: You should backup your database before trying out this experimental feature. NEVER move the database to a network, removable, or external drive, or you may lose data."/>. </group>. <labelgroup title="Current Database location:">. <group>. <pathbox name="current_location"/>. </group>. </labelgroup>. <labelgroup title="New Database location:">. <group>. <pathbox name="new_location" width="25em"/>. <button title="Browse..." name="changeloc"/>. <button title="Default" name="defaultloc"/>. </group>. </labelgroup>. <buttongroup>. <button title="Move on next restart" type="accept" name="move"/>. <button title="Cancel" type="cancel"/>. </buttongroup>.</window>..

C:\Program Files (x86)\Google\Picasa3\runtime\moving_database.fen

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	199
Entropy (8bit):	4.564143793421066
Encrypted:	false
SSDEEP:	6:2qR5H8/DAbdF8XKQrmHAXyLxferqRpLroKQr8oCLWY/DASpL3b8:2qR6QXQVyVXQfCLWoNJQ
MD5:	E4CD8ED767108A0E4D3BC12537D402A3
SHA1:	C9ADC8ADC0A1218B1068E49EEFB9FAA9DC0ACE00
SHA-256:	947101FE0ABF9C84B20A3D8C92B80CFCDEC8A3B4DD311E0902E7EF19B81C3748
SHA-512:	E2DFDA3A28C5BA2F3285C7CD829864A5244EE3892A83C5607401CB8B2AB70B70C85314AE39C0A85B82AE7DF796701549ED612D598DDC84BD53649E80DBBE1872
Malicious:	false
Reputation:	unknown
Preview:	<window title="Moving Database" width="fit" focus="progress">. <group>. <label title="Picasa is moving the database."/>. </group>. <group>. <progress name="progress"/>. </group>.</window>..

C:\Program Files (x86)\Google\Picasa3\runtime\newbackupset.fen

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	910
Entropy (8bit):	4.642402458585952
Encrypted:	false
SSDEEP:	24:mqLqS9SELnOLLqqiJYbobaKzuELnOLMyaouELn8Oog:JGyO3qqAYCBzPO4oP8e
MD5:	8AD75E7AEA3B1605D01189D5C5C44183
SHA1:	8F3A0F4E18312CB0FE5C2F2C1AC2D9DED3494F3F
SHA-256:	76AA4AC7A27C9E4F223AEF68366F5358B45F752B91B899FEE7DA3EB28C8A0969
SHA-512:	03BA833043E7804B1659C0532C2F2865893F9336E5F51D08FAA45011EE95953179E92766C0C4BD1F73BBAD4320CEEA9BCE8993530B62C5E9B55A2C48A089158B
Malicious:	false
Reputation:	unknown
Preview:	<window title="New Backup Set" width="fit">. <labelgroup title="Name:" width="fill">. <edit name="name" width="fill"/>. </labelgroup>. <labelgroup title="Backup type:" name="typegroup">. <radiogroup name="type">. <radio title="CD or DVD backup"/>. <radio title="Disk-to-disk backup (for external and network drives)"/>. </radiogroup>. <group>. <bind attr="enabled" source="type"/>. <spacer amount="indent"/>. <browse title="Choose..." name="disk"/>. </group>. </labelgroup>. <labelgroup title="Files to backup:">. <radiogroup name="files">. <radio title="All file types"/>. <radio title="All pictures (exclude movies)"/>. <radio title="Only JPEGs with camera information"/>. </radiogroup>. </labelgroup>. <buttongroup>. <button title="Create" type="accept" name="ok"/>. <button title="Cancel" type="cancel"/>. </buttongroup>.</window>.

C:\Program Files (x86)\Google\Picasa3\runtime\offsettime.fen

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	886
Entropy (8bit):	4.371159263789697
Encrypted:	false
SSDEEP:	24:kL+jL6X3qY1NxvnA8qnTavnZB+lpvE8Eog:kL+d4fYTafZB+vM8E
MD5:	AD6535662C127F4FF6746604D3C2EE42
SHA1:	54EC4AEE8B5D6D3FB56083F06E11E7099635E93C
SHA-256:	59BD558305CD546B12E1CFB28A128DDE53DCE00C81A2F86E609CB1A46CB44A9F
SHA-512:	9E4B6AF9C0D6E9C9D62EEC31E86404501E92DA93ADAF43913BFA27E8F2B154792E110633CE5710F7AB35C0679E066C410C69BF84056AFA7CA09DF56923C7362E
Malicious:	false
Reputation:	unknown
Preview:	<window title="Adjust Photo Date" width="fit">. <group layout="row">. <printpreview name="thumb"/>. <group layout="column" width="fill">. <labelgroup title="Current photo date: ">. <group layout="row">. <date name="currentdate" />. <time name="currenttime" />. </group>. </labelgroup>. <labelgroup title="New photo date: ">. <group layout="row">. <date name="newdate"/>. <time name="newtime"/>. </group>. </labelgroup>. </group>. </group>. <radiogroup name="adjust_type" align="center">. <radio name="relative" title="Adjust all photo dates by the amount"/>. <radio name="absolute" title="Set all photos to the same date and time"/>. </radiogroup>. <buttongroup>. <button title="OK" type="accept" name="ok"/>. <button title="Cancel" type="cancel"/>. </buttongroup>.</window>.

C:\Program Files (x86)\Google\Picasa3\runtime\options.fen

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe
File Type:	exported SGML document, ASCII text
Category:	dropped
Size (bytes):	11754
Entropy (8bit):	4.603999621023586
Encrypted:	false
SSDEEP:	96:atA8x5ilZPBUrTi+XkOF0U25WZwmu4H8UFqe8UFJqRpq9+k9j92Zl9Yfbg1aNPVE:/88+Xk3UBTHBQeB79w3Ozg4ipfxmGQux
MD5:	E7FCFDA1E4C56520195E80292380F002
SHA1:	D27A2D2198087705431F0851109C15C11D3466DB
SHA-256:	4D944BA64CC8D266B6688B959D6C750595D65B78D2AEAAE4950356B680DDFF08
SHA-512:	5B474FF2E78955CFE074F7825D6C011FEFF76AEE9552FFD391042EE0C9573CDE072ABAC922DD3B2F3A722008BE7849C353A9641B02933541524AFC64CEFCE4A7
Malicious:	false
Reputation:	unknown
Preview:	<window mac_title="Preferences" win_title="Options" width="fit">. <tabs name="tabs">. <tab title="General">. <labelgroup title="User interface:">. <check title="Use special effects" name="UITransitions"/>. <check title="Show tooltips" name="ShowTooltips" os="win"/>. <check title="Show help tags" name="ShowTooltips" os="mac"/>. <check title="Single-click to exit Edit View" name="SingleClickExit"/>. </labelgroup>. <spacer amount="1em"/>. <labelgroup title="Files:">. <check title="Detect duplicates while importing" name="autoexclude"/>. <check title="Clear cache files" name="disposepreviews"/>. <check title="Delete from disk without confirmation" name="DoNotConfirmDeleteFromDisk"/>. <check title="Remove from album without confirmation" name="DoNotConfirmRemoveFromAlbum"/>. </labelgroup>. <separator/>. <labelgroup title="Help improve Picasa:" width="fit">. Stats Reporting -->.

C:\Program Files (x86)\Google\Picasa3\runtime\orderprintsprefs.fen

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1456
Entropy (8bit):	4.700669254399255
Encrypted:	false
SSDEEP:	24:64SKCtOkaNlQpRZQqSELAFpzrpQODiFNuELQLW5MDK1SELQL/SELs7o4:64vCkkPRYpzr9+NYq5MDK2kh
MD5:	A4BD2E5ED2FB56CF895464AAE1094FFB
SHA1:	A0B63B3FEBA918FF6EDA73553D7C6C9815F92F3D
SHA-256:	0616B0595198E412961244D9035706ABF33C7714A1EC8E3976EDEF019F2505E8
SHA-512:	F74FD3911F254EDA2846467ED6E600BB79BAC24FF04733871F5803EA45649B3DA93AD3ECE525E05D385539B251CB59948B4431FC414205C6A995315F7A920F65
Malicious:	false
Reputation:	unknown
Preview:	<window title="Login" width="fit">. <label align="start" width="fill" name="status"/>. <label width="fill" name="infotext" title="Enter the username and password you normally use to login to this photo printing service. If you don't already have an account with this provider, click on "Create an account" to sign up."/>.. <labelgroup title="Email:" name="emaillabel">. <edit width="fill" name="username"/>. <spacer amount=".2em"/>. <link align="end" size="small" title="Create an account..." url="http://www.google.com" name="createlink"/>. </labelgroup>.. <labelgroup title="Password:">. <password width="fill" name="password"/>. <spacer amount=".2em"/>. <link align="end" size="small" title="Forgot your password?" url="http://www.google.com" name="forgotlink"/>. <group>. <check title="Save Password" name="savepassword"/>. <spacer amount="4em"/>. <label align="end" title="Login secured by SSL" size="small"/>. </group>. </labelgroup>.. <

C:\Program Files (x86)\Google\Picasa3\runtime\picasaweb_logo.gif

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe
File Type:	GIF image data, version 89a, 106 x 32
Category:	dropped
Size (bytes):	1485
Entropy (8bit):	7.723874649790046
Encrypted:	false
SSDEEP:	24:1YgRbi1Cgzu+1lzoC4QnD1LfqmDN7kDHZvCW/CpmjXyRkk+eSKjrh1F27:1O1CgzRpomh85qEqmjX6rhX27
MD5:	06771AEF4A6CC67F7AFD1A4923695ED8
SHA1:	3A7AEC33EB6B61E441E8674BE4B16FB9A9421AB6
SHA-256:	BE1B49BBEE87AF1D359BF67CFFF857CF78DAC2AFC9E93BDEC553EC38A0E04056
SHA-512:	429117F1EDDC07110114B5D820F791F848DB43FA644B3BADCF39D117F0ED24A2E19CE8DD4F036CC78A86FB51C405A94A3D9A72DFA96BC7A0D20336A6CC0D47A5
Malicious:	false
Reputation:	unknown
Preview:	GIF89aj. .......WWW.......\..............Y..Il.cccvvv....&....................1/......^...s..............g.....................................=G.y........:..........?=.................MMM......!.......,....j. ......ph.YVC./S$%..tJ.Z.....Z2..R),b..:i.n.$...S...~....v>H733yot}..U+>b?0u)...... Hm...OZ+L<. ...6.66.1Z...\|w07&..&......9'f..k.E,...&)....2.'YBb........>\>.,P.[..OnV.gZ.......2..vC.........P.....uj..KRn"DwC...`....TQ.W.."..$$....~$.1.C...3........?......<. .....a.X..@....z......)8u..)...x1.4.....u...V..I&F...(.....(.H .C.n..t.(....V.Z.....[X.6.....b.px.h..1.d.D..z..x9....?....`.....6H`.G...wO.+D.............=.....N%..w._.3.P....g..{..j.....c..M.1....p.....f....7.......A.y..........Q@.._j...m......h.....XV..%..K....5..G.h...L...x..ca..}.......m.6.[..4.../M.N....z.0i.V2.#@{R......0^Y.pA...T..A...d.....Wg......\A..#..{e.eO=4..F.....5l..;f.Id.B.)...J aB<.._..Dyeq..K1.@.A..gUq....:V4.....)......eH`WI.H......k......\|ID...j....0...E...:qA.E

C:\Program Files (x86)\Google\Picasa3\runtime\poster.fen

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	784
Entropy (8bit):	4.564282790383213
Encrypted:	false
SSDEEP:	12:oUZa8KS92HKFKLj+V0fHVtfM3ftZfafBfgfffWAufqRELnOLjq+LnfHKFSELnmt4:/ZaFgtKLj+LJELnOLG+2SELnmnKRYYog
MD5:	C8874AC879EBA43C27109BAC71DC57E9
SHA1:	0368776A206FD09F7B2DAEB7E90F92C30735B629
SHA-256:	8EBCA75F795D2C704917014192CCD0AE5F4F8CC65BFEC1BE73F8FCF694E2DEBE
SHA-512:	95DA89E8C5394DCD220C8BB3660733BDD5E564DF8D1F8939C79CD238945CA938416998FD08D1E0260D1973110A8BE60DD47DEE0839FB022CF74E8FEA76394F56
Malicious:	false
Reputation:	unknown
Preview:	<window title="Poster Settings" width="fit">. <label title="Tip: if you don't want to trim, crop your picture to the same size as the paper." width="fill"/>. <labelgroup title="Poster size:">. <popup name="factor" width="fill">. <item title="200%"/>. <item title="300%"/>. <item title="400%"/>. <item title="500%"/>. <item title="600%"/>. <item title="700%"/>. <item title="800%"/>. <item title="900%"/>. <item title="1000%"/>. </popup>. </labelgroup>. <labelgroup title="Paper size:">. <popup name="paper" width="fill"/>. </labelgroup>. <check title="Overlap tiles" name="overlap" align="center"/>. <buttongroup>. <button title="OK" type="accept"/>. <button title="Cancel" type="cancel"/>. </buttongroup>.</window>.

C:\Program Files (x86)\Google\Picasa3\runtime\properties.xml

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 (with BOM) text
Category:	dropped
Size (bytes):	841
Entropy (8bit):	5.027537195081919
Encrypted:	false
SSDEEP:	24:Jd+mJTlMbMbibJ84xs2Jq0o+7g9v4iUKqKLLG:3+mJTle84R/ogi//G
MD5:	E8D8020208F55E8E05CB9A8B23525933
SHA1:	7221D21EB73F4A0DBEE041247400E7C32DFAC457
SHA-256:	74E42924C8D005EB83460559C7B730666550B64B891B4E4EB562F965CC978CC1
SHA-512:	424A5DE4E77AD12A11E6BD6F9DE1174A8392CA3D4497D3014188C3E86FC4235F2F9EA95499FAB30A241BE8325F8716047F546BCEF6F4D0209B7BC1E9C601CFC7
Malicious:	false
Reputation:	unknown
Preview:	.<?xml version="1.0" encoding="utf-8"?>.<Properties>. <FilePath/>. <FileSize/>. <Dimensions/>. <Make/>. <Model/>. <DateTimeOriginal/>. <DateTimeDigitized/>. <DateTime/>. <FileDate/>. <Orientation/>. <Flash/>. <Lens/>. <FocalLength/>. <FocalLengthIn35mmFilm/>. <CCDWidth/>. <ExposureTime/>. <ApertureValue/>. <FNumber/>. <SubjectDistance/>. <ISOSpeedRatings/>. <WhiteBalance/>. <MeteringMode/>. <ExposureProgram/>. <Compression/>. <ColorSpace/>. <ICC/>. <EmbeddedThumbnail/>. <Quality/>. <Keywords/>. <Regions/>. <GPSLatitude/>. <GPSLongitude/>. <GPSAltitude/>. <ImageUniqueID/>. <MovieInfo/>. <MovieRate/>. <MovieLength/>. <OnlinePhotoID/>. <FilterString hide="1"/>. <IsTempFile hide="1"/>. <EXIFUnknown hide="1"/>. <IPTCUnknown hide="1"/>. <XMP hide="1"/>. <XMPUnknown hide="1"/>.</Properties>.

C:\Program Files (x86)\Google\Picasa3\runtime\pwconfirm.html

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe
File Type:	HTML document, ASCII text
Category:	dropped
Size (bytes):	1964
Entropy (8bit):	5.567725223058721
Encrypted:	false
SSDEEP:	48:11v1fRWxRYW0WbiviItTiIFXwOjK9ijaRQgAD+YfjK9ijA:v1fKTSRk+XD+P
MD5:	C835BA8CA5724CB9C7CF4FDC29714945
SHA1:	1667B0A288BEE40C5B91684758C99694FFB68E77
SHA-256:	47DE0F3402D9482FE32CE877533EEAC4960C467FA3829BDFD26C444DA906EEEC
SHA-512:	C1FA93DD186137A7CB9C82E72C9D8A97C8FED6540FE5AFC020F539351760E5A3B85CA7A4116BCA26379A189203C708E38A9CB822E8268426BCDD2E0A1AD1CB85
Malicious:	false
Reputation:	unknown
Preview:	<head>.<meta http-equiv="Content-Type" content="text/html;charset=utf-8" >.<style type="text/css">.body {background: #F9F9F9; margin: 0; font-family: 'Lucida Grande', Arial, San-serif;font-size: smaller;}.h1 {font-weight: bold; margin:0; font-size: 1.1em; color: #A0A0A0; background:#FFF; border-bottom: 2px solid #ececec;}.h1 img {margin:0 .5em;}.h2 {font-weight: bold;font-size: 1.1em; color:#4D4D4D; margin-top: 0}.h3 {font-weight: bold;font-size: 1.2em; margin: 0; color:#4D4D4D;}.h4 {font-weight: bold; margin:0 0 1em 0; font-size: 1.1em; color: #A0A0A0;}.form {margin:0;padding:0;}..box {padding: 1em;}..downloadinfo {border: 2px solid #E8EEFA; background: white; text-align: center; padding: .5em;}..buttons {width: 14em;}..actions {background: #C3D9FF; padding: .5em;}..actions input { width: 11em; margin-right: .8em;}..actions form {display: inline;}..container {padding: .5em; background: #E1ECFE;}..imagecontainer {padding: .5em; background: #FFF; border: 1px solid #ccc;}..imagecontainer

C:\Program Files (x86)\Google\Picasa3\runtime\quota.fen

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	585
Entropy (8bit):	4.580335111652429
Encrypted:	false
SSDEEP:	12:oUXQFKjLe6amABQtYrxtEas6pbpAKyzZBBfSstmlgJqGlA/QFKo+:rXQC03ttEa2djBfS//8g
MD5:	DCBA6E63C5542048E04C2546617AD322
SHA1:	920F21F1FB033616A28BFCA5716451B208B48B7E
SHA-256:	C9AB716B9D355474B474C044B5491C8C3BE8D90DEA3B192CBDB7613F8DF7E365
SHA-512:	24F2AF5EC09E86A9103649A89846D174ACDCA7BCAD938C8DC5845AC40B5760CA18F7BEE99E4BFB60102AE1CAA13D2487DA7ED6B75E3BD163043ECE221A1F53DF
Malicious:	false
Reputation:	unknown
Preview:	<window width="fit" focus="buttons" title="Low Storage">. <group>. <appicon/>. <group layout="column">. <label name="message" width="24em" title="You are low on storage. You can either upload at reduced sizes for free or click 'Upgrade' to buy more."/>. <link name="learnmore" title="Learn more."/>. <check title="Don't warn me about this in the future." name="remember"/>. </group>. </group>. <buttongroup name="buttons">. <button title="Upgrade" type="accept" name="upgrade"/>. <button title="OK" type="cancel" name="ok"/>. </buttongroup>.</window>.

C:\Program Files (x86)\Google\Picasa3\runtime\refresh_contacts_progress.fen

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	330
Entropy (8bit):	4.580281261358229
Encrypted:	false
SSDEEP:	6:NFQH8TF8XKQrmHAXyzQCAlzPMKPSpLroKQr8oCLWY/DASpLr0mRT4EjEcLQFcHLD:7Q56VXQfCLWoNVNhVtQFKo+
MD5:	0E79D9361A9F4D914146675E2094138E
SHA1:	49249D27C225DC09D6078BBD69802C2AA0E13D45
SHA-256:	AECE165B2DDB87569336BE292F2E1978460A167CF2E65862D2C55A6156EF82C6
SHA-512:	CDFEA05F05A8B28C0859D595022D1A088CBE48CA7130F46DF340F083A135E7BEC1741B99CAF96533F54B56210DE3128EDF2D1D6B74687CFBA47F1B7DEB39762C
Malicious:	false
Reputation:	unknown
Preview:	<window title="Refreshing Contacts" width="fit" focus="ok">. <group>. <label title="Picasa is refreshing online contact information."/>. </group>. <group>. <progress name="progress"/>. </group>. <buttongroup align="center">. <button title="Refresh in Background" type="accept" name="ok"/>. </buttongroup>.</window>.

C:\Program Files (x86)\Google\Picasa3\runtime\rename.fen

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	747
Entropy (8bit):	4.566553387272911
Encrypted:	false
SSDEEP:	12:2th3oH1Hth3oHrDSEpbkKqRAQkZmyvogNmT5aShICljLLnBOdfH99rYxtpO5GlAP:2thYrhYLDSEpIKTmyvogNmT5aShICtnG
MD5:	2EE4C269C178399E88BD1DE46CD836CC
SHA1:	01F927AC07892922B8518B5237F059DFC38B1CD3
SHA-256:	CAAE8F7FCC021FDD51AB224F5CCF21ECD675E142AF9D2FB39A34681ED8969097
SHA-512:	93754A785CB59D43CB388B2DFD86C0C679FC52CB46450B348976A292F4D5AAFE70184ACADFAE63FB7AE8C66A6E465E09AC04EFA2C9BF563622ECC2C1C15782A0
Malicious:	false
Reputation:	unknown
Preview:	<window title="Rename Files" width="fit">. <label title="1 file(s) selected for rename." width="fill">. <bind format="%s file(s) selected for rename." source="files" attr="title"/>. </label>. <spacer amount="0"/>. <label title="Please enter a new name for these files:"/>. <edit width="25em" title="" name="newname" filter="filename"/>. <group align="center">. <labelgroup title="Include in filename:">. <check title="Date" name="date"/>. <check title="Image resolution" name="size"/>. </labelgroup>. </group>. <label title="Example:" width="fill" height="2li" name="sample"/>. <buttongroup>. <button title="Rename" type="accept" name="rename"/>. <button title="Cancel" type="cancel"/>. </buttongroup>.</window>.

C:\Program Files (x86)\Google\Picasa3\runtime\respack.yt

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe
File Type:	data
Category:	dropped
Size (bytes):	3878179
Entropy (8bit):	6.370672599972476
Encrypted:	false
SSDEEP:	24576:pGtQFKonaP2mH08w0UgbdCeHVsJHt85FzvIOVBcSpcl6PSMV2RqlV:WQwonafQKz9TcSp9F2RqlV
MD5:	B36CA3DB66A3357D94B8790CD8771C65
SHA1:	10C0E8C6EBEF517963BBEA04D79D16BDB1464F42
SHA-256:	247040B6AEF7F8255E1DAE35CD22007C9A67CECC6B8E66946535EA14D0475444
SHA-512:	5E49852DC974F6ACF4BAF8885BFB3B4C6474D50A11A86F4FC3257E2FED7D2D5626BC613524D1AC4A9333F09267A430BD2094E4C826A173708C59AFBA823AA549
Malicious:	false
Reputation:	unknown
Preview:	..9..... ................ ..............+. ..............N.!............................#.......................................F........................#........................#........................#........................#........................#........................#........................#........................#........................#........................#........................#........................#........................#........................#........................#........................#........................#........................#........................#........................#........................#........................#........................#........................#........................#........................#........................#........................#........................#........................#........................#........................#........................#........................#.....................

C:\Program Files (x86)\Google\Picasa3\runtime\reviewprint.fen

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1038
Entropy (8bit):	4.638659357955501
Encrypted:	false
SSDEEP:	24:GWLjjb2M2Onv+cBYVC6BXjR6ncLKz9TrsQIE:TXt2OvMHBX4EKz9Hs9E
MD5:	7C6D98216862B67000ACAA6BE76A6EAE
SHA1:	62C8F26BB295820170353022C99112579170411A
SHA-256:	7FE7760260937CCC9B74818D04DD9B52DFBE2BB8506CEDF20ABD789181593C04
SHA-512:	801456C99EDC2CC869B04D497554E355D763DF0ABE5EC2FF86927FC76229420F862E101126B8590EEE959D3A0BD451E215A30746CD5197CCDB6FD9CB87B58CCF
Malicious:	false
Reputation:	unknown
Preview:	<window title="Review for Printing" layout="row" width="fit">. <group layout="column" width="fit" height="fill">. <label title="{CPrintDlg::toosmall}Some of your pictures are too small to print well. You can remove these pictures, print them anyway, or cancel and change the print size." width="fill" name="overall"/>. <list height="10li" max-height="fill" name="list" width="fill" header="hide" scroll="v">. <column width="fill"/>. </list>. <group>. <button title="Remove Selected" name="remove"/>. <button title="Remove Low Quality Pictures" name="removeall"/>. </group>. </group>. <group layout="column" align="end" width="15em">. <label title="Image Preview" name="top" width="fill" text-align="center"/>. <printpreview width="fill" name="preview"/>. <label title="Info" name="bottom" width="fill" height="2li" text-align="center" size="small"/>. <buttongroup>. <button title="OK" type="accept"/>. <button title="Cancel" type="cancel"/>.

C:\Program Files (x86)\Google\Picasa3\runtime\slingshot\respack.yt

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe
File Type:	data
Category:	dropped
Size (bytes):	379760
Entropy (8bit):	6.22097966408985
Encrypted:	false
SSDEEP:	6144:Q4w/EBaMKaRqj0JtM+UmjwaUdLSJ4Sqk72OuTHwm:x9BahobMNmjwJLSJpqkiOO9
MD5:	55E5D4CF1C92310E5A5A159D9AC7EEB1
SHA1:	228C9BC507F1525E18CB2E6BC34D7CCFFB7FD698
SHA-256:	988EE1633B0389BD1FB30DF19765BDCB106DD2DAFF0506476C41C8A7DEB67F89
SHA-512:	F3238795058B45D1385C6E5024CB1199EE1922897B75F5189647021EF2CCBD6386C7E279C15A7895761A1A982E06AE17B24F1D33ADC4BD6E2464725819572221
Malicious:	false
Reputation:	unknown
Preview:	....................@...T...................QQQb...............................QQQb...........NNN_...................................................PPP_...........rrr..............................................................xxx............rrr...................................................................yyy.......OOO_..................................................................TTT_................................................................................................RRRa.......................................................................WWWa..........................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Google\Picasa3\runtime\splashbk.jpg

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe
File Type:	JPEG image data, JFIF standard 1.02, resolution (DPI), density 72x72, segment length 16, Exif Standard: [TIFF image data, big-endian, direntries=7, orientation=upper-left, xresolution=98, yresolution=106, resolutionunit=2, software=Adobe Photoshop CS2 Windows, datetime=2008:10:15 16:56:08], baseline, precision 8, 640x235, components 3
Category:	dropped
Size (bytes):	44195
Entropy (8bit):	6.436726737525852
Encrypted:	false
SSDEEP:	384:Liu05u0IU5ylLZDEjl0l6FIvkhIRMZXbSIE6Zfxtb5TN/tD9wkVuYNb:LRZhq6l6CvkhIRiSIzR/fVuYNb
MD5:	DDE7CE5EA50E33BEE533609428D713D3
SHA1:	F4B491360680AD0409B63B31213BBEACD930327C
SHA-256:	A25CF9995BC198418D5B513DB1A5EA272DD871FD109313F7F04E5BB5DB8276F0
SHA-512:	04A19252A709C5E6C130B5F24C3F15FFBFF45FD1FB96B49D84F17AFCACDD73EF3F0AD4F8A1EF26AD6E6175DDBBB03B1EC27F67B2F23910C0D0BC5D4D67F06E4C
Malicious:	false
Reputation:	unknown
Preview:	......JFIF.....H.H.....<Exif..MM.*.............................b...........j.(...........1.........r.2...........i....................'.......'.Adobe Photoshop CS2 Windows.2008:10:15 16:56:08....................................................................................&.(.........................................H.......H..........JFIF.....H.H......Adobe_CM......Adobe.d.................................................................................................................................................;...."................?..........................................................................3......!.1.AQa."q.2.....B#$.R.b34r..C.%.S...cs5....&D.TdE.t6..U.e...u..F'...............Vfv........7GWgw........................5.....!1..AQaq"..2.....B#.R..3$b.r..CS.cs4.%......&5..D.T..dEU6te....u..F...............Vfv........'7GWgw.................?..T.I%)$;2)..{..$.jc.k}....v.........II.I$...I%)$.IJI$.R.I$...I%)$.IJI$.S...U..:.:f!..`5..K.................%..r.W.L.J.ls.

C:\Program Files (x86)\Google\Picasa3\runtime\webexport.fen

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1503
Entropy (8bit):	4.6311138734210315
Encrypted:	false
SSDEEP:	24:dCtpWL4I+0RDzXGdELnOLy+vELnOLj0SELnOLJOguELnA3id4ijTQLdnlBwAuL1L:ctcUI+0RDDXOO+aOHIOthPA3iaiXQhUV
MD5:	CBCC14BFC9B83F2970AA707B7BF5065D
SHA1:	14343EB6EC3AC0BB9E040E1EC1941CFC97E69ABB
SHA-256:	13D29013CE31B7C08D2474695F41610164919BEB34C89DC3DD81E384E9AB9C11
SHA-512:	C724486BE77933E85E0DB90A0B88D6EB213AD43C26C33DC97377EA49B8844E8FE84CC68E5A9A9E67CD1915F68DD7501ECC76641945FD5519D0B4054BC1A37D41
Malicious:	false
Reputation:	unknown
Preview:	<window title="Export as HTML Page" width="fit">. <labelgroup title="Export pictures at:">. <popup name="sizeradio">. <item title="Original Size"/>. <item title="1024 pixels (for large monitors)"/>. <item title="800 pixels (for large Web pages)"/>. <item title="640 pixels (for Web pages)"/>. <item title="320 pixels (for email)"/>. </popup>. </labelgroup>. <labelgroup title="Export movies using:">. <popup name="moviesradio">. <item title="First frame"/>. <item title="Full movie"/>. </popup>. </labelgroup>. <labelgroup title="Web page title:">. <edit width="fill" name="description"/>. </labelgroup>. <labelgroup title="Folder:">. <group>. <pathbox width="fill" name="location"/>. <button title="Browse..." name="changeloc"/>. </group>. </labelgroup>. <separator/>. <label width="fill" title="Click a Template Name to view an example. When you have made your selection, click Export."/>. <group>. <group layout="col

C:\Program Files (x86)\Google\Picasa3\runtime\winedisable.txt

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	78
Entropy (8bit):	3.0713091912724715
Encrypted:	false
SSDEEP:	3:6ZTRLJVWKzVrdvRVVVB00cM9STbMn:6ZTRLJVVzrz/O0J9gY
MD5:	9E52791DACE21ACB7167E06E0F03190C
SHA1:	5CA65E9DE7660DB401E5F0F27B804970749344FF
SHA-256:	E5F0B53F43057A4064DCCABC9C60483F0D9EDEE85FB65C67509BC276C91CF367
SHA-512:	D54605003DF5A4C76AD644175FF16CEEA2E990AA5DED074DBB19D6A48B681EABC6FB33B9C3E5E7A846B299871375E3400CE8030D4A5F98B00D66212717132F54
Malicious:	false
Reputation:	unknown
Preview:	40225.40192.40019.40372.40350.40373.40368.40370.40371.40284.40393.40276.40432.

C:\Program Files (x86)\Google\Picasa3\runtime\write_all_facetags.fen

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	596
Entropy (8bit):	4.544788077051211
Encrypted:	false
SSDEEP:	12:WdQsmH8nGGgz4Kg0XloLW0t2NWyV8t0WEswWZUk5GlAUjKoQ:8Q2G180d0t2NNV8joq
MD5:	7DEEC126F9F9D4D84BE54415A1113969
SHA1:	B904F82224C69F6ACDB174B3C85AE54BA08474CF
SHA-256:	5C6B16E9057F32C68562AE64846852B652A3C0A59E44E9717A6D67F91BA43E2D
SHA-512:	BD3B980256F4614E3CAC99ED173012A825B90B69249368F1B3706A0497378B05ACD106D5935338824B12BA75AC76F5178E7B25B26FF781F0CFB2C50E77AEDC89
Malicious:	false
Reputation:	unknown
Preview:	<window title="Write Face Tags" width="fit" focus="onlyselection">. <group>. <label width="fill" title="Write faces or write all may take a long time. If logging is set to detailed or higher, network.log will contain messages about read-only files which could not be updated. Signing out is recommended while using this feature."/>. </group>. <buttongroup>. <button title="Write Selected" name="onlyselection"/>. <button title="Write Faces" name="allwithfaces"/>. <button title="Write All" name="allfiles"/>. <button title="Cancel" type="cancel"/>. </buttongroup>.</window>..

C:\Program Files (x86)\Google\Picasa3\runtime\xhairs.png

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe
File Type:	PNG image data, 72 x 72, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	4300
Entropy (8bit):	7.9470767012789185
Encrypted:	false
SSDEEP:	96:WeTU/xQitARxO8Iuga8hdckxjqUbosWZUnfz1EQArHF+z:WeT6iiISvZxjqOosWZSfRjYFE
MD5:	302ADC5B0621EF7EF052A1E1155A27C5
SHA1:	E808153F9CBC5C64EF2C9993AE40FFEFE912E399
SHA-256:	E8496052F51A1AFA5348D8B7675B2930B31CDEAE90DF72E87467C9D8358AD00E
SHA-512:	C7942FEFD49F133984F9D88033947D520FDA96B0D52718DC20E20F71EEE6291B23ED2638CCEC3E61FF0CA0C0510912BE5D36CA877E2836BC711B0D22E1CE3B22
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR...H...H.....U.G....gAMA.....OX2....tEXtSoftware.Adobe ImageReadyq.e<...^IDATx..\yp.e..L&39'.........(&.A..j1.. .R..RD.r-e....-DpY..G`a.....n8.f.p%....$..s.9f.}..&/....L2Y..0...........H..n..R.......#`...p....}.0.q4...H......V../.3...+a.. ).F...>...0&....O@........p..7..F.....D$...P..n.MDp..5..r.!...H".T\..u.`D.s......c..5.L...^N...P@.k.I.:ujf\\\jppp_.L.(.H.cbbZ}..;.....6...j.^...-.wo.-[.!`...I....E.......~.8}.......J.. '...Cb..............&.J..X6..o{SS..`0\...:..g.......e.".......p.$?p....#F...........l.S.....[s..%]QQQ.]..P.&M.t2##....../.G......1.6..9..Ug...Y.\|.e.).a...L....."....._~..%.....%2P.Fc......+....x..=..."7./..!.0.`.6l.08++kp.>}...8...b.....].m...wQ.D.}..$~.......lfBB.....!..0.;.a[.j..O..x.N>.....Z.@.aT.P.X3f....V.\.4.k..mOv.V..z.....o.F.`6.........Jx......4Ce2.....W_}.... J..f.!@.`.U..W0n3..Q..5ch.FpJJJ.M.&.....a.~....iii.`...c!............=.[....FWTT.........>..4#.u.:..Z.....-..-..........1.[.n..7..#F.h

C:\Program Files (x86)\Google\Picasa3\runtime\youtube.fen

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe
File Type:	ASCII text, with very long lines (349)
Category:	dropped
Size (bytes):	1511
Entropy (8bit):	4.700365459317251
Encrypted:	false
SSDEEP:	24:Dv0LBSELnOLCpSELnOLe+d0ELnOLckce+SELnAde+KTwsOTB5hRtdjKT6ZkH906F:YFOyOi+fOoRHAdejTwsOTBfjdOT6id0K
MD5:	6E757BF085B7FC23D18C247D656517EE
SHA1:	057CF6C97FED2449BF9AD59E55AC436FC7385E3A
SHA-256:	35B69907F6A4EF37D4340940885D32AE916B7F6A3AFEC94ADBD244D1D464D44A
SHA-512:	61A950881C9B54FEDD4CF77F0D18C734E041C1364B22706593183D4B71550E98483E51ACB868CBCDD59FE72CF863285759DF7FCECDB81E711CC6C86A48C262D3
Malicious:	false
Reputation:	unknown
Preview:	<window title="Upload to YouTube" width="fit">. <labelgroup title="Title:" width="fill">. <edit name="title" width="23em"/>. </labelgroup>. <labelgroup title="Description:" width="fill">. <edit name="description" width="fill" height="2li"/>. </labelgroup>. <labelgroup title="Video category:" width="fill">. <popup name="category">. <item title="Loading..."/>. </popup>. </labelgroup>. <labelgroup title="Tags:" width="fill">. <label width="fill" title="These are keywords used to help people find your video. (space separated)"/>. <edit name="tags" width="fill"/>. <check name="public" title="Make this video public"/>. </labelgroup>. <separator/>. <label align="center" title="Your video is limited to 10 minutes and 1 GB"/>. <label text-align="center" width="fill" name="legal" title="Do not upload any TV shows, music videos, music concerts, or commercials without permission unless they consist entirely of content you created yourself. The Copyright Tips pa

C:\Program Files (x86)\Google\Picasa3\uninstall.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive
Category:	dropped
Size (bytes):	212240
Entropy (8bit):	7.485550014492417
Encrypted:	false
SSDEEP:	6144:dW+7+eMKo1DymiYXt4XbrG7XZv+1v0EoDwXvx:dRtGDymiYKG7XN+18E7J
MD5:	3A08977ADC09A57DF210E6966660046B
SHA1:	53647D418AE8548D0359EDCF51B80A6F3A43D877
SHA-256:	002E9254E29D6DC9E760EA08BFC1A0DE4EBF887D4B4580DF0355EB44420D9CD0
SHA-512:	FE79F6C6C8003C14885049C0C33E1147B25E6DDC68911F5A717837B56809E8F9CFA6984B422F4912C45C835F9007F11D0E99DB30DFCC0D8EA759461819961998
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......1.D9u.ju.ju.j..ujw.ju.+j..j..wjd.j!..j..j..,jt.jRichu.j........PE..L....n3T.................`.........Z3.......p....@.......................................@..................................t...........<...........#..H............................................................p...............................text....^.......`.................. ..`.rdata..T....p.......d..............@..@.data................x..............@....ndata...................................rsrc....<.......>...~..............@..@................................................................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Google\Picasa3\update\LifeScapeUpdater\currentVersion.ini

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	67
Entropy (8bit):	4.8321931536957266
Encrypted:	false
SSDEEP:	3:3zGEVAtmlTyYaYAQSKEKtQRAY:SaeoATKE5
MD5:	1544CE8FC87FC86288C6B464F5B0828C
SHA1:	F13665BD7D1A3CE88147D70E577125665EB39591
SHA-256:	652B5A200AF64AC1F836646E948E46C0584425F70263BCDAFC28D6C8B4E2FD55
SHA-512:	DCEB4586C651B5938E59D8FCC56F48C84F4D5B0DFB3F82E9FABB4B33E6D1A2446DFC9F6535A9F10D5567881C4391046B1943C2DF1F76FC4D9627A958EA4D80E3
Malicious:	false
Reputation:	unknown
Preview:	[LifescapeUpdater]..versionID=3.9.141.255..downloadURL=update.exe..

C:\Program Files (x86)\Google\Picasa3\web\documentation\examples\assets\maketext18.gif

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe
File Type:	GIF image data, version 87a, 397 x 22
Category:	dropped
Size (bytes):	2811
Entropy (8bit):	6.587212037968287
Encrypted:	false
SSDEEP:	48:c8NmW4Q+6KBcr6ZfLW96eJ2Clkk7SimUrupSk2w01iFvYiWU:c88W4UMGJ2C8gipgkWU
MD5:	4DDF6EAB4029EBA1161DC3FAEC70582F
SHA1:	5219576328CC83ED10BB8739F77F17F5D07A539B
SHA-256:	9D73B6E5916AFD7E5A998CE96DC70A4E23AF80D6CDDD8AE4AB96D59885719420
SHA-512:	025D0B87803E99953E9B6B9979DEACFF7DB36CFF119810A5B7D634B521A1D694EACCC6D95778BD336DB5791E1AF12977FCF73BB7042E0C7035E77830D5CCB458
Malicious:	false
Reputation:	unknown
Preview:	GIF87a..........................................................}}}ssshhh]]]QQQCCC444""".....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................,...............H......\....#J.H....3j.... C..I...(S.\...0c.I...2.(.@.B...h.."....4.....C{R...T......@j....2.....e..\|@.....J.....]..Tv..`... .. .A]..0...b....=0p.]..%...`q\......7!...1.^\.......[.d..

C:\Program Files (x86)\Google\Picasa3\web\documentation\examples\assets\nav.gif

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe
File Type:	GIF image data, version 89a, 127 x 45
Category:	dropped
Size (bytes):	823
Entropy (8bit):	7.45916095795822
Encrypted:	false
SSDEEP:	12:7huTnmJpgP+oJqdJTzpKNs/cLhmW8jRcxzMjNnwTCkUzypvQ8rANEYwEfFSlM9Ul:rcGFJZq0joziNnTR+pvQFEYff4eC
MD5:	CF52FA0604311640650D71AA1EC08F70
SHA1:	170E17F0D85C87DE5329ED941F2ECCC93A2564BA
SHA-256:	1FC4BE34D753EE38D2392822326375A605C23CA313A599571287E8B515A8C35A
SHA-512:	C7D6AB5FD67D122CB4C9DE556BF9F0FB8988B1825CF5A8F0CF17E78D5B120C9FE0C7534364AC5DC892D6E30EE63716D543E25CCFC6A7B5B5D30329C5B2BADECE
Malicious:	false
Reputation:	unknown
Preview:	GIF89a..-....................................fffOOO???333...................................................!.......,......-.... .dY.h!.)J.D[.em.x..r.Qo.{.Z..r.d........(..B.R..j.v.\.w.n......Lg..v.-/..MvMx`JSE~...].OK.....0.........u..>...#.L..J........;.z.(.'\|.q..9...Q.n^.d.8.A...b.'F..6.;.@.{.3...7.:..(....5.9.'...f.$.8.........S...\H..6.....4.!.~7..[...8..mhL..^...C......".s..41o.I../:\|f..3y.$i.g>.;..$..dR\9...J...X.\....`u\|.K.^....:.b...n.kJ-....p1.._-...-.....Z.DP..A.......X.....4`.W..J..4`....y...Lg......<.2....(f.a.......i......` ...}..~. .....<........k..@.....Bx.y...........#.0..3.[M{u...l...". _.q.e. B..U.l..W..:..@..<8...@..x.$HB.#.G....'....'.............@.$.a"z,.'#.4^..\|.@...-.x_.y%..\|.0P..;.uc%........{Q..."0@e.....b;N(B..6 X..l(...}.Ao].9..t..@.......=*...Nji......;

C:\Program Files (x86)\Google\Picasa3\web\documentation\examples\assets\prevnext.gif

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe
File Type:	GIF image data, version 89a, 70 x 45
Category:	dropped
Size (bytes):	499
Entropy (8bit):	6.834211680516138
Encrypted:	false
SSDEEP:	12:iTuI0Fzv1JAvqbqZ2q1xPgd+j8SvX70jeFQ/FE:9ztJDOZ//y+jPvz
MD5:	C67ABB91625676DC8789862A28C50CDC
SHA1:	F3442BC5BF2A4FCEDD929543D51DDF5376C0BCFE
SHA-256:	72821A1CC66EA33222D87686A4D91BCB3CB7B068CCA7C3930575477BED270116
SHA-512:	8613A7FF20B889051133B0F156F76BCBA9BEA732D7FFBFEDB52577093ED54A6B24605AFB4D98BF5479EBC085609BE37027610D101D62F2566EA82B10959ECDB1
Malicious:	false
Reputation:	unknown
Preview:	GIF89aF.-....................................fffOOO???333...................................................!.......,....F.-.... .di.f....P.pM....<.6_!.\|..BZ.$...A..eM.U.lJ...b........m...b$.]...$.,...et}O{.y."3~."G.i..............Q....D.........D.4..K...."......".....#..................E................".#.........D.K..........< .D........&...@.2L.......p..b.D8(.0.5.X.p.h`."1~...x....}.7z...DM.@...#.r3.x.....lFh.B.....t...A..8.-`8.....HB.ju...n.......x..........L.....+....;

C:\Program Files (x86)\Google\Picasa3\web\documentation\examples\assets\style.css

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	589
Entropy (8bit):	5.572039171428112
Encrypted:	false
SSDEEP:	12:C2bDgIZSJZdToGPBSJZdTpC2M1aSJ1eUgD7DqvTSJZdTpCn:C2bDtEJZRMJZRDinJUjnAOJZRI
MD5:	CB75FA80755989777D10BCEF1F388F2C
SHA1:	8680CC7DE7825A2849627F7D3EA3808FDFE54A1A
SHA-256:	934E24930863F409EE2B7F7FE2C192061F9F84810163FBB548AA4615A3644A7A
SHA-512:	F64A2035690401B1C2BEFEEB192BE70D1FC409C0B2F51A1132916EF61E841DFA0569773703F16CBC23B7E4BBB3AA78F18FA7543524CA57B6DDF868F40390D192
Malicious:	false
Reputation:	unknown
Preview:	BODY {..MARGIN-TOP: 100px; FONT-SIZE: 11px; BACKGROUND-ATTACHMENT: scroll; BACKGROUND-IMAGE: url(http://www.stereopsis.com/bg.gif); MARGIN-LEFT: 80px; BACKGROUND-REPEAT: no-repeat; FONT-FAMILY: Verdana, Arial, Helvetica, sans-serif; BACKGROUND-COLOR: #ffffff.}.TD {..FONT-SIZE: 11px; FONT-FAMILY: Verdana, Arial, Helvetica, sans-serif.}.P {..BACKGROUND: white.}.H1 {..FONT-SIZE: 30px; COLOR: #979797; FONT-FAMILY: Helvetica, Verdana, Arial.}.A:hover {..COLOR: #804c4c; BACKGROUND-COLOR: #f0efe3.}.H3 {..FONT-SIZE: 14px; COLOR: #000000; FONT-FAMILY: Verdana, Arial, Helvetica, sans-serif.}.

C:\Program Files (x86)\Google\Picasa3\web\documentation\examples\footer.html

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	103
Entropy (8bit):	4.665829203207896
Encrypted:	false
SSDEEP:	3:jvw9qrHL/ZEusjTIWltfTFADaE9HtetTEVLZcKBc4NGL:r7iuQTft76DP5gicKq4QL
MD5:	75CE1C70A50C40E76FFD78CDA74AB479
SHA1:	D322EECB2D31480831DDF71B587409646BF19995
SHA-256:	E8CA4079F6A9BF0360B6BD871EC5323CCEBE0BA0F9A6A55F545C40683DDA527E
SHA-512:	55D96A665A2E447C6C72D71666976BCE91CC086046E8CA4C078E30AF3F6FCF378B83DF9A7827EA8B00D304EE30E2E5E87E1480F6E2D1D9C37C01BD54474FF722
Malicious:	false
Reputation:	unknown
Preview:	<map name="Map">. <area shape="rect" coords="95,1,129,44" href="frameset.htm">.</map>.</body>.</html>.

C:\Program Files (x86)\Google\Picasa3\web\documentation\examples\header.html

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe
File Type:	HTML document, ASCII text
Category:	dropped
Size (bytes):	309
Entropy (8bit):	4.990864998461542
Encrypted:	false
SSDEEP:	6:qFzLMAA46QcjWR0NNEXW0YeeT6xvzMkdxWHGjweRRAuvqYEY2EWpO:GA46QclfYvwYxWHGjRAuYY2EgO
MD5:	A69CD84CA10D26F31399F7DE2A26A6D3
SHA1:	29CD755EF723582420002B56426F4796A87ACB32
SHA-256:	9BDEB265A19890F86E88B154522087E86B848E5E5C110C1108B8B83C1D37874A
SHA-512:	CB65FE080A1AC16BF2DCF0E1523A1E17D9690B679926D119B0ABAB0392C9EE12059B4473768335E9976FD8462DFBB50193918B4C516547DB7056EF307EA6AE8D
Malicious:	false
Reputation:	unknown
Preview:	<html>.<head>.<title><%albumName%></title>.<meta http-equiv="Content-Type" content="text/html; charset=UTF-8">.<link rel="stylesheet" href="style.css" type="text/css">.</head>.<body bgcolor="#FFFFFF" text="#000000">.<h1><%albumName%> (<%albumItemCount%> images)</h1>.<h2><%albumCaption%></h2>.<p class="desc">

C:\Program Files (x86)\Google\Picasa3\web\documentation\examples\imagelistelement.html

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe
File Type:	HTML document, ASCII text
Category:	dropped
Size (bytes):	205
Entropy (8bit):	4.5708908639061345
Encrypted:	false
SSDEEP:	3:uNXADjtA+dMIGUeQBEqIMc+MRNws+eMRiDR498AjxAhLhRFWdKdPL:uFAHXdzEqx4+4DR4OcuXFWd0
MD5:	B4DEEAC3F0C04D967DCB1F990F61C999
SHA1:	098400511D66C556DDE2CB4537C8C41EF37ED7B5
SHA-256:	B013A6C7857D61CE31E484D4663DFC1514275449C8875E23BDE5FF38DE277453
SHA-512:	D706CDF80376C87FE87891B603BFD545C0228F6A51A35ECE27A8AC90B284570D07A7C634388E680395A674C21B3FF7DC2E3FFB6D8ACE29B097608065DB01246E
Malicious:	false
Reputation:	unknown
Preview:	<a href="<%itemLargeImage%>"><img src="<%itemThumbnailImage%>" width="<%itemThumbnailWidth%>" height="<%itemThumbnailHeight%> alt="<%itemName%>"" title="<%itemName%> -- <%itemSize%> bytes" border="0"></a>.

C:\Program Files (x86)\Google\Picasa3\web\documentation\examples\imagelistfooter.html

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	12
Entropy (8bit):	2.6258145836939115
Encrypted:	false
SSDEEP:	3:6Tr:C
MD5:	E0C74237602B2A467D4D5001EC2EEAB6
SHA1:	C6A25EDAF62ECDA9412B72E55E9D49880C8176AF
SHA-256:	C9469A26C597E2155429150F992554598B7BF93EF906FD7F3CCD4B8BA4E6A082
SHA-512:	1627831BF78371AA2D16DCFBCC8723A93EA1651028F89A2C873CACD39A165FDC6843627114C5AF1628B44DA185A72718BAA3E8176E2CCF4620D4D4D4C1E121A8
Malicious:	false
Reputation:	unknown
Preview:	</p>.<hr><p>

C:\Program Files (x86)\Google\Picasa3\web\documentation\examples\imagelistheader.html

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	3
Entropy (8bit):	1.584962500721156
Encrypted:	false
SSDEEP:	3:P:P
MD5:	4DA1A46EC20CF93EE5C846A51E04F0ED
SHA1:	63ADA55C0BA212A5B1F8D5A70890788F00972BF4
SHA-256:	33F2799467177287A29260780A107AC98EA63DD6165F67FCC0D74767D0A82090
SHA-512:	CF55201BF1AC8CCB9A9AA36352064F3270A754C9B596C52F6E250F438E6AC9962E60A6696C55D90C8160C3682CD20ADEF0176068B8A832F5F4A9D134EACE8624
Malicious:	false
Reputation:	unknown
Preview:	<p>

C:\Program Files (x86)\Google\Picasa3\web\documentation\examples\imagetarget.tpl

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1559
Entropy (8bit):	4.44034819464168
Encrypted:	false
SSDEEP:	48:vklmUML2G8hB5rR8Pl7hg0SWHvr1Czl4R:vklmUMLt8/5WPhu0NPr1ol4R
MD5:	733D7425A101AD81C6BC5A96277169AC
SHA1:	8EF4AF5C8BBB1FA4E490B4DD11062DDEC2C9895A
SHA-256:	DD44A42584B81F8923177738C3CDBD925911D8ED2BE15CE2F50A9A54E48E9E06
SHA-512:	DB92DD75B0CB604726EC59B0AE618AB3533287F571D6A9B632BECCB1BB38A14113988DA8DE8C5A379DE8CECF9252960F2E0A1893F1C635BAF26A579192FC8036
Malicious:	false
Reputation:	unknown
Preview:	#templatefile 1.0 Lifescape web template file.# pound sign is a comment character.#.# lines that begin with "include" point to a file to be included at this point.# lines that begin with "loop" repeat the specified file once per image.# if loop or include files begin with "#templatefile" then that templatefile.# is processed in its entirety. In this way you can create .# file-per-image exports. .#.# The special "targetloop tplfile templatefile" command loops over each image, .# interpreting tplfile for each one. A sequence number is appended to the export filename.# specified in tplfile. After the tplfiles have been exported, templatefile is included once per.# exported file, with "<%target%>" defined as the relative path of the exported file..#.# The "copy" command copies the indicated path or directory to the export directory..# Examples:.# copy everything from the "assets\" directory at the same level as the template into the output dir.# copy assets\ .#.# copy a single file to the

C:\Program Files (x86)\Google\Picasa3\web\documentation\examples\includedtarget.html

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe
File Type:	HTML document, ASCII text
Category:	dropped
Size (bytes):	201
Entropy (8bit):	4.567838463729835
Encrypted:	false
SSDEEP:	3:uNXADj44o7ZJGUeQBEqIMc+MRNws+eMRiDR498AjxAhLhRFWdKdPL:uFAHQ7REqx4+4DR4OcuXFWd0
MD5:	59DF0DADFC29841B27EC64BFB918C7A2
SHA1:	773BFF86B6925BE3A1C4EF6B24A4FF5B10F7D6EB
SHA-256:	421D05E53D1FF77C0950FF3F6901ED88C7A48A675BA9B3BC00522D196D1F037E
SHA-512:	DB6CB7EE442894448E18E9215F4522EEB4B5D346E5EC67A0B306235C7EB4E82E288D07C8C08A9FFF30B49F0524FD0F1F917996A46C32B105217D38735FF63DAF
Malicious:	false
Reputation:	unknown
Preview:	<a href="<%targetPath%>"><img src="<%itemThumbnailImage%>" width="<%itemThumbnailWidth%>" height="<%itemThumbnailHeight%> alt="<%itemName%>"" title="<%itemName%> -- <%itemSize%> bytes" border="0"></a>.

C:\Program Files (x86)\Google\Picasa3\web\documentation\examples\index.tpl

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1927
Entropy (8bit):	4.433546490158435
Encrypted:	false
SSDEEP:	48:vklmUML2G8hB5rR8Pl7hg0SWHvrEMfl4Cgfuize:vklmUMLt8/5WPhu0NPrEMfl4CgLS
MD5:	7CC648EC6DCCA06A3799961CD3A32A7B
SHA1:	8E30E2292B89C964CD16A102FDBC3E76E1EB8FC5
SHA-256:	D5EFFA0BD2B42220DAAF125EAD655D91C2ABBE73A3E7F947A98F4DF20326E097
SHA-512:	20E3F3AC146122D99A5B289AAE6FE1B17DAB1331BAA37FA2B2BBAF39232540BF6190F2CD99CB1313CD4AC88C41586C2344D13145B24C28CD36478B3B6181189C
Malicious:	false
Reputation:	unknown
Preview:	#templatefile 1.0 Lifescape web template file.# pound sign is a comment character.#.# lines that begin with "include" point to a file to be included at this point.# lines that begin with "loop" repeat the specified file once per image.# if loop or include files begin with "#templatefile" then that templatefile.# is processed in its entirety. In this way you can create .# file-per-image exports. .#.# The special "targetloop tplfile templatefile" command loops over each image, .# interpreting tplfile for each one. A sequence number is appended to the export filename.# specified in tplfile. After the tplfiles have been exported, templatefile is included once per.# exported file, with "<%target%>" defined as the relative path of the exported file..#.# The "copy" command copies the indicated path or directory to the export directory..# Examples:.# copy everything from the "assets\" directory at the same level as the template into the output dir.# copy assets\ .#.# copy a single file to the

C:\Program Files (x86)\Google\Picasa3\web\documentation\examples\itemheader.html

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe
File Type:	HTML document, ASCII text
Category:	dropped
Size (bytes):	215
Entropy (8bit):	4.826357400543029
Encrypted:	false
SSDEEP:	6:qFzLM/46QcjWR0NNEXW0YeeT6xvzMkdxWHGjwew:J46QclfYvwYxWHGu
MD5:	44CDCEE98BEB140B4FDD41501F867453
SHA1:	2B16170936B4F49B262077A2136531C3DBA1D8CB
SHA-256:	7D9F6BA96B8797B57555D1799A7101F001327B012D85B1B75E0C859B065AD4AD
SHA-512:	BDD24BC95353DDBD777D47FDFC9C33EC412F89F39D15C9375D1D6976EB60F97994A47DC282FC43FB352E2307088141ED704C936079B95B67B5EEC7D05A6C0DCC
Malicious:	false
Reputation:	unknown
Preview:	<html>.<head>.<title><%itemName%></title>.<meta http-equiv="Content-Type" content="text/html; charset=UTF-8">.<link rel="stylesheet" href="style.css" type="text/css">.</head>.<body bgcolor="#FFFFFF" text="#000000">.

C:\Program Files (x86)\Google\Picasa3\web\documentation\examples\output_header.html

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe
File Type:	HTML document, ASCII text, with CR line terminators
Category:	dropped
Size (bytes):	468
Entropy (8bit):	4.946585296277453
Encrypted:	false
SSDEEP:	12:2VetAGI6Qclfbv2vu1HGCpXP3rWSVMCLx2tAY+CA:2A6sCvuVGCpXP3VMCLx2tA
MD5:	469AAF91B2CB8C2EADA443781B431BB4
SHA1:	0BEE96EA29B229F43F759751F06144A9CEB907B4
SHA-256:	5EC9312FC57F27B3C18119E910885A5667A52DEA8D01D2A36852770D776A987A
SHA-512:	B83A91AD6BE81C698B00B9961AA11241EBC23A9966B52C9B9124ABC0B8CB0315BBB76C04A9045FB5965CF340961F2D3C9F876AEC426CD1C0808B10204328FE27
Malicious:	false
Reputation:	unknown
Preview:	<html>..<head>..<title>TestWebExport albumName</title>..<meta http-equiv="Content-Type" content="text/html; chacharset=UTF-8">.<link rel="stylesheet" href="style.css" type="text/css">..</head>..TestConditional1 worked!!..<body bgcolor="#FFFFFF" text="#000000">..<table width="800" border="0" cellspacing="0" cellpadding="0">.. <tr>.. <td width="450" align="left" valign="top">TestWebExport albumName<br>.. <span class="desc">TestWebExport album caption string

C:\Program Files (x86)\Google\Picasa3\web\documentation\examples\style.css

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	78
Entropy (8bit):	4.586138199870895
Encrypted:	false
SSDEEP:	3:NGxLRIYC2BEwLk1JLty0MTJssdFDQRyuN3C:2oB1JLtdAsoMRJ9C
MD5:	28D394BF7F25566B8AE5101C8472C963
SHA1:	F87166AED2280D329F2F5CC8CFB68DCB9F79B3A8
SHA-256:	08CB5B18F7A2DAE61F8239AF79C105CF42350B0E484D50F2344049444C513866
SHA-512:	51D352560DFCCFB178E08C978CCB33DDE3FD2A60E87697695C34A3E1DD5BFF83B8D63F36AE3C18FCF8251054A0384E003A1996086A0C7175E6C9DB76CA9751EB
Malicious:	false
Reputation:	unknown
Preview:	.desc { font-family: Verdana, Arial, Helvetica, sans-serif; font-size: 11px}.

C:\Program Files (x86)\Google\Picasa3\web\documentation\examples\targetlistelement.html

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe
File Type:	HTML document, ASCII text
Category:	dropped
Size (bytes):	798
Entropy (8bit):	4.738320319271403
Encrypted:	false
SSDEEP:	24:fu85F6eBF6Rs60F6IrtF6IDZp0TcmmxzCnc+i1e:fH6u6O6c6cicmmEncte
MD5:	AC2C2FCFB2D183171D525D4402CD5698
SHA1:	03AFC393C24D1594B920D0B2E60C84AD0F8EE9DE
SHA-256:	F30DF1B2B452EAA6CCE9AA342C8F383339BFC096AC6372B97E2C9886013E01F0
SHA-512:	4006B95847D2418EB8C00FA4FB64F80C2D508E3A8627D651567BB0B47CD3B65EE9CDA925555BC14BBA7A19EB0482EE06BB2403646CAA952455E2C24B9D4B13F1
Malicious:	false
Reputation:	unknown
Preview:	<h1><%itemName%> -- <%itemSize%> bytes</h1>.<p>.<%if !isFirstTarget%><a href="<%firstTarget%>"><%endif%>First<%if !isFirstTarget%></a><%endif%> \| .<%if isPrevTarget%><a href="<%prevTarget%>"><%endif%>Previous<%if isPrevTarget%></a><%endif%> \| .<%if isNextTarget%><a href="<%nextTarget%>"><%endif%>Next<%if isNextTarget%></a><%endif%> \| .<%if !isLastTarget%><a href="<%lastTarget%>"><%endif%>Last<%if !isLastTarget%></a><%endif%>.<p>.<hr>.Thumbnail: <img src="<%itemThumbnailImage%>" width="<%itemThumbnailWidth%>" height="<%itemThumbnailHeight%> alt="<%itemName%>"" title="<%itemName%> (thumbnail)" border="0"><p>.FullSized: <a href="<%referrer%>"><img src="<%itemLargeImage%>" width="<%itemWidth%>" height="<%itemHeight%> alt="<%itemName%>"" title="<%itemName%> (large)" bytes" border="0"></a><p>.

C:\Program Files (x86)\Google\Picasa3\web\documentation\examples\targetlistheader.html

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.434183719779188
Encrypted:	false
SSDEEP:	3:r5DCJ4ARL0KGbv:rxCJ4ARLC
MD5:	1967F52FA6E3B804E955D03938ABE807
SHA1:	C9978703F757DD795D9FEE4A36D447D29CED9B2D
SHA-256:	D45B167DEF2543CA74A53AE62DE2858987CBE50D0DC17BD3BAA9C6D2AC1F19EA
SHA-512:	6773CB6B7FDB54EB8AECA729529322A74918D82406CB38F9E0E848F8352DF92593499BCB37375311B5AE5B7D445FF38E0D2E7A19CFD6AE85145BAF174CCB01F6
Malicious:	false
Reputation:	unknown
Preview:	<h1>Images With HTML Target Files:</h1>.

C:\Program Files (x86)\Google\Picasa3\web\documentation\index.html

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe
File Type:	HTML document, ASCII text
Category:	dropped
Size (bytes):	15403
Entropy (8bit):	4.803144264335707
Encrypted:	false
SSDEEP:	192:lKEckKEFZiRvTiZRvc2IoP4ZEJPQNG2Q90RnmTan1gRTO7XCRBkh6uFyWvRj2ked:ll27ifMG7g3s0P7Xph6EymRJCp
MD5:	6EB9E0DCC6407D2AE2349CF8325746DF
SHA1:	DA489A60D385B9D9B65A9FE224715A2AA01A7010
SHA-256:	2DEBADB3F59215BFED8DA5C0570E68ECC55EBBBFA9FD1E2581DA010CFE1B1A48
SHA-512:	3B8E8503D8C47362D1B32E3A688E1071EF4104A0CBBD0B9025DF3BC2052A6A8828529CB46A36C67580AE0D0F64B7A07484A39506862ED11BAF9A66EA073DBB3E
Malicious:	false
Reputation:	unknown
Preview:	<html>.<head>.<title>Picasa Web Templating</title>.<meta http-equiv="Content-Type" content="text/html; charset=UTF-8">.<link rel="stylesheet" href="style.css" type="text/css">.</head>.<body bgcolor="#FFFFFF" text="#000000">.<h1>The Picasa Web Templating System</h1>.<h2>Overview</h2>..When the user does a web page export from the current album in Picasa, the Picasa Web Templating system is used to produce the.desired HTML output. Web templates may be either template command (.tpl) files, or <a href="#includedFile">files which contain HTML formatting</a> .and special templating-system variables (typically with the extension .html)<p>..During an export, thumbnail and large-sized copies of the selected images are written to the "thumbnail" and "image" subdirectories of the selected.export directory, respectively. Then, the top-level template command file (always "index.tpl") in a template directory is .processed and the <a href="#templateCommands">commands</a> executed in order. The specia

C:\Program Files (x86)\Google\Picasa3\web\documentation\style.css

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	557
Entropy (8bit):	4.718417638536047
Encrypted:	false
SSDEEP:	12:UFUaJZdToMR/fJZdToMR/+DRMYV7rT42bbJZdToMRtAZnbacba2TbinmLmZ2lZr:U+aJZRnJZR4eYV734MbJZRsbaaaYinmT
MD5:	9E8FFB612E2A6B83E55CA84F5E2752C1
SHA1:	45C0CBE7A659B286D7731C39D5A5725E0FE50C7D
SHA-256:	14FE83441D1DAA035CA8763B7C15E32631F672ACA7D4A6C0953A5C34DEB1F452
SHA-512:	1164101839081635FF5BA7B957D94C54AEE19FB402CEE422DADD93376A69510A3DCE7665F03557EBFA00EB77524421E93791908DAA9F42C7AD9BEB84116BA5D3
Malicious:	false
Reputation:	unknown
Preview:	body { font-family: Verdana, Arial, Helvetica, sans-serif; font-size: 11px}.table { font-family: Verdana, Arial, Helvetica, sans-serif; font-size: 11px}.th { text-align: left; font-style: italic }.caption { text-align: bottom; vertical-align: bottom; font-family: Verdana, Arial, Helvetica, sans-serif; font-size: 18px}..parameterName { font-weight: bold; vertical-align: top}..commandcell { vertical-align: top}..commandrow {vertical-align: top}..notImplemented {color: red}..variableName { font-weight: bold }..variableDescription { font-weight: normal }

C:\Program Files (x86)\Google\Picasa3\web\templates\TemplateNotes.txt

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	598
Entropy (8bit):	4.7318910341696085
Encrypted:	false
SSDEEP:	12:8FR5b3gAA3xYdI25W68a5i+2MC5e02fRkIN5uG+ApT5B1nDLlWABagICn12nNP:8FRl3SYS2w6zo+rC5gk+9+ApTz1nDLUn
MD5:	E982708DF09DC6EC749E856B1FB332FF
SHA1:	AD6904B0D85D0C2C324BB7F6CFE3EB431A194B54
SHA-256:	729302B86E592E415339E54653FB4AA47BDE44D45EFA2E8253AF9A53F87591AB
SHA-512:	0EB38A4A59DF86855F07D6B4DD383CB826C85BB89D13AD0230646445D0C0A42415E2D174D27150991F3A322781A7D3F66EDF2B7BD32B652EDE25C9E0C33AC197
Malicious:	false
Reputation:	unknown
Preview:	.The following variables will be active for any page:..albumNumber.albumName.albumCaption.albumDate.albumItemCount...Within an image loop, the following variables will be active in addition to the album variables above:..itemNumber.itemName.itemOriginalPath.itemWidth.itemHeight.itemSize (in K).itemThumbnailImage.itemLargeImage..Conditional variables.isNextImage.isPrevImage..Conditionals are used like so.<%if isNextImage%>Some HTML goes here<%endif>..Templates are like so:..index.tpl -> index.htm..include header.htm..include index0.htm..loop index1.htm..include index2.htm..include footer.htm.

C:\Program Files (x86)\Google\Picasa3\web\templates\blackbg\assets\style.css

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe
File Type:	assembler source, ASCII text
Category:	dropped
Size (bytes):	856
Entropy (8bit):	5.408899757502812
Encrypted:	false
SSDEEP:	24:EJZRcJZRcldJUjkJZR5JZRNJZRPJZR6C7JZRc:EJZqJZkJUAJZbJZfJZBJZbJZ6
MD5:	10BB8100F07780FD53CFE5C05C6A90F2
SHA1:	FD94D5302C99AD156EB143A1EAE8346509F53AD6
SHA-256:	CBD9D5F5272E37C9687C82546732FCD8005DA7A81E63BC579A381F165686E464
SHA-512:	9E28897C8AE87C5ABF7A59314D2A3E5FDB63136057A64B52A72781845CE7D5CE84AE11674AB654437C71187DD0A6FA587912FEB4127020DA3F970DECDEB706AE
Malicious:	false
Reputation:	unknown
Preview:	BODY {..MARGIN-TOP: 70px; FONT-SIZE: 11px; MARGIN-LEFT: 80px; FONT-FAMILY: Verdana, Arial, Helvetica, sans-serif; BACKGROUND-COLOR: #000000.}.TD {..FONT-SIZE: 11px; FONT-FAMILY: Verdana, Arial, Helvetica, sans-serif.}.P {..BACKGROUND: black.}.H1 {..FONT-SIZE: 12px; COLOR: #979797; FONT-FAMILY: Helvetica, Verdana, Arial.}.A:hover {..COLOR: #804c4c; BACKGROUND-COLOR: #f0efe3.}.H2 {..FONT-SIZE: 10px; COLOR: #ffffff; FONT-FAMILY: Verdana, Arial, Helvetica, sans-serif.}.H3 {..FONT-SIZE: 18px; COLOR: #ffffff; FONT-FAMILY: Verdana, Arial, Helvetica, sans-serif.}..textsm {..FONT-SIZE: 14px; COLOR: #ffffff; FONT-FAMILY: Verdana, Arial, Helvetica, sans-serif.}..textbg {..FONT-SIZE: 20px; COLOR: #ffffff; FONT-FAMILY: Verdana, Arial, Helvetica, sans-serif.}..textreg {..FONT-SIZE: 12px; COLOR: #999999; FONT-FAMILY: Verdana, Arial, Helvetica, sans-serif.}...

C:\Program Files (x86)\Google\Picasa3\web\templates\blackbg\footer.html

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	103
Entropy (8bit):	4.665829203207896
Encrypted:	false
SSDEEP:	3:jvw9qrHL/ZEusjTIWltfTFADaE9HtetTEVLZcKBc4NGL:r7iuQTft76DP5gicKq4QL
MD5:	75CE1C70A50C40E76FFD78CDA74AB479
SHA1:	D322EECB2D31480831DDF71B587409646BF19995
SHA-256:	E8CA4079F6A9BF0360B6BD871EC5323CCEBE0BA0F9A6A55F545C40683DDA527E
SHA-512:	55D96A665A2E447C6C72D71666976BCE91CC086046E8CA4C078E30AF3F6FCF378B83DF9A7827EA8B00D304EE30E2E5E87E1480F6E2D1D9C37C01BD54474FF722
Malicious:	false
Reputation:	unknown
Preview:	<map name="Map">. <area shape="rect" coords="95,1,129,44" href="frameset.htm">.</map>.</body>.</html>.

C:\Program Files (x86)\Google\Picasa3\web\templates\blackbg\frameset.htm

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe
File Type:	HTML document, ASCII text
Category:	dropped
Size (bytes):	462
Entropy (8bit):	4.949323477586758
Encrypted:	false
SSDEEP:	12:XoPX6QclfutsxO0wKCyHRbh8Icd5hD3XHGawL:YPXs2GxOTKdR+IcdXXGj
MD5:	1F4D1252156541CF6825B694A4D51566
SHA1:	6BD741AAB174A778B0A912EF6DB825C4A7E2650C
SHA-256:	E45227535C0E87CE3B3E121E7CB568114A65F38B24DE3A951D91906BE838293E
SHA-512:	7FA923A564AAF18EADBE90569BD3A3A29E55436F84622C2584606B2069983A881C4BBB8447BCB68B1FEBEE9C471E27018DE26A6F39EA17E1843E60D12D035A76
Malicious:	false
Reputation:	unknown
Preview:	<html>.<head>.<title>Sunset in the Santa Monica Mountains Part 1</title>.<meta http-equiv="Content-Type" content="text/html; charset=UTF-8">.</head>.<frameset rows="85," cols="" border="0" framespacing="0" frameborder="NO"> . <frame src="head.htm" name="top" frameborder="NO" scrolling="NO">. <frame src="oneup.htm" name="bottom" frameborder="NO" scrolling="AUTO">.</frameset>.<noframes> .<body bgcolor="#FFFFFF" text="#000000">.</body>.</noframes> .</html>.

C:\Program Files (x86)\Google\Picasa3\web\templates\blackbg\header.html

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe
File Type:	HTML document, ASCII text
Category:	dropped
Size (bytes):	359
Entropy (8bit):	4.918140244794393
Encrypted:	false
SSDEEP:	6:qFzLO6QcjWR0NNEXW0YmRu+SKT6xvzMkdxWHGjwe3us/J7AuvqYESJ/sjsEWpO:Z6QclfF+2vwYxWHGVAuYSOsEgO
MD5:	E97374844EF118E3AC0A81A97FBF21BD
SHA1:	DE4DEC146A2427C3D3EED03034788F7CDC3BF5FC
SHA-256:	41E483B5E01EC66C066F13D810612A58ED8EB7B3B753D8A9B47EDE62A4AF7ED5
SHA-512:	795FCE4EDC52EA656E6A89DF5EA8439D40A944C65EF414783AE1E20440D59BB50F81A00CA947D4AE5039DACD9A92212BCAEBED2FBCB2CFBCC79CE80713AD84B2
Malicious:	false
Reputation:	unknown
Preview:	<html>.<head>.<meta http-equiv="Content-Type" content="text/html; charset=UTF-8">.<title><%exportDescription%></title>.<link rel="stylesheet" href="style.css" type="text/css">.</head>.<body bgcolor="#FFFFFF" text="#000000">.<span class="textbg"><%albumName%> (<%albumItemCount%> images)</span><br>.<span class="textsm"><%albumCaption%></span>.<p class="desc">

C:\Program Files (x86)\Google\Picasa3\web\templates\blackbg\imagelistelement.html

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe
File Type:	HTML document, ASCII text
Category:	dropped
Size (bytes):	182
Entropy (8bit):	4.568882633345414
Encrypted:	false
SSDEEP:	3:uNXADjtA+dMIGMLY32o+QBEqIMc+MRNws+eMRiDsRQ+lqPL:uFAHXdDYmojEqx4+4D0w
MD5:	1F5BC1D3D13E36CD76E50F44B1CCAC2C
SHA1:	E1B99B2E996BCAE144CED09CE491795C40D2764F
SHA-256:	BEDB80E2C65C7FF96469CC894BBD114737784EE7866ED5C0FFC7284AECB20D6C
SHA-512:	C897D5BCA66C6CF2F08403C4F153395C6781CBCC0A820CD479F9B045E236020B8960EF1B0AB545CCE18C87DF312C0CA04B711FEEB3A3E4DED3CF247E3F238572
Malicious:	false
Reputation:	unknown
Preview:	<a href="<%itemLargeImage%>"><img align="center" src="<%itemThumbnailImage%>" width="<%itemThumbnailWidth%>" height="<%itemThumbnailHeight%>" title="<%itemCaption%>" border="0"></a>.

C:\Program Files (x86)\Google\Picasa3\web\templates\blackbg\imagelistfooter.html

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	12
Entropy (8bit):	2.6258145836939115
Encrypted:	false
SSDEEP:	3:6Tr:C
MD5:	E0C74237602B2A467D4D5001EC2EEAB6
SHA1:	C6A25EDAF62ECDA9412B72E55E9D49880C8176AF
SHA-256:	C9469A26C597E2155429150F992554598B7BF93EF906FD7F3CCD4B8BA4E6A082
SHA-512:	1627831BF78371AA2D16DCFBCC8723A93EA1651028F89A2C873CACD39A165FDC6843627114C5AF1628B44DA185A72718BAA3E8176E2CCF4620D4D4D4C1E121A8
Malicious:	false
Reputation:	unknown
Preview:	</p>.<hr><p>

C:\Program Files (x86)\Google\Picasa3\web\templates\blackbg\imagelistheader.html

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	3
Entropy (8bit):	1.584962500721156
Encrypted:	false
SSDEEP:	3:P:P
MD5:	4DA1A46EC20CF93EE5C846A51E04F0ED
SHA1:	63ADA55C0BA212A5B1F8D5A70890788F00972BF4
SHA-256:	33F2799467177287A29260780A107AC98EA63DD6165F67FCC0D74767D0A82090
SHA-512:	CF55201BF1AC8CCB9A9AA36352064F3270A754C9B596C52F6E250F438E6AC9962E60A6696C55D90C8160C3682CD20ADEF0176068B8A832F5F4A9D134EACE8624
Malicious:	false
Reputation:	unknown
Preview:	<p>

C:\Program Files (x86)\Google\Picasa3\web\templates\blackbg\imagetarget.tpl

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1563
Entropy (8bit):	4.439872563240265
Encrypted:	false
SSDEEP:	48:vklmUML2G8hB5rR8Pl7hg0SWHv8SCzl4R:vklmUMLt8/5WPhu0NP8Sol4R
MD5:	8AFF34838DCEDBE0C42EC0A66A58D032
SHA1:	57A389E5D389161E6B0CE936C54EA036F1604404
SHA-256:	51764BA905E29B298E15EBB858616172E2DE9C2CAE0B27516810922668666ED5
SHA-512:	2A176CC0D1261D20E716F69D08D72AC3E43F9C7086421ACC3FBD13913794FE92A70CC0CA105724C53B099EBA1E81A929F46F43E170E8A5C21F6A463B01890C4D
Malicious:	false
Reputation:	unknown
Preview:	#templatefile 1.0 Lifescape web template file.# pound sign is a comment character.#.# lines that begin with "include" point to a file to be included at this point.# lines that begin with "loop" repeat the specified file once per image.# if loop or include files begin with "#templatefile" then that templatefile.# is processed in its entirety. In this way you can create .# file-per-image exports. .#.# The special "targetloop tplfile templatefile" command loops over each image, .# interpreting tplfile for each one. A sequence number is appended to the export filename.# specified in tplfile. After the tplfiles have been exported, templatefile is included once per.# exported file, with "<%target%>" defined as the relative path of the exported file..#.# The "copy" command copies the indicated path or directory to the export directory..# Examples:.# copy everything from the "assets\" directory at the same level as the template into the output dir.# copy assets\ .#.# copy a single file to the

C:\Program Files (x86)\Google\Picasa3\web\templates\blackbg\includedtarget.html

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe
File Type:	HTML document, ASCII text
Category:	dropped
Size (bytes):	178
Entropy (8bit):	4.562760577734868
Encrypted:	false
SSDEEP:	3:uNXADj44o7ZJGMLY32o+QBEqIMc+MRNws+eMRiDsRQ+lqPL:uFAHQ7tYmojEqx4+4D0w
MD5:	CC8FFE5BE72C7F6AEC09B84A7DC6C974
SHA1:	C6B620E722543D7ECAA45A3E2B07043CA22184B3
SHA-256:	7AB014BFDF2FB111B45087C90A495A14C339453C77DA9215B2B034D432386711
SHA-512:	6D4644C3F0800B32CFACC388DC1515ABB1FD668BF4F04258352CC5308F0E882CC67ADD65B72636F9E53132CEE30AFAD1DBE3274DF1DB7570BF2BC6F23B28F5D1
Malicious:	false
Reputation:	unknown
Preview:	<a href="<%targetPath%>"><img align="center" src="<%itemThumbnailImage%>" width="<%itemThumbnailWidth%>" height="<%itemThumbnailHeight%>" title="<%itemCaption%>" border="0"></a>.

C:\Program Files (x86)\Google\Picasa3\web\templates\blackbg\index.html

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe
File Type:	HTML document, ASCII text
Category:	dropped
Size (bytes):	667
Entropy (8bit):	4.973826498172302
Encrypted:	false
SSDEEP:	12:Z6QclfF+2vwYADHGbepXP3OSVMCLxLAJ8MbdxMCLxHdiwog5JHMpH2oWEgs3iDT/:ZsN+9TGqpXP3BMCLx9MnMCLxHagMpWoW
MD5:	94E21252FDB65E018486CD928C8D1378
SHA1:	B9169E767C9182C22BA3C5449A22CA5EC7B531F5
SHA-256:	CE651DEEF969E7E1204E6CDC7C85D136A793103D893032ACACD4EF9E30DAC2C2
SHA-512:	987BDEA4635BA0AEFEE39285F974C03E26B17E861DDEF1AD2B8F3468A219C056E086CD0D6DC91F93E2E2CDD9C50FAA24D0AA6BE7F80BF40A2FA8616E25463D5A
Malicious:	false
Reputation:	unknown
Preview:	<html>.<head>.<meta http-equiv="Content-Type" content="text/html; charset=UTF-8">.<title><%exportDescription%></title>.<link rel="stylesheet" href="style.css" type="text/css">.</head>..<body bgcolor="#FFFFFF" text="#000000">.<table width="800" border="0" cellspacing="0" cellpadding="0">. <tr>. <td width="450" align="left" valign="top"><%albumName%><br>. <span class="desc"><%albumCaption%></span></td>. <td align="left" valign="top"><img src="images/nav.gif" width="127" height="45" usemap="#Map" border="0"></td>. </tr>.</table>.<p class="desc">...<map name="Map">. <area shape="rect" coords="95,1,129,44" href="frameset.htm">.</map>.</body>.</html>.

C:\Program Files (x86)\Google\Picasa3\web\templates\blackbg\index.tpl

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe
File Type:	C source, ASCII text
Category:	dropped
Size (bytes):	2253
Entropy (8bit):	4.503027624109741
Encrypted:	false
SSDEEP:	48:ryYMd2lmUML2G8hB5rR8Pl7hg0SWHbC92Lr9LLX6rPfl46gfuize:eF2lmUMLt8/5WPhu0N74kr9LLXcPfl4g
MD5:	F3A5C50E415C7BF1E578AB07455D94E0
SHA1:	D24ADA30B4E94F901F212C0FC1D51B83D55D70B4
SHA-256:	80A21CCD3FDF2CD1247267461CC9B2A98E3DA35C70A87ED59C0AADD2651523EF
SHA-512:	D681BBD9C5A4C0DF79EE5DF141784EAE10CBA546DFF323A60776FD8A36E601DC79BB8B28BF9DFB6FF58A00714AB173DB3572C4E6D0A8F7FE215F0643614FB110
Malicious:	false
Reputation:	unknown
Preview:	#templatefile -v "1.0" -n "Template 2, 2-page black background" -d "Thumbnail index page linked to a full view picture page.".# pound sign is a comment character.#.# lines that begin with "include" point to a file to be included at this point.# lines that begin with "loop" repeat the specified file once per image.# if loop or include files begin with "#templatefile" then that templatefile.# is processed in its entirety. In this way you can create .# file-per-image exports. .#.# The special "targetloop tplfile templatefile" command loops over each image, .# interpreting tplfile for each one. A sequence number is appended to the export filename.# specified in tplfile. After the tplfiles have been exported, templatefile is included once per.# exported file, with "<%target%>" defined as the relative path of the exported file..#.# The "copy" command copies the indicated path or directory to the export directory..# Examples:.# copy everything from the "assets\" directory at the same level as

C:\Program Files (x86)\Google\Picasa3\web\templates\blackbg\itemheader.html

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe
File Type:	HTML document, ASCII text
Category:	dropped
Size (bytes):	215
Entropy (8bit):	4.826357400543029
Encrypted:	false
SSDEEP:	6:qFzLO6QcjWR0NNEXW0YmRZ4KT6xvzMkdxWHGjwew:Z6QclfqEvwYxWHGu
MD5:	331CFC47C3BD9A84097C6DC889AB366C
SHA1:	271273696CFF4DF446EB93A72F99A98A045BF5B2
SHA-256:	9891FC499E4FADBD26096441ED72BB1909FA5FB5540156D86278938BE69CAA60
SHA-512:	7118766A6DCDC078B985C99C94D38FE5EE35CBAE3324A64D761BB33BDCCC9EB16E24FC7D82B493D17F9DFFFD5EA3188DD9289356B6933C035D742336E2A7D2AF
Malicious:	false
Reputation:	unknown
Preview:	<html>.<head>.<meta http-equiv="Content-Type" content="text/html; charset=UTF-8">.<title><%itemName%></title>.<link rel="stylesheet" href="style.css" type="text/css">.</head>.<body bgcolor="#FFFFFF" text="#000000">.

C:\Program Files (x86)\Google\Picasa3\web\templates\blackbg\preview.jpg

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe
File Type:	JPEG image data, JFIF standard 1.02, aspect ratio, density 100x100, segment length 16, baseline, precision 8, 280x390, components 3
Category:	dropped
Size (bytes):	21634
Entropy (8bit):	7.946199130025125
Encrypted:	false
SSDEEP:	384:bbzcRFFxVzLJTK/nisSy1wFuAMV4xW7bP8rFo/rv0ZOHsj1EafWhkK:zcLZLJTKai16M+xW7bPN8Z2sjVu
MD5:	89FD39BB212940A16FE627A829511E22
SHA1:	D9E0BE1F03AF9183368AA84385BD762FCBA87498
SHA-256:	C07FAE0ECAFFF0D7D6D536D94F49A786682074739E2EF20C0BD23880CCEA53AB
SHA-512:	1DFD49E72AB75C125C43884CCB0730FB886A4CB61970B8DB72A0B082253BEB69C1E2C202B82CC71AC4E02D584E713B3F6F0F4A7C14DF2C3AB22DCADC69AFC342
Malicious:	false
Reputation:	unknown
Preview:	......JFIF.....d.d......Ducky.......P......Adobe.d.................................................................................................................................................................................................................................................."..!2.1ABR..Qb.#..T5.vaqr...3t...6V..8X......Cs$u.7WS4%.h...c..D...H..dUG&........................"2.!1ABR.Q.b.ar.q..#........3....CS$..............?.......@ .......@ .......@ .......@ .......@ .......@ .......@ .......@ .......@ .......@ .......@ .......@ .......@ .......@ .......@ .......@ .......@ .......@cV...^;.Z.v5.A.F.IF. .....U.j.I...w.Q..G$%Yi.M...X..e.5.xs......... ...8.:f...=..%..i1 ....Qn.....^cr.".7.]r....+R'.IT.W.....".....O.u.;)....3..W...7M.$....pT[....k*j8t.Z..9..47.\| .:x.BL..iH.".... D.~LW...F\9..W5........u..R'!1.......(t....\|....-....J$..S.7.$j8...+i..P.....Z...C.\,.y].N.%.P-@R.).:-.a.S....kU.j..dV.w.C...k.#j..f...SU......,I.4.U...{.....<E..e.U..X}.O.q.Y}

C:\Program Files (x86)\Google\Picasa3\web\templates\blackbg\style.css

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	78
Entropy (8bit):	4.586138199870895
Encrypted:	false
SSDEEP:	3:NGxLRIYC2BEwLk1JLty0MTJssdFDQRyuN3C:2oB1JLtdAsoMRJ9C
MD5:	28D394BF7F25566B8AE5101C8472C963
SHA1:	F87166AED2280D329F2F5CC8CFB68DCB9F79B3A8
SHA-256:	08CB5B18F7A2DAE61F8239AF79C105CF42350B0E484D50F2344049444C513866
SHA-512:	51D352560DFCCFB178E08C978CCB33DDE3FD2A60E87697695C34A3E1DD5BFF83B8D63F36AE3C18FCF8251054A0384E003A1996086A0C7175E6C9DB76CA9751EB
Malicious:	false
Reputation:	unknown
Preview:	.desc { font-family: Verdana, Arial, Helvetica, sans-serif; font-size: 11px}.

C:\Program Files (x86)\Google\Picasa3\web\templates\blackbg\targetlistelement.html

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe
File Type:	HTML document, ASCII text
Category:	dropped
Size (bytes):	1249
Entropy (8bit):	5.224086331549607
Encrypted:	false
SSDEEP:	24:espHPF6eHXF6ROHo0F6mrHrF6Ig86e0RuwsFmZFr4mL8XIOxzCu+i/:tpH962V6st6oR6o6erxmXr9gXIOEu3
MD5:	183742F8D48EFDE081B3C481394B750D
SHA1:	0763C35AC489AB54AA9C9B6648041A2FB2F7460B
SHA-256:	551B68A36B53429DC0341419E156AC7C8ACA74C5D19ADB6185F8F9E370CAEE85
SHA-512:	81789E9620654223C10A3FAC06ABEC7AC7CA70851E539E243711563D203AA0E41A5A0B23145D0AAC2B5410AA4F9CF22B3868E398FC4530C79BF8FB447E7F9455
Malicious:	false
Reputation:	unknown
Preview:	<span class="textbg"><%albumName%> -- <%itemCaption%> </span><br> <span class="textsm"></span>.<p><span class="textreg">.<%if !isFirstTarget%><a href="<%firstTarget%>"><%endif%>First<%if !isFirstTarget%></a><%endif%> \|.<%if isPrevTarget%><a href="<%prevTarget%>"><%endif%>Previous Picture<%if isPrevTarget%></a><%endif%> \|.<%if isNextTarget%><a href="<%nextTarget%>"><%endif%>Next Picture<%if isNextTarget%></a><%endif%> \|.<%if !isLastTarget%><a href="<%lastTarget%>"><%endif%>Last<%if !isLastTarget%></a><%endif%> \| <a href="<%referrer%>">Thumbnails</a><br>.</span><hr size="1">.<%if isSimpleEmbed%>.<embed src="<%itemLargeImage%>" autoplay="true" showcontrols="true" controller="true">.<%endif%>.<%if isExtendedEmbed%>.<OBJECT ID="MediaPlayer" .CLASSID="CLSID:22D6F312-B0F6-11D0-94AB-0080C74C7E95" .TYPE="application/x-oleobject".STANDBY="Loading Windows Media Player components...">.<PARAM NAME="FileName" VALUE="<%itemLargeImage%>">.<PARAM NAME="autostart" VALUE="1">.<PARAM NAME="showcontrols" V

C:\Program Files (x86)\Google\Picasa3\web\templates\blackbg\targetlistheader.html

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	85
Entropy (8bit):	4.5114696122265014
Encrypted:	false
SSDEEP:	3:ve/vdq0HRCAeFWl+z+LpM7vc9NCzv:W/Vq0EFF+LpgTv
MD5:	478250A789BB70B5121AEB9947FBDDD0
SHA1:	6A8B5E1B38E1F69E34EC146DD4FF9937C605C67A
SHA-256:	10D1D02F182A22DD96088C47434A9D35722AE9C8375D693C76576AA1A4CE8355
SHA-512:	21765C84D130BC020C66357C6F7C7A1709FBC204B35F8A47D20684E0FAF228B2CE8ADB657F95D4E6B26B97D44E01DC52601EFEE6371A055EE6A23564A62215C6
Malicious:	false
Reputation:	unknown
Preview:	<span class="textreg">Click a picture to see a larger view.</span><br>.<hr size="1">.

C:\Program Files (x86)\Google\Picasa3\web\templates\blackbg\verboseimagelistelement.html

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe
File Type:	HTML document, ASCII text
Category:	dropped
Size (bytes):	366
Entropy (8bit):	4.779429420784768
Encrypted:	false
SSDEEP:	6:gbXE+P6RMC7d+tPU+YMGXdDYmojEqx4+4D0I+scB4M+5CBtB5CB9n:gbU+P6iCstlYM+RROlW+00I+5BJB0B9n
MD5:	ED8842064398E0ABC3BF8BF40926168C
SHA1:	C9175EC82FAE118A375E9ADFA39F10603AF58F2A
SHA-256:	F485215249FD7978BB633CB75A02A3C6569BF3CEBF7D4ED2A591544C1A79F48F
SHA-512:	02BDE287797DDF754FE3EB3CDE4891936F0A3DE83815D1404EE27B8C0DB17A05C929E2BCE1823D71028C80D52E329C97F2AB6F70E24EF15BBA689F6ADD2413B3
Malicious:	false
Reputation:	unknown
Preview:	<hr size="1">.<%if isFirstImage%>First Image: <%endif%>.<%if isPrevImage%><--Prev Image(<%prevImage%>)<%endif%>.<a href="<%itemLargeImage%>"><img align="center" src="<%itemThumbnailImage%>" width="<%itemThumbnailWidth%>" height="<%itemThumbnailHeight%>" title="<%itemCaption%>" border="0"></a>.<%if isNextImage%>Next Image(<%nextImage%>)--><%nextImage%><%endif%>.<p>

C:\Program Files (x86)\Google\Picasa3\web\templates\blackfrm\assets\style.css

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe
File Type:	assembler source, ASCII text
Category:	dropped
Size (bytes):	1106
Entropy (8bit):	5.4145998203291885
Encrypted:	false
SSDEEP:	24:CkbUEJZRcJZRcemJZREdJUjkJZR5JZRNJZRPJZR6C7JZRSmJZRS:NzJZqJZMJZKJUAJZbJZfJZBJZbJZ1JZQ
MD5:	A652CB651FC84C33E8FEE04E0C489528
SHA1:	00C8748312CA20A0E57F05A12CE2776A8338477D
SHA-256:	24C397DEEF7D3AA750EE0BCD63BD7B5EF3EA7B882D79E3BCC3A4B4C3FD24B36C
SHA-512:	784311B5B2D4BA7316FA515C79CB76CCCD8DB5CF7744ED56D2994F5AC0A1D3A6F9A985509FEDDB432740E6442A576D550BD3A6CA2A22134D56C6325668D1F64F
Malicious:	false
Reputation:	unknown
Preview:	BODY {..MARGIN-TOP: 10px; FONT-SIZE: 11px; BACKGROUND-ATTACHMENT: scroll; MARGIN-LEFT: 10px; BACKGROUND-REPEAT: no-repeat; FONT-FAMILY: Verdana, Arial, Helvetica, sans-serif; BACKGROUND-COLOR: #000000.}.TD {..FONT-SIZE: 11px; FONT-FAMILY: Verdana, Arial, Helvetica, sans-serif.}.P {..BACKGROUND: black..FONT-SIZE: 12px; COLOR: #ffffff; FONT-FAMILY: Verdana, Arial, Helvetica, sans-serif.}.H1 {..FONT-SIZE: 12px; COLOR: #979797; FONT-FAMILY: Helvetica, Verdana, Arial.}.A:hover {..COLOR: #804c4c; BACKGROUND-COLOR: #f0efe3.}.H2 {..FONT-SIZE: 10px; COLOR: #ffffff; FONT-FAMILY: Verdana, Arial, Helvetica, sans-serif.}.H3 {..FONT-SIZE: 18px; COLOR: #ffffff; FONT-FAMILY: Verdana, Arial, Helvetica, sans-serif.}..textsm {..FONT-SIZE: 14px; COLOR: #ffffff; FONT-FAMILY: Verdana, Arial, Helvetica, sans-serif.}..textbg {..FONT-SIZE: 20px; COLOR: #ffffff; FONT-FAMILY: Verdana, Arial, Helvetica, sans-serif.}..textreg {..FONT-SIZE: 12px; COLOR: #999999; FONT-FAMILY: Verdana, Arial, Helvetica, sans-serif.}.

C:\Program Files (x86)\Google\Picasa3\web\templates\blackfrm\caption.html

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe
File Type:	HTML document, ASCII text
Category:	dropped
Size (bytes):	337
Entropy (8bit):	4.844338013501573
Encrypted:	false
SSDEEP:	6:qFzLO6QcjWR0NNEXW0YeeT6xvzMkdxKR9dOEs/J7AmJMpvqYESJ/sjMbJqq4Qb:Z6QclfYvwYxu9QEsAmJxSOMbJIQb
MD5:	7A4C88D0249E2A5C6D8FB9D85FCAE445
SHA1:	035FB924AC0176E2C3CB447A18ED3A74B046E977
SHA-256:	E41227F996E9B68A8689180A18ED543D82D010273001D4786D1AE3435AEDF70B
SHA-512:	389E0EB00A3360BAB13899D74D628723CF700B5BD45CC2AEDC336C4BE8606D822134E261393D96AF08DAC22F8171B17FB7F5FD6827367A457B6E270E37C1D8F8
Malicious:	false
Reputation:	unknown
Preview:	<html>.<head>.<meta http-equiv="Content-Type" content="text/html; charset=UTF-8">.<link rel="stylesheet" href="style.css" type="text/css">.</head>.<body>.<table cols=1><tr><td><span class="textbg"><%albumName%> -- <%albumDate%> (<%albumItemCount%> images)</span><br>.<span class="textsm"><%albumCaption%></span></td></tr>.</body>.</html>

C:\Program Files (x86)\Google\Picasa3\web\templates\blackfrm\footer.html

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.5
Encrypted:	false
SSDEEP:	3:TNGL:TQL
MD5:	1FFF66EFF9242EEE8EC3324428E15032
SHA1:	7BDB1E034041CBF3313DC597518E44660D3C2392
SHA-256:	02ED54EDC42FBBBC36988B2A184B67E49568BE4807832538BA9B7EDDA53744D8
SHA-512:	15C2A4A649B4A7BD3185D66BD41217F3394994DC79AB99ABA0DB9FAC3F8C91C7703E91CB22B788108C9F937E84A1CB3042CCA1FE9952346AC2BD1A387F84B266
Malicious:	false
Reputation:	unknown
Preview:	</body>.</html>.

C:\Program Files (x86)\Google\Picasa3\web\templates\blackfrm\frameImageSet.tpl

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1499
Entropy (8bit):	4.621169510209783
Encrypted:	false
SSDEEP:	24:ryYUi6M8rsk9iUML2B+0YFg9P1ZvDQ4FNcSzhvrR8PiaoNyJYlXYGVOBXQ0SW889:ryYZ6lmUML2G8hB5rR8Pl7hg0SWHzLAG
MD5:	444D4917BA86ACC73EF723AAE6B10268
SHA1:	DE1EFDBEA53D549E936B4C9B101B3F8635EDF5A8
SHA-256:	575273C2E901A9D2E9DED3BCAB77B27E7E6C0F11436AD857FCB4DB24DCBFB12F
SHA-512:	AE997DBF1DC949DE3AE8BE9B1BE4C2B5AB39E305856F99835BCD1AEEAE52E0FCF88DC382B05E80C437287B3E5443ADA01E19B3A1E72DED3CB624CDC99E9E4D51
Malicious:	false
Reputation:	unknown
Preview:	#templatefile -v "1.0" -n "SUBTEMPLATE" -d "USED INTERNALLY BY ANOTHER TEMPLATE".# pound sign is a comment character.#.# lines that begin with "include" point to a file to be included at this point.# lines that begin with "loop" repeat the specified file once per image.# if loop or include files begin with "#templatefile" then that templatefile.# is processed in its entirety. In this way you can create .# file-per-image exports. .#.# The special "targetloop tplfile templatefile" command loops over each image, .# interpreting tplfile for each one. A sequence number is appended to the export filename.# specified in tplfile. After the tplfiles have been exported, templatefile is included once per.# exported file, with "<%target%>" defined as the relative path of the exported file..#.# The "copy" command copies the indicated path or directory to the export directory..# Examples:.# copy everything from the "assets\" directory at the same level as the template into the output dir.# copy asse

C:\Program Files (x86)\Google\Picasa3\web\templates\blackfrm\frameIndex.html

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe
File Type:	HTML document, ASCII text
Category:	dropped
Size (bytes):	373
Entropy (8bit):	4.819286015302676
Encrypted:	false
SSDEEP:	6:qFzLO6QcjWR0NNEXW0YmRu+SKT6xvzMkdO5hG6t1fmLr0lBvHMF8LbS18l8LjWAx:Z6QclfF+2vwYshGCuL4l72CS9L
MD5:	CCBDE7A32E8BDB607EDE9F0BA023EF40
SHA1:	141AF16AE6A28F731EE39D6FC4B60104F80A251A
SHA-256:	F4D789DDA14F143C0D52B0BC92E1B2414F77D95C4C851941D3A892DBF9767885
SHA-512:	7BFC667E908D148B0C7E4BA1AD0CC0A148C06C60BF7CE191EEE73BB4D8174871261DAA367C99F0F909FFC1B8414269FB783EA1DF4FA509EDACB3A4C7474E958C
Malicious:	false
Reputation:	unknown
Preview:	<html>.<head>.<meta http-equiv="Content-Type" content="text/html; charset=UTF-8">.<title><%exportDescription%></title>.<link rel="stylesheet" href="style.css" type="text/css">.</head>.<frameset cols="100%" rows="10%,*" border="0">.<frame src="caption.html" scrolling="no" border="no" border="0">.</frame>.<frame src="imageset.html" border="0">.</frame>.</frameset>.</html>.

C:\Program Files (x86)\Google\Picasa3\web\templates\blackfrm\framebase.tpl

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1486
Entropy (8bit):	4.4835856487562715
Encrypted:	false
SSDEEP:	24:P3JeM8rsk9iUML2B+0YFg9P1ZvDQ4FNcSzhvrR8PiaoNyJYlXYGVOBXQ0SW88Hzo:vklmUML2G8hB5rR8Pl7hg0SWHzLAq6bF
MD5:	8529E772BDB2B46F4D2C8CDF9D707F08
SHA1:	C223756A32C9F76ED981694BBEA920D1405DB757
SHA-256:	25862E264FC0096A32E0E3417AEA55A3ECB35C2262C0D620DE9BEDF694486C2E
SHA-512:	5D5565940D54CD0749CD1289F839827FF1F4C0CF14BD63CC9C630E62FB7822D484A4378832EA694ADD55F77AD87932C6E329F852DD3CF480D34F0BEBDB634569
Malicious:	false
Reputation:	unknown
Preview:	#templatefile 1.0 Lifescape web template file.# pound sign is a comment character.#.# lines that begin with "include" point to a file to be included at this point.# lines that begin with "loop" repeat the specified file once per image.# if loop or include files begin with "#templatefile" then that templatefile.# is processed in its entirety. In this way you can create .# file-per-image exports. .#.# The special "targetloop tplfile templatefile" command loops over each image, .# interpreting tplfile for each one. A sequence number is appended to the export filename.# specified in tplfile. After the tplfiles have been exported, templatefile is included once per.# exported file, with "<%target%>" defined as the relative path of the exported file..#.# The "copy" command copies the indicated path or directory to the export directory..# Examples:.# copy everything from the "assets\" directory at the same level as the template into the output dir.# copy assets\ .#.# copy a single file to the

C:\Program Files (x86)\Google\Picasa3\web\templates\blackfrm\framecaption.tpl

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1497
Entropy (8bit):	4.621858773387597
Encrypted:	false
SSDEEP:	24:ryYUi6M8rsk9iUML2B+0YFg9P1ZvDQ4FNcSzhvrR8PiaoNyJYlXYGVOBXQ0SW88z:ryYZ6lmUML2G8hB5rR8Pl7hg0SWHzLAc
MD5:	22ECF8F68A2A89356E1B1F1C8829D828
SHA1:	8A93576BE66B88803EF0857E1D77E9706C012ED5
SHA-256:	AA4B8F32AABC77BCDFB753BA216DA7048E9F49CCC96D55F981722BC0F300DCBE
SHA-512:	E5A0519BDC3113798E83212679727A49BD00A0986928E3E78BAC021FEEBD5628EB20C07D95332A2B9BE5462CB720980CB621007C4D8ED18C52B00EDD55B88C5F
Malicious:	false
Reputation:	unknown
Preview:	#templatefile -v "1.0" -n "SUBTEMPLATE" -d "USED INTERNALLY BY ANOTHER TEMPLATE".# pound sign is a comment character.#.# lines that begin with "include" point to a file to be included at this point.# lines that begin with "loop" repeat the specified file once per image.# if loop or include files begin with "#templatefile" then that templatefile.# is processed in its entirety. In this way you can create .# file-per-image exports. .#.# The special "targetloop tplfile templatefile" command loops over each image, .# interpreting tplfile for each one. A sequence number is appended to the export filename.# specified in tplfile. After the tplfiles have been exported, templatefile is included once per.# exported file, with "<%target%>" defined as the relative path of the exported file..#.# The "copy" command copies the indicated path or directory to the export directory..# Examples:.# copy everything from the "assets\" directory at the same level as the template into the output dir.# copy asse

C:\Program Files (x86)\Google\Picasa3\web\templates\blackfrm\header.html

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe
File Type:	HTML document, ASCII text
Category:	dropped
Size (bytes):	176
Entropy (8bit):	4.6991037382833545
Encrypted:	false
SSDEEP:	3:qVvzL6HjJDeIeAlGKA+KWRIJaGNEXW0YEjgDMRJwKIAmBLLyFzT6xgoVlRAdnWAG:qFzLO6QcjWR0NNEXW0YmRWA4KT6xvzMY
MD5:	11E33A87FBBBBEF4892E71536242FBA6
SHA1:	6B6C3524E035D0C0AA7E388D3CAA0A7A9A254CC3
SHA-256:	BE9605E09FC08FE7300CAA43736A113B0FAD16ABFAC511096EC402BE57498646
SHA-512:	1770D9F73808019DCFCBB252AB74E25CAE56C7E0794873CB622ADCB545F272821B6168F2406431A43710FFF7C7C14D09C3F34063817E6C6378DF5F12B5DE6B29
Malicious:	false
Reputation:	unknown
Preview:	<html>.<head>.<meta http-equiv="Content-Type" content="text/html; charset=UTF-8">.<title><%albumName%></title>.<link rel="stylesheet" href="style.css" type="text/css">.</head>.

C:\Program Files (x86)\Google\Picasa3\web\templates\blackfrm\imageset.html

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe
File Type:	HTML document, ASCII text
Category:	dropped
Size (bytes):	371
Entropy (8bit):	4.7808620419069765
Encrypted:	false
SSDEEP:	6:G6QcjWR0NNEXW0YmRWA4KT6xvzMkdO5hGBofjBvHcuLbQbuJlELjWALVLjWALxb:G6QclfVAEvwYshGBofjKUQbGl6F9b
MD5:	CA0A0ADD9A6CD2DE7364E16A011DCB08
SHA1:	2A78C4EF7DDFD3B18341D2EA9EAD89FC6264784D
SHA-256:	EDA2BC2D247AB47594C6EDEDA99EFE9A1704B61DDC081B8324DBEA98702B4750
SHA-512:	1E97AF247A1DDABCCA01F3D5533530C660B5D0F8A0736CB3860DC7DCF760AB077D6C0AEDE89D5C93C7AFC21C045613F9060F080FE26CFE300585AF104F2C3D6E
Malicious:	false
Reputation:	unknown
Preview:	<head>.<meta http-equiv="Content-Type" content="text/html; charset=UTF-8">.<title><%albumName%></title>.<link rel="stylesheet" href="style.css" type="text/css">.</head>.<frameset cols="180,*" border="0">.<frame src="thumbnails.html" scrolling="yes" border="0">.</frame>.<frame src="target0.html" name="images" border="0">.</frame>.</frameset>.</frame>.</frameset>.</html>

C:\Program Files (x86)\Google\Picasa3\web\templates\blackfrm\imagetarget.tpl

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1496
Entropy (8bit):	4.545704889100564
Encrypted:	false
SSDEEP:	24:ryYUi6M8rsk9iUML2B+0YFg9P1ZvDQ4FNcSzhvrR8PiaoNyJYlXYGVOBXQ0SW88P:ryYZ6lmUML2G8hB5rR8Pl7hg0SWHMzl2
MD5:	623DB4BE5CA2327B660D2C03C2C9D572
SHA1:	3F1A51178D47C0BC2387303DBB1B77291F3B8AF4
SHA-256:	F03BD8BB2A56D1F052BD1A930E9F2D4743D3C84F18BBF9D2C6A59FE025449D31
SHA-512:	13C815BEDCE9928F0276A3F8653940E3CCCB878BD838DFF6535928F1109E2D3F409B85C64D5A9F9605DCD9C41F41ED0CAFCABF5CCAFB9C9DB867B9FBA397BE93
Malicious:	false
Reputation:	unknown
Preview:	#templatefile -v "1.0" -n "SUBTEMPLATE" -d "USED INTERNALLY BY ANOTHER TEMPLATE".# pound sign is a comment character.#.# lines that begin with "include" point to a file to be included at this point.# lines that begin with "loop" repeat the specified file once per image.# if loop or include files begin with "#templatefile" then that templatefile.# is processed in its entirety. In this way you can create .# file-per-image exports. .#.# The special "targetloop tplfile templatefile" command loops over each image, .# interpreting tplfile for each one. A sequence number is appended to the export filename.# specified in tplfile. After the tplfiles have been exported, templatefile is included once per.# exported file, with "<%target%>" defined as the relative path of the exported file..#.# The "copy" command copies the indicated path or directory to the export directory..# Examples:.# copy everything from the "assets\" directory at the same level as the template into the output dir.# copy asse

C:\Program Files (x86)\Google\Picasa3\web\templates\blackfrm\includedtarget.html

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe
File Type:	HTML document, ASCII text
Category:	dropped
Size (bytes):	227
Entropy (8bit):	4.607874890559247
Encrypted:	false
SSDEEP:	3:sWqw9rQBssNQDj44olR9A+pPONUeQBEqIMc+MRNws+eMRiDsNAjPKPhZA3Q+0pn:s2Qqs6HQl7A+PEqx4+4DCKP3ipn
MD5:	E500797FC8BF72FDE55A0094D52900E2
SHA1:	3233306B3E0E9A00ED36597C0349BA452DC667DC
SHA-256:	CB69613A96E703651155B2658859E5FEB7B3916E08C2639EB5231C97FCFF6F48
SHA-512:	55622D3AADBB5101AB566C75AC5E90320EB88571C7D9093AFA4D692F1C2AA9E8CAF60D11099EB5857CB3896E8FC8722C7D22681CAD2247A12B59696E8496C570
Malicious:	false
Reputation:	unknown
Preview:	<p class="framethumbnail"><a href="<%targetPath%>" target="images"><img src="<%itemThumbnailImage%>" width="<%itemThumbnailWidth%>" height="<%itemThumbnailHeight%>" title="<%itemName%>" border="0"></a><br>.<%itemCaption%></p>.

C:\Program Files (x86)\Google\Picasa3\web\templates\blackfrm\index.tpl

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1851
Entropy (8bit):	4.547156615530786
Encrypted:	false
SSDEEP:	48:ryYuv+9qdlmUML2G8hB5rR8Pl7hg0SWHbC92Lr9LAq6brGyT:eN7dlmUMLt8/5WPhu0N74kr9LARvGyT
MD5:	910AAA759177F569DE61B352A3B69F7E
SHA1:	29620F820447A58BA7BCBB61D25E42E4FB304CCF
SHA-256:	51F1404A822DAFCE5C8AD22ED11BA808F13E0278B7F97218B6A37550364B29B7
SHA-512:	0717EEE34C2A0A3C87A4A31C3023980B8F5C5507BA8F8A7E71CE858BC5454C63D11017EA281D0848DCDA13583C3D936F22EA5BED4AB172904F4F4B5A0A56C10D
Malicious:	false
Reputation:	unknown
Preview:	#templatefile -v "1.0" -n "Template 5, 1-page black background" -d "Scrollable thumbnail index on left with full view picture on right.".# pound sign is a comment character.#.# lines that begin with "include" point to a file to be included at this point.# lines that begin with "loop" repeat the specified file once per image.# if loop or include files begin with "#templatefile" then that templatefile.# is processed in its entirety. In this way you can create .# file-per-image exports. .#.# The special "targetloop tplfile templatefile" command loops over each image, .# interpreting tplfile for each one. A sequence number is appended to the export filename.# specified in tplfile. After the tplfiles have been exported, templatefile is included once per.# exported file, with "<%target%>" defined as the relative path of the exported file..#.# The "copy" command copies the indicated path or directory to the export directory..# Examples:.# copy everything from the "assets\" directory at the sa

C:\Program Files (x86)\Google\Picasa3\web\templates\blackfrm\itemheader.html

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe
File Type:	HTML document, ASCII text
Category:	dropped
Size (bytes):	215
Entropy (8bit):	4.826357400543029
Encrypted:	false
SSDEEP:	6:qFzLO6QcjWR0NNEXW0YmRZ4KT6xvzMkdxWHGjwew:Z6QclfqEvwYxWHGu
MD5:	331CFC47C3BD9A84097C6DC889AB366C
SHA1:	271273696CFF4DF446EB93A72F99A98A045BF5B2
SHA-256:	9891FC499E4FADBD26096441ED72BB1909FA5FB5540156D86278938BE69CAA60
SHA-512:	7118766A6DCDC078B985C99C94D38FE5EE35CBAE3324A64D761BB33BDCCC9EB16E24FC7D82B493D17F9DFFFD5EA3188DD9289356B6933C035D742336E2A7D2AF
Malicious:	false
Reputation:	unknown
Preview:	<html>.<head>.<meta http-equiv="Content-Type" content="text/html; charset=UTF-8">.<title><%itemName%></title>.<link rel="stylesheet" href="style.css" type="text/css">.</head>.<body bgcolor="#FFFFFF" text="#000000">.

C:\Program Files (x86)\Google\Picasa3\web\templates\blackfrm\preview.jpg

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe
File Type:	JPEG image data, JFIF standard 1.02, aspect ratio, density 100x100, segment length 16, baseline, precision 8, 280x390, components 3
Category:	dropped
Size (bytes):	24059
Entropy (8bit):	7.951075929486254
Encrypted:	false
SSDEEP:	384:hO86pX7/QsZVoYFr8LHvptBB423ZK+v86j5ml9N40L3NoAWLg5QC2w6AAAt:CRVoBpLB4Qp86dmlvvL9uLg5QTAAAt
MD5:	7678B01A4746DD37F8728DD6394C49AA
SHA1:	68805E4C3C5771CC139E87FE99E80AE93AEA55BD
SHA-256:	60A12F2029837CA162B58683A9ACA1A6D71A0278E582A29B26E246F3E29405EE
SHA-512:	8AF2F1C25D4C48D4F65D19494D42E9BD15240F6DF501536E095B30EF941C84D2673720B952F9F94289CAE9FEA672CFB592EF5506109685162AC4E71A33C40811
Malicious:	false
Reputation:	unknown
Preview:	......JFIF.....d.d......Ducky.......P......Adobe.d...................................................................................................................................................................................................................................................".!2..1ABR#..Qabr.3...Uu.7......St.5.v8Xq..C.$T.V....4.&W..sD.%'..c.E..GF........................"2.!1R..AQ.Bb.a.r#3...q....S.....C..c..............?.......@ .......@ .......@ .......@ .......@ .......@ .......@ .......@ .......@ .......@ .......@ .......@ .......@ .......@ .......@ .......@ .......@ .......@i.X)^%y...el..k.88....&.>z.%..+L.B[g......b...+).s.'8c...k.k.~.O.\.r......p.Y..Y.H.T%..t.!-...)OaS...-#r....~I....+m.{....}.(...._...r.l.9E..+v..^36..6..6...]1C"Y....f....M^..E"W.gbR"...:Usj3\..sgf.Jn.r.Q\|D.....l,.%T..H.[....-.U.Q......w ..7.....d..E.Tx..4.=4G...vo3....0.[.,mv...n...7..,R.E...K.k.'....;P....<....t.j..2.....M.Hw'.e...hiUc._#.2A.......Cuz.c.[5..S.S"nU.$...

C:\Program Files (x86)\Google\Picasa3\web\templates\blackfrm\targetlistelement.html

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe
File Type:	HTML document, ASCII text
Category:	dropped
Size (bytes):	1131
Entropy (8bit):	5.255328433781255
Encrypted:	false
SSDEEP:	24:Vp6F6eHXF6ROHo0F6mrHrF6I3O6e0RuwsFmZFr4mL8XIjkxzCu+id:Vpu62V6st6oR6h6erxmXr9gXIjkEuF
MD5:	D1A14817B1137560BC6CA3A22A6CE189
SHA1:	ACEAC48828D0832F4D9C0AADD8DF65A5DA29998F
SHA-256:	8E717B2A957308A9D1572D048F17EBC13548276238C3F5FAC7B6D1EE56972876
SHA-512:	16AD7B04FC506557907BAF79793D7B1E48657DDCF96FC95F312EE978370405A21A9B543F0FC855311B7029B5FCE51A104A9D3AF8825B23014249CC516D94B704
Malicious:	false
Reputation:	unknown
Preview:	<span class="textbg"><%itemCaption%> </span>.<p><span class="textreg">.<%if !isFirstTarget%><a href="<%firstTarget%>"><%endif%>First<%if !isFirstTarget%></a><%endif%> \|.<%if isPrevTarget%><a href="<%prevTarget%>"><%endif%>Previous Picture<%if isPrevTarget%></a><%endif%> \|.<%if isNextTarget%><a href="<%nextTarget%>"><%endif%>Next Picture<%if isNextTarget%></a><%endif%> \|.<%if !isLastTarget%><a href="<%lastTarget%>"><%endif%>Last<%if !isLastTarget%></a><%endif%><br>.</span><hr size="1">.<%if isSimpleEmbed%>.<embed src="<%itemLargeImage%>" autoplay="true" showcontrols="true" controller="true">.<%endif%>.<%if isExtendedEmbed%>.<OBJECT ID="MediaPlayer" .CLASSID="CLSID:22D6F312-B0F6-11D0-94AB-0080C74C7E95" .TYPE="application/x-oleobject".STANDBY="Loading Windows Media Player components...">.<PARAM NAME="FileName" VALUE="<%itemLargeImage%>">.<PARAM NAME="autostart" VALUE="1">.<PARAM NAME="showcontrols" VALUE="1">.<EMBED TYPE="application/x-mplayer2">.</EMBED>.</OBJECT>.<%endif%>.<%if isImage%

C:\Program Files (x86)\Google\Picasa3\web\templates\blackfrm\thumbnails.tpl

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1779
Entropy (8bit):	4.6283274395880465
Encrypted:	false
SSDEEP:	48:ryYZ6lmUML2G8hB5rR8Pl7hg0SWHbC92Lr9LAq6br2mizU:ezlmUMLt8/5WPhu0N74kr9LARv2rI
MD5:	23CCB993DB296EBD77F86E3A18A3837A
SHA1:	10223121576FEEEFEFC22CC8E9688C6FBEF53C3B
SHA-256:	C52CD585C65C8CDF77495FAA6F463844A5D871E86BC70BBB393036E0A57C4152
SHA-512:	150EC095BDBB9B23E0B675689271755E44ADFC70752CA05EFCDD1457FA84A69FC8C4CA2FBF4B6137CACAB82DBA1336AA045BD0E9D90A76E34A4F952A57BF450C
Malicious:	false
Reputation:	unknown
Preview:	#templatefile -v "1.0" -n "SUBTEMPLATE" -d "USED INTERNALLY BY ANOTHER TEMPLATE".# pound sign is a comment character.#.# lines that begin with "include" point to a file to be included at this point.# lines that begin with "loop" repeat the specified file once per image.# if loop or include files begin with "#templatefile" then that templatefile.# is processed in its entirety. In this way you can create .# file-per-image exports. .#.# The special "targetloop tplfile templatefile" command loops over each image, .# interpreting tplfile for each one. A sequence number is appended to the export filename.# specified in tplfile. After the tplfiles have been exported, templatefile is included once per.# exported file, with "<%target%>" defined as the relative path of the exported file..#.# The "copy" command copies the indicated path or directory to the export directory..# Examples:.# copy everything from the "assets\" directory at the same level as the template into the output dir.# copy asse

C:\Program Files (x86)\Google\Picasa3\web\templates\blackfrm\xLifescape.ini

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	80
Entropy (8bit):	4.91644607116552
Encrypted:	false
SSDEEP:	3:39AZI9qc+eNxt6MLT1KURkF1+:y29qfefVKURM1+
MD5:	FF2466D250E650B1971C72DC3F47A92E
SHA1:	93C34B6E4388F77A46CAFAE64684C6C2BF85A804
SHA-256:	B4A50ACC4F262E1D23576C83F78F02C0C6CD049AF99E32601BC6C784AED00800
SHA-512:	7A48AE251B018994392A41FE4015547F7983A83EB94E9F41D49C29EA0C4BE2CD43850A69D1DE5C218B8AEE5E68AD10A8DE4160D14665844EAE72EF3084A1A1E7
Malicious:	false
Reputation:	unknown
Preview:	[LifeScape].name=blackbg.description=.date=37429.106389.category=Other Pictures.

C:\Program Files (x86)\Google\Picasa3\web\templates\greybg\assets\style.css

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe
File Type:	assembler source, ASCII text
Category:	dropped
Size (bytes):	859
Entropy (8bit):	5.432701596959672
Encrypted:	false
SSDEEP:	24:jJZRfvJZRBVdJUjhOJZReOJZRKOJZRoOJZR6GJZRc:jJZlvJZ7zJUwJZnJZLJZdJZxJZ6
MD5:	9BBE0FE71307813D66F47FE2A0210DDB
SHA1:	0ABC6816522452E5A36F63E824CF46F86C387D45
SHA-256:	74C39F77BA3A75342818B3B1458D77FF6128504FC26243EE00781F69D0B9704E
SHA-512:	39BBCEFF738F38AC7A8CF9D8EB66EB4E2FD89B469E14469CF596E828C4F4F53C95ABAD05417A3136EBFE6C0DA4CD4D8FB36BD46EB307DD6780D4A8D876FDBE5C
Malicious:	false
Reputation:	unknown
Preview:	.BODY {..MARGIN-TOP: 70px; FONT-SIZE: 11px; MARGIN-LEFT: 80px; FONT-FAMILY: Verdana, Arial, Helvetica, sans-serif; BACKGROUND-COLOR: #D3D3D3.}.TD {..FONT-SIZE: 11px; FONT-FAMILY: Verdana, Arial, Helvetica, sans-serif.}.P {..BACKGROUND: #D3D3D3.}.H1 {..FONT-SIZE: 12px; COLOR: #979797; FONT-FAMILY: Helvetica, Verdana, Arial.}.A:hover {..COLOR: #804c4c; BACKGROUND-COLOR: #f0efe3.}.H2 {..FONT-SIZE: 10px; COLOR: #000000; FONT-FAMILY: Verdana, Arial, Helvetica, sans-serif.}.H3 {..FONT-SIZE: 18px; COLOR: #000000; FONT-FAMILY: Verdana, Arial, Helvetica, sans-serif.}..textsm {..FONT-SIZE: 14px; COLOR: #000000; FONT-FAMILY: Verdana, Arial, Helvetica, sans-serif.}..textbg {..FONT-SIZE: 20px; COLOR: #000000; FONT-FAMILY: Verdana, Arial, Helvetica, sans-serif.}..textreg {..FONT-SIZE: 12px; COLOR: #666666; FONT-FAMILY: Verdana, Arial, Helvetica, sans-serif.}...

C:\Program Files (x86)\Google\Picasa3\web\templates\greybg\footer.html

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	103
Entropy (8bit):	4.665829203207896
Encrypted:	false
SSDEEP:	3:jvw9qrHL/ZEusjTIWltfTFADaE9HtetTEVLZcKBc4NGL:r7iuQTft76DP5gicKq4QL
MD5:	75CE1C70A50C40E76FFD78CDA74AB479
SHA1:	D322EECB2D31480831DDF71B587409646BF19995
SHA-256:	E8CA4079F6A9BF0360B6BD871EC5323CCEBE0BA0F9A6A55F545C40683DDA527E
SHA-512:	55D96A665A2E447C6C72D71666976BCE91CC086046E8CA4C078E30AF3F6FCF378B83DF9A7827EA8B00D304EE30E2E5E87E1480F6E2D1D9C37C01BD54474FF722
Malicious:	false
Reputation:	unknown
Preview:	<map name="Map">. <area shape="rect" coords="95,1,129,44" href="frameset.htm">.</map>.</body>.</html>.

C:\Program Files (x86)\Google\Picasa3\web\templates\greybg\frameset.htm

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe
File Type:	HTML document, ASCII text
Category:	dropped
Size (bytes):	462
Entropy (8bit):	4.949323477586758
Encrypted:	false
SSDEEP:	12:XoPX6QclfutsxO0wKCyHRbh8Icd5hD3XHGawL:YPXs2GxOTKdR+IcdXXGj
MD5:	1F4D1252156541CF6825B694A4D51566
SHA1:	6BD741AAB174A778B0A912EF6DB825C4A7E2650C
SHA-256:	E45227535C0E87CE3B3E121E7CB568114A65F38B24DE3A951D91906BE838293E
SHA-512:	7FA923A564AAF18EADBE90569BD3A3A29E55436F84622C2584606B2069983A881C4BBB8447BCB68B1FEBEE9C471E27018DE26A6F39EA17E1843E60D12D035A76
Malicious:	false
Reputation:	unknown
Preview:	<html>.<head>.<title>Sunset in the Santa Monica Mountains Part 1</title>.<meta http-equiv="Content-Type" content="text/html; charset=UTF-8">.</head>.<frameset rows="85," cols="" border="0" framespacing="0" frameborder="NO"> . <frame src="head.htm" name="top" frameborder="NO" scrolling="NO">. <frame src="oneup.htm" name="bottom" frameborder="NO" scrolling="AUTO">.</frameset>.<noframes> .<body bgcolor="#FFFFFF" text="#000000">.</body>.</noframes> .</html>.

C:\Program Files (x86)\Google\Picasa3\web\templates\greybg\header.html

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe
File Type:	HTML document, ASCII text
Category:	dropped
Size (bytes):	359
Entropy (8bit):	4.918140244794393
Encrypted:	false
SSDEEP:	6:qFzLO6QcjWR0NNEXW0YmRu+SKT6xvzMkdxWHGjwe3us/J7AuvqYESJ/sjsEWpO:Z6QclfF+2vwYxWHGVAuYSOsEgO
MD5:	E97374844EF118E3AC0A81A97FBF21BD
SHA1:	DE4DEC146A2427C3D3EED03034788F7CDC3BF5FC
SHA-256:	41E483B5E01EC66C066F13D810612A58ED8EB7B3B753D8A9B47EDE62A4AF7ED5
SHA-512:	795FCE4EDC52EA656E6A89DF5EA8439D40A944C65EF414783AE1E20440D59BB50F81A00CA947D4AE5039DACD9A92212BCAEBED2FBCB2CFBCC79CE80713AD84B2
Malicious:	false
Reputation:	unknown
Preview:	<html>.<head>.<meta http-equiv="Content-Type" content="text/html; charset=UTF-8">.<title><%exportDescription%></title>.<link rel="stylesheet" href="style.css" type="text/css">.</head>.<body bgcolor="#FFFFFF" text="#000000">.<span class="textbg"><%albumName%> (<%albumItemCount%> images)</span><br>.<span class="textsm"><%albumCaption%></span>.<p class="desc">

C:\Program Files (x86)\Google\Picasa3\web\templates\greybg\imagelistelement.html

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe
File Type:	HTML document, ASCII text
Category:	dropped
Size (bytes):	182
Entropy (8bit):	4.568882633345414
Encrypted:	false
SSDEEP:	3:uNXADjtA+dMIGMLY32o+QBEqIMc+MRNws+eMRiDsRQ+lqPL:uFAHXdDYmojEqx4+4D0w
MD5:	1F5BC1D3D13E36CD76E50F44B1CCAC2C
SHA1:	E1B99B2E996BCAE144CED09CE491795C40D2764F
SHA-256:	BEDB80E2C65C7FF96469CC894BBD114737784EE7866ED5C0FFC7284AECB20D6C
SHA-512:	C897D5BCA66C6CF2F08403C4F153395C6781CBCC0A820CD479F9B045E236020B8960EF1B0AB545CCE18C87DF312C0CA04B711FEEB3A3E4DED3CF247E3F238572
Malicious:	false
Reputation:	unknown
Preview:	<a href="<%itemLargeImage%>"><img align="center" src="<%itemThumbnailImage%>" width="<%itemThumbnailWidth%>" height="<%itemThumbnailHeight%>" title="<%itemCaption%>" border="0"></a>.

C:\Program Files (x86)\Google\Picasa3\web\templates\greybg\imagelistfooter.html

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	12
Entropy (8bit):	2.6258145836939115
Encrypted:	false
SSDEEP:	3:6Tr:C
MD5:	E0C74237602B2A467D4D5001EC2EEAB6
SHA1:	C6A25EDAF62ECDA9412B72E55E9D49880C8176AF
SHA-256:	C9469A26C597E2155429150F992554598B7BF93EF906FD7F3CCD4B8BA4E6A082
SHA-512:	1627831BF78371AA2D16DCFBCC8723A93EA1651028F89A2C873CACD39A165FDC6843627114C5AF1628B44DA185A72718BAA3E8176E2CCF4620D4D4D4C1E121A8
Malicious:	false
Reputation:	unknown
Preview:	</p>.<hr><p>

C:\Program Files (x86)\Google\Picasa3\web\templates\greybg\imagelistheader.html

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	3
Entropy (8bit):	1.584962500721156
Encrypted:	false
SSDEEP:	3:P:P
MD5:	4DA1A46EC20CF93EE5C846A51E04F0ED
SHA1:	63ADA55C0BA212A5B1F8D5A70890788F00972BF4
SHA-256:	33F2799467177287A29260780A107AC98EA63DD6165F67FCC0D74767D0A82090
SHA-512:	CF55201BF1AC8CCB9A9AA36352064F3270A754C9B596C52F6E250F438E6AC9962E60A6696C55D90C8160C3682CD20ADEF0176068B8A832F5F4A9D134EACE8624
Malicious:	false
Reputation:	unknown
Preview:	<p>

C:\Program Files (x86)\Google\Picasa3\web\templates\greybg\imagetarget.tpl

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1563
Entropy (8bit):	4.439872563240265
Encrypted:	false
SSDEEP:	48:vklmUML2G8hB5rR8Pl7hg0SWHv8SCzl4R:vklmUMLt8/5WPhu0NP8Sol4R
MD5:	8AFF34838DCEDBE0C42EC0A66A58D032
SHA1:	57A389E5D389161E6B0CE936C54EA036F1604404
SHA-256:	51764BA905E29B298E15EBB858616172E2DE9C2CAE0B27516810922668666ED5
SHA-512:	2A176CC0D1261D20E716F69D08D72AC3E43F9C7086421ACC3FBD13913794FE92A70CC0CA105724C53B099EBA1E81A929F46F43E170E8A5C21F6A463B01890C4D
Malicious:	false
Reputation:	unknown
Preview:	#templatefile 1.0 Lifescape web template file.# pound sign is a comment character.#.# lines that begin with "include" point to a file to be included at this point.# lines that begin with "loop" repeat the specified file once per image.# if loop or include files begin with "#templatefile" then that templatefile.# is processed in its entirety. In this way you can create .# file-per-image exports. .#.# The special "targetloop tplfile templatefile" command loops over each image, .# interpreting tplfile for each one. A sequence number is appended to the export filename.# specified in tplfile. After the tplfiles have been exported, templatefile is included once per.# exported file, with "<%target%>" defined as the relative path of the exported file..#.# The "copy" command copies the indicated path or directory to the export directory..# Examples:.# copy everything from the "assets\" directory at the same level as the template into the output dir.# copy assets\ .#.# copy a single file to the

C:\Program Files (x86)\Google\Picasa3\web\templates\greybg\includedtarget.html

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe
File Type:	HTML document, ASCII text
Category:	dropped
Size (bytes):	178
Entropy (8bit):	4.562760577734868
Encrypted:	false
SSDEEP:	3:uNXADj44o7ZJGMLY32o+QBEqIMc+MRNws+eMRiDsRQ+lqPL:uFAHQ7tYmojEqx4+4D0w
MD5:	CC8FFE5BE72C7F6AEC09B84A7DC6C974
SHA1:	C6B620E722543D7ECAA45A3E2B07043CA22184B3
SHA-256:	7AB014BFDF2FB111B45087C90A495A14C339453C77DA9215B2B034D432386711
SHA-512:	6D4644C3F0800B32CFACC388DC1515ABB1FD668BF4F04258352CC5308F0E882CC67ADD65B72636F9E53132CEE30AFAD1DBE3274DF1DB7570BF2BC6F23B28F5D1
Malicious:	false
Reputation:	unknown
Preview:	<a href="<%targetPath%>"><img align="center" src="<%itemThumbnailImage%>" width="<%itemThumbnailWidth%>" height="<%itemThumbnailHeight%>" title="<%itemCaption%>" border="0"></a>.

C:\Program Files (x86)\Google\Picasa3\web\templates\greybg\index.html

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe
File Type:	HTML document, ASCII text
Category:	dropped
Size (bytes):	667
Entropy (8bit):	4.973826498172302
Encrypted:	false
SSDEEP:	12:Z6QclfF+2vwYADHGbepXP3OSVMCLxLAJ8MbdxMCLxHdiwog5JHMpH2oWEgs3iDT/:ZsN+9TGqpXP3BMCLx9MnMCLxHagMpWoW
MD5:	94E21252FDB65E018486CD928C8D1378
SHA1:	B9169E767C9182C22BA3C5449A22CA5EC7B531F5
SHA-256:	CE651DEEF969E7E1204E6CDC7C85D136A793103D893032ACACD4EF9E30DAC2C2
SHA-512:	987BDEA4635BA0AEFEE39285F974C03E26B17E861DDEF1AD2B8F3468A219C056E086CD0D6DC91F93E2E2CDD9C50FAA24D0AA6BE7F80BF40A2FA8616E25463D5A
Malicious:	false
Reputation:	unknown
Preview:	<html>.<head>.<meta http-equiv="Content-Type" content="text/html; charset=UTF-8">.<title><%exportDescription%></title>.<link rel="stylesheet" href="style.css" type="text/css">.</head>..<body bgcolor="#FFFFFF" text="#000000">.<table width="800" border="0" cellspacing="0" cellpadding="0">. <tr>. <td width="450" align="left" valign="top"><%albumName%><br>. <span class="desc"><%albumCaption%></span></td>. <td align="left" valign="top"><img src="images/nav.gif" width="127" height="45" usemap="#Map" border="0"></td>. </tr>.</table>.<p class="desc">...<map name="Map">. <area shape="rect" coords="95,1,129,44" href="frameset.htm">.</map>.</body>.</html>.

C:\Program Files (x86)\Google\Picasa3\web\templates\greybg\index.tpl

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe
File Type:	C source, ASCII text
Category:	dropped
Size (bytes):	2202
Entropy (8bit):	4.500271804965929
Encrypted:	false
SSDEEP:	48:ryYp2lmUML2G8hB5rR8Pl7hg0SWHbC92LrHIXMfl46gfuize:eU2lmUMLt8/5WPhu0N74krHIXMfl46g2
MD5:	CBEC6D642F9C3245062DD752A30E81A1
SHA1:	4B2BAC3C087BA85B285F39D7D15206D24A1D5E35
SHA-256:	889EB2524E398F6892FE6155FD7940DA36FE50C1239317D591DDF323995208D4
SHA-512:	1CFB4B7A7582B95CA31C7CFC97EC50E5024E757F6B44A0B598E3398258E37125170BC032DBACD9CE7077ED9B577EBAE2164CBD4EC31F1834F9AE1D5159AB79BB
Malicious:	false
Reputation:	unknown
Preview:	#templatefile -v "1.0" -n "Template 1, 2-page grey background" -d "Thumbnail index page linked to a full view picture page.".# pound sign is a comment character.#.# lines that begin with "include" point to a file to be included at this point.# lines that begin with "loop" repeat the specified file once per image.# if loop or include files begin with "#templatefile" then that templatefile.# is processed in its entirety. In this way you can create .# file-per-image exports. .#.# The special "targetloop tplfile templatefile" command loops over each image, .# interpreting tplfile for each one. A sequence number is appended to the export filename.# specified in tplfile. After the tplfiles have been exported, templatefile is included once per.# exported file, with "<%target%>" defined as the relative path of the exported file..#.# The "copy" command copies the indicated path or directory to the export directory..# Examples:.# copy everything from the "assets\" directory at the same level as

C:\Program Files (x86)\Google\Picasa3\web\templates\greybg\itemheader.html

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe
File Type:	HTML document, ASCII text
Category:	dropped
Size (bytes):	215
Entropy (8bit):	4.826357400543029
Encrypted:	false
SSDEEP:	6:qFzLO6QcjWR0NNEXW0YmRZ4KT6xvzMkdxWHGjwew:Z6QclfqEvwYxWHGu
MD5:	331CFC47C3BD9A84097C6DC889AB366C
SHA1:	271273696CFF4DF446EB93A72F99A98A045BF5B2
SHA-256:	9891FC499E4FADBD26096441ED72BB1909FA5FB5540156D86278938BE69CAA60
SHA-512:	7118766A6DCDC078B985C99C94D38FE5EE35CBAE3324A64D761BB33BDCCC9EB16E24FC7D82B493D17F9DFFFD5EA3188DD9289356B6933C035D742336E2A7D2AF
Malicious:	false
Reputation:	unknown
Preview:	<html>.<head>.<meta http-equiv="Content-Type" content="text/html; charset=UTF-8">.<title><%itemName%></title>.<link rel="stylesheet" href="style.css" type="text/css">.</head>.<body bgcolor="#FFFFFF" text="#000000">.

C:\Program Files (x86)\Google\Picasa3\web\templates\greybg\preview.jpg

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe
File Type:	JPEG image data, JFIF standard 1.02, aspect ratio, density 100x100, segment length 16, baseline, precision 8, 280x390, components 3
Category:	dropped
Size (bytes):	20772
Entropy (8bit):	7.9220408549243215
Encrypted:	false
SSDEEP:	384:K/MrO7Pjklq+66KaHeuwZ13fYXB7DWSwb5PZSVqa3Q3g2cairUlhskV:Lrw7b+1Hed7vYX9DWSwb5PZSgEQ3dcj2
MD5:	7E32AFD16E39CEAE046D345346DE7F3C
SHA1:	8C86AAFA3F71BAFE9DD04BDAC6C4E49D238A023B
SHA-256:	7CF224356AED59D6E2C1F20486854DC7F26F77E2D0F89CB7BAF5439BBF1975FD
SHA-512:	2ABD7E463F5FB6F9752F49AB85214EE89D7B8254D12D6063EEAEE3408EB5FB3C1B1D75C25E55F61428A281EED103140505416F74EAD7DDF69650761A6CB13B54
Malicious:	false
Reputation:	unknown
Preview:	......JFIF.....d.d......Ducky.......P......Adobe.d................................................................................................................................................................................................................................................."..!2.1BR..AQbr....#..t.6V.aq.3S$T.5U.v.7....C4....s%.D...c.........................."..12BR!Ab..Qa.r.q...#......3S..C$D..............?...@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@A.\....N.V.....M...9..... ..:..d.....Qu....Ek\9t.....X......x9.O..?.VJ.O5.1..R8....d.tD...bLH.k....Oe~e.W...p.=.%.......n..O..0...1%.Dd..{..=.........hx\.k5.d...d..Gy...vq"6.em.=.q.....D9.yA..2+..Ac..D=a..@.n..^....}c56+&..!..G....~d.&=]....h.=...X.X}U=....zs..k"-.#..7$.[H...t...N...V.>.....-...K..b..x[ptb:.}+Z'Od.O.s..Z...5......$q^8..".+n..X...R.Ki92.Us.........dyU._.^...jt......VK.`~.N...W9.*.{...

C:\Program Files (x86)\Google\Picasa3\web\templates\greybg\style.css

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	78
Entropy (8bit):	4.586138199870895
Encrypted:	false
SSDEEP:	3:NGxLRIYC2BEwLk1JLty0MTJssdFDQRyuN3C:2oB1JLtdAsoMRJ9C
MD5:	28D394BF7F25566B8AE5101C8472C963
SHA1:	F87166AED2280D329F2F5CC8CFB68DCB9F79B3A8
SHA-256:	08CB5B18F7A2DAE61F8239AF79C105CF42350B0E484D50F2344049444C513866
SHA-512:	51D352560DFCCFB178E08C978CCB33DDE3FD2A60E87697695C34A3E1DD5BFF83B8D63F36AE3C18FCF8251054A0384E003A1996086A0C7175E6C9DB76CA9751EB
Malicious:	false
Reputation:	unknown
Preview:	.desc { font-family: Verdana, Arial, Helvetica, sans-serif; font-size: 11px}.

C:\Program Files (x86)\Google\Picasa3\web\templates\greybg\targetlistelement.html

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe
File Type:	HTML document, ASCII text
Category:	dropped
Size (bytes):	1248
Entropy (8bit):	5.223727930868804
Encrypted:	false
SSDEEP:	24:espHPF6eHXF6ROHo0F6mrHrF6Ig86e0RuwsFmZFr4mL8XIOxzCu+iX:tpH962V6st6oR6o6erxmXr9gXIOEuv
MD5:	3E6BB7B47B33EDA73B4EB7FEECAB132F
SHA1:	8000561599280030148643081531818CCB0EDC4C
SHA-256:	160F3FD2604BBC2A75D741473522415A6BB38E7A595D414F2EE57959A053FD4E
SHA-512:	E1BEEA985023B5680958A9E6EE54D7F939752B668E2F4A56E298D40892290693D5EF9B6BBFD7A4ABB8E02583E5AAF0AF72693A2F8592C6D896AE55A46991CA77
Malicious:	false
Reputation:	unknown
Preview:	<span class="textbg"><%albumName%> -- <%itemCaption%> </span><br> <span class="textsm"></span>.<p><span class="textreg">.<%if !isFirstTarget%><a href="<%firstTarget%>"><%endif%>First<%if !isFirstTarget%></a><%endif%> \|.<%if isPrevTarget%><a href="<%prevTarget%>"><%endif%>Previous Picture<%if isPrevTarget%></a><%endif%> \|.<%if isNextTarget%><a href="<%nextTarget%>"><%endif%>Next Picture<%if isNextTarget%></a><%endif%> \|.<%if !isLastTarget%><a href="<%lastTarget%>"><%endif%>Last<%if !isLastTarget%></a><%endif%> \| <a href="<%referrer%>">Thumbnails</a><br>.</span><hr size="1">.<%if isSimpleEmbed%>.<embed src="<%itemLargeImage%>" autoplay="true" showcontrols="true" controller="true">.<%endif%>.<%if isExtendedEmbed%>.<OBJECT ID="MediaPlayer" .CLASSID="CLSID:22D6F312-B0F6-11D0-94AB-0080C74C7E95" .TYPE="application/x-oleobject".STANDBY="Loading Windows Media Player components...">.<PARAM NAME="FileName" VALUE="<%itemLargeImage%>">.<PARAM NAME="autostart" VALUE="1">.<PARAM NAME="showcontrols" V

C:\Program Files (x86)\Google\Picasa3\web\templates\greybg\targetlistheader.html

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	85
Entropy (8bit):	4.5114696122265014
Encrypted:	false
SSDEEP:	3:ve/vdq0HRCAeFWl+z+LpM7vc9NCzv:W/Vq0EFF+LpgTv
MD5:	478250A789BB70B5121AEB9947FBDDD0
SHA1:	6A8B5E1B38E1F69E34EC146DD4FF9937C605C67A
SHA-256:	10D1D02F182A22DD96088C47434A9D35722AE9C8375D693C76576AA1A4CE8355
SHA-512:	21765C84D130BC020C66357C6F7C7A1709FBC204B35F8A47D20684E0FAF228B2CE8ADB657F95D4E6B26B97D44E01DC52601EFEE6371A055EE6A23564A62215C6
Malicious:	false
Reputation:	unknown
Preview:	<span class="textreg">Click a picture to see a larger view.</span><br>.<hr size="1">.

C:\Program Files (x86)\Google\Picasa3\web\templates\greybg\verboseimagelistelement.html

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe
File Type:	HTML document, ASCII text
Category:	dropped
Size (bytes):	366
Entropy (8bit):	4.779429420784768
Encrypted:	false
SSDEEP:	6:gbXE+P6RMC7d+tPU+YMGXdDYmojEqx4+4D0I+scB4M+5CBtB5CB9n:gbU+P6iCstlYM+RROlW+00I+5BJB0B9n
MD5:	ED8842064398E0ABC3BF8BF40926168C
SHA1:	C9175EC82FAE118A375E9ADFA39F10603AF58F2A
SHA-256:	F485215249FD7978BB633CB75A02A3C6569BF3CEBF7D4ED2A591544C1A79F48F
SHA-512:	02BDE287797DDF754FE3EB3CDE4891936F0A3DE83815D1404EE27B8C0DB17A05C929E2BCE1823D71028C80D52E329C97F2AB6F70E24EF15BBA689F6ADD2413B3
Malicious:	false
Reputation:	unknown
Preview:	<hr size="1">.<%if isFirstImage%>First Image: <%endif%>.<%if isPrevImage%><--Prev Image(<%prevImage%>)<%endif%>.<a href="<%itemLargeImage%>"><img align="center" src="<%itemThumbnailImage%>" width="<%itemThumbnailWidth%>" height="<%itemThumbnailHeight%>" title="<%itemCaption%>" border="0"></a>.<%if isNextImage%>Next Image(<%nextImage%>)--><%nextImage%><%endif%>.<p>

C:\Program Files (x86)\Google\Picasa3\web\templates\greyfrm\assets\style.css

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1107
Entropy (8bit):	5.30505791022424
Encrypted:	false
SSDEEP:	24:nkbEEJZR3JJR7sJZRhdZJJMJZ+JJJRuJZRuJZR4z7JZRvmJZR8:WDJZNJJOJZBZJJMJZ+JJJQJZIJZ2JZAS
MD5:	EBA236E1F82B4078AB1E48550A7FFBA5
SHA1:	C437BE63516071F62A0B154C0260716E0496CA95
SHA-256:	5F3EDA054F54821CBEF6357E6AE86CA19F55AEA55C969CECC61A45F35A6563DE
SHA-512:	E20015B67FC27BFCE1EAD62D1A6AC096EBCC045DD20912D9D208A76A46ECE88390295E53C5DA1A6D94BD6955EF1164B1A8F0E9A4F0BBBDCB5A9463A3FE94A028
Malicious:	false
Reputation:	unknown
Preview:	BODY { MARGIN-TOP: 10px; FONT-SIZE: 11px; BACKGROUND-ATTACHMENT: scroll; MARGIN-LEFT: .10px; BACKGROUND-REPEAT: no-repeat; FONT-FAMILY: Verdana, Arial, Helvetica, sans-serif; .BACKGROUND-COLOR: #cccccc } TD { FONT-SIZE: 11px; FONT-FAMILY: Verdana, Arial, .Helvetica, sans-serif } P { BACKGROUND: #ccccccFONT-SIZE: 12px; COLOR: #ffffff; .FONT-FAMILY: Verdana, Arial, Helvetica, sans-serif } H1 { FONT-SIZE: 12px; COLOR: .#979797; FONT-FAMILY: Helvetica, Verdana, Arial } A:hover { COLOR: #804c4c; BACKGROUND-COLOR: .#cccccc } H2 { FONT-SIZE: 10px; COLOR: #ffffff; FONT-FAMILY: Verdana, Arial, Helvetica, .sans-serif } H3 { FONT-SIZE: 18px; COLOR: #ffffff; FONT-FAMILY: Verdana, Arial, .Helvetica, sans-serif } .textsm { FONT-SIZE: 14px; COLOR: #ffffff; FONT-FAMILY: .Verdana, Arial, Helvetica, sans-serif } .textbg { FONT-SIZE: 20px; COLOR: #ffffff; .FONT-FAMILY: Verdana, Arial, Helvetica, sans-serif } .textreg { FONT-SIZE: 12px; .COLOR: #999999; FONT-FAMILY: Verdana, Arial, Helvetica, sans-serif }

C:\Program Files (x86)\Google\Picasa3\web\templates\greyfrm\caption.html

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe
File Type:	HTML document, ASCII text
Category:	dropped
Size (bytes):	337
Entropy (8bit):	4.844338013501573
Encrypted:	false
SSDEEP:	6:qFzLO6QcjWR0NNEXW0YeeT6xvzMkdxKR9dOEs/J7AmJMpvqYESJ/sjMbJqq4Qb:Z6QclfYvwYxu9QEsAmJxSOMbJIQb
MD5:	7A4C88D0249E2A5C6D8FB9D85FCAE445
SHA1:	035FB924AC0176E2C3CB447A18ED3A74B046E977
SHA-256:	E41227F996E9B68A8689180A18ED543D82D010273001D4786D1AE3435AEDF70B
SHA-512:	389E0EB00A3360BAB13899D74D628723CF700B5BD45CC2AEDC336C4BE8606D822134E261393D96AF08DAC22F8171B17FB7F5FD6827367A457B6E270E37C1D8F8
Malicious:	false
Reputation:	unknown
Preview:	<html>.<head>.<meta http-equiv="Content-Type" content="text/html; charset=UTF-8">.<link rel="stylesheet" href="style.css" type="text/css">.</head>.<body>.<table cols=1><tr><td><span class="textbg"><%albumName%> -- <%albumDate%> (<%albumItemCount%> images)</span><br>.<span class="textsm"><%albumCaption%></span></td></tr>.</body>.</html>

C:\Program Files (x86)\Google\Picasa3\web\templates\greyfrm\footer.html

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.5
Encrypted:	false
SSDEEP:	3:TNGL:TQL
MD5:	1FFF66EFF9242EEE8EC3324428E15032
SHA1:	7BDB1E034041CBF3313DC597518E44660D3C2392
SHA-256:	02ED54EDC42FBBBC36988B2A184B67E49568BE4807832538BA9B7EDDA53744D8
SHA-512:	15C2A4A649B4A7BD3185D66BD41217F3394994DC79AB99ABA0DB9FAC3F8C91C7703E91CB22B788108C9F937E84A1CB3042CCA1FE9952346AC2BD1A387F84B266
Malicious:	false
Reputation:	unknown
Preview:	</body>.</html>.

C:\Program Files (x86)\Google\Picasa3\web\templates\greyfrm\frameImageSet.tpl

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1500
Entropy (8bit):	4.636773887719727
Encrypted:	false
SSDEEP:	24:ryYUi6M8rsk9iUML2B+0YFg9P1ZvDQ4FNcSzhvrR8PiaoNyJYlXYGVOBXQ0SW88o:ryYZ6lmUML2G8hB5rR8Pl7hg0SWHNAq6
MD5:	459E17F13E5D605B7409D92D25B79540
SHA1:	F9D0E5C9A948A39E7BC91DE1BA8A5A1B8979F1CA
SHA-256:	8F7B0FD51599F32547FB568A3A2237A1E373B9EF8DAAC530E2498B0C671A1F91
SHA-512:	E9E5B997FFC0AC580F536242FB8C09780B236127F18863D98C81D2E753292DBD9F378CD5794C9C78C73849CFFED3FF7DD832009A4283438C586A519834E5EA03
Malicious:	false
Reputation:	unknown
Preview:	#templatefile -v "1.0" -n "SUBTEMPLATE" -d "USED INTERNALLY BY ANOTHER TEMPLATE".# pound sign is a comment character.#.# lines that begin with "include" point to a file to be included at this point.# lines that begin with "loop" repeat the specified file once per image.# if loop or include files begin with "#templatefile" then that templatefile.# is processed in its entirety. In this way you can create .# file-per-image exports. .#.# The special "targetloop tplfile templatefile" command loops over each image, .# interpreting tplfile for each one. A sequence number is appended to the export filename.# specified in tplfile. After the tplfiles have been exported, templatefile is included once per.# exported file, with "<%target%>" defined as the relative path of the exported file..#.# The "copy" command copies the indicated path or directory to the export directory..# Examples:.# copy everything from the "assets\" directory at the same level as the template into the output dir.# copy asse

C:\Program Files (x86)\Google\Picasa3\web\templates\greyfrm\frameIndex.html

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe
File Type:	HTML document, ASCII text
Category:	dropped
Size (bytes):	373
Entropy (8bit):	4.819286015302676
Encrypted:	false
SSDEEP:	6:qFzLO6QcjWR0NNEXW0YmRu+SKT6xvzMkdO5hG6t1fmLr0lBvHMF8LbS18l8LjWAx:Z6QclfF+2vwYshGCuL4l72CS9L
MD5:	CCBDE7A32E8BDB607EDE9F0BA023EF40
SHA1:	141AF16AE6A28F731EE39D6FC4B60104F80A251A
SHA-256:	F4D789DDA14F143C0D52B0BC92E1B2414F77D95C4C851941D3A892DBF9767885
SHA-512:	7BFC667E908D148B0C7E4BA1AD0CC0A148C06C60BF7CE191EEE73BB4D8174871261DAA367C99F0F909FFC1B8414269FB783EA1DF4FA509EDACB3A4C7474E958C
Malicious:	false
Reputation:	unknown
Preview:	<html>.<head>.<meta http-equiv="Content-Type" content="text/html; charset=UTF-8">.<title><%exportDescription%></title>.<link rel="stylesheet" href="style.css" type="text/css">.</head>.<frameset cols="100%" rows="10%,*" border="0">.<frame src="caption.html" scrolling="no" border="no" border="0">.</frame>.<frame src="imageset.html" border="0">.</frame>.</frameset>.</html>.

C:\Program Files (x86)\Google\Picasa3\web\templates\greyfrm\framebase.tpl

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1487
Entropy (8bit):	4.498807566116527
Encrypted:	false
SSDEEP:	24:P3JeM8rsk9iUML2B+0YFg9P1ZvDQ4FNcSzhvrR8PiaoNyJYlXYGVOBXQ0SW88HFz:vklmUML2G8hB5rR8Pl7hg0SWHNAq6bre
MD5:	E43682700996BE00B2FE7D0C257687D1
SHA1:	3C29545DD0F0BD991B3EFB76EF3A95FB9BAB525C
SHA-256:	3403DBA73E37C18C68D93A97E0FBB61EF115F9CD836E05D1FFD6FD435E619517
SHA-512:	3E1F054D57697E096F32FEC0818C7CF7832A6C7F9B00512946A5F77F07E50783687E86433E4C1094C1724E3F73C9F1C50EBB29DB5EC3F85CD09998C628FAF5D0
Malicious:	false
Reputation:	unknown
Preview:	#templatefile 1.0 Lifescape web template file.# pound sign is a comment character.#.# lines that begin with "include" point to a file to be included at this point.# lines that begin with "loop" repeat the specified file once per image.# if loop or include files begin with "#templatefile" then that templatefile.# is processed in its entirety. In this way you can create .# file-per-image exports. .#.# The special "targetloop tplfile templatefile" command loops over each image, .# interpreting tplfile for each one. A sequence number is appended to the export filename.# specified in tplfile. After the tplfiles have been exported, templatefile is included once per.# exported file, with "<%target%>" defined as the relative path of the exported file..#.# The "copy" command copies the indicated path or directory to the export directory..# Examples:.# copy everything from the "assets\" directory at the same level as the template into the output dir.# copy assets\ .#.# copy a single file to the

C:\Program Files (x86)\Google\Picasa3\web\templates\greyfrm\framecaption.tpl

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1498
Entropy (8bit):	4.637482238996728
Encrypted:	false
SSDEEP:	24:ryYUi6M8rsk9iUML2B+0YFg9P1ZvDQ4FNcSzhvrR8PiaoNyJYlXYGVOBXQ0SW88G:ryYZ6lmUML2G8hB5rR8Pl7hg0SWHNAqA
MD5:	327480EFE1D2F4C333066E9A4D3C465D
SHA1:	EDAD28EDAD1E69C0415A91BF996B1C1DB713F205
SHA-256:	E6733A042D0B9ACCDCF25D735E746BA8B6B7C08818555CA45CEA00496DC01D0E
SHA-512:	84B60512656180641D88D40B68B7411A65B14970279A3AA58A4CC911FCE6607DE64CEC79297E190B241245818D572264B2C7825E2C98E1ECFD163E7BD84274ED
Malicious:	false
Reputation:	unknown
Preview:	#templatefile -v "1.0" -n "SUBTEMPLATE" -d "USED INTERNALLY BY ANOTHER TEMPLATE".# pound sign is a comment character.#.# lines that begin with "include" point to a file to be included at this point.# lines that begin with "loop" repeat the specified file once per image.# if loop or include files begin with "#templatefile" then that templatefile.# is processed in its entirety. In this way you can create .# file-per-image exports. .#.# The special "targetloop tplfile templatefile" command loops over each image, .# interpreting tplfile for each one. A sequence number is appended to the export filename.# specified in tplfile. After the tplfiles have been exported, templatefile is included once per.# exported file, with "<%target%>" defined as the relative path of the exported file..#.# The "copy" command copies the indicated path or directory to the export directory..# Examples:.# copy everything from the "assets\" directory at the same level as the template into the output dir.# copy asse

C:\Program Files (x86)\Google\Picasa3\web\templates\greyfrm\header.html

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe
File Type:	HTML document, ASCII text
Category:	dropped
Size (bytes):	176
Entropy (8bit):	4.6991037382833545
Encrypted:	false
SSDEEP:	3:qVvzL6HjJDeIeAlGKA+KWRIJaGNEXW0YEjgDMRJwKIAmBLLyFzT6xgoVlRAdnWAG:qFzLO6QcjWR0NNEXW0YmRWA4KT6xvzMY
MD5:	11E33A87FBBBBEF4892E71536242FBA6
SHA1:	6B6C3524E035D0C0AA7E388D3CAA0A7A9A254CC3
SHA-256:	BE9605E09FC08FE7300CAA43736A113B0FAD16ABFAC511096EC402BE57498646
SHA-512:	1770D9F73808019DCFCBB252AB74E25CAE56C7E0794873CB622ADCB545F272821B6168F2406431A43710FFF7C7C14D09C3F34063817E6C6378DF5F12B5DE6B29
Malicious:	false
Reputation:	unknown
Preview:	<html>.<head>.<meta http-equiv="Content-Type" content="text/html; charset=UTF-8">.<title><%albumName%></title>.<link rel="stylesheet" href="style.css" type="text/css">.</head>.

C:\Program Files (x86)\Google\Picasa3\web\templates\greyfrm\imageset.html

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe
File Type:	HTML document, ASCII text
Category:	dropped
Size (bytes):	371
Entropy (8bit):	4.7808620419069765
Encrypted:	false
SSDEEP:	6:G6QcjWR0NNEXW0YmRWA4KT6xvzMkdO5hGBofjBvHcuLbQbuJlELjWALVLjWALxb:G6QclfVAEvwYshGBofjKUQbGl6F9b
MD5:	CA0A0ADD9A6CD2DE7364E16A011DCB08
SHA1:	2A78C4EF7DDFD3B18341D2EA9EAD89FC6264784D
SHA-256:	EDA2BC2D247AB47594C6EDEDA99EFE9A1704B61DDC081B8324DBEA98702B4750
SHA-512:	1E97AF247A1DDABCCA01F3D5533530C660B5D0F8A0736CB3860DC7DCF760AB077D6C0AEDE89D5C93C7AFC21C045613F9060F080FE26CFE300585AF104F2C3D6E
Malicious:	false
Reputation:	unknown
Preview:	<head>.<meta http-equiv="Content-Type" content="text/html; charset=UTF-8">.<title><%albumName%></title>.<link rel="stylesheet" href="style.css" type="text/css">.</head>.<frameset cols="180,*" border="0">.<frame src="thumbnails.html" scrolling="yes" border="0">.</frame>.<frame src="target0.html" name="images" border="0">.</frame>.</frameset>.</frame>.</frameset>.</html>

C:\Program Files (x86)\Google\Picasa3\web\templates\greyfrm\imagetarget.tpl

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1520
Entropy (8bit):	4.584372625050878
Encrypted:	false
SSDEEP:	24:ryYUi6M8rsk9iUML2B+0YFg9P1ZvDQ4FNcSzhvrR8PiaoNyJYlXYGVOBXQ0SW88B:ryYZ6lmUML2G8hB5rR8Pl7hg0SWHMZl2
MD5:	1C06D4CED84D8DC2FC530F15ACEA2643
SHA1:	3F7394481319C32802105D0DCBB15BDE67F6F3E0
SHA-256:	DEB1469E8F34BE784ABE4C14C57D947823482127C496AE3AEAE12CEAD4278841
SHA-512:	77B8CFCD69F9A750CA9F9DB7200466097ACA6BBB08D34C4BC94BDD8195AA35C2B2FBF60347A6386FA25B437C1579063432AF93BDCD868F5472A6E2FDC1EC525F
Malicious:	false
Reputation:	unknown
Preview:	#templatefile -v "1.0" -n "SUBTEMPLATE" -d "USED INTERNALLY BY ANOTHER TEMPLATE".# pound sign is a comment character.#.# lines that begin with "include" point to a file to be included at this point.# lines that begin with "loop" repeat the specified file once per image.# if loop or include files begin with "#templatefile" then that templatefile.# is processed in its entirety. In this way you can create .# file-per-image exports. .#.# The special "targetloop tplfile templatefile" command loops over each image, .# interpreting tplfile for each one. A sequence number is appended to the export filename.# specified in tplfile. After the tplfiles have been exported, templatefile is included once per.# exported file, with "<%target%>" defined as the relative path of the exported file..#.# The "copy" command copies the indicated path or directory to the export directory..# Examples:.# copy everything from the "assets\" directory at the same level as the template into the output dir.# copy asse

C:\Program Files (x86)\Google\Picasa3\web\templates\greyfrm\includedtarget.html

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe
File Type:	HTML document, ASCII text
Category:	dropped
Size (bytes):	226
Entropy (8bit):	4.607304708233295
Encrypted:	false
SSDEEP:	3:sWqw9rQBssNQDj44olR9A+pPONUeQBEqIMc+MRNws+eMRiDsNAjkPhZA3Q+0pn:s2Qqs6HQl7A+PEqx4+4DCs3ipn
MD5:	2BCA8C9FCF0CE01800EE0390825847A0
SHA1:	9DA7A4C0F70586E798D5765D6F1CB2AEF6A31C26
SHA-256:	16438D751135778A6E67F102B08ED395D6D19738DBF76A1F07BA29200339F0AF
SHA-512:	8136D1428CC21CBF8E9E8821C5935C9D7D26804248ABF5F423AED7B0A6A006DEC0B8DF1E61A2A76CA68AFDF29C4D3A007DA4F133123B6701ABFD4ACB8B497045
Malicious:	false
Reputation:	unknown
Preview:	<p class="framethumbnail"><a href="<%targetPath%>" target="images"><img src="<%itemThumbnailImage%>" width="<%itemThumbnailWidth%>" height="<%itemThumbnailHeight%>" title="<%itemName%>" border="0"></a><br>.<%itemCaption%></p>.

C:\Program Files (x86)\Google\Picasa3\web\templates\greyfrm\index.tpl

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1851
Entropy (8bit):	4.558377913225103
Encrypted:	false
SSDEEP:	48:ryYz+9qdlmUML2G8hB5rR8Pl7hg0SWHbC92LrvAq6brPyT:e+7dlmUMLt8/5WPhu0N74krvARvPyT
MD5:	74B72F81E33DBA779AFD9E1BA9EEA053
SHA1:	58D29B94BBDD35BCEF049176767420E032F123B7
SHA-256:	76DC4EE5DFC1F79B2038A05BD471D0418620EA9FCB716DF98FE4EB4CB831C4A9
SHA-512:	9A7ADF1BBBA36C08E57F09A3EA805980AFADF7CED686BD9911B2ABC084126DFA47B1869AF9F49421610C1AB9922FC16EE12966036164114F45D8E5716B1F3666
Malicious:	false
Reputation:	unknown
Preview:	#templatefile -v "1.0" -n "Template 4, 1-page grey background" -d "Scrollable thumbnail index on left with full view picture on right.".# pound sign is a comment character.#.# lines that begin with "include" point to a file to be included at this point.# lines that begin with "loop" repeat the specified file once per image.# if loop or include files begin with "#templatefile" then that templatefile.# is processed in its entirety. In this way you can create .# file-per-image exports. .#.# The special "targetloop tplfile templatefile" command loops over each image, .# interpreting tplfile for each one. A sequence number is appended to the export filename.# specified in tplfile. After the tplfiles have been exported, templatefile is included once per.# exported file, with "<%target%>" defined as the relative path of the exported file..#.# The "copy" command copies the indicated path or directory to the export directory..# Examples:.# copy everything from the "assets\" directory at the sam

C:\Program Files (x86)\Google\Picasa3\web\templates\greyfrm\itemheader.html

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe
File Type:	HTML document, ASCII text
Category:	dropped
Size (bytes):	215
Entropy (8bit):	4.826357400543029
Encrypted:	false
SSDEEP:	6:qFzLO6QcjWR0NNEXW0YmRZ4KT6xvzMkdxWHGjwew:Z6QclfqEvwYxWHGu
MD5:	331CFC47C3BD9A84097C6DC889AB366C
SHA1:	271273696CFF4DF446EB93A72F99A98A045BF5B2
SHA-256:	9891FC499E4FADBD26096441ED72BB1909FA5FB5540156D86278938BE69CAA60
SHA-512:	7118766A6DCDC078B985C99C94D38FE5EE35CBAE3324A64D761BB33BDCCC9EB16E24FC7D82B493D17F9DFFFD5EA3188DD9289356B6933C035D742336E2A7D2AF
Malicious:	false
Reputation:	unknown
Preview:	<html>.<head>.<meta http-equiv="Content-Type" content="text/html; charset=UTF-8">.<title><%itemName%></title>.<link rel="stylesheet" href="style.css" type="text/css">.</head>.<body bgcolor="#FFFFFF" text="#000000">.

C:\Program Files (x86)\Google\Picasa3\web\templates\greyfrm\preview.jpg

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe
File Type:	JPEG image data, JFIF standard 1.02, aspect ratio, density 100x100, segment length 16, baseline, precision 8, 280x390, components 3
Category:	dropped
Size (bytes):	22677
Entropy (8bit):	7.914831817771256
Encrypted:	false
SSDEEP:	384:sCf5Kd9i2plTlXyS79Hb6/t5zDt674fXotS09m42bjVmHhu0y7Nece3J6:nkFp5lp9e/Ht+tV9ZwjVwhu0y7Nece38
MD5:	B1C414EB641A0ED7F5E1F4DC36059AB5
SHA1:	39AAC756B0419FB5B7D7B354CFCD0B1DA05BB90A
SHA-256:	FB9EDBBC0547CCE6AFB2D0070B36E59F56CE70C849ABF055F8602C5D0117D28C
SHA-512:	8600CA743673449F205D8C235AF7613F275838A76A93D2248CEAC86B9AFEC19156839C4AFF0C3217560968D30250A5628644CEF72F52FF79C8617607B81067EF
Malicious:	false
Reputation:	unknown
Preview:	......JFIF.....d.d......Ducky.......P......Adobe.d.................................................................................................................................................................................................................................................."..!2B.1AR..Qbr...#t..aq..3Ss.$4T.Uu.7...Cc..5.6..%.&V.....Dd.e..'........................"2..R!B...1AQ.C.a.br.#3.q.........S................?.................................................................................................................................................. .a.p4...".#..b#2M.d&.e.nu.l.......K..W..a......oZ....~...,.1<.{[`..;...6.,......q..o..m.kZR...Y.....s.A..q..._...L...fg.w..V.2....kEo....i.e......#s.OnT.5..00.$0.`..n.........P.>'D.....09-T.<....i..\.=M...r.M...#."Y..6...=.S.....>.5.Q.F.."....NA.\..a.xb,op..P.J......T...P....f.n1E)X.-?...J....b./..f.\|N..Q......B.roPHn.\|d....9.K....J..DL.U.6x;I.:.5[....Q.d./+..($ML)X.,.g....9.[u/.).....Va..

C:\Program Files (x86)\Google\Picasa3\web\templates\greyfrm\targetlistelement.html

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe
File Type:	HTML document, ASCII text
Category:	dropped
Size (bytes):	1131
Entropy (8bit):	5.255328433781255
Encrypted:	false
SSDEEP:	24:Vp6F6eHXF6ROHo0F6mrHrF6I3O6e0RuwsFmZFr4mL8XIjkxzCu+id:Vpu62V6st6oR6h6erxmXr9gXIjkEuF
MD5:	D1A14817B1137560BC6CA3A22A6CE189
SHA1:	ACEAC48828D0832F4D9C0AADD8DF65A5DA29998F
SHA-256:	8E717B2A957308A9D1572D048F17EBC13548276238C3F5FAC7B6D1EE56972876
SHA-512:	16AD7B04FC506557907BAF79793D7B1E48657DDCF96FC95F312EE978370405A21A9B543F0FC855311B7029B5FCE51A104A9D3AF8825B23014249CC516D94B704
Malicious:	false
Reputation:	unknown
Preview:	<span class="textbg"><%itemCaption%> </span>.<p><span class="textreg">.<%if !isFirstTarget%><a href="<%firstTarget%>"><%endif%>First<%if !isFirstTarget%></a><%endif%> \|.<%if isPrevTarget%><a href="<%prevTarget%>"><%endif%>Previous Picture<%if isPrevTarget%></a><%endif%> \|.<%if isNextTarget%><a href="<%nextTarget%>"><%endif%>Next Picture<%if isNextTarget%></a><%endif%> \|.<%if !isLastTarget%><a href="<%lastTarget%>"><%endif%>Last<%if !isLastTarget%></a><%endif%><br>.</span><hr size="1">.<%if isSimpleEmbed%>.<embed src="<%itemLargeImage%>" autoplay="true" showcontrols="true" controller="true">.<%endif%>.<%if isExtendedEmbed%>.<OBJECT ID="MediaPlayer" .CLASSID="CLSID:22D6F312-B0F6-11D0-94AB-0080C74C7E95" .TYPE="application/x-oleobject".STANDBY="Loading Windows Media Player components...">.<PARAM NAME="FileName" VALUE="<%itemLargeImage%>">.<PARAM NAME="autostart" VALUE="1">.<PARAM NAME="showcontrols" VALUE="1">.<EMBED TYPE="application/x-mplayer2">.</EMBED>.</OBJECT>.<%endif%>.<%if isImage%

C:\Program Files (x86)\Google\Picasa3\web\templates\greyfrm\thumbnails.tpl

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1780
Entropy (8bit):	4.644802675722558
Encrypted:	false
SSDEEP:	48:ryYZ6lmUML2G8hB5rR8Pl7hg0SWHbC92LrvAq6brVmizU:ezlmUMLt8/5WPhu0N74krvARvVrI
MD5:	CD7D263248526E3DC1ACFED0FF3288D7
SHA1:	D55C236E8CF22F6BF84BAF653D178EC3DC621DEF
SHA-256:	CC2604A39AE7EF970C1AF85E270C72EFB0796E8466B8FC9297A5620E37EC3D53
SHA-512:	013AA7379042E59BF268E0E5A86057D05AB41E0DEE403888E5FFF9390B1F575CBC5AA79256FD8DDE7028F332EDC326BF3B729A6B0E4A3286AFCCA9C7A76A181D
Malicious:	false
Reputation:	unknown
Preview:	#templatefile -v "1.0" -n "SUBTEMPLATE" -d "USED INTERNALLY BY ANOTHER TEMPLATE".# pound sign is a comment character.#.# lines that begin with "include" point to a file to be included at this point.# lines that begin with "loop" repeat the specified file once per image.# if loop or include files begin with "#templatefile" then that templatefile.# is processed in its entirety. In this way you can create .# file-per-image exports. .#.# The special "targetloop tplfile templatefile" command loops over each image, .# interpreting tplfile for each one. A sequence number is appended to the export filename.# specified in tplfile. After the tplfiles have been exported, templatefile is included once per.# exported file, with "<%target%>" defined as the relative path of the exported file..#.# The "copy" command copies the indicated path or directory to the export directory..# Examples:.# copy everything from the "assets\" directory at the same level as the template into the output dir.# copy asse

C:\Program Files (x86)\Google\Picasa3\web\templates\whitebg\assets\style.css

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe
File Type:	assembler source, ASCII text
Category:	dropped
Size (bytes):	856
Entropy (8bit):	5.413693345164635
Encrypted:	false
SSDEEP:	24:EJZRMJZRDiVdJUjhOJZReOJZRKOJZRoOJZR6qJZRc:EJZKJZhcJUwJZnJZLJZdJZBJZ6
MD5:	F87C3FD3790DD73004198D21C74A6244
SHA1:	F8A11D6045384AC147569C6F710CB445DE60D051
SHA-256:	275726315690D7D1656489D484E21406C333030B04AE98688EB321ED603A7419
SHA-512:	4C07E681C58037AC26481004494E64BB8EBEFB170ECBF04A8DF1A216B69FE56D156F852F0C5CBBD55B3FA2E51B496020BE666169B07F860790B861EF6E6E0AF5
Malicious:	false
Reputation:	unknown
Preview:	BODY {..MARGIN-TOP: 70px; FONT-SIZE: 11px; MARGIN-LEFT: 80px; FONT-FAMILY: Verdana, Arial, Helvetica, sans-serif; BACKGROUND-COLOR: #ffffff.}.TD {..FONT-SIZE: 11px; FONT-FAMILY: Verdana, Arial, Helvetica, sans-serif.}.P {..BACKGROUND: white.}.H1 {..FONT-SIZE: 12px; COLOR: #979797; FONT-FAMILY: Helvetica, Verdana, Arial.}.A:hover {..COLOR: #804c4c; BACKGROUND-COLOR: #f0efe3.}.H2 {..FONT-SIZE: 10px; COLOR: #000000; FONT-FAMILY: Verdana, Arial, Helvetica, sans-serif.}.H3 {..FONT-SIZE: 18px; COLOR: #000000; FONT-FAMILY: Verdana, Arial, Helvetica, sans-serif.}..textsm {..FONT-SIZE: 14px; COLOR: #000000; FONT-FAMILY: Verdana, Arial, Helvetica, sans-serif.}..textbg {..FONT-SIZE: 20px; COLOR: #000000; FONT-FAMILY: Verdana, Arial, Helvetica, sans-serif.}..textreg {..FONT-SIZE: 12px; COLOR: #979797; FONT-FAMILY: Verdana, Arial, Helvetica, sans-serif.}...

C:\Program Files (x86)\Google\Picasa3\web\templates\whitebg\footer.html

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	103
Entropy (8bit):	4.665829203207896
Encrypted:	false
SSDEEP:	3:jvw9qrHL/ZEusjTIWltfTFADaE9HtetTEVLZcKBc4NGL:r7iuQTft76DP5gicKq4QL
MD5:	75CE1C70A50C40E76FFD78CDA74AB479
SHA1:	D322EECB2D31480831DDF71B587409646BF19995
SHA-256:	E8CA4079F6A9BF0360B6BD871EC5323CCEBE0BA0F9A6A55F545C40683DDA527E
SHA-512:	55D96A665A2E447C6C72D71666976BCE91CC086046E8CA4C078E30AF3F6FCF378B83DF9A7827EA8B00D304EE30E2E5E87E1480F6E2D1D9C37C01BD54474FF722
Malicious:	false
Reputation:	unknown
Preview:	<map name="Map">. <area shape="rect" coords="95,1,129,44" href="frameset.htm">.</map>.</body>.</html>.

C:\Program Files (x86)\Google\Picasa3\web\templates\whitebg\frameset.htm

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe
File Type:	HTML document, ASCII text
Category:	dropped
Size (bytes):	462
Entropy (8bit):	4.949323477586758
Encrypted:	false
SSDEEP:	12:XoPX6QclfutsxO0wKCyHRbh8Icd5hD3XHGawL:YPXs2GxOTKdR+IcdXXGj
MD5:	1F4D1252156541CF6825B694A4D51566
SHA1:	6BD741AAB174A778B0A912EF6DB825C4A7E2650C
SHA-256:	E45227535C0E87CE3B3E121E7CB568114A65F38B24DE3A951D91906BE838293E
SHA-512:	7FA923A564AAF18EADBE90569BD3A3A29E55436F84622C2584606B2069983A881C4BBB8447BCB68B1FEBEE9C471E27018DE26A6F39EA17E1843E60D12D035A76
Malicious:	false
Reputation:	unknown
Preview:	<html>.<head>.<title>Sunset in the Santa Monica Mountains Part 1</title>.<meta http-equiv="Content-Type" content="text/html; charset=UTF-8">.</head>.<frameset rows="85," cols="" border="0" framespacing="0" frameborder="NO"> . <frame src="head.htm" name="top" frameborder="NO" scrolling="NO">. <frame src="oneup.htm" name="bottom" frameborder="NO" scrolling="AUTO">.</frameset>.<noframes> .<body bgcolor="#FFFFFF" text="#000000">.</body>.</noframes> .</html>.

C:\Program Files (x86)\Google\Picasa3\web\templates\whitebg\header.html

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe
File Type:	HTML document, ASCII text
Category:	dropped
Size (bytes):	359
Entropy (8bit):	4.918140244794393
Encrypted:	false
SSDEEP:	6:qFzLO6QcjWR0NNEXW0YmRu+SKT6xvzMkdxWHGjwe3us/J7AuvqYESJ/sjsEWpO:Z6QclfF+2vwYxWHGVAuYSOsEgO
MD5:	E97374844EF118E3AC0A81A97FBF21BD
SHA1:	DE4DEC146A2427C3D3EED03034788F7CDC3BF5FC
SHA-256:	41E483B5E01EC66C066F13D810612A58ED8EB7B3B753D8A9B47EDE62A4AF7ED5
SHA-512:	795FCE4EDC52EA656E6A89DF5EA8439D40A944C65EF414783AE1E20440D59BB50F81A00CA947D4AE5039DACD9A92212BCAEBED2FBCB2CFBCC79CE80713AD84B2
Malicious:	false
Reputation:	unknown
Preview:	<html>.<head>.<meta http-equiv="Content-Type" content="text/html; charset=UTF-8">.<title><%exportDescription%></title>.<link rel="stylesheet" href="style.css" type="text/css">.</head>.<body bgcolor="#FFFFFF" text="#000000">.<span class="textbg"><%albumName%> (<%albumItemCount%> images)</span><br>.<span class="textsm"><%albumCaption%></span>.<p class="desc">

C:\Program Files (x86)\Google\Picasa3\web\templates\whitebg\imagelistelement.html

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe
File Type:	HTML document, ASCII text
Category:	dropped
Size (bytes):	182
Entropy (8bit):	4.568882633345414
Encrypted:	false
SSDEEP:	3:uNXADjtA+dMIGMLY32o+QBEqIMc+MRNws+eMRiDsRQ+lqPL:uFAHXdDYmojEqx4+4D0w
MD5:	1F5BC1D3D13E36CD76E50F44B1CCAC2C
SHA1:	E1B99B2E996BCAE144CED09CE491795C40D2764F
SHA-256:	BEDB80E2C65C7FF96469CC894BBD114737784EE7866ED5C0FFC7284AECB20D6C
SHA-512:	C897D5BCA66C6CF2F08403C4F153395C6781CBCC0A820CD479F9B045E236020B8960EF1B0AB545CCE18C87DF312C0CA04B711FEEB3A3E4DED3CF247E3F238572
Malicious:	false
Reputation:	unknown
Preview:	<a href="<%itemLargeImage%>"><img align="center" src="<%itemThumbnailImage%>" width="<%itemThumbnailWidth%>" height="<%itemThumbnailHeight%>" title="<%itemCaption%>" border="0"></a>.

C:\Program Files (x86)\Google\Picasa3\web\templates\whitebg\imagelistfooter.html

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	12
Entropy (8bit):	2.6258145836939115
Encrypted:	false
SSDEEP:	3:6Tr:C
MD5:	E0C74237602B2A467D4D5001EC2EEAB6
SHA1:	C6A25EDAF62ECDA9412B72E55E9D49880C8176AF
SHA-256:	C9469A26C597E2155429150F992554598B7BF93EF906FD7F3CCD4B8BA4E6A082
SHA-512:	1627831BF78371AA2D16DCFBCC8723A93EA1651028F89A2C873CACD39A165FDC6843627114C5AF1628B44DA185A72718BAA3E8176E2CCF4620D4D4D4C1E121A8
Malicious:	false
Reputation:	unknown
Preview:	</p>.<hr><p>

C:\Program Files (x86)\Google\Picasa3\web\templates\whitebg\imagelistheader.html

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	3
Entropy (8bit):	1.584962500721156
Encrypted:	false
SSDEEP:	3:P:P
MD5:	4DA1A46EC20CF93EE5C846A51E04F0ED
SHA1:	63ADA55C0BA212A5B1F8D5A70890788F00972BF4
SHA-256:	33F2799467177287A29260780A107AC98EA63DD6165F67FCC0D74767D0A82090
SHA-512:	CF55201BF1AC8CCB9A9AA36352064F3270A754C9B596C52F6E250F438E6AC9962E60A6696C55D90C8160C3682CD20ADEF0176068B8A832F5F4A9D134EACE8624
Malicious:	false
Reputation:	unknown
Preview:	<p>

C:\Program Files (x86)\Google\Picasa3\web\templates\whitebg\imagetarget.tpl

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1563
Entropy (8bit):	4.439872563240265
Encrypted:	false
SSDEEP:	48:vklmUML2G8hB5rR8Pl7hg0SWHv8SCzl4R:vklmUMLt8/5WPhu0NP8Sol4R
MD5:	8AFF34838DCEDBE0C42EC0A66A58D032
SHA1:	57A389E5D389161E6B0CE936C54EA036F1604404
SHA-256:	51764BA905E29B298E15EBB858616172E2DE9C2CAE0B27516810922668666ED5
SHA-512:	2A176CC0D1261D20E716F69D08D72AC3E43F9C7086421ACC3FBD13913794FE92A70CC0CA105724C53B099EBA1E81A929F46F43E170E8A5C21F6A463B01890C4D
Malicious:	false
Reputation:	unknown
Preview:	#templatefile 1.0 Lifescape web template file.# pound sign is a comment character.#.# lines that begin with "include" point to a file to be included at this point.# lines that begin with "loop" repeat the specified file once per image.# if loop or include files begin with "#templatefile" then that templatefile.# is processed in its entirety. In this way you can create .# file-per-image exports. .#.# The special "targetloop tplfile templatefile" command loops over each image, .# interpreting tplfile for each one. A sequence number is appended to the export filename.# specified in tplfile. After the tplfiles have been exported, templatefile is included once per.# exported file, with "<%target%>" defined as the relative path of the exported file..#.# The "copy" command copies the indicated path or directory to the export directory..# Examples:.# copy everything from the "assets\" directory at the same level as the template into the output dir.# copy assets\ .#.# copy a single file to the

C:\Program Files (x86)\Google\Picasa3\web\templates\whitebg\includedtarget.html

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe
File Type:	HTML document, ASCII text
Category:	dropped
Size (bytes):	178
Entropy (8bit):	4.562760577734868
Encrypted:	false
SSDEEP:	3:uNXADj44o7ZJGMLY32o+QBEqIMc+MRNws+eMRiDsRQ+lqPL:uFAHQ7tYmojEqx4+4D0w
MD5:	CC8FFE5BE72C7F6AEC09B84A7DC6C974
SHA1:	C6B620E722543D7ECAA45A3E2B07043CA22184B3
SHA-256:	7AB014BFDF2FB111B45087C90A495A14C339453C77DA9215B2B034D432386711
SHA-512:	6D4644C3F0800B32CFACC388DC1515ABB1FD668BF4F04258352CC5308F0E882CC67ADD65B72636F9E53132CEE30AFAD1DBE3274DF1DB7570BF2BC6F23B28F5D1
Malicious:	false
Reputation:	unknown
Preview:	<a href="<%targetPath%>"><img align="center" src="<%itemThumbnailImage%>" width="<%itemThumbnailWidth%>" height="<%itemThumbnailHeight%>" title="<%itemCaption%>" border="0"></a>.

C:\Program Files (x86)\Google\Picasa3\web\templates\whitebg\index.html

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe
File Type:	HTML document, ASCII text
Category:	dropped
Size (bytes):	667
Entropy (8bit):	4.973826498172302
Encrypted:	false
SSDEEP:	12:Z6QclfF+2vwYADHGbepXP3OSVMCLxLAJ8MbdxMCLxHdiwog5JHMpH2oWEgs3iDT/:ZsN+9TGqpXP3BMCLx9MnMCLxHagMpWoW
MD5:	94E21252FDB65E018486CD928C8D1378
SHA1:	B9169E767C9182C22BA3C5449A22CA5EC7B531F5
SHA-256:	CE651DEEF969E7E1204E6CDC7C85D136A793103D893032ACACD4EF9E30DAC2C2
SHA-512:	987BDEA4635BA0AEFEE39285F974C03E26B17E861DDEF1AD2B8F3468A219C056E086CD0D6DC91F93E2E2CDD9C50FAA24D0AA6BE7F80BF40A2FA8616E25463D5A
Malicious:	false
Reputation:	unknown
Preview:	<html>.<head>.<meta http-equiv="Content-Type" content="text/html; charset=UTF-8">.<title><%exportDescription%></title>.<link rel="stylesheet" href="style.css" type="text/css">.</head>..<body bgcolor="#FFFFFF" text="#000000">.<table width="800" border="0" cellspacing="0" cellpadding="0">. <tr>. <td width="450" align="left" valign="top"><%albumName%><br>. <span class="desc"><%albumCaption%></span></td>. <td align="left" valign="top"><img src="images/nav.gif" width="127" height="45" usemap="#Map" border="0"></td>. </tr>.</table>.<p class="desc">...<map name="Map">. <area shape="rect" coords="95,1,129,44" href="frameset.htm">.</map>.</body>.</html>.

C:\Program Files (x86)\Google\Picasa3\web\templates\whitebg\index.tpl

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe
File Type:	C source, ASCII text
Category:	dropped
Size (bytes):	2182
Entropy (8bit):	4.474664138782757
Encrypted:	false
SSDEEP:	48:ryYR2lmUML2G8hB5rR8Pl7hg0SWHbC92LrR7Mfl46gfuize:eG2lmUMLt8/5WPhu0N74krR7Mfl46gLS
MD5:	9C98FA152DB2DD258CDE40ECE8CFFBC4
SHA1:	8748A232BF8C458842003D9E35F235A6F7FF0415
SHA-256:	0F2546181779245A500C3A9D33F177FBC6E8D54F62DC872AF5516688BFB9E084
SHA-512:	74A6C4CCBE544515C0E9EDEE844B3790F0646D5401D6B0E9BFC682487F0492FB8ADE09EC1463D784099324B6DD2A6458334FD4BA5154FA14341CD9D065C1B091
Malicious:	false
Reputation:	unknown
Preview:	#templatefile -v "1.0" -n "Template 3, 2-page white background" -d "Thumbnail index page linked to a full view picture page.".# pound sign is a comment character.#.# lines that begin with "include" point to a file to be included at this point.# lines that begin with "loop" repeat the specified file once per image.# if loop or include files begin with "#templatefile" then that templatefile.# is processed in its entirety. In this way you can create .# file-per-image exports. .#.# The special "targetloop tplfile templatefile" command loops over each image, .# interpreting tplfile for each one. A sequence number is appended to the export filename.# specified in tplfile. After the tplfiles have been exported, templatefile is included once per.# exported file, with "<%target%>" defined as the relative path of the exported file..#.# The "copy" command copies the indicated path or directory to the export directory..# Examples:.# copy everything from the "assets\" directory at the same level as

C:\Program Files (x86)\Google\Picasa3\web\templates\whitebg\itemheader.html

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe
File Type:	HTML document, ASCII text
Category:	dropped
Size (bytes):	215
Entropy (8bit):	4.826357400543029
Encrypted:	false
SSDEEP:	6:qFzLO6QcjWR0NNEXW0YmRZ4KT6xvzMkdxWHGjwew:Z6QclfqEvwYxWHGu
MD5:	331CFC47C3BD9A84097C6DC889AB366C
SHA1:	271273696CFF4DF446EB93A72F99A98A045BF5B2
SHA-256:	9891FC499E4FADBD26096441ED72BB1909FA5FB5540156D86278938BE69CAA60
SHA-512:	7118766A6DCDC078B985C99C94D38FE5EE35CBAE3324A64D761BB33BDCCC9EB16E24FC7D82B493D17F9DFFFD5EA3188DD9289356B6933C035D742336E2A7D2AF
Malicious:	false
Reputation:	unknown
Preview:	<html>.<head>.<meta http-equiv="Content-Type" content="text/html; charset=UTF-8">.<title><%itemName%></title>.<link rel="stylesheet" href="style.css" type="text/css">.</head>.<body bgcolor="#FFFFFF" text="#000000">.

C:\Program Files (x86)\Google\Picasa3\web\templates\whitebg\preview.jpg

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe
File Type:	JPEG image data, JFIF standard 1.02, aspect ratio, density 100x100, segment length 16, baseline, precision 8, 280x390, components 3
Category:	dropped
Size (bytes):	21087
Entropy (8bit):	7.923955442658476
Encrypted:	false
SSDEEP:	384:huAzoL3EEgt2JARM0ysid88rtks4w/XtT+D+yjWjqor6guGZGypfPuA2q:hDSfVbv90+fBr8GZ9xh
MD5:	FFAF2A5E0BE4F1C6979142152EFCE86B
SHA1:	18FEA16BC8706B9FE9C3176AD0B0786645E5EBF9
SHA-256:	FF24A8E688318F2226430052AB1AB074273E76526E831858155D73702A1B3691
SHA-512:	9BEA10123AB757668990B795C3978E6B47355515EBACEC4F76FE5EE851C55F168664CA9EA3EC50922857371AA77AC36486AF2402B45841C16CFAF6686F90F499
Malicious:	false
Reputation:	unknown
Preview:	......JFIF.....d.d......Ducky.......P......Adobe.d................................................................................................................................................................................................................................................"..!2..1BR..AQbr..#..T7aq..3S$t.5.Vv....C4.u...6..sD%U.......E........................."2.!1ABR..Qbar.q........#3...C$...............?.................................................................................................................................................sg_.;..X<...6$z..f.pJL....E.F....E..G$%Yi.M......e.5.x...?.VJ.O5.1..R8....d.tD...bLH.k....O..J..x.S.y..,......;t.2\|v.i.x..-.# /..V..N.Wj..j......f.Q.N..I.tw...g.#k.V.i..j...5..r..=dW....%.t.z.#......<...!.3Sb.oa....y..8.7.N.c...I.......kWln...{..1....N4.D[.G.4nH...;...p...<&.Y.D.d<.z.0.g..8..^.......J...kT....4...k.?-#.8H.qa.D"V.c..!..n.$.zU._.d.&..j.."..r..%.0?.S.......:.\|L......=./._...5:x..J..

C:\Program Files (x86)\Google\Picasa3\web\templates\whitebg\style.css

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	78
Entropy (8bit):	4.586138199870895
Encrypted:	false
SSDEEP:	3:NGxLRIYC2BEwLk1JLty0MTJssdFDQRyuN3C:2oB1JLtdAsoMRJ9C
MD5:	28D394BF7F25566B8AE5101C8472C963
SHA1:	F87166AED2280D329F2F5CC8CFB68DCB9F79B3A8
SHA-256:	08CB5B18F7A2DAE61F8239AF79C105CF42350B0E484D50F2344049444C513866
SHA-512:	51D352560DFCCFB178E08C978CCB33DDE3FD2A60E87697695C34A3E1DD5BFF83B8D63F36AE3C18FCF8251054A0384E003A1996086A0C7175E6C9DB76CA9751EB
Malicious:	false
Reputation:	unknown
Preview:	.desc { font-family: Verdana, Arial, Helvetica, sans-serif; font-size: 11px}.

C:\Program Files (x86)\Google\Picasa3\web\templates\whitebg\targetlistelement.html

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe
File Type:	HTML document, ASCII text
Category:	dropped
Size (bytes):	1248
Entropy (8bit):	5.223727930868804
Encrypted:	false
SSDEEP:	24:espHPF6eHXF6ROHo0F6mrHrF6Ig86e0RuwsFmZFr4mL8XIOxzCu+iX:tpH962V6st6oR6o6erxmXr9gXIOEuv
MD5:	3E6BB7B47B33EDA73B4EB7FEECAB132F
SHA1:	8000561599280030148643081531818CCB0EDC4C
SHA-256:	160F3FD2604BBC2A75D741473522415A6BB38E7A595D414F2EE57959A053FD4E
SHA-512:	E1BEEA985023B5680958A9E6EE54D7F939752B668E2F4A56E298D40892290693D5EF9B6BBFD7A4ABB8E02583E5AAF0AF72693A2F8592C6D896AE55A46991CA77
Malicious:	false
Reputation:	unknown
Preview:	<span class="textbg"><%albumName%> -- <%itemCaption%> </span><br> <span class="textsm"></span>.<p><span class="textreg">.<%if !isFirstTarget%><a href="<%firstTarget%>"><%endif%>First<%if !isFirstTarget%></a><%endif%> \|.<%if isPrevTarget%><a href="<%prevTarget%>"><%endif%>Previous Picture<%if isPrevTarget%></a><%endif%> \|.<%if isNextTarget%><a href="<%nextTarget%>"><%endif%>Next Picture<%if isNextTarget%></a><%endif%> \|.<%if !isLastTarget%><a href="<%lastTarget%>"><%endif%>Last<%if !isLastTarget%></a><%endif%> \| <a href="<%referrer%>">Thumbnails</a><br>.</span><hr size="1">.<%if isSimpleEmbed%>.<embed src="<%itemLargeImage%>" autoplay="true" showcontrols="true" controller="true">.<%endif%>.<%if isExtendedEmbed%>.<OBJECT ID="MediaPlayer" .CLASSID="CLSID:22D6F312-B0F6-11D0-94AB-0080C74C7E95" .TYPE="application/x-oleobject".STANDBY="Loading Windows Media Player components...">.<PARAM NAME="FileName" VALUE="<%itemLargeImage%>">.<PARAM NAME="autostart" VALUE="1">.<PARAM NAME="showcontrols" V

C:\Program Files (x86)\Google\Picasa3\web\templates\whitebg\targetlistheader.html

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	85
Entropy (8bit):	4.5114696122265014
Encrypted:	false
SSDEEP:	3:ve/vdq0HRCAeFWl+z+LpM7vc9NCzv:W/Vq0EFF+LpgTv
MD5:	478250A789BB70B5121AEB9947FBDDD0
SHA1:	6A8B5E1B38E1F69E34EC146DD4FF9937C605C67A
SHA-256:	10D1D02F182A22DD96088C47434A9D35722AE9C8375D693C76576AA1A4CE8355
SHA-512:	21765C84D130BC020C66357C6F7C7A1709FBC204B35F8A47D20684E0FAF228B2CE8ADB657F95D4E6B26B97D44E01DC52601EFEE6371A055EE6A23564A62215C6
Malicious:	false
Reputation:	unknown
Preview:	<span class="textreg">Click a picture to see a larger view.</span><br>.<hr size="1">.

C:\Program Files (x86)\Google\Picasa3\web\templates\whitebg\verboseimagelistelement.html

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe
File Type:	HTML document, ASCII text
Category:	dropped
Size (bytes):	366
Entropy (8bit):	4.779429420784768
Encrypted:	false
SSDEEP:	6:gbXE+P6RMC7d+tPU+YMGXdDYmojEqx4+4D0I+scB4M+5CBtB5CB9n:gbU+P6iCstlYM+RROlW+00I+5BJB0B9n
MD5:	ED8842064398E0ABC3BF8BF40926168C
SHA1:	C9175EC82FAE118A375E9ADFA39F10603AF58F2A
SHA-256:	F485215249FD7978BB633CB75A02A3C6569BF3CEBF7D4ED2A591544C1A79F48F
SHA-512:	02BDE287797DDF754FE3EB3CDE4891936F0A3DE83815D1404EE27B8C0DB17A05C929E2BCE1823D71028C80D52E329C97F2AB6F70E24EF15BBA689F6ADD2413B3
Malicious:	false
Reputation:	unknown
Preview:	<hr size="1">.<%if isFirstImage%>First Image: <%endif%>.<%if isPrevImage%><--Prev Image(<%prevImage%>)<%endif%>.<a href="<%itemLargeImage%>"><img align="center" src="<%itemThumbnailImage%>" width="<%itemThumbnailWidth%>" height="<%itemThumbnailHeight%>" title="<%itemCaption%>" border="0"></a>.<%if isNextImage%>Next Image(<%nextImage%>)--><%nextImage%><%endif%>.<p>

C:\Program Files (x86)\Google\Picasa3\web\templates\whitefrm\assets\style.css

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1106
Entropy (8bit):	5.308774976707778
Encrypted:	false
SSDEEP:	24:nkbEEJZR4nWJJRi6cJZRhdZJJYOJZ+OOJJRlcJZReJZR4aOJZRvvOJZR8:WDJZKnWJJI3JZBZJJLJZ+lJJwJZoJZEN
MD5:	77EBA8878156A09A9A45C41BCC4930FB
SHA1:	6738B37980349765077E0B38B19980D993D9C6CC
SHA-256:	9D143365E6B292B421F225200242B144ED9F4CACB2E9301D0F8FD00131601F45
SHA-512:	EC593D02DA10875685C0B2B9FF8BB0BD6B5AFC6443CCC30BA584DD942BB31386E3F70419D5106B9829A8931A003B1C6375F3F5C9A9C487F7F8AAB295BBEEB485
Malicious:	false
Reputation:	unknown
Preview:	BODY { MARGIN-TOP: 10px; FONT-SIZE: 11px; BACKGROUND-ATTACHMENT: scroll; MARGIN-LEFT: .10px; BACKGROUND-REPEAT: no-repeat; FONT-FAMILY: Verdana, Arial, Helvetica, sans-serif; .BACKGROUND-COLOR: #ffffff } TD { FONT-SIZE: 11px; FONT-FAMILY: Verdana, Arial, .Helvetica, sans-serif } P { BACKGROUND: white FONT-SIZE: 12px; COLOR: #000000; .FONT-FAMILY: Verdana, Arial, Helvetica, sans-serif } H1 { FONT-SIZE: 12px; COLOR: .#979797; FONT-FAMILY: Helvetica, Verdana, Arial } A:hover { COLOR: #804c4c; BACKGROUND-COLOR: .#f0efe3 } H2 { FONT-SIZE: 10px; COLOR: #000000; FONT-FAMILY: Verdana, Arial, Helvetica, .sans-serif } H3 { FONT-SIZE: 18px; COLOR: #000000; FONT-FAMILY: Verdana, Arial, .Helvetica, sans-serif } .textsm { FONT-SIZE: 14px; COLOR: #000000; FONT-FAMILY: .Verdana, Arial, Helvetica, sans-serif } .textbg { FONT-SIZE: 20px; COLOR: #000000; .FONT-FAMILY: Verdana, Arial, Helvetica, sans-serif } .textreg { FONT-SIZE: 12px; .COLOR: #000000; FONT-FAMILY: Verdana, Arial, Helvetica, sans-serif }

C:\Program Files (x86)\Google\Picasa3\web\templates\whitefrm\caption.html

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe
File Type:	HTML document, ASCII text
Category:	dropped
Size (bytes):	337
Entropy (8bit):	4.844338013501573
Encrypted:	false
SSDEEP:	6:qFzLO6QcjWR0NNEXW0YeeT6xvzMkdxKR9dOEs/J7AmJMpvqYESJ/sjMbJqq4Qb:Z6QclfYvwYxu9QEsAmJxSOMbJIQb
MD5:	7A4C88D0249E2A5C6D8FB9D85FCAE445
SHA1:	035FB924AC0176E2C3CB447A18ED3A74B046E977
SHA-256:	E41227F996E9B68A8689180A18ED543D82D010273001D4786D1AE3435AEDF70B
SHA-512:	389E0EB00A3360BAB13899D74D628723CF700B5BD45CC2AEDC336C4BE8606D822134E261393D96AF08DAC22F8171B17FB7F5FD6827367A457B6E270E37C1D8F8
Malicious:	false
Reputation:	unknown
Preview:	<html>.<head>.<meta http-equiv="Content-Type" content="text/html; charset=UTF-8">.<link rel="stylesheet" href="style.css" type="text/css">.</head>.<body>.<table cols=1><tr><td><span class="textbg"><%albumName%> -- <%albumDate%> (<%albumItemCount%> images)</span><br>.<span class="textsm"><%albumCaption%></span></td></tr>.</body>.</html>

C:\Program Files (x86)\Google\Picasa3\web\templates\whitefrm\footer.html

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.5
Encrypted:	false
SSDEEP:	3:TNGL:TQL
MD5:	1FFF66EFF9242EEE8EC3324428E15032
SHA1:	7BDB1E034041CBF3313DC597518E44660D3C2392
SHA-256:	02ED54EDC42FBBBC36988B2A184B67E49568BE4807832538BA9B7EDDA53744D8
SHA-512:	15C2A4A649B4A7BD3185D66BD41217F3394994DC79AB99ABA0DB9FAC3F8C91C7703E91CB22B788108C9F937E84A1CB3042CCA1FE9952346AC2BD1A387F84B266
Malicious:	false
Reputation:	unknown
Preview:	</body>.</html>.

C:\Program Files (x86)\Google\Picasa3\web\templates\whitefrm\frameImageSet.tpl

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1453
Entropy (8bit):	4.597413722936698
Encrypted:	false
SSDEEP:	24:ryYUi6M8rsk9iUML2B+0YFg9P1ZvDQ4FNcSzhvrR8PiaoNyJYlXYGVOBXQ0SW88+:ryYZ6lmUML2G8hB5rR8Pl7hg0SWH8q6f
MD5:	C2BEFFCA3B60CFD0DCBA364662DF28FE
SHA1:	9ADF9E563850AB071B9E48E564AE8EF977F9962D
SHA-256:	D694C1014B9FF02272A6EC41B53FF1D1E3056BE8F3121CD0B32F9C4E5E9CF7B2
SHA-512:	DB44E6D3C980747F73E9750E851DA57C79AE7E9417C6F521D53A8A005ECA3147F93469166F15ECB6960AFC80687F53EA41D05D5BC9FB424739F21610BFF76B1E
Malicious:	false
Reputation:	unknown
Preview:	#templatefile -v "1.0" -n "SUBTEMPLATE" -d "USED INTERNALLY BY ANOTHER TEMPLATE".# pound sign is a comment character.#.# lines that begin with "include" point to a file to be included at this point.# lines that begin with "loop" repeat the specified file once per image.# if loop or include files begin with "#templatefile" then that templatefile.# is processed in its entirety. In this way you can create .# file-per-image exports. .#.# The special "targetloop tplfile templatefile" command loops over each image, .# interpreting tplfile for each one. A sequence number is appended to the export filename.# specified in tplfile. After the tplfiles have been exported, templatefile is included once per.# exported file, with "<%target%>" defined as the relative path of the exported file..#.# The "copy" command copies the indicated path or directory to the export directory..# Examples:.# copy everything from the "assets\" directory at the same level as the template into the output dir.# copy asse

C:\Program Files (x86)\Google\Picasa3\web\templates\whitefrm\frameIndex.html

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe
File Type:	HTML document, ASCII text
Category:	dropped
Size (bytes):	373
Entropy (8bit):	4.819286015302676
Encrypted:	false
SSDEEP:	6:qFzLO6QcjWR0NNEXW0YmRu+SKT6xvzMkdO5hG6t1fmLr0lBvHMF8LbS18l8LjWAx:Z6QclfF+2vwYshGCuL4l72CS9L
MD5:	CCBDE7A32E8BDB607EDE9F0BA023EF40
SHA1:	141AF16AE6A28F731EE39D6FC4B60104F80A251A
SHA-256:	F4D789DDA14F143C0D52B0BC92E1B2414F77D95C4C851941D3A892DBF9767885
SHA-512:	7BFC667E908D148B0C7E4BA1AD0CC0A148C06C60BF7CE191EEE73BB4D8174871261DAA367C99F0F909FFC1B8414269FB783EA1DF4FA509EDACB3A4C7474E958C
Malicious:	false
Reputation:	unknown
Preview:	<html>.<head>.<meta http-equiv="Content-Type" content="text/html; charset=UTF-8">.<title><%exportDescription%></title>.<link rel="stylesheet" href="style.css" type="text/css">.</head>.<frameset cols="100%" rows="10%,*" border="0">.<frame src="caption.html" scrolling="no" border="no" border="0">.</frame>.<frame src="imageset.html" border="0">.</frame>.</frameset>.</html>.

C:\Program Files (x86)\Google\Picasa3\web\templates\whitefrm\framebase.tpl

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1440
Entropy (8bit):	4.456983141359701
Encrypted:	false
SSDEEP:	24:P3JeM8rsk9iUML2B+0YFg9P1ZvDQ4FNcSzhvrR8PiaoNyJYlXYGVOBXQ0SW88H8Q:vklmUML2G8hB5rR8Pl7hg0SWH8q6brZs
MD5:	FAB92DD8ADC298E7C47B95A4C3BFBC39
SHA1:	5398D796A1F10ED913969068798C0D0D5A922923
SHA-256:	AFCC25AF523D0151CF30D3E0B755701FEC25689F1373E3A5D13B448EA7448248
SHA-512:	A09AF2681C32E8366C9D12901B99C5C5F1B54D34A0E82B4A8175FF8ED0957101FC96057F29A2F1E1BE528A9F20905512B0AA8C0FF061AA8F1D6D3F1312474B04
Malicious:	false
Reputation:	unknown
Preview:	#templatefile 1.0 Lifescape web template file.# pound sign is a comment character.#.# lines that begin with "include" point to a file to be included at this point.# lines that begin with "loop" repeat the specified file once per image.# if loop or include files begin with "#templatefile" then that templatefile.# is processed in its entirety. In this way you can create .# file-per-image exports. .#.# The special "targetloop tplfile templatefile" command loops over each image, .# interpreting tplfile for each one. A sequence number is appended to the export filename.# specified in tplfile. After the tplfiles have been exported, templatefile is included once per.# exported file, with "<%target%>" defined as the relative path of the exported file..#.# The "copy" command copies the indicated path or directory to the export directory..# Examples:.# copy everything from the "assets\" directory at the same level as the template into the output dir.# copy assets\ .#.# copy a single file to the

C:\Program Files (x86)\Google\Picasa3\web\templates\whitefrm\framecaption.tpl

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1451
Entropy (8bit):	4.598007014307905
Encrypted:	false
SSDEEP:	24:ryYUi6M8rsk9iUML2B+0YFg9P1ZvDQ4FNcSzhvrR8PiaoNyJYlXYGVOBXQ0SW88U:ryYZ6lmUML2G8hB5rR8Pl7hg0SWH8q6V
MD5:	BE49F3F726C104C57976C59C5B4DE5D1
SHA1:	8C1DEC41D9FC2ACCCB95DF77C99ED289761920A6
SHA-256:	8F7DF789ECDC0379E878D5D2A03D41C6A5368FF1C202E0416FE89460A675137D
SHA-512:	458B45B1C2683B3180319BDFC3BB9B02CB70B063C62A6B73B09EBA04FD824A9FC258D65E9B78AB62161650631BFA7E61731B81B41E17E3042AB67318D94F5095
Malicious:	false
Reputation:	unknown
Preview:	#templatefile -v "1.0" -n "SUBTEMPLATE" -d "USED INTERNALLY BY ANOTHER TEMPLATE".# pound sign is a comment character.#.# lines that begin with "include" point to a file to be included at this point.# lines that begin with "loop" repeat the specified file once per image.# if loop or include files begin with "#templatefile" then that templatefile.# is processed in its entirety. In this way you can create .# file-per-image exports. .#.# The special "targetloop tplfile templatefile" command loops over each image, .# interpreting tplfile for each one. A sequence number is appended to the export filename.# specified in tplfile. After the tplfiles have been exported, templatefile is included once per.# exported file, with "<%target%>" defined as the relative path of the exported file..#.# The "copy" command copies the indicated path or directory to the export directory..# Examples:.# copy everything from the "assets\" directory at the same level as the template into the output dir.# copy asse

C:\Program Files (x86)\Google\Picasa3\web\templates\whitefrm\header.html

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe
File Type:	HTML document, ASCII text
Category:	dropped
Size (bytes):	176
Entropy (8bit):	4.6991037382833545
Encrypted:	false
SSDEEP:	3:qVvzLMvwKIAmBtHjJDeIeAlGKA+KWRIJaGNEXW0YEjgbM2FzT6xgoVlRAdnWAbBY:qFzLMAA46QcjWR0NNEXW0YeeT6xvzMkd
MD5:	C754FF188A12E5E31082629F67962FDC
SHA1:	5165D07BB3BA7D579D04AF3167291DAEEA11A71E
SHA-256:	50A2BEA1DE2D8E5835A3D825EB491CCA867F68AE4390CF02E333F565AE64F2EB
SHA-512:	A6FF8A635371F9F6FB3B2B53694ED99A758778874210A9C73D200FB53D3B7B6877115E2DB724BEE5FA4F34A89F242BB7428569AE520EA63DB9EE71967FFE5426
Malicious:	false
Reputation:	unknown
Preview:	<html>.<head>.<title><%albumName%></title>.<meta http-equiv="Content-Type" content="text/html; charset=UTF-8">.<link rel="stylesheet" href="style.css" type="text/css">.</head>.

C:\Program Files (x86)\Google\Picasa3\web\templates\whitefrm\imageset.html

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe
File Type:	HTML document, ASCII text
Category:	dropped
Size (bytes):	371
Entropy (8bit):	4.7808620419069765
Encrypted:	false
SSDEEP:	6:G6QcjWR0NNEXW0YmRWA4KT6xvzMkdO5hGBofjBvHcuLbQbuJlELjWALVLjWALxb:G6QclfVAEvwYshGBofjKUQbGl6F9b
MD5:	CA0A0ADD9A6CD2DE7364E16A011DCB08
SHA1:	2A78C4EF7DDFD3B18341D2EA9EAD89FC6264784D
SHA-256:	EDA2BC2D247AB47594C6EDEDA99EFE9A1704B61DDC081B8324DBEA98702B4750
SHA-512:	1E97AF247A1DDABCCA01F3D5533530C660B5D0F8A0736CB3860DC7DCF760AB077D6C0AEDE89D5C93C7AFC21C045613F9060F080FE26CFE300585AF104F2C3D6E
Malicious:	false
Reputation:	unknown
Preview:	<head>.<meta http-equiv="Content-Type" content="text/html; charset=UTF-8">.<title><%albumName%></title>.<link rel="stylesheet" href="style.css" type="text/css">.</head>.<frameset cols="180,*" border="0">.<frame src="thumbnails.html" scrolling="yes" border="0">.</frame>.<frame src="target0.html" name="images" border="0">.</frame>.</frameset>.</frame>.</frameset>.</html>

C:\Program Files (x86)\Google\Picasa3\web\templates\whitefrm\imagetarget.tpl

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1496
Entropy (8bit):	4.545704889100564
Encrypted:	false
SSDEEP:	24:ryYUi6M8rsk9iUML2B+0YFg9P1ZvDQ4FNcSzhvrR8PiaoNyJYlXYGVOBXQ0SW88P:ryYZ6lmUML2G8hB5rR8Pl7hg0SWHMzl2
MD5:	623DB4BE5CA2327B660D2C03C2C9D572
SHA1:	3F1A51178D47C0BC2387303DBB1B77291F3B8AF4
SHA-256:	F03BD8BB2A56D1F052BD1A930E9F2D4743D3C84F18BBF9D2C6A59FE025449D31
SHA-512:	13C815BEDCE9928F0276A3F8653940E3CCCB878BD838DFF6535928F1109E2D3F409B85C64D5A9F9605DCD9C41F41ED0CAFCABF5CCAFB9C9DB867B9FBA397BE93
Malicious:	false
Reputation:	unknown
Preview:	#templatefile -v "1.0" -n "SUBTEMPLATE" -d "USED INTERNALLY BY ANOTHER TEMPLATE".# pound sign is a comment character.#.# lines that begin with "include" point to a file to be included at this point.# lines that begin with "loop" repeat the specified file once per image.# if loop or include files begin with "#templatefile" then that templatefile.# is processed in its entirety. In this way you can create .# file-per-image exports. .#.# The special "targetloop tplfile templatefile" command loops over each image, .# interpreting tplfile for each one. A sequence number is appended to the export filename.# specified in tplfile. After the tplfiles have been exported, templatefile is included once per.# exported file, with "<%target%>" defined as the relative path of the exported file..#.# The "copy" command copies the indicated path or directory to the export directory..# Examples:.# copy everything from the "assets\" directory at the same level as the template into the output dir.# copy asse

C:\Program Files (x86)\Google\Picasa3\web\templates\whitefrm\includedtarget.html

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe
File Type:	HTML document, ASCII text
Category:	dropped
Size (bytes):	226
Entropy (8bit):	4.607304708233295
Encrypted:	false
SSDEEP:	3:sWqw9rQBssNQDj44olR9A+pPONUeQBEqIMc+MRNws+eMRiDsNAjkPhZA3Q+0pn:s2Qqs6HQl7A+PEqx4+4DCs3ipn
MD5:	2BCA8C9FCF0CE01800EE0390825847A0
SHA1:	9DA7A4C0F70586E798D5765D6F1CB2AEF6A31C26
SHA-256:	16438D751135778A6E67F102B08ED395D6D19738DBF76A1F07BA29200339F0AF
SHA-512:	8136D1428CC21CBF8E9E8821C5935C9D7D26804248ABF5F423AED7B0A6A006DEC0B8DF1E61A2A76CA68AFDF29C4D3A007DA4F133123B6701ABFD4ACB8B497045
Malicious:	false
Reputation:	unknown
Preview:	<p class="framethumbnail"><a href="<%targetPath%>" target="images"><img src="<%itemThumbnailImage%>" width="<%itemThumbnailWidth%>" height="<%itemThumbnailHeight%>" title="<%itemName%>" border="0"></a><br>.<%itemCaption%></p>.

C:\Program Files (x86)\Google\Picasa3\web\templates\whitefrm\index.tpl

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1805
Entropy (8bit):	4.5238750325688555
Encrypted:	false
SSDEEP:	48:ryYX+9qdlmUML2G8hB5rR8Pl7hg0SWHbC92Lr+q6brPyT:ew7dlmUMLt8/5WPhu0N74kr+RvPyT
MD5:	6A1B523ECEB8FE218406685D8CE54D57
SHA1:	204C832B1C99E02F1991E514BD73C7CFB1996C32
SHA-256:	D0AD55C02C26701ADC0015EAFDB9B9C322B977EFB8E213BCC4812CFFFEF4060B
SHA-512:	9816EAEBD2ABE80AFF2C1E3BD05511AA39D1B858431B9ABED0EFCA4F5ABF55EC81C176E5C28566A69FEFDE18520AF5DE89BDBF84F5C11D0E1A6E707E38E3214C
Malicious:	false
Reputation:	unknown
Preview:	#templatefile -v "1.0" -n "Template 6, 1-page white background" -d "Scrollable thumbnail index on left with full view picture on right.".# pound sign is a comment character.#.# lines that begin with "include" point to a file to be included at this point.# lines that begin with "loop" repeat the specified file once per image.# if loop or include files begin with "#templatefile" then that templatefile.# is processed in its entirety. In this way you can create .# file-per-image exports. .#.# The special "targetloop tplfile templatefile" command loops over each image, .# interpreting tplfile for each one. A sequence number is appended to the export filename.# specified in tplfile. After the tplfiles have been exported, templatefile is included once per.# exported file, with "<%target%>" defined as the relative path of the exported file..#.# The "copy" command copies the indicated path or directory to the export directory..# Examples:.# copy everything from the "assets\" directory at the sa

C:\Program Files (x86)\Google\Picasa3\web\templates\whitefrm\itemheader.html

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe
File Type:	HTML document, ASCII text
Category:	dropped
Size (bytes):	215
Entropy (8bit):	4.826357400543029
Encrypted:	false
SSDEEP:	6:qFzLO6QcjWR0NNEXW0YmRZ4KT6xvzMkdxWHGjwew:Z6QclfqEvwYxWHGu
MD5:	331CFC47C3BD9A84097C6DC889AB366C
SHA1:	271273696CFF4DF446EB93A72F99A98A045BF5B2
SHA-256:	9891FC499E4FADBD26096441ED72BB1909FA5FB5540156D86278938BE69CAA60
SHA-512:	7118766A6DCDC078B985C99C94D38FE5EE35CBAE3324A64D761BB33BDCCC9EB16E24FC7D82B493D17F9DFFFD5EA3188DD9289356B6933C035D742336E2A7D2AF
Malicious:	false
Reputation:	unknown
Preview:	<html>.<head>.<meta http-equiv="Content-Type" content="text/html; charset=UTF-8">.<title><%itemName%></title>.<link rel="stylesheet" href="style.css" type="text/css">.</head>.<body bgcolor="#FFFFFF" text="#000000">.

C:\Program Files (x86)\Google\Picasa3\web\templates\whitefrm\preview.jpg

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe
File Type:	JPEG image data, JFIF standard 1.02, aspect ratio, density 100x100, segment length 16, baseline, precision 8, 280x390, components 3
Category:	dropped
Size (bytes):	24286
Entropy (8bit):	7.949489010897486
Encrypted:	false
SSDEEP:	384:UK6ZrqGEmSEEILsf1+SqPMHl+oZKRRk6wgksckXFee6btOzAoDDEbjwy:UJZD1EILsf8CluRrwgkZkXStOXsx
MD5:	7B8BE04FE3177276EC1CEEA51B2B81CA
SHA1:	0C0208BE9FE8E448F5BDF78ED0554BD8ABD61F07
SHA-256:	5CBFB8C662EC0CD379C17BD0874D2D62697A78000186ADB6ADAE374276EAB89D
SHA-512:	4E9354A7FD87B26B810B00E942F60DFFD20723C6FF64A1F342E06C77F7BE91CA4C3D301C12B50D28CB968A4199C5BC70968BB7668B1A84AC3F3FC86FE54B1D79
Malicious:	false
Reputation:	unknown
Preview:	......JFIF.....d.d......Ducky.......P......Adobe.d.................................................................................................................................................................................................................................................."..!12B..R#..AQabr..3.5.V.q....Ss.Tt.Uuv7...C.$4..c.D&..d......%e6Ff'.........................."2.!1R..AQ.BC.a.b#3.qr....S.......cs................?.....@ .......@ .......@ .......@ .......@ .......@ .......@ .......@ .......@ .......@ .......@ .......@ .......@ .......@ .......@ .......@ .......@ .......@ ..}..W.^{u..[B....-.E....IE\|jJ.!........b...+).s.'8c...k.s.~.O.\.r...l..xy..Y..\..$`...:\|P....)OB.+..ZF....+.N......+m.{....}.(...._.j."...Y.-.1[.l..[........t......F.;.TU5{?...].9."(}M..Y...K..E....X...[.<....[....E.4..Ti..=bz.S.....A..j.#..{pjN..,q..&.....Cku..G.N..#.h..;.T...x..&...i.>.j.)...1B../C.M.}M.*.r..k...y....8N.n..9E_92.[...$D...SNn.>...c....C..../.n..$.XX......

C:\Program Files (x86)\Google\Picasa3\web\templates\whitefrm\targetlistelement.html

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe
File Type:	HTML document, ASCII text
Category:	dropped
Size (bytes):	1131
Entropy (8bit):	5.255328433781255
Encrypted:	false
SSDEEP:	24:Vp6F6eHXF6ROHo0F6mrHrF6I3O6e0RuwsFmZFr4mL8XIjkxzCu+id:Vpu62V6st6oR6h6erxmXr9gXIjkEuF
MD5:	D1A14817B1137560BC6CA3A22A6CE189
SHA1:	ACEAC48828D0832F4D9C0AADD8DF65A5DA29998F
SHA-256:	8E717B2A957308A9D1572D048F17EBC13548276238C3F5FAC7B6D1EE56972876
SHA-512:	16AD7B04FC506557907BAF79793D7B1E48657DDCF96FC95F312EE978370405A21A9B543F0FC855311B7029B5FCE51A104A9D3AF8825B23014249CC516D94B704
Malicious:	false
Reputation:	unknown
Preview:	<span class="textbg"><%itemCaption%> </span>.<p><span class="textreg">.<%if !isFirstTarget%><a href="<%firstTarget%>"><%endif%>First<%if !isFirstTarget%></a><%endif%> \|.<%if isPrevTarget%><a href="<%prevTarget%>"><%endif%>Previous Picture<%if isPrevTarget%></a><%endif%> \|.<%if isNextTarget%><a href="<%nextTarget%>"><%endif%>Next Picture<%if isNextTarget%></a><%endif%> \|.<%if !isLastTarget%><a href="<%lastTarget%>"><%endif%>Last<%if !isLastTarget%></a><%endif%><br>.</span><hr size="1">.<%if isSimpleEmbed%>.<embed src="<%itemLargeImage%>" autoplay="true" showcontrols="true" controller="true">.<%endif%>.<%if isExtendedEmbed%>.<OBJECT ID="MediaPlayer" .CLASSID="CLSID:22D6F312-B0F6-11D0-94AB-0080C74C7E95" .TYPE="application/x-oleobject".STANDBY="Loading Windows Media Player components...">.<PARAM NAME="FileName" VALUE="<%itemLargeImage%>">.<PARAM NAME="autostart" VALUE="1">.<PARAM NAME="showcontrols" VALUE="1">.<EMBED TYPE="application/x-mplayer2">.</EMBED>.</OBJECT>.<%endif%>.<%if isImage%

C:\Program Files (x86)\Google\Picasa3\web\templates\whitefrm\thumbnails.tpl

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1733
Entropy (8bit):	4.610842472151827
Encrypted:	false
SSDEEP:	48:ryYZ6lmUML2G8hB5rR8Pl7hg0SWHbC92Lr+q6brVmizU:ezlmUMLt8/5WPhu0N74kr+RvVrI
MD5:	0AA947C873E55CE7CC70FA9284E09936
SHA1:	BC4BDEAB3B71B8933D9FE10136D2120B84BF6A55
SHA-256:	8FF27B1B43046E6BA630A0AEA03FD9D44377319F8C9D567B9CC02B97C35573D4
SHA-512:	DDEB3DDD4974AC91C67CE4FD2D23D189F672A4FAFACD90BCB05742A3D7B6E5E20FCF6F4F4296944736C1CBC72BF698BC405E68CDA57CB7132FEFBE7DFAD42CE4
Malicious:	false
Reputation:	unknown
Preview:	#templatefile -v "1.0" -n "SUBTEMPLATE" -d "USED INTERNALLY BY ANOTHER TEMPLATE".# pound sign is a comment character.#.# lines that begin with "include" point to a file to be included at this point.# lines that begin with "loop" repeat the specified file once per image.# if loop or include files begin with "#templatefile" then that templatefile.# is processed in its entirety. In this way you can create .# file-per-image exports. .#.# The special "targetloop tplfile templatefile" command loops over each image, .# interpreting tplfile for each one. A sequence number is appended to the export filename.# specified in tplfile. After the tplfiles have been exported, templatefile is included once per.# exported file, with "<%target%>" defined as the relative path of the exported file..#.# The "copy" command copies the indicated path or directory to the export directory..# Examples:.# copy everything from the "assets\" directory at the same level as the template into the output dir.# copy asse

C:\Program Files (x86)\Google\Picasa3\web\templates\xml\footer.xml

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	8
Entropy (8bit):	3.0
Encrypted:	false
SSDEEP:	3:cmn:F
MD5:	C09626D94E306867086337A4BE2D41B5
SHA1:	0C4F51A64464B0B2F7402557AA806129E6C3EDD3
SHA-256:	CFDBDDCA33A4D5B0499B61F78CC5D0184D1E49EB79A253EE3A93D86583027B58
SHA-512:	DB3AB9BAB714F43E6A6FE63F91632D7618B2A9C7A012DC58B564A58EE10FB52E252510A15755C7D2882905A19E63AF607CDF37300DDA98F9841306100BBF2081
Malicious:	false
Reputation:	unknown
Preview:	</album>

C:\Program Files (x86)\Google\Picasa3\web\templates\xml\header.xml

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe
File Type:	XML 1.0 document, ASCII text
Category:	dropped
Size (bytes):	183
Entropy (8bit):	4.598037346457998
Encrypted:	false
SSDEEP:	3:vFWWMNHU8LdgCzLZ8ZCEIAiEAIAm2DIAtgHuSZfKZegv62C3+0TeL:TMVBdTt8ZoAiEtAOAHqfK562m6
MD5:	232084584A45D326F3D0981D8B0CB3D2
SHA1:	A1B16650C8993BC9720D7B8B7CBD6B0E864512B6
SHA-256:	A95D977002DEED2A430090D2CEA27CFE86F821DDB798519D2E5EA465807D4855
SHA-512:	1E65A707F2B58BAAB3EA4EAF2E2CA7997AA899F442586A2BF252D55675EC85BFDB35965F0AC2A5A456819DD96CC93A6F90062C391EE9D767EE59F13BF4E8A6CE
Malicious:	false
Reputation:	unknown
Preview:	<?xml version="1.0" encoding="utf-8" ?>.<album>.<albumName><%albumName%></albumName>.<albumItemCount><%albumItemCount%></albumItemCount>.<albumCaption><%albumCaption%></albumCaption>.

C:\Program Files (x86)\Google\Picasa3\web\templates\xml\imagelistelement.xml

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1589
Entropy (8bit):	4.606978060981107
Encrypted:	false
SSDEEP:	48:3yZZvMWU1MWpmNMzKat9hjCtADw2GtcKpugEAlTZV:bucKpugLTZV
MD5:	B8B067C14C2BE00AF341C93FB00DB027
SHA1:	B2AF3AFEF681E2A6F5CE178B88A3D6F1368C856A
SHA-256:	8308D1519D9C42839535118D6EF2005BE9AF96007A5CFD422CDD4B8D7FF8173F
SHA-512:	F67D5B73A2A4544E19CADEF782C416ABB775A8346817AC2F6976CA78385DA68C37FF4D783092F85CA91FC26C2B4BC58FD0D39943FBCCA332AEEB4ACD42C4EF92
Malicious:	false
Reputation:	unknown
Preview:	<image>..<%if isFirstImage%><isFirstImage>...true..</isFirstImage>..<%endif%>..<%if !isFirstImage%><isFirstImage>...false..</isFirstImage>..<%endif%>..<%if isPrevImage%><isPrevImage>...true..</isPrevImage>..<%endif%>..<%if !isPrevImage%><isPrevImage>...false..</isPrevImage>..<prevImage />..<%endif%>..<%if isLastImage%><isLastImage>...true..</isLastImage>..<%endif%>..<%if !isLastImage%><isLastImage>...false..</isLastImage>..<%endif%>..<%if isNextImage%><isNextImage>...true..</isNextImage>..<%endif%>..<%if !isNextImage%><isNextImage>...false..</isNextImage>..<%endif%>....<firstImage>...<%firstImage%>..</firstImage>..<itemLargeImage>...<%itemLargeImage%>..</itemLargeImage>...<nextImage>...<%nextImage%>..</nextImage>..<nextThumbnail>...<%nextThumbnail%>..</nextThumbnail>..<prevImage>...<%prevImage%>..</prevImage>..<prevThumbnail>...<%prevThumbnail%>..</prevThumbnail>..<lastImage>...<%lastImage%>..</lastImage>..<lastThumbnail>...<%lastThumbnail%>..</lastThumbnail>...<itemWidth>...<%itemWidt

C:\Program Files (x86)\Google\Picasa3\web\templates\xml\imagelistfooter.xml

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	10
Entropy (8bit):	3.321928094887362
Encrypted:	false
SSDEEP:	3:HK:HK
MD5:	1182C58D911EA64DD33649F86ACF8612
SHA1:	481DB5DC1F7BC2EA3D5736B2B814C2DF97BF83E2
SHA-256:	981F14BE9103CEC8B4CDBF00DD315DF4E5BECE375926EA3D388D633447F52E93
SHA-512:	B6C280DF9E6338B319731A116D6A496D224CEA21B8E9BD156D8F6B62FDC698EFB7157DE1CD0F238A1EAA98E3747F744CDBDD31C6BDAE004848C3D862B296348C
Malicious:	false
Reputation:	unknown
Preview:	</images>.

C:\Program Files (x86)\Google\Picasa3\web\templates\xml\imagelistheader.xml

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	9
Entropy (8bit):	3.169925001442312
Encrypted:	false
SSDEEP:	3:bPL:/
MD5:	8166C93FA380BE291870434359E211E8
SHA1:	5C8EEA151AD1AACA5E49402DA959A546512FEA41
SHA-256:	B7BD84420AB8A96F4EF52FD57463235F65D7B139A6F3D9BD18FF05E78BC5072A
SHA-512:	96F11A38E07C4E70CF9460BFFB0F389699307E399CDE2F5DF96251DE696D3098F8445F02001A3BF80E28D841987FBC524D5DC0A3ACB6B30CE0484AD597F3D6ED
Malicious:	false
Reputation:	unknown
Preview:	<images>.

C:\Program Files (x86)\Google\Picasa3\web\templates\xml\index.tpl

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1813
Entropy (8bit):	4.5034385080489505
Encrypted:	false
SSDEEP:	48:ryYhrwlmUML2G8hB5rR8Pl7hg0SWHbC92Lr2EcuSl4G:eHlmUMLt8/5WPhu0N74kr2EzSl4G
MD5:	3992778E235D3B81B701FDCB2ABA9B15
SHA1:	B06816C198B420DD4C84D3AEB5E20630D5889697
SHA-256:	9AE910744C757585C80AA7B541D22528BB92341A1E32285F4CD107270A1E5F3D
SHA-512:	E0BB7B9477B9C43ECCCB618E5AF1EBF8C536C44945E32C7F7F559AFB8AA4A05E8578CDC5B30FB86A5859BA01D551ECD4519FCAD444D882BF102ADB1086694169
Malicious:	false
Reputation:	unknown
Preview:	#templatefile -v "1.0" -n "XML Code" -d "Raw XML-formatted text for further translation.".# pound sign is a comment character.#.# lines that begin with "include" point to a file to be included at this point.# lines that begin with "loop" repeat the specified file once per image.# if loop or include files begin with "#templatefile" then that templatefile.# is processed in its entirety. In this way you can create .# file-per-image exports. .#.# The special "targetloop tplfile templatefile" command loops over each image, .# interpreting tplfile for each one. A sequence number is appended to the export filename.# specified in tplfile. After the tplfiles have been exported, templatefile is included once per.# exported file, with "<%target%>" defined as the relative path of the exported file..#.# The "copy" command copies the indicated path or directory to the export directory..# Examples:.# copy everything from the "assets\" directory at the same level as the template into the output dir.#

C:\Program Files (x86)\Google\Picasa3\web\templates\xml\preview.jpg

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe
File Type:	JPEG image data, JFIF standard 1.02, aspect ratio, density 100x100, segment length 16, baseline, precision 8, 280x390, components 3
Category:	dropped
Size (bytes):	23251
Entropy (8bit):	7.92850389741974
Encrypted:	false
SSDEEP:	384:kM1cE3RIxfn3GQOZnN6zpbD78gxxiG12eXpWsj0WjaMfOhG0AZg:Xj3yB34ZN6zN7RXpWssMfOhsi
MD5:	A0A65FD59AB4BFFFE084066E0DA894A0
SHA1:	0C98E6924B3B89DDD26C6C96CC60C913891E3D38
SHA-256:	1602597EEB716BE74FDED3838320520EDD01EEC7ED3B49A0874B3A9C52D074E6
SHA-512:	D1AF435D76E874D2261A0AB92865701635D497DD91132694AE6ED1DAA988968A51548DCAD8B93CF3CA3F0A16EC7F326E49C4EAFF847FD8DC1B1FF163A2A3B01C
Malicious:	false
Reputation:	unknown
Preview:	......JFIF.....d.d......Ducky.......F......Adobe.d..........................................................................................................................................................................................................................................."...2.!BR#.1b.4T...AQ.r..3.$t.5u.Va.CSq.....U.c%..s.&...Dd...E'....................."...2RB..1#S.!b3.CAQqr$......c............?...R.;...V..W..7.8t.... 04..I...k.l{3..x........_K..[]......... .8t..oV.#4.E.S.Ss......e.~K.5...z.]...YA...8HV...K........?$V}..\|.u{fz. IS....\|?U....LK.C............<I....I....uC.m.-..g..9./&.~.....}s.+z...=.V.d..=..\%......{..u.{x.i.c..J..@(<yYs.?.z.xP....7%.:..v..q8J..8.j...D.....j..">.7..r^M..Y....H.iI A,....Q]r..wE>t%.....y.....\Z;.~..t..~.P..02Q....3...g........W...Z..... ..cI#U*39.L.O.=.>.?&....2...i+.....d.oa.......7%.....2..5.{.o.Y.7U..%\..,..S.{..8..~~I..o.._...U\Q..Q.z........?........v.m....!S..s..qT..k..n..+.oB.K.\...Q@c....L.~!.q}.v.u.....d.

C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys\3310a4fa6cb9c60504498d7eea986fc2_9e146be9-c76a-4720-bcdb-53011b87bd06

Download File

Process:	C:\Users\user\AppData\Roaming\Seznam.cz\bin\sznpp.exe
File Type:	Matlab v4 mat-file (little endian) , sparse, rows 0, columns 10
Category:	dropped
Size (bytes):	1070
Entropy (8bit):	7.0136939323455065
Encrypted:	false
SSDEEP:	24:dZNFwUKr+lgT6kKzsCwXMOfNKD75Lui4aLW+oUMO1RKr+lvsucZQYEG:dKU6tcQFXPFKd/IYMO36OsTQ9G
MD5:	521355651FE83F6BD5159C4AB94B0DAE
SHA1:	5AB52623516876F8F80417834BEAFF6E9F982023
SHA-256:	698D69D6204DCCCCA100041A02CEF5EF22933ABB0CF4B8791355142558158833
SHA-512:	DF5E147901DE7470B70741960788C569849ABDF62905CE3A318F1DD595C02CE72C0E0113850C2FA4986FEC634A22A75AE8C1C861385FEE968343537B818ECB70
Malicious:	false
Reputation:	unknown
Preview:	....................\...................Container.....................RSA1H.......?............Lw...8FHL....&..U......)..L..\|}.#r~....k.<.9./.? .sB.o.....................z..O......}w.C.mwF..O..?.....,...C.r.y.p.t.o.A.P.I. .P.r.i.v.a.t.e. .K.e.y....f...... ...b..e....<n(3.(H..".I1......7Vk.............. ....r7.zB...I.......=i.!..kh.u...>......M.K.I.3............!e.+b...g.....p..[J]...7.C.)}...1Js..?..\|fb...LR(k...:.&..j.,.O...<e.w....k...N..k.D>N..#xy..4....VIn.=W......{...7.7...R..y..{...cH..n......^ROg.P....h..T...z...$W..~.x.....O..KV.x..$.........-._.k......O.f....,1.b......XJq].5C.rn..p..\n.v..0.\`...L./N.p.dL:4...:CC"J..?...~..V..V...>......5....I.M..3...tm..X.v."J.m.WJY..9cz.Cu..&..zdL.9+k.LI. 0.u..IWe.m...N.3.@....,j..........!.\| .I.Z5..{ u..G..}....Yd.DlB<..B.......N~.............z..O......}w.C.mwF..O..?.........E.x.p.o.r.t. .F.l.a.g....f...... .....J.....@.}..g)....8..q.y...*............ ......[hA..?N........hQ......0....q.....#b.].....3.

C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Picasa 3\Configure Picasa Photo Viewer.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Archive, ctime=Fri Oct 9 16:37:42 2015, mtime=Wed Oct 2 09:16:00 2024, atime=Fri Oct 9 16:37:42 2015, length=4806984, window=hide
Category:	dropped
Size (bytes):	1273
Entropy (8bit):	4.5790411537348366
Encrypted:	false
SSDEEP:	24:8OH/iIEAdOEuWKxiouIPWl1j1crAdqipEfcdRZTpndRZTUIUUFXqygm:8OH/8AdO+KxbrPWn1ccAipEfcd/Tpndc
MD5:	07DF3FEFA3C43FF7D251A387DCEA9F61
SHA1:	800D2ACB883C260C13E7F8063C0F7A20E2D4CD95
SHA-256:	640C90F2A439AC332DBBF4F8706B1D0200291F3B1E922E268E6C6EA4858BDC19
SHA-512:	F5B3FEF2C0F4F884F4EF6A4C5231473AE877B5F45207FAB81B1B8E5EB13B7F4C1A0DFFA8ED1551C736460A7267379ADA7A7C34C2C592B3959370A037C5F33403
Malicious:	false
Reputation:	unknown
Preview:	L..................F.... ......3.....~K........3....HYI..........................P.O. .:i.....+00.../C:\.....................1.....BY.Q..PROGRA~2.........O.IBY.Q....................V......N..P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.)...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.8.1.7.....T.1.....BY.R..Google..>......CW.VBY.R..............................G.o.o.g.l.e.....V.1.....BY.R..Picasa3.@......BY.RBY.R.............................P.i.c.a.s.a.3.....x.2.HYI.IG.. .PICASA~1.EXE..\......IG..BY.R..............................P.i.c.a.s.a.P.h.o.t.o.V.i.e.w.e.r...e.x.e.......j...............-.......i.............{......C:\Program Files (x86)\Google\Picasa3\PicasaPhotoViewer.exe..J.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.).\.G.o.o.g.l.e.\.P.i.c.a.s.a.3.\.P.i.c.a.s.a.P.h.o.t.o.V.i.e.w.e.r...e.x.e.%.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.).\.G.o.o.g.l.e.\.P.i.c.a.s.a.3.../.r.e.c.o.n.f.i.g.........................@Z\|...K.J.........`.......X.......216554...........hT..

C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Picasa 3\Picasa 3.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Archive, ctime=Fri Oct 9 16:37:40 2015, mtime=Wed Oct 2 09:15:58 2024, atime=Fri Oct 9 16:37:40 2015, length=10160456, window=hide
Category:	dropped
Size (bytes):	1201
Entropy (8bit):	4.568209501349215
Encrypted:	false
SSDEEP:	24:8mYiIEAdOEuWKxiouIPW34CcAAvqipEf8+dRZTpidRZToUUFfqygm:8mY8AdO+KxbrPW34CcXSipEf8+d/Tpiz
MD5:	15A4EF2615EF29386C4361EF1DF8534E
SHA1:	ACBBAAF2E5333211138A880483CAE99780EC26AD
SHA-256:	B19BC3488ED5D8FBBE51BB0EAFED105C386115AF5946BD6152506627385223AD
SHA-512:	8492474A09C0BDFE3927629454DBC669620E6B2FF66EAE596B82746294729986E363736C5BD831396649CEB87DFBDB3DE6151C6D43CD29BBA565C514C9415AE7
Malicious:	false
Reputation:	unknown
Preview:	L..................F.... ......1......[........1....H............................P.O. .:i.....+00.../C:\.....................1.....BY.Q..PROGRA~2.........O.IBY.Q....................V......N..P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.)...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.8.1.7.....T.1.....BY.R..Google..>......CW.VBY.R..............................G.o.o.g.l.e.....V.1.....BY.R..Picasa3.@......BY.RBY.R.............................P.i.c.a.s.a.3.....b.2.H...IG.. .Picasa3.exe.H......IG..BY.R..............................P.i.c.a.s.a.3...e.x.e.......`...............-......._.............{......C:\Program Files (x86)\Google\Picasa3\Picasa3.exe..@.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.).\.G.o.o.g.l.e.\.P.i.c.a.s.a.3.\.P.i.c.a.s.a.3...e.x.e.%.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.).\.G.o.o.g.l.e.\.P.i.c.a.s.a.3.........................@Z\|...K.J.........`.......X.......216554...........hT..CrF.f4... ..!............%..hT..CrF.f4... ..!............%.............1

C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Picasa 3\Uninstall.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Archive, ctime=Fri Oct 9 16:37:44 2015, mtime=Wed Oct 2 09:16:00 2024, atime=Fri Oct 9 16:37:44 2015, length=212240, window=hide
Category:	dropped
Size (bytes):	1213
Entropy (8bit):	4.619462223963141
Encrypted:	false
SSDEEP:	24:8mg2iIEAdOEuWKxiouIPW90g7/RAFqipETtdRZTONdRZToUUFfqygm:8mg28AdO+KxbrPW90gDiIipExd/TONdJ
MD5:	1865A7F2D08D4B4C26F4EA8FCDDBCBAE
SHA1:	B49327AC4627ABDEB55BC9B2F24CB3153971C2D8
SHA-256:	478845858C5BDF2001B1E2E2930E20F525CBA9E6DE94C17917A1EC8543915513
SHA-512:	9B08B3C03996F13CFFEB35169AB1FD75D6BB76C786AF7B578374B0552A62E38F5D218E8E5BC84A0A7BFC2CCF731FE21476E90767CBD65F8AF691C22A5AAC090C
Malicious:	false
Reputation:	unknown
Preview:	L..................F.... ....$K4......^......$K4.....=...........................P.O. .:i.....+00.../C:\.....................1.....BY.Q..PROGRA~2.........O.IBY.Q....................V......N..P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.)...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.8.1.7.....T.1.....BY.R..Google..>......CW.VBY.R..............................G.o.o.g.l.e.....V.1.....BY.R..Picasa3.@......BY.RBY.R.............................P.i.c.a.s.a.3.....h.2..=..IG.. .UNINST~1.EXE..L......IG..BY.R..............................u.n.i.n.s.t.a.l.l...e.x.e.......b...............-.......a.............{......C:\Program Files (x86)\Google\Picasa3\uninstall.exe..B.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.).\.G.o.o.g.l.e.\.P.i.c.a.s.a.3.\.u.n.i.n.s.t.a.l.l...e.x.e.%.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.).\.G.o.o.g.l.e.\.P.i.c.a.s.a.3.........................@Z\|...K.J.........`.......X.......216554...........hT..CrF.f4... ..!............%..hT..CrF.f4... ..!............%..

C:\Users\Public\Desktop\Picasa 3.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Archive, ctime=Fri Oct 9 16:37:40 2015, mtime=Wed Oct 2 09:16:07 2024, atime=Fri Oct 9 16:37:40 2015, length=10160456, window=hide
Category:	dropped
Size (bytes):	1183
Entropy (8bit):	4.579474226623884
Encrypted:	false
SSDEEP:	24:8mIKiIEAdOEuWKxiouIPW34CcAAvqipEf8m0dRZTpidRZToUUFfqygm:8mJ8AdO+KxbrPW34CcXSipEf8Fd/Tpiz
MD5:	4C13ADA7FB76C7C143EFF5A7633AC722
SHA1:	6601E7695FEB0E87AD8FA2AAED5B2BD6E956B4E2
SHA-256:	141D172065A8536E1EBA8BDB78954899FE3FB005C8745FC2C5DDE9DD334D1AA0
SHA-512:	9203DAEC2A1274D06CE41D5BC6BC9C9CCD8FDB92A919B2BA3A8B3AC6C7AFF6068F15F907DABB462CEF18408D6C57B12251788512977A91CCCD661675D1CA9062
Malicious:	false
Reputation:	unknown
Preview:	L..................F.... ......1....a.h........1....H............................P.O. .:i.....+00.../C:\.....................1.....BY.Q..PROGRA~2.........O.IBY.Q....................V......N..P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.)...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.8.1.7.....T.1.....BY.R..Google..>......CW.VBY.R..............................G.o.o.g.l.e.....V.1.....BY.R..Picasa3.@......BY.RBY.R.............................P.i.c.a.s.a.3.....b.2.H...IG.. .Picasa3.exe.H......IG..BY.R..............................P.i.c.a.s.a.3...e.x.e.......`...............-......._.............{......C:\Program Files (x86)\Google\Picasa3\Picasa3.exe..7.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.).\.G.o.o.g.l.e.\.P.i.c.a.s.a.3.\.P.i.c.a.s.a.3...e.x.e.%.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.).\.G.o.o.g.l.e.\.P.i.c.a.s.a.3.........................@Z\|...K.J.........`.......X.......216554...........hT..CrF.f4... ..!............%..hT..CrF.f4... ..!............%.............1SPS.XF.L8C....&.m

C:\Users\user\AppData\LocalLow\Microsoft\Internet Explorer\Services\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico

Download File

Process:	C:\Program Files\Internet Explorer\iexplore.exe
File Type:	MS Windows icon resource - 1 icon, 32x32, 32 bits/pixel
Category:	dropped
Size (bytes):	4286
Entropy (8bit):	3.8046022951415335
Encrypted:	false
SSDEEP:	24:suZOWcCXPRS4QAUs/KBy3TYI42Apvl6wheXpktCH2Yn4KgISQggggFpz1k9PAYHu:HBRh+sCBykteatiBn4KWi1+Ne
MD5:	DA597791BE3B6E732F0BC8B20E38EE62
SHA1:	1125C45D285C360542027D7554A5C442288974DE
SHA-256:	5B2C34B3C4E8DD898B664DBA6C3786E2FF9869EFF55D673AA48361F11325ED07
SHA-512:	D8DC8358727590A1ED74DC70356AEDC0499552C2DC0CD4F7A01853DD85CEB3AEAD5FBDC7C75D7DA36DB6AF2448CE5ABDFF64CEBDCA3533ECAD953C061A9B338E
Malicious:	false
Reputation:	unknown
Preview:	...... .... .........(... ...@..... ...................................................................................................................................................................................................N...Sz..R...R...P...N..L..H..DG..........................................................................................R6..U...U...S...R...P...N..L..I..F..B...7...............................................................................S6..V...V...U...S...R...P...N..L..I..F..C...?..:z......................................................................O...W...V...V...U...S...R...P...N..L..I..E..C...?...;..{7..q2$..............................................................T..D..]...S)..p6..J...R...P...N..L..I..E..B..>..;..z7..p2..f,X.........................................................A..O#..N!..N!..N!..P$..q:...P...N..K..I..E..A..=..9..x5..n0..e,...5...................................................Ea.Z,..T$..T$..T

C:\Users\user\AppData\Local\Google\Picasa2\cache\cacheindex_0

Download File

Process:	C:\Program Files (x86)\Google\Picasa3\Picasa3.exe
File Type:	ISO-8859 text, with no line terminators
Category:	dropped
Size (bytes):	4
Entropy (8bit):	1.5
Encrypted:	false
SSDEEP:	3:00:00
MD5:	6C54887CD5D21BB3306E84201D3956C1
SHA1:	07DBDA8D5EB8429C1D9795AB201927287F4DCDC5
SHA-256:	7976ACFBC3DE10E4E4720F1FE68A3621615536679EF373FD7D6DF906C8C86DC4
SHA-512:	628419155DB2AB3A8990EB2C3000AEAB4990569044C7BF28588F305C241489EFB1AB20FA3B7D9E07D0B918E411A531199FD090F720B7C881053CB605F62D4CC1
Malicious:	false
Reputation:	unknown
Preview:	...?

C:\Users\user\AppData\Local\Google\Picasa2\cache\feeds\cbc8c166b3afe4a32114ae7882d0efb0

Download File

Process:	C:\Program Files (x86)\Google\Picasa3\Picasa3.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 text, with very long lines (33882)
Category:	dropped
Size (bytes):	58543
Entropy (8bit):	5.19585870025368
Encrypted:	false
SSDEEP:	1536:Dh837Lpb80i/g7BZmYOWL2WAxxxXx1xXxQ4xXQxrxHnxXFOxnxmxXOxFxBxixQx2:DhwLpt7
MD5:	46AE8D0032D01C615B6ED82DE7445E79
SHA1:	96728FFC260B49C2648A1F5BCB182FD73548A43E
SHA-256:	EB0A50C53499B4402E13A35D1FD710E3C5A2501F100775956851F9ADC5608A73
SHA-512:	52AF718D7B1BD0B2F54433A3E5DA4A2068FAB61AEE4FE8BBAC1F5F5FBE6AFCFE25B0960379DE3357720F5F4434260BB7BB37B1778C5E851F918E2DF42B3B1B52
Malicious:	false
Reputation:	unknown
Preview:	<?xml version='1.0' encoding='UTF-8'?><?xml-stylesheet href="http://www.blogger.com/styles/atom.css" type="text/css"?><feed xmlns='http://www.w3.org/2005/Atom' xmlns:openSearch='http://a9.com/-/spec/opensearchrss/1.0/' xmlns:blogger='http://schemas.google.com/blogger/2008' xmlns:georss='http://www.georss.org/georss' xmlns:gd="http://schemas.google.com/g/2005" xmlns:thr='http://purl.org/syndication/thread/1.0'><id>tag:blogger.com,1999:blog-1456569655786168306</id><updated>2024-08-28T07:47:25.998-07:00</updated><category term="autoupdate"/><title type='text'>The Picasa 3 ReadMe</title><subtitle type='html'></subtitle><link rel='http://schemas.google.com/g/2005#feed' type='application/atom+xml' href='http://picasa-readme.blogspot.com/feeds/posts/default'/><link rel='self' type='application/atom+xml' href='http://www.blogger.com/feeds/1456569655786168306/posts/default'/><link rel='alternate' type='text/html' href='http://picasa-readme.blogspot.com/'/><link rel='hub' href='http://pubsubhubb

C:\Users\user\AppData\Local\Google\Picasa2\db3\albumdata_0

Download File

Process:	C:\Program Files (x86)\Google\Picasa3\Picasa3.exe
File Type:	ISO-8859 text, with no line terminators
Category:	dropped
Size (bytes):	4
Entropy (8bit):	1.5
Encrypted:	false
SSDEEP:	3:00:00
MD5:	6C54887CD5D21BB3306E84201D3956C1
SHA1:	07DBDA8D5EB8429C1D9795AB201927287F4DCDC5
SHA-256:	7976ACFBC3DE10E4E4720F1FE68A3621615536679EF373FD7D6DF906C8C86DC4
SHA-512:	628419155DB2AB3A8990EB2C3000AEAB4990569044C7BF28588F305C241489EFB1AB20FA3B7D9E07D0B918E411A531199FD090F720B7C881053CB605F62D4CC1
Malicious:	false
Reputation:	unknown
Preview:	...?

C:\Users\user\AppData\Local\Google\Picasa2\db3\albums_0.db

Download File

Process:	C:\Program Files (x86)\Google\Picasa3\Picasa3.exe
File Type:	ISO-8859 text, with no line terminators
Category:	dropped
Size (bytes):	4
Entropy (8bit):	1.5
Encrypted:	false
SSDEEP:	3:00:00
MD5:	6C54887CD5D21BB3306E84201D3956C1
SHA1:	07DBDA8D5EB8429C1D9795AB201927287F4DCDC5
SHA-256:	7976ACFBC3DE10E4E4720F1FE68A3621615536679EF373FD7D6DF906C8C86DC4
SHA-512:	628419155DB2AB3A8990EB2C3000AEAB4990569044C7BF28588F305C241489EFB1AB20FA3B7D9E07D0B918E411A531199FD090F720B7C881053CB605F62D4CC1
Malicious:	false
Reputation:	unknown
Preview:	...?

C:\Users\user\AppData\Local\Google\Picasa2\db3\bigthumbs_0.db

Download File

Process:	C:\Program Files (x86)\Google\Picasa3\Picasa3.exe
File Type:	ISO-8859 text, with no line terminators
Category:	dropped
Size (bytes):	4
Entropy (8bit):	1.5
Encrypted:	false
SSDEEP:	3:00:00
MD5:	6C54887CD5D21BB3306E84201D3956C1
SHA1:	07DBDA8D5EB8429C1D9795AB201927287F4DCDC5
SHA-256:	7976ACFBC3DE10E4E4720F1FE68A3621615536679EF373FD7D6DF906C8C86DC4
SHA-512:	628419155DB2AB3A8990EB2C3000AEAB4990569044C7BF28588F305C241489EFB1AB20FA3B7D9E07D0B918E411A531199FD090F720B7C881053CB605F62D4CC1
Malicious:	false
Reputation:	unknown
Preview:	...?

C:\Users\user\AppData\Local\Google\Picasa2\db3\catdata_0

Download File

Process:	C:\Program Files (x86)\Google\Picasa3\Picasa3.exe
File Type:	ISO-8859 text, with no line terminators
Category:	dropped
Size (bytes):	4
Entropy (8bit):	1.5
Encrypted:	false
SSDEEP:	3:00:00
MD5:	6C54887CD5D21BB3306E84201D3956C1
SHA1:	07DBDA8D5EB8429C1D9795AB201927287F4DCDC5
SHA-256:	7976ACFBC3DE10E4E4720F1FE68A3621615536679EF373FD7D6DF906C8C86DC4
SHA-512:	628419155DB2AB3A8990EB2C3000AEAB4990569044C7BF28588F305C241489EFB1AB20FA3B7D9E07D0B918E411A531199FD090F720B7C881053CB605F62D4CC1
Malicious:	false
Reputation:	unknown
Preview:	...?

C:\Users\user\AppData\Local\Google\Picasa2\db3\facetemplatesV2_0.db

Download File

Process:	C:\Program Files (x86)\Google\Picasa3\Picasa3.exe
File Type:	ISO-8859 text, with no line terminators
Category:	dropped
Size (bytes):	4
Entropy (8bit):	1.5
Encrypted:	false
SSDEEP:	3:00:00
MD5:	6C54887CD5D21BB3306E84201D3956C1
SHA1:	07DBDA8D5EB8429C1D9795AB201927287F4DCDC5
SHA-256:	7976ACFBC3DE10E4E4720F1FE68A3621615536679EF373FD7D6DF906C8C86DC4
SHA-512:	628419155DB2AB3A8990EB2C3000AEAB4990569044C7BF28588F305C241489EFB1AB20FA3B7D9E07D0B918E411A531199FD090F720B7C881053CB605F62D4CC1
Malicious:	false
Reputation:	unknown
Preview:	...?

C:\Users\user\AppData\Local\Google\Picasa2\db3\imagedata_0

Download File

Process:	C:\Program Files (x86)\Google\Picasa3\Picasa3.exe
File Type:	ISO-8859 text, with no line terminators
Category:	dropped
Size (bytes):	4
Entropy (8bit):	1.5
Encrypted:	false
SSDEEP:	3:00:00
MD5:	6C54887CD5D21BB3306E84201D3956C1
SHA1:	07DBDA8D5EB8429C1D9795AB201927287F4DCDC5
SHA-256:	7976ACFBC3DE10E4E4720F1FE68A3621615536679EF373FD7D6DF906C8C86DC4
SHA-512:	628419155DB2AB3A8990EB2C3000AEAB4990569044C7BF28588F305C241489EFB1AB20FA3B7D9E07D0B918E411A531199FD090F720B7C881053CB605F62D4CC1
Malicious:	false
Reputation:	unknown
Preview:	...?

C:\Users\user\AppData\Local\Google\Picasa2\db3\previews_0.db

Download File

Process:	C:\Program Files (x86)\Google\Picasa3\Picasa3.exe
File Type:	ISO-8859 text, with no line terminators
Category:	dropped
Size (bytes):	4
Entropy (8bit):	1.5
Encrypted:	false
SSDEEP:	3:00:00
MD5:	6C54887CD5D21BB3306E84201D3956C1
SHA1:	07DBDA8D5EB8429C1D9795AB201927287F4DCDC5
SHA-256:	7976ACFBC3DE10E4E4720F1FE68A3621615536679EF373FD7D6DF906C8C86DC4
SHA-512:	628419155DB2AB3A8990EB2C3000AEAB4990569044C7BF28588F305C241489EFB1AB20FA3B7D9E07D0B918E411A531199FD090F720B7C881053CB605F62D4CC1
Malicious:	false
Reputation:	unknown
Preview:	...?

C:\Users\user\AppData\Local\Google\Picasa2\db3\profilephotos_0.db

Download File

Process:	C:\Program Files (x86)\Google\Picasa3\Picasa3.exe
File Type:	ISO-8859 text, with no line terminators
Category:	dropped
Size (bytes):	4
Entropy (8bit):	1.5
Encrypted:	false
SSDEEP:	3:00:00
MD5:	6C54887CD5D21BB3306E84201D3956C1
SHA1:	07DBDA8D5EB8429C1D9795AB201927287F4DCDC5
SHA-256:	7976ACFBC3DE10E4E4720F1FE68A3621615536679EF373FD7D6DF906C8C86DC4
SHA-512:	628419155DB2AB3A8990EB2C3000AEAB4990569044C7BF28588F305C241489EFB1AB20FA3B7D9E07D0B918E411A531199FD090F720B7C881053CB605F62D4CC1
Malicious:	false
Reputation:	unknown
Preview:	...?

C:\Users\user\AppData\Local\Google\Picasa2\db3\thumbs2_0.db

Download File

Process:	C:\Program Files (x86)\Google\Picasa3\Picasa3.exe
File Type:	ISO-8859 text, with no line terminators
Category:	dropped
Size (bytes):	4
Entropy (8bit):	1.5
Encrypted:	false
SSDEEP:	3:00:00
MD5:	6C54887CD5D21BB3306E84201D3956C1
SHA1:	07DBDA8D5EB8429C1D9795AB201927287F4DCDC5
SHA-256:	7976ACFBC3DE10E4E4720F1FE68A3621615536679EF373FD7D6DF906C8C86DC4
SHA-512:	628419155DB2AB3A8990EB2C3000AEAB4990569044C7BF28588F305C241489EFB1AB20FA3B7D9E07D0B918E411A531199FD090F720B7C881053CB605F62D4CC1
Malicious:	false
Reputation:	unknown
Preview:	...?

C:\Users\user\AppData\Local\Google\Picasa2\db3\thumbs_0.db

Download File

Process:	C:\Program Files (x86)\Google\Picasa3\Picasa3.exe
File Type:	ISO-8859 text, with no line terminators
Category:	dropped
Size (bytes):	4
Entropy (8bit):	1.5
Encrypted:	false
SSDEEP:	3:00:00
MD5:	6C54887CD5D21BB3306E84201D3956C1
SHA1:	07DBDA8D5EB8429C1D9795AB201927287F4DCDC5
SHA-256:	7976ACFBC3DE10E4E4720F1FE68A3621615536679EF373FD7D6DF906C8C86DC4
SHA-512:	628419155DB2AB3A8990EB2C3000AEAB4990569044C7BF28588F305C241489EFB1AB20FA3B7D9E07D0B918E411A531199FD090F720B7C881053CB605F62D4CC1
Malicious:	false
Reputation:	unknown
Preview:	...?

C:\Users\user\AppData\Local\Google\Picasa2\runtime\Arial Bold-24-1.000000-400-0.ytf

Download File

Process:	C:\Program Files (x86)\Google\Picasa3\Picasa3.exe
File Type:	data
Category:	dropped
Size (bytes):	174215
Entropy (8bit):	3.9203304579033635
Encrypted:	false
SSDEEP:	1536:qgmk/GgIDsyY+IEvuctqb7AceTwZjQFaKazhd3sQ4kF/cdDx8r2g:qkGgI4l6vuctQ7neTKTRzhd3sQ4kFP2g
MD5:	61452B19F195359440C8876C3ACB73F8
SHA1:	3E3B8E1F45B8D0788302B5CB4166F57FE3978AA0
SHA-256:	2497D0E2DE1BD034930F512A49A12F003681EBC5437B4382C387951959A66D8E
SHA-512:	0DC41B1CA6570EB84E60EDC6416D3536E33FD501ABC9F1B4C03622962440BA80C5EE68FB60ED5B51537AF858D1329FA34AC97657EBC28F5BF7E05105C8354542
Malicious:	false
Reputation:	unknown
Preview:	d......................?............u.......Arial Boldp.d.....t.d.....V.r.....T.r.....A. .....R.W.....A.W.....A.......Y.o.....W.o.....A.y.....Y.A.....W.A.....Y.,.....W.,.....v.......r.......T.w.....L.V.....F.A.....F.,.....T.s.....P.......p.a.....t.a.....V.o.....T.o.....Y.p.....Y. .....A.T.....V.A.....T.A.....L. .....V.,.....T.,.....Y.-.....W.-.....A.v..... .Y.....L.W.....G.,.....L.......T.c.....W.y.......s.....p.f.....t.f.....R.Y.....y.,.....w.,.....Y.:.....W.:.....L.y.....Y.u.....W.u.....A.Y.....Y.q.....p.s.....t.s.....V.-.....T.-.....f.t.....d.t.....Y.......W.......Y.i.....W.i.....A.w.....V.y.....T.y.....S.t.....f.p.....d.p.....T.O.....F.......Y.e.....W.e.....v.,.....r.,.....V.:.....T.:.....V.u.....T.u.....L.T..... .A.....S.p.....Y.;.....W.;.....Y.v.....Y.a.....W.a.....f......... .....R.V.....P.A.....W.r.............P.,.............A.V.....V.......T.......V.i.....T.i.....1.1.....L.Y.....G.......V.e.....T.e.....r.......V.;.....T.;.....P. .....V.a.....T.a.....y.......w.......@@@@@@@@@@

C:\Users\user\AppData\Local\Google\Picasa2\runtime\Arial-12-1.000000-400-0.ytf

Download File

Process:	C:\Program Files (x86)\Google\Picasa3\Picasa3.exe
File Type:	DIY-Thermocam raw data (Lepton 3.x), scale -10357--29841, spot sensor temperature 88393864543792942064807408981155774464.000000, unit celsius, color scheme 0, userbration: offset 0.000000, slope 137438953472.000000
Category:	dropped
Size (bytes):	50288
Entropy (8bit):	6.0538641248978164
Encrypted:	false
SSDEEP:	768:KIeolu5J5nquLbTq/dQyWApRxMoPy5IGA/tIz4ee1cnIswk4sI4V:/xKnVqFVWonPYA1XeSh4V
MD5:	87F44A1648F5D13F8A124E8909FF7862
SHA1:	3FFE9F310FA7CF4CB73F0476157636BE8AF6F2BE
SHA-256:	FB6D25ED914817A1B19702E6A79054CE6DD3747A27D6BBF58FC84BA0141B1889
SHA-512:	E183BAA99C4DBB0C18BAD4B2B77F55D8E5A2C4D9F107EB9427F0A37EAC2C0863B15FD162D596E50C4F6074381E4CFABF8EE5F8B05691992C414D5FDEBA9D5957
Malicious:	false
Reputation:	unknown
Preview:	d......................?{...........x.......Arialt.d.....V.r.....T.r.....A. .....R.W.....A.W.....A.......Y.o.....W.o.....A.y.....Y.A.....W.A.....Y.,.....W.,.....v.......r.......T.w.....L.V.....F.A.....F.,..... .T.....T.s.....P.......p.a.....t.a.....V.o.....T.o.....R.T.....f.f.....Y.p.....Y. .....A.T.....V.A.....T.A.....L. .....V.,.....T.,.....Y.-.....W.-.....A.v..... .Y.....L.W.....G.,.....L.......T.c.....W.y.......s.....p.f.....t.f.....R.Y.....y.,.....w.,.....Y.:.....W.:.....L.y.....Y.u.....W.u.....A.Y.....T. .....Y.q.....p.s.....t.s.....V.-.....T.-.....f.t.....d.t.....Y.......W.......Y.i.....W.i.....A.w.....V.y.....T.y.....S.t.....f.p.....d.p.....T.O.....F.......Y.e.....W.e.....v.,.....r.,.....V.:.....T.:.....V.u.....T.u.....L.T..... .A.....S.p.....Y.;.....W.;.....Y.v.....Y.a.....W.a.....f......... .....R.V.....P.A.....W.r.............P.,.............A.V.....V.......T.......V.i.....T.i.....1.1.....L.Y.....G.......V.e.....T.e.....r.......V.;.....T.;.....P. .....V.a.....T.a.....y......

C:\Users\user\AppData\Local\Google\Picasa2\runtime\Arial-14-1.000000-400-0.ytf

Download File

Process:	C:\Program Files (x86)\Google\Picasa3\Picasa3.exe
File Type:	data
Category:	dropped
Size (bytes):	64510
Entropy (8bit):	5.788685491607631
Encrypted:	false
SSDEEP:	1536:hfrK6O+Ia+wGds4+8kFV0c5bhANSZzxZMH5DL:hfE+IXkFV0c5bhg/
MD5:	F17C557F951CB970A6BE140B4C3A2293
SHA1:	65BC431295941BEDEA935016E8EA14DCF2E29225
SHA-256:	233222CB73D128A17827BC71CF69CFAF1613B48B805AE7DCC6F3DF1D9F891E06
SHA-512:	3AFCFF757E4B742884EC37423C58A92973D5614E4E402C57A3CBCFC48E41ECCEA621C774EA478908A7D784F15DC0879788BFA19CFC2378C2A52A8CF90630CD1C
Malicious:	false
Reputation:	unknown
Preview:	d......................?............x.......Arialt.d.....V.r.....T.r.....A. .....R.W.....A.W.....A.......Y.o.....W.o.....A.y.....Y.A.....W.A.....Y.,.....W.,.....v.......r.......T.w.....L.V.....F.A.....F.,..... .T.....T.s.....P.......p.a.....t.a.....V.o.....T.o.....R.T.....f.f.....Y.p.....Y. .....A.T.....V.A.....T.A.....L. .....V.,.....T.,.....Y.-.....W.-.....A.v..... .Y.....L.W.....G.,.....L.......T.c.....W.y.......s.....p.f.....t.f.....R.Y.....y.,.....w.,.....Y.:.....W.:.....L.y.....Y.u.....W.u.....A.Y.....T. .....Y.q.....p.s.....t.s.....V.-.....T.-.....f.t.....d.t.....Y.......W.......Y.i.....W.i.....A.w.....V.y.....T.y.....S.t.....f.p.....d.p.....T.O.....F.......Y.e.....W.e.....v.,.....r.,.....V.:.....T.:.....V.u.....T.u.....L.T..... .A.....S.p.....Y.;.....W.;.....Y.v.....Y.a.....W.a.....f......... .....R.V.....P.A.....W.r.............P.,.............A.V.....V.......T.......V.i.....T.i.....1.1.....L.Y.....G.......V.e.....T.e.....r.......V.;.....T.;.....P. .....V.a.....T.a.....y......

C:\Users\user\AppData\Local\Google\Picasa2\runtime\Arial-14-1.000000-700-0.ytf

Download File

Process:	C:\Program Files (x86)\Google\Picasa3\Picasa3.exe
File Type:	data
Category:	dropped
Size (bytes):	66055
Entropy (8bit):	6.013224300221448
Encrypted:	false
SSDEEP:	1536:h7SsPVwz9Y3g6foH5d/q7O3mTi/H/aJ/Ww:hpPVwzaQ6fA132
MD5:	C3AC1005CF795A30261C2C4B6E0A5425
SHA1:	22DB92CEE9E7A2931BADDF8EAB5A17EE011635D4
SHA-256:	1EE65580D56D63B5186C75F309FB6F1ED7743C9C37062AA8CE5600973F39195A
SHA-512:	452E33C36D6516F4FD4B4992F01F626DB768283E067A4E2E22B64431915A8CFAE4A7F49B9343E501F03E3E4023E425D7C543D278FCC6A7B6AC3B15FB9A7A34F2
Malicious:	false
Reputation:	unknown
Preview:	d......................?*...........u.......Arialp.d.....t.d.....V.r.....T.r.....A. .....R.W.....A.W.....A.......Y.o.....W.o.....A.y.....Y.A.....W.A.....Y.,.....W.,.....v.......r.......T.w.....L.V.....F.A.....F.,.....T.s.....P.......p.a.....t.a.....V.o.....T.o.....Y.p.....Y. .....A.T.....V.A.....T.A.....L. .....V.,.....T.,.....Y.-.....W.-.....A.v..... .Y.....L.W.....G.,.....L.......T.c.....W.y.......s.....p.f.....t.f.....R.Y.....y.,.....w.,.....Y.:.....W.:.....L.y.....Y.u.....W.u.....A.Y.....Y.q.....p.s.....t.s.....V.-.....T.-.....f.t.....d.t.....Y.......W.......Y.i.....W.i.....A.w.....V.y.....T.y.....S.t.....f.p.....d.p.....T.O.....F.......Y.e.....W.e.....v.,.....r.,.....V.:.....T.:.....V.u.....T.u.....L.T..... .A.....S.p.....Y.;.....W.;.....Y.v.....Y.a.....W.a.....f......... .....R.V.....P.A.....W.r.............P.,.............A.V.....V.......T.......V.i.....T.i.....1.1.....L.Y.....G.......V.e.....T.e.....r.......V.;.....T.;.....P. .....V.a.....T.a.....y.......w.......F====F7....70..

C:\Users\user\AppData\Local\Google\Picasa2\runtime\Arial-14-1.000000-800-0.ytf

Download File

Process:	C:\Program Files (x86)\Google\Picasa3\Picasa3.exe
File Type:	data
Category:	dropped
Size (bytes):	66055
Entropy (8bit):	6.013187010288149
Encrypted:	false
SSDEEP:	1536:s7SsPVwz9Y3g6foH5d/q7O3mTi/H/aJ/WS:spPVwzaQ6fA13Y
MD5:	BE614FB6212137B1EEFDF075F29840A5
SHA1:	A357906CE3D6C22DCF59C2B975C4F0D3DDB21B28
SHA-256:	7FC1A47A3CB018BDC9835917360ABA92E57F966B3BD7E9B4487CD75F6AC3B553
SHA-512:	5E3D2136394C8424A769501957DCFCE27AAF1A872FFC27FA3CC83143313A0AFC98F4B83BB1AF33B29D07D9CC19032B71978F876397F4F0A29CADBE3E2DEE767B
Malicious:	false
Reputation:	unknown
Preview:	d....... ..............?*...........u.......Arialp.d.....t.d.....V.r.....T.r.....A. .....R.W.....A.W.....A.......Y.o.....W.o.....A.y.....Y.A.....W.A.....Y.,.....W.,.....v.......r.......T.w.....L.V.....F.A.....F.,.....T.s.....P.......p.a.....t.a.....V.o.....T.o.....Y.p.....Y. .....A.T.....V.A.....T.A.....L. .....V.,.....T.,.....Y.-.....W.-.....A.v..... .Y.....L.W.....G.,.....L.......T.c.....W.y.......s.....p.f.....t.f.....R.Y.....y.,.....w.,.....Y.:.....W.:.....L.y.....Y.u.....W.u.....A.Y.....Y.q.....p.s.....t.s.....V.-.....T.-.....f.t.....d.t.....Y.......W.......Y.i.....W.i.....A.w.....V.y.....T.y.....S.t.....f.p.....d.p.....T.O.....F.......Y.e.....W.e.....v.,.....r.,.....V.:.....T.:.....V.u.....T.u.....L.T..... .A.....S.p.....Y.;.....W.;.....Y.v.....Y.a.....W.a.....f......... .....R.V.....P.A.....W.r.............P.,.............A.V.....V.......T.......V.i.....T.i.....1.1.....L.Y.....G.......V.e.....T.e.....r.......V.;.....T.;.....P. .....V.a.....T.a.....y.......w.......F====F7....70..

C:\Users\user\AppData\Local\Google\Picasa2\runtime\Arial-16-1.000000-700-0.ytf

Download File

Process:	C:\Program Files (x86)\Google\Picasa3\Picasa3.exe
File Type:	GLS_BINARY_LSB_FIRST
Category:	dropped
Size (bytes):	84015
Entropy (8bit):	5.6987964015066055
Encrypted:	false
SSDEEP:	1536:XvZ3HMgDsYJfqZXXfI/oPRVQGMNAIM00NwTY7XwfY+Y2Y/YSVoYW1r/irlAnz9E:XVHT9mf7KN/MNwTY7F6K
MD5:	051673F4D8A5FE5D0CD16BD56746CF26
SHA1:	818C94305133A7795A2A6A678D2EDFF571F466DB
SHA-256:	9B89623126646CCB9DEE53E749E839EB1F358D5DE02460094521C5608FFFE3E4
SHA-512:	92C3AD00651912BAAF8E21A04D6DA3BDD2AFFA5B69788EABB5BD68D6A450BC5F39A6A322ED18BDE627FC7ACBA21A1979322BAC1291D99A54D4A8561810D77240
Malicious:	false
Reputation:	unknown
Preview:	d......................?R,..........u.......Arialp.d.....t.d.....V.r.....T.r.....A. .....R.W.....A.W.....A.......Y.o.....W.o.....A.y.....Y.A.....W.A.....Y.,.....W.,.....v.......r.......T.w.....L.V.....F.A.....F.,.....T.s.....P.......p.a.....t.a.....V.o.....T.o.....Y.p.....Y. .....A.T.....V.A.....T.A.....L. .....V.,.....T.,.....Y.-.....W.-.....A.v..... .Y.....L.W.....G.,.....L.......T.c.....W.y.......s.....p.f.....t.f.....R.Y.....y.,.....w.,.....Y.:.....W.:.....L.y.....Y.u.....W.u.....A.Y.....Y.q.....p.s.....t.s.....V.-.....T.-.....f.t.....d.t.....Y.......W.......Y.i.....W.i.....A.w.....V.y.....T.y.....S.t.....f.p.....d.p.....T.O.....F.......Y.e.....W.e.....v.,.....r.,.....V.:.....T.:.....V.u.....T.u.....L.T..... .A.....S.p.....Y.;.....W.;.....Y.v.....Y.a.....W.a.....f......... .....R.V.....P.A.....W.r.............P.,.............A.V.....V.......T.......V.i.....T.i.....1.1.....L.Y.....G.......V.e.....T.e.....r.......V.;.....T.;.....P. .....V.a.....T.a.....y.......w.......Q=====N......@0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\0669b119-acba-4bbe-8e70-c93881f82d72.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	58117
Entropy (8bit):	6.1058245319628615
Encrypted:	false
SSDEEP:	1536:k/Ps+wsI7yO/3i+EeTTvqrvbtoYKBuSZ+aoo:k/0+zI7yOq+EGTivXKBuWNP
MD5:	A15AFAFE37B48F6BF28CB6305E339894
SHA1:	12CB1308B5A115D65E76225209AFAC83025A6E7D
SHA-256:	9DF0276F2720BCC9BBB7C9107DF139A46F8A45EF67146E3E0FB8984CA6266547
SHA-512:	99071C2B70BD0C9258DCE83FD35EFEC63C0F6F11830D436F6BC1580B69964D93C31EEA2094A296775F6C84AF2142838C8D34E7408D968DD19E0829A9087DD611
Malicious:	false
Reputation:	unknown
Preview:	{"abusive_adblocker_etag":"\"8ABCE35666CBACA121128B98C75E78308AAC1CE803625FAFB4A7AFA722C77CA4\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	107893
Entropy (8bit):	4.640150877587074
Encrypted:	false
SSDEEP:	1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7s:fwUQC5VwBIiElEd2K57P7s
MD5:	6A210AC23EEE3FAAC034BFB11ABA34B1
SHA1:	2E5EA0B3C7FAADDF621CE18F3D908A70B4B82E5E
SHA-256:	E2D3BF817F9AD2A0A29C7B4228FC6E467D75BB51E23895CF1BECC16D37F49B86
SHA-512:	8516AC234507D98A00705B7F86F1B50E0B97B260351E2249AB05507317FD1C46175AD6C6088F4D28E51954B1A91E07B5683F7FCF78F6AD2C15DB0D971273F6D7
Malicious:	false
Reputation:	unknown
Preview:	{"sites":[{"url":"24video.be"},{"url":"7dnifutbol.bg"},{"url":"6tv.dk"},{"url":"9kefa.com"},{"url":"aculpaedoslb.blogspot.pt"},{"url":"aek-live.gr"},{"url":"arcadepunk.co.uk"},{"url":"acidimg.cc"},{"url":"aazah.com"},{"url":"allehensbeverwijk.nl"},{"url":"amateurgonewild.org"},{"url":"aindasoudotempo.blogspot.com"},{"url":"anorthosis365.com"},{"url":"autoreview.bg"},{"url":"alivefoot.us"},{"url":"arbitro10.com"},{"url":"allhard.org"},{"url":"babesnude.info"},{"url":"aysel.today"},{"url":"animepornx.com"},{"url":"bahisideal20.com"},{"url":"analyseindustrie.nl"},{"url":"bahis10line.org"},{"url":"apoel365.net"},{"url":"bahissitelerisikayetleri.com"},{"url":"bambusratte.com"},{"url":"banzaj.pl"},{"url":"barlevegas.com"},{"url":"baston.info"},{"url":"atomcurve.com"},{"url":"atascadocherba.com"},{"url":"astrologer.gr"},{"url":"adultpicz.com"},{"url":"alleporno.com"},{"url":"beaver-tube.com"},{"url":"beachbabes.info"},{"url":"bearworldmagazine.com"},{"url":"bebegimdensonra.com"},{"url":"autoy

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\eda23fc5-6e01-4b7f-8cb1-3e8fdf6a9606.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	107893
Entropy (8bit):	4.640150877587074
Encrypted:	false
SSDEEP:	1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7s:fwUQC5VwBIiElEd2K57P7s
MD5:	6A210AC23EEE3FAAC034BFB11ABA34B1
SHA1:	2E5EA0B3C7FAADDF621CE18F3D908A70B4B82E5E
SHA-256:	E2D3BF817F9AD2A0A29C7B4228FC6E467D75BB51E23895CF1BECC16D37F49B86
SHA-512:	8516AC234507D98A00705B7F86F1B50E0B97B260351E2249AB05507317FD1C46175AD6C6088F4D28E51954B1A91E07B5683F7FCF78F6AD2C15DB0D971273F6D7
Malicious:	false
Reputation:	unknown
Preview:	{"sites":[{"url":"24video.be"},{"url":"7dnifutbol.bg"},{"url":"6tv.dk"},{"url":"9kefa.com"},{"url":"aculpaedoslb.blogspot.pt"},{"url":"aek-live.gr"},{"url":"arcadepunk.co.uk"},{"url":"acidimg.cc"},{"url":"aazah.com"},{"url":"allehensbeverwijk.nl"},{"url":"amateurgonewild.org"},{"url":"aindasoudotempo.blogspot.com"},{"url":"anorthosis365.com"},{"url":"autoreview.bg"},{"url":"alivefoot.us"},{"url":"arbitro10.com"},{"url":"allhard.org"},{"url":"babesnude.info"},{"url":"aysel.today"},{"url":"animepornx.com"},{"url":"bahisideal20.com"},{"url":"analyseindustrie.nl"},{"url":"bahis10line.org"},{"url":"apoel365.net"},{"url":"bahissitelerisikayetleri.com"},{"url":"bambusratte.com"},{"url":"banzaj.pl"},{"url":"barlevegas.com"},{"url":"baston.info"},{"url":"atomcurve.com"},{"url":"atascadocherba.com"},{"url":"astrologer.gr"},{"url":"adultpicz.com"},{"url":"alleporno.com"},{"url":"beaver-tube.com"},{"url":"beachbabes.info"},{"url":"bearworldmagazine.com"},{"url":"bebegimdensonra.com"},{"url":"autoy

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics\BrowserMetrics-66FD1D7A-810.pma

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4194304
Entropy (8bit):	0.4763999856088743
Encrypted:	false
SSDEEP:	6144:LLIZzYhxcjyGDqkHaHblaDmu5aHeqKPTdCkrq1:xcjUSmPi
MD5:	E7E3CFE0560B32B29BFC6D7A678B4D4D
SHA1:	28712842B3230517A12AE7721604EA500D56061F
SHA-256:	4B05D9D7DB47BB6FE7BC1157954AAA69A2600B3B6F87FB734EDD2488B00EA152
SHA-512:	DA3E5023DFF552FC7D201CB6E8A3425E92CFBD9F7AB93B5C5B0FF1AFDE2C8C4D80343EAF3B17AF1DD48372B4BC8E23725D78BF7F6CA416A0E133268590CF4836
Malicious:	false
Reputation:	unknown
Preview:	...@..@...@.....C.].....@...................8...............`... ...i.y.........BrowserMetrics......i.y..Yd. .......A...................v.0.....UV&K.k<................UV&K.k<................UMA.PersistentHistograms.InitResult.....8...i.y.[".................................................i.y.Pq.30....y.........117.0.2045.47-64..".en-GB...Windows NT..10.0.190452l..x86_64..?........".xajbye20,1(.0..8..B.......2.:.M..BU..Be...?j...GenuineIntel... .. ..........x86_64...J....k..^o..J..l.zL.^o..J...I.r.^o..J....\.^o..J.....f.^o..J....?.^o..P.Z...b.INBXj....... .8.@..............2......................w..U...&..`v.>.........."....."...2..."..:............B)..1.3.177.11.. .*.RegKeyNotFound2.windowsR...Z....+....W@..$...SF@.......Y@.......Y@.......Y@........?........?.................?.......Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......Y@................Y@.......Y@.......Y@........?........?z............<..8...#...msNurturingAssistanceHomeDependency.....trig

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	280
Entropy (8bit):	4.182630182615968
Encrypted:	false
SSDEEP:	3:FiWWltlUEuWZW4HSRqOFhJXI2EyBl+BVP/Sh/JzvKo8sBXwlWllt:o1UuyRqsx+BVsJDKo89Q/
MD5:	C760E0B69978E63840B03457CF1CE24B
SHA1:	50285CF1679E38D336A8D4F7770AD6D9A82A4848
SHA-256:	17899E4ABA7B20EE2C8055BDC88D7B28E1E51453C39CA0590E086A5E63E94256
SHA-512:	7052961D214DB49C4020EFD09A8D2ADCE974CC99614A08757A9D1717667E86802E416FE85582DCB8FACEC5224C55D269FD3D595BF64B289FAC516830021AB747
Malicious:	false
Reputation:	unknown
Preview:	sdPC......................z....K..s...x."1SCRpGKHAwpF5kOwXUUSc/ojBrTkNG2SgkvqW1WE7kI="..................................................................................47DEQpj8HBSa+/TImW+5JCeuQeRkm5NMpJWZG3hSuFU=....................7dc5f755-0f90-4102-bc8e-37d02917bdc7............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\1c2cfe16-ae4e-4feb-9961-ec9a0f2fb63e.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	699551
Entropy (8bit):	4.553680319379518
Encrypted:	false
SSDEEP:	3072:FpOhNt41h1VwjfczePyCeXnyZle/uJWFkf:FpeNt4NVwbczeGnKM/No
MD5:	11C597A84894F4D7371987CBECF9D318
SHA1:	E18D9FA9B7DE0E0A306C7A00359337E04D2006CA
SHA-256:	50BC2FBB37A60F4E8ACCBDAF91E0F0BBC4AB33A590F619FCA886466EECABE324
SHA-512:	59B499B3F2D9F2C388FCF77BF4F88CAE5F4D80E3E6DFE3B8D20B64B8CF97EC518B7F24E999C5B0CB1B689C415822784D552D022766F2E30B2473F12568CA46C4
Malicious:	false
Reputation:	unknown
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13372337786836701","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13341058280410352","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"should_reset_check_default_browser":false,"toolbar_extensions_hub_button_visibility":0,"underside_chat_bing_signed_in_status":false,"window_placement":{"bottom":974,"left":10,"maximized":true,"right":1060,"top":10,"work_area_bottom":984,"work_area_left":0,"work_area_right":1280,"work_area_top":0}},"browser_content_container_height":914,"browser_content_container_width":1236,"browser_content_container_x":0,"browser_content_container_y":70,"continuous_migration":{"ci_correction_for_holdout_treatment_state":1},"countryid_at_install":17224,"custom_links":{"li

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\23c5afa6-3bae-4a3a-a1a4-7faada5d420c.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	698313
Entropy (8bit):	4.547164093617049
Encrypted:	false
SSDEEP:	3072:FpOhNt41h1VwjfczePyCeXnyZle/uJWFFj:FpeNt4NVwbczeGnKM/Nz
MD5:	23AE66CD56FE8CBE030FE933641D0D54
SHA1:	C869C25A1A29C4EED922FBAB95D878096408BF9C
SHA-256:	9E3F6E15B4DBB5823D58450063CF82FC789A2CD6F83DBFAA884D25D896EBC26E
SHA-512:	F79346A317FC509ED89FA7ED5B1098E3ED9091C51796B62FFACA47BDFF301AAEACE73EB7E1A6CAD6A29DBF4FAD8016CFE9C23ADC6C852A59A6BF50F18447E593
Malicious:	false
Reputation:	unknown
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13372337786836701","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13341058280410352","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"should_reset_check_default_browser":false,"toolbar_extensions_hub_button_visibility":0,"underside_chat_bing_signed_in_status":false,"window_placement":{"bottom":974,"left":10,"maximized":true,"right":1060,"top":10,"work_area_bottom":984,"work_area_left":0,"work_area_right":1280,"work_area_top":0}},"browser_content_container_height":914,"browser_content_container_width":1236,"browser_content_container_x":0,"browser_content_container_y":70,"continuous_migration":{"ci_correction_for_holdout_treatment_state":1},"countryid_at_install":17224,"custom_links":{"li

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\65f918b5-5577-4073-b6c3-22298e62bbdf.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	26697
Entropy (8bit):	5.574829293029989
Encrypted:	false
SSDEEP:	768:ZgkaHUWPYyfff8F1+UoAYDCx9Tuqh0VfUC9xbog/OV7NtXo7Erw724pYtu3:ZgkaHUWPYyfffu1jaiNt47dqjtI
MD5:	0DAC26DE08647CE1A55C6EC6DE7CBD44
SHA1:	E7186B3F7DA27BE8364DF6B6344AA153BFF5FE0A
SHA-256:	AD7B20D47FD9ACB1783FCC3B7D92103668C848F57215F75AD59BAE1325769A37
SHA-512:	F50FEB3668002C7F34FF576E56328507202901E9587C9DF22F58B1CBF7E678523289244FA1897A16C74FDB396D6EB9E74EA5453E61915C21A82FCE9939B89D46
Malicious:	false
Reputation:	unknown
Preview:	{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13372337786467250","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13372337786467250","location":5,"ma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	modified
Size (bytes):	480979
Entropy (8bit):	5.3949084737685284
Encrypted:	false
SSDEEP:	3072:F0S15tRdAYDI1JcYx457aDZ7aJOGiMleOebNG/dFd2X13W2:F0cXAYDI1JcYW5WZ0OG1yJG/dKW2
MD5:	A655EA5D6AEABBDB3B8CD87D6AFC6039
SHA1:	5AB920EE007D96EF5CFAD7EB91559B96DB4DABE5
SHA-256:	91EA5B53C5A7B9552503E4C27FB15C75F02A897663DAFB370BE484BA69C08611
SHA-512:	05C00EA344F08BBC6BD9C375A129A2C2CA3DF633EC38C45E999F4FA5E49CD26644B381E3160931CF2B24498FB569C7ACF8B1936E9557C8263C1C3F75DA9E15FF
Malicious:	false
Reputation:	unknown
Preview:	...m.................DB_VERSION.1...8.................QUERY_TIMESTAMP:arbitration_priority_list4...13341056840624329.$QUERY:arbitration_priority_list4....[{"name":"arbitration_priority_list","url":"https://edgeassetservice.azureedge.net/assets/arbitration_priority_list/4.0.5/asset?sv=2017-07-29&sr=c&sig=NtPyTqjbjPElpw2mWa%2FwOk1no4JFJEK8%2BwO4xQdDJO4%3D&st=2021-01-01T00%3A00%3A00Z&se=2023-12-30T00%3A00%3A00Z&sp=r&assetgroup=ArbitrationService","version":{"major":4,"minor":0,"patch":5},"hash":"N0MkrPHaUyfTgQSPaiVpHemLMcVgqoPh/xUYLZyXayg=","size":11749}]...................'ASSET_VERSION:arbitration_priority_list.4.0.5..ASSET:arbitration_priority_list.[{. "configVersion": 32,. "PrivilegedExperiences": [. "ShorelinePrivilegedExperienceID",. "SHOPPING_AUTO_SHOW_COUPONS_CHECKOUT",. "SHOPPING_AUTO_SHOW_LOWER_PRICE_FOUND",. "SHOPPING_AUTO_SHOW_BING_SEARCH",. "SHOPPING_AUTO_SHOW_REBATES",. "SHOPPING_AUTO_SHOW_REBATES_CONFIRMATION",. "SHOPPING_AUTO_SHOW_REBATES_DEACTI

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	329
Entropy (8bit):	5.10337966229248
Encrypted:	false
SSDEEP:	6:WwUbcZq2PRN23oH+Tcwt9Eh1tIFUt8BwUbcYF29Zmw+BwUbc7zkwORN23oH+Tcw+:J+cZvaYeb9Eh16FUt8C+cYI/+C+cn5Jw
MD5:	67526B9807EA92D56EBC7901BECF8B71
SHA1:	E411C578ED0E29CF382C242AF65EA86BF9ADF452
SHA-256:	D334F4D74AD393049CE8C9D6F6D90830F81BBFC75DCE41D52A47434FA24F24A1
SHA-512:	9FB1BE639852A0751A2755E5FFBDCB2D1BDC9B4EF8FB644611D0B74EB6AFDB2E38E301FB7641287A1E62248E676A4582B75106B3B211C7157CE2F438FCE6338D
Malicious:	false
Reputation:	unknown
Preview:	2024/10/02-06:16:29.271 e64 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db/MANIFEST-000001.2024/10/02-06:16:29.272 e64 Recovering log #3.2024/10/02-06:16:29.656 e64 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	329
Entropy (8bit):	5.10337966229248
Encrypted:	false
SSDEEP:	6:WwUbcZq2PRN23oH+Tcwt9Eh1tIFUt8BwUbcYF29Zmw+BwUbc7zkwORN23oH+Tcw+:J+cZvaYeb9Eh16FUt8C+cYI/+C+cn5Jw
MD5:	67526B9807EA92D56EBC7901BECF8B71
SHA1:	E411C578ED0E29CF382C242AF65EA86BF9ADF452
SHA-256:	D334F4D74AD393049CE8C9D6F6D90830F81BBFC75DCE41D52A47434FA24F24A1
SHA-512:	9FB1BE639852A0751A2755E5FFBDCB2D1BDC9B4EF8FB644611D0B74EB6AFDB2E38E301FB7641287A1E62248E676A4582B75106B3B211C7157CE2F438FCE6338D
Malicious:	false
Reputation:	unknown
Preview:	2024/10/02-06:16:29.271 e64 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db/MANIFEST-000001.2024/10/02-06:16:29.272 e64 Recovering log #3.2024/10/02-06:16:29.656 e64 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Bookmarks (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4364
Entropy (8bit):	4.235769396185342
Encrypted:	false
SSDEEP:	96:G0eVyxFxKiy1+Tzac8adJK0DwbCD2qXaZj5jdj5eyj5H:GAc2B9FtteBt
MD5:	389D4F86CC16CA4B32BAD5B39976FAA2
SHA1:	0EA8E2E3D8B0D4DDE244C69D1B0A39DB1A298986
SHA-256:	4B17594306803A717F05F2DCDF70F5F607B430060504DA4A43C015E06043A697
SHA-512:	C36C243619B32F4667B89D22DCE7FFBF6925E39A20E5901DD89602AA8A0E63F1893E3CB15F1E0DADF8BD38CF58E6AC6BE454FBB2B1A1D923555B747294BAD4B7
Malicious:	false
Reputation:	unknown
Preview:	{.. "checksum": "45c5e75d52aad358849be76b67352156",.. "roots": {.. "bookmark_bar": {.. "children": [ {.. "date_added": "13351791439314668",.. "date_last_used": "0",.. "guid": "6a2852fd-d4cf-4716-941a-d071da2e9e76",.. "id": "7",.. "name": "Amazon",.. "show_icon": false,.. "source": "import_fre",.. "type": "url",.. "url": "http://www.amazon.com/".. }, {.. "date_added": "13351791439314668",.. "date_last_used": "0",.. "guid": "6a78a7f8-baa9-48e8-b482-2fae1b3d2dd7",.. "id": "8",.. "name": "Facebook",.. "show_icon": false,.. "source": "import_fre",.. "type": "url",.. "url": "http://www.facebook.com/".. }, {.. "date_added": "13351791439314668",.. "date_last_used": "0",.. "guid": "8b97f025-eeed-4a1c-8b8d-15a24412fa55",.. "i

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\DIPS

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 7, cookie 0x3, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	28672
Entropy (8bit):	0.45940336029615
Encrypted:	false
SSDEEP:	24:TLi5YFQq3qh7z3WMYziciNW9WkZ96UwOfBk9I/:TouQq3qh7z3bY2LNW9WMcUvBk9I/
MD5:	79FE8210C165CF46DD61F2917BCBBBB5
SHA1:	D3407D5C90A6720BFEF47E33BFBDD0CA96D85FF7
SHA-256:	AD5C082CD52E52FDE39BC83FFD05D9CB182D5165CD2D04830F4BA01F7EDE9AF6
SHA-512:	EDD6FAF7F198EE33E3C2CE373F0E5668A50A25E806628F7591A64DD63B8A8C9E875EDC1F4AE8E8079749E98A61C7FD78F42EF57468F569ACB856F6BED84ACC22
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ ..........................................................................j..........g.....8...n................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\DashTrackerDatabase

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 5, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 5
Category:	dropped
Size (bytes):	10240
Entropy (8bit):	0.8708334089814068
Encrypted:	false
SSDEEP:	12:LBtW4mqsmvEFUU30dZV3lY7+YNbr1dj3BzA2ycFUxOUDaazMvbKGxiTUwZ79GV:LLaqEt30J2NbDjfy6UOYMvbKGxjgm
MD5:	92F9F7F28AB4823C874D79EDF2F582DE
SHA1:	2D4F1B04C314C79D76B7FF3F50056ECA517C338B
SHA-256:	6318FCD9A092D1F5B30EBD9FB6AEC30B1AEBD241DC15FE1EEED3B501571DA3C7
SHA-512:	86FEF0E05F871A166C3FAB123B0A4B95870DCCECBE20B767AF4BDFD99653184BBBFE4CE1EDF17208B7700C969B65B8166EE264287B613641E7FDD55A6C09E6D4
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ ..........................................................................j...v... .. .....M....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons\coupons_data.db\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	116
Entropy (8bit):	4.994010050744163
Encrypted:	false
SSDEEP:	3:iWstvhYNrkU1cleqjXHVFUw3CAlrLuOZf9:iptAwleqjX1HSaLZf9
MD5:	A105E51FE00336B6E15773C6527E666B
SHA1:	2DB0F6E166BDB55F73C77B649542B9810041B35C
SHA-256:	4D04DCB4BEE7F0510E10B56602A004B99C94E7C8184058CD1AF09B27E16D2AAB
SHA-512:	723027F9076E2370CD04EFF88613CBEFF1BCBD721168E7BF53F2EE68E0E6EAF04205FC5D7B177D3BCF37E39A4890711068D3FEB106215FE5695E1ABC6AD2FB7D
Malicious:	false
Reputation:	unknown
Preview:	...m.................DB_VERSION.1g.YL................FLYOUT_STORAGE:.{"personalization_data_consent_enabled":false}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons\coupons_data.db\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	344
Entropy (8bit):	5.183403936084811
Encrypted:	false
SSDEEP:	6:WwUbHrjIq2PRN23oH+TcwtnG2tMsIFUt8BwUbHQZZmw+BwUbHQzkwORN23oH+Tci:J+fIvaYebn9GFUt8C+c/+C+c5JYebn9b
MD5:	6CA2A5702D52F7CDB7A350B6D65EDC6D
SHA1:	DC2C58767298D2425936C92330EB4220E2D24C1E
SHA-256:	6F61538047CF784BBDCB1F591599B7B81E10B7C275E89A3DD818861146479389
SHA-512:	103EA3D3DF624128C05FD6039BAB59FA8CD4C0A1729B14B806CB9109F02436A51DC4B8CC83D370F815DC7EDDC02E190B722162D227AC8628555915418CF35A99
Malicious:	false
Reputation:	unknown
Preview:	2024/10/02-06:16:26.492 19a4 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons/coupons_data.db/MANIFEST-000001.2024/10/02-06:16:26.495 19a4 Recovering log #3.2024/10/02-06:16:26.495 19a4 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons/coupons_data.db/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons\coupons_data.db\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	344
Entropy (8bit):	5.183403936084811
Encrypted:	false
SSDEEP:	6:WwUbHrjIq2PRN23oH+TcwtnG2tMsIFUt8BwUbHQZZmw+BwUbHQzkwORN23oH+Tci:J+fIvaYebn9GFUt8C+c/+C+c5JYebn9b
MD5:	6CA2A5702D52F7CDB7A350B6D65EDC6D
SHA1:	DC2C58767298D2425936C92330EB4220E2D24C1E
SHA-256:	6F61538047CF784BBDCB1F591599B7B81E10B7C275E89A3DD818861146479389
SHA-512:	103EA3D3DF624128C05FD6039BAB59FA8CD4C0A1729B14B806CB9109F02436A51DC4B8CC83D370F815DC7EDDC02E190B722162D227AC8628555915418CF35A99
Malicious:	false
Reputation:	unknown
Preview:	2024/10/02-06:16:26.492 19a4 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons/coupons_data.db/MANIFEST-000001.2024/10/02-06:16:26.495 19a4 Recovering log #3.2024/10/02-06:16:26.495 19a4 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons/coupons_data.db/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\EntityExtractionAssetStore.db\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Reputation:	unknown
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\EntityExtractionAssetStore.db\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	375520
Entropy (8bit):	5.3540976044246875
Encrypted:	false
SSDEEP:	6144:PA/imBpx6WdPSxKWcHu5MURacq49QxxPnyEndBuHltBfdK5WNbsVEziP/CfXtLPz:PFdMyq49tEndBuHltBfdK5WNbsVEziPU
MD5:	FA23F5DA73C6E839CF7272FDC698F056
SHA1:	98112C10B87B8E5C8620F41156D6336AD5539C19
SHA-256:	C09A6D136588BB3945B5C56720667F8BCF21745C5F6DCEB97EFE411482511D76
SHA-512:	7367F44E92EF840237165AEAA63B0720EF4C652F68F7717B37E5CA6BC2946F8C78778CDE6050A702861669B354B87E9F0783450FDCFA98A4E30FFB75FE5F7640
Malicious:	false
Reputation:	unknown
Preview:	...m.................DB_VERSION.1r.._q...............&QUERY_TIMESTAMP:domains_config_gz2...13372337794768380..QUERY:domains_config_gz2....[{"name":"domains_config_gz","url":"https://edgeassetservice.azureedge.net/assets/domains_config_gz/2.8.76/asset?assetgroup=EntityExtractionDomainsConfig","version":{"major":2,"minor":8,"patch":76},"hash":"78Xsq/1H+MXv88uuTT1Rx79Nu2ryKVXh2J6ZzLZd38w=","size":374872}]..*.`~...............ASSET_VERSION:domains_config_gz.2.8.76..ASSET:domains_config_gz...{"config": {"token_limit": 1600, "page_cutoff": 4320, "default_locale_map": {"bg": "bg-bg", "bs": "bs-ba", "el": "el-gr", "en": "en-us", "es": "es-mx", "et": "et-ee", "cs": "cs-cz", "da": "da-dk", "de": "de-de", "fa": "fa-ir", "fi": "fi-fi", "fr": "fr-fr", "he": "he-il", "hr": "hr-hr", "hu": "hu-hu", "id": "id-id", "is": "is-is", "it": "it-it", "ja": "ja-jp", "ko": "ko-kr", "lv": "lv-lv", "lt": "lt-lt", "mk": "mk-mk", "nl": "nl-nl", "nb": "nb-no", "no": "no-no", "pl": "pl-pl", "pt": "pt-pt", "ro": "

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\EntityExtractionAssetStore.db\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Reputation:	unknown
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\EntityExtractionAssetStore.db\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	305
Entropy (8bit):	5.158956082531264
Encrypted:	false
SSDEEP:	6:WwUmuM1RN23oH+Tcwtk2WwnvB2KLlwwUtoyq2PRN23oH+Tcwtk2WwnvIFUv:JCbYebkxwnvFLR4vaYebkxwnQFUv
MD5:	EE093AB777658B8F47B9535DBCBE6DA3
SHA1:	78CFF0CA9644918E58552165D92CEED682C077CD
SHA-256:	4B68DC682FB79B060F702F35C526387362D69D0F1BF2B755E60D277D96C6BFFA
SHA-512:	5EAAC99D0EBD00ED4D16E93BAA633A6CB7EB03D540A6F200B4374266943EE2CF81890CEB64B251FE272B884D16895A24BCE14CC82DB1B1ECBBABC2499BF7D66A
Malicious:	false
Reputation:	unknown
Preview:	2024/10/02-06:16:33.099 b34 Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtractionAssetStore.db since it was missing..2024/10/02-06:16:33.266 b34 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtractionAssetStore.db/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\EntityExtractionAssetStore.db\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Reputation:	unknown
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\domains_config.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	modified
Size (bytes):	358860
Entropy (8bit):	5.324614630801436
Encrypted:	false
SSDEEP:	6144:CgimBVvUrsc6rRA81b/18jyJNjfvrfM6Rf:C1gAg1zfvn
MD5:	D483EE5F4BA62AED277009CF0937D367
SHA1:	D67103F1EB2E76A1782099BBCA8A6EFF22EB994F
SHA-256:	4615A14AFABB032F6BFCDE4F87DD03A4B28CC2A42662903547FA81F48857B526
SHA-512:	BED3CD5DFF95212FF8D0808B0F5C387FC7A4609736B3BFB94314946B3B407884346E5FD078D81CCEAF01E86C36CC783A4826575BE75A8E099FF69863F2D594A0
Malicious:	false
Reputation:	unknown
Preview:	{"aee_config":{"ar":{"price_regex":{"ae":"(((ae\|aed\|\\x{062F}\\x{0660}\\x{0625}\\x{0660}\|\\x{062F}\\.\\x{0625}\|dhs\|dh)\\s\\d{1,3})\|(\\d{1,3}\\s(ae\|aed\|\\x{062F}\\x{0660}\\x{0625}\\x{0660}\|\\x{062F}\\.\\x{0625}\|dhs\|dh)))","dz":"(((dzd\|da\|\\x{062F}\\x{062C})\\s\\d{1,3})\|(\\d{1,3}\\s(dzd\|da\|\\x{062F}\\x{062C})))","eg":"(((e\\x{00a3}\|egp)\\s\\d{1,3})\|(\\d{1,3}\\s(e\\x{00a3}\|egp)))","ma":"(((mad\|dhs\|dh)\\s\\d{1,3})\|(\\d{1,3}\\s(mad\|dhs\|dh)))","sa":"((\\d{1,3}\\s(sar\\s\\x{fdfc}\|sar\|sr\|\\x{fdfc}\|\\.\\x{0631}\\.\\x{0633}))\|((sar\\s\\x{fdfc}\|sar\|sr\|\\x{fdfc}\|\\.\\x{0631}\\.\\x{0633})\\s\\d{1,3}))"},"product_terms":"((\\x{0623}\\x{0636}\\x{0641}\\s\\x{0625}\\x{0644}\\x{0649}\\s\\x{0627}\\x{0644}\\x{0639}\\x{0631}\\x{0628}\\x{0629})\|(\\x{0623}\\x{0636}\\x{0641}\\s\\x{0625}\\x{0644}\\x{0649}\\s\\x{0627}\\x{0644}\\x{062D}\\x{0642}\\x{064A}\\x{0628}\\x{0629})\|(\\x{0627}\\x{0634}\\x{062A}\\x{0631}\\x{064A}\\s*\\x{0627}\\x{0644}\\x{0622}\\x{0646})\|(\\x{062E}\\x{064A}\\x{0627}\\x{0631}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	399
Entropy (8bit):	1.8784775129881184
Encrypted:	false
SSDEEP:	6:qTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCT:qWWWWWWWWWWWWWWWWWWWW
MD5:	A15AC2782BB6B4407D11979316F678FD
SHA1:	B64EAF0810E180D99B83BBA8E366B2E3416C5881
SHA-256:	55F8FA21C3F0D42C973AEDF538F1ADE32563AE4A1E7107C939AB82B4A4D7859A
SHA-512:	370B43C7E434C6CC9328D266C1C9DB327621E2C95AD13D953C4D63457A141FBF2BE0B35072DE96BECC29048224D3646535A149229FC2BA367C7903D3E3E79BDB
Malicious:	false
Reputation:	unknown
Preview:	.f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5...............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	320
Entropy (8bit):	5.1300073072654895
Encrypted:	false
SSDEEP:	6:WwUbHn9+q2PRN23oH+Tcwt8aPrqIFUt8BwUbHWJZmw+BwUbHW9VkwORN23oH+TcD:J+H4vaYebL3FUt8C+2J/+C+2D5JYebQJ
MD5:	10D5E142CB3B4E6DDA4613632FE8B049
SHA1:	5E1B2906DFE165030ADF58ECA4ED60D8BAD0C38D
SHA-256:	5393E8C19DDEC33C2604E4766FFF9E1F3883AC32CD399A78B6D9AD816078357C
SHA-512:	B2317AEE8936F73710142BC045BF294D84DC5F4CE99C9DE3D4E53FE1EA8D74579425C0269391681C77036C3130A3C666261BD3C221099A923971F62546BC8796
Malicious:	false
Reputation:	unknown
Preview:	2024/10/02-06:16:26.483 1268 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules/MANIFEST-000001.2024/10/02-06:16:26.484 1268 Recovering log #3.2024/10/02-06:16:26.484 1268 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	320
Entropy (8bit):	5.1300073072654895
Encrypted:	false
SSDEEP:	6:WwUbHn9+q2PRN23oH+Tcwt8aPrqIFUt8BwUbHWJZmw+BwUbHW9VkwORN23oH+TcD:J+H4vaYebL3FUt8C+2J/+C+2D5JYebQJ
MD5:	10D5E142CB3B4E6DDA4613632FE8B049
SHA1:	5E1B2906DFE165030ADF58ECA4ED60D8BAD0C38D
SHA-256:	5393E8C19DDEC33C2604E4766FFF9E1F3883AC32CD399A78B6D9AD816078357C
SHA-512:	B2317AEE8936F73710142BC045BF294D84DC5F4CE99C9DE3D4E53FE1EA8D74579425C0269391681C77036C3130A3C666261BD3C221099A923971F62546BC8796
Malicious:	false
Reputation:	unknown
Preview:	2024/10/02-06:16:26.483 1268 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules/MANIFEST-000001.2024/10/02-06:16:26.484 1268 Recovering log #3.2024/10/02-06:16:26.484 1268 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	399
Entropy (8bit):	1.8784775129881184
Encrypted:	false
SSDEEP:	6:qTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCT:qWWWWWWWWWWWWWWWWWWWW
MD5:	A15AC2782BB6B4407D11979316F678FD
SHA1:	B64EAF0810E180D99B83BBA8E366B2E3416C5881
SHA-256:	55F8FA21C3F0D42C973AEDF538F1ADE32563AE4A1E7107C939AB82B4A4D7859A
SHA-512:	370B43C7E434C6CC9328D266C1C9DB327621E2C95AD13D953C4D63457A141FBF2BE0B35072DE96BECC29048224D3646535A149229FC2BA367C7903D3E3E79BDB
Malicious:	false
Reputation:	unknown
Preview:	.f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5...............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	324
Entropy (8bit):	5.168236198641727
Encrypted:	false
SSDEEP:	6:WwUbHwX9+q2PRN23oH+Tcwt865IFUt8BwUbHQXJUbJZmw+BwUbHQXn9VkwORN23b:J+64vaYeb/WFUt8C+tJ/+C+yD5JYeb/L
MD5:	6B17AB8549F048BA8512B56D25C2B5A4
SHA1:	8E58A6BAA185F25F0F844F5BFAF2C0A0B82D9C3E
SHA-256:	43E69C1D461E734FB73E2F6666DED22B678D9C97DE1533F035A68F34EF2D9DA4
SHA-512:	3956BD5B94427A011F9B402A91232CAC4049A58DECE3327D6EE32B546B46807D9724E3660891512149E4B3E88768F443E2461734E8692C32FE51D464686DD131
Malicious:	false
Reputation:	unknown
Preview:	2024/10/02-06:16:26.497 1268 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts/MANIFEST-000001.2024/10/02-06:16:26.526 1268 Recovering log #3.2024/10/02-06:16:26.527 1268 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	324
Entropy (8bit):	5.168236198641727
Encrypted:	false
SSDEEP:	6:WwUbHwX9+q2PRN23oH+Tcwt865IFUt8BwUbHQXJUbJZmw+BwUbHQXn9VkwORN23b:J+64vaYeb/WFUt8C+tJ/+C+yD5JYeb/L
MD5:	6B17AB8549F048BA8512B56D25C2B5A4
SHA1:	8E58A6BAA185F25F0F844F5BFAF2C0A0B82D9C3E
SHA-256:	43E69C1D461E734FB73E2F6666DED22B678D9C97DE1533F035A68F34EF2D9DA4
SHA-512:	3956BD5B94427A011F9B402A91232CAC4049A58DECE3327D6EE32B546B46807D9724E3660891512149E4B3E88768F443E2461734E8692C32FE51D464686DD131
Malicious:	false
Reputation:	unknown
Preview:	2024/10/02-06:16:26.497 1268 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts/MANIFEST-000001.2024/10/02-06:16:26.526 1268 Recovering log #3.2024/10/02-06:16:26.527 1268 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	1197
Entropy (8bit):	1.8784775129881184
Encrypted:	false
SSDEEP:	12:qWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWW:
MD5:	A2A3B1383E3AAC2430F44FC7BF3E447E
SHA1:	B807210A1205126A107A5FE25F070D2879407AA4
SHA-256:	90685D4E050DA5B6E6F7A42A1EE21264A68F1734FD3BD4A0E044BB53791020A2
SHA-512:	396FAB9625A2FF396222DBC86A0E2CDE724C83F3130EE099F2872AED2F2F2ECE13B0853D635F589B70BD1B5E586C05A3231D68CAF9E46B6E2DAC105A10D0A1C8
Malicious:	false
Reputation:	unknown
Preview:	.f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5........

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	317
Entropy (8bit):	5.201034050853528
Encrypted:	false
SSDEEP:	6:WwUbHcd+q2PRN23oH+Tcwt8NIFUt8BwUbHccZmw+BwUbHccVkwORN23oH+Tcwt8n:J+3vaYebpFUt8C+f/+C+N5JYebqJ
MD5:	33B98FD7E656BEAFF552C318A47214F6
SHA1:	B70F9C807FFF8E0231269A1D1F980AC0832DC5FB
SHA-256:	0253CEC26542E9280833BC146CD188C970FECFC401F45719BD5A2554A4F8E3A7
SHA-512:	7825D182703F797774045700A823738C45FE93D509DC43F3E9DBA3A75F575950DE1A83595426576D6A7108BCD891D1464BB85907A0B0A08D48D06D33EF209B22
Malicious:	false
Reputation:	unknown
Preview:	2024/10/02-06:16:26.956 ab8 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State/MANIFEST-000001.2024/10/02-06:16:26.957 ab8 Recovering log #3.2024/10/02-06:16:26.957 ab8 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	317
Entropy (8bit):	5.201034050853528
Encrypted:	false
SSDEEP:	6:WwUbHcd+q2PRN23oH+Tcwt8NIFUt8BwUbHccZmw+BwUbHccVkwORN23oH+Tcwt8n:J+3vaYebpFUt8C+f/+C+N5JYebqJ
MD5:	33B98FD7E656BEAFF552C318A47214F6
SHA1:	B70F9C807FFF8E0231269A1D1F980AC0832DC5FB
SHA-256:	0253CEC26542E9280833BC146CD188C970FECFC401F45719BD5A2554A4F8E3A7
SHA-512:	7825D182703F797774045700A823738C45FE93D509DC43F3E9DBA3A75F575950DE1A83595426576D6A7108BCD891D1464BB85907A0B0A08D48D06D33EF209B22
Malicious:	false
Reputation:	unknown
Preview:	2024/10/02-06:16:26.956 ab8 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State/MANIFEST-000001.2024/10/02-06:16:26.957 ab8 Recovering log #3.2024/10/02-06:16:26.957 ab8 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\jmjflgjpcpepeafmmgdpfkogkghcpiha\1.2.1_0\_metadata\computed_hashes.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	429
Entropy (8bit):	5.809210454117189
Encrypted:	false
SSDEEP:	6:Y8U0vEjrAWT0VAUD9lpMXO4SrqiweVHUSENjrAWT0HQQ9/LZyVMQ3xqiweVHlrSQ:Y8U5j0pqCjJA7tNj0pHx/LZ4hcdQ
MD5:	5D1D9020CCEFD76CA661902E0C229087
SHA1:	DCF2AA4A1C626EC7FFD9ABD284D29B269D78FCB6
SHA-256:	B829B0DF7E3F2391BFBA70090EB4CE2BA6A978CCD665EEBF1073849BDD4B8FB9
SHA-512:	5F6E72720E64A7AC19F191F0179992745D5136D41DCDC13C5C3C2E35A71EB227570BD47C7B376658EF670B75929ABEEBD8EF470D1E24B595A11D320EC1479E3C
Malicious:	false
Reputation:	unknown
Preview:	{"file_hashes":[{"block_hashes":["OdZL4YFLwCTKbdslekC6/+U9KTtDUk+T+nnpVOeRzUc=","6RbL+qKART8FehO4s7U0u67iEI8/jaN+8Kg3kII+uy4=","CuN6+RcZAysZCfrzCZ8KdWDkQqyaIstSrcmsZ/c2MVs="],"block_size":4096,"path":"content.js"},{"block_hashes":["OdZL4YFLwCTKbdslekC6/+U9KTtDUk+T+nnpVOeRzUc=","UL53sQ5hOhAmII/Yx6muXikzahxM+k5gEmVOh7xJ3Rw=","u6MdmVNzBUfDzMwv2LEJ6pXR8k0nnvpYRwOL8aApwP8="],"block_size":4096,"path":"content_new.js"}],"version":2}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Favicons

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 2, database pages 11, cookie 0x8, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	24576
Entropy (8bit):	2.3488825630774772
Encrypted:	false
SSDEEP:	96:RBCyvNvei++Xhu9VIN1eZ7aH/XnTuc5o79F2ShU48JJtdklWzNd:nNOOu9VE3XnhIn83tdklmd
MD5:	A35D3B3060F5FD33C255AF5B7765E30A
SHA1:	1DE9AE020E4F1C2D246031DA533C1F8F7F6A4599
SHA-256:	7D5CD29856D4D69EB0C9C0EE0F0D39CEBAF7CE54B638B2CAF6EFD99CE479703C
SHA-512:	7148C76E54C466ED74EC1E66F8D353BAA073A199E8846B31E5075E8DBD6446EEA96413FFBDDC04E4CB7C34CB5B665911B5126051FE6C28F5A51CA40992BDE8C8
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ ..........................................................................j..........g....._.c...~.2.................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................s...;+...indexfavicon_bitmaps_icon_idfavico

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 2, database pages 38, cookie 0x1f, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	155648
Entropy (8bit):	0.7211114923635249
Encrypted:	false
SSDEEP:	192:YzewbbshH+bDo3iN0Z2TVJkXBBE3yb/8oWBVU:YzewbbshIU3iGAIBBE3q/xWBVU
MD5:	3C9F0241D2BB4A85084AF87C3A05F4F6
SHA1:	14D55821C2F46604FF478E8640F7B24A88B9CB76
SHA-256:	8857D8A40D235CCBC80D56849E5A6CCBB8267C23C5568793C14FD8F1BCDF0693
SHA-512:	3EE9F685F11B8D309B5FFF789882E19069E7A443CBD72ED5D412B94D39AB26C0323C24678AA079B4425BBC2465C8064C34BDD2F241313CC116B3DA4E69D7AFEF
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ .......&..................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History-journal

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	0.21917635620654863
Encrypted:	false
SSDEEP:	3:/7tFlljq7A/mhWJFuQ3yy7IOWUVWdweytllrE9SFcTp4AGbNCV9RUIM3:475fOXWd0Xi99pEYE
MD5:	FE0AB4182A3F4BD61EA6E38358A71679
SHA1:	81F0E7FB7A3270BF0F4E5819088AB626ACAD07FC
SHA-256:	E9B271B3B36ED8CAB34BA040457580FB030518A252BDB23ADD543A01B06259F4
SHA-512:	8B3CFEE0E9267A067F3C5CD4A6A52B9A6478A1901F4452A7F90D402567E86E3EB4C06EAA6351F6E71FE9AF6BB095CF97FBE9E96DDFE6998C0AD28446FFDCA775
Malicious:	false
Reputation:	unknown
Preview:	..............>....&....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	401
Entropy (8bit):	5.2686705081033995
Encrypted:	false
SSDEEP:	12:J+NvaYeb8rcHEZrELFUt8C+o/+C+35JYeb8rcHEZrEZSJ:iaYeb8nZrExg8/JYeb8nZrEZe
MD5:	42712E9E64C06260E29CBA8139994454
SHA1:	B9E62D3D116BD48854F8F9EB1C398BAC69343C7A
SHA-256:	CE2B47EEC4081243E49B28E1DBCC45BE068FDFA7F3887B8C589961C4BBE02DFD
SHA-512:	E62779756485D44F112054310E79F3360398C9BB3815FAE158F59654D2FAD433733A6FAA345B73811523FDCB10343FB01C259609876FBFB433A97863C3A279B5
Malicious:	false
Reputation:	unknown
Preview:	2024/10/02-06:16:27.388 ab8 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold/MANIFEST-000001.2024/10/02-06:16:27.388 ab8 Recovering log #3.2024/10/02-06:16:27.389 ab8 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	401
Entropy (8bit):	5.2686705081033995
Encrypted:	false
SSDEEP:	12:J+NvaYeb8rcHEZrELFUt8C+o/+C+35JYeb8rcHEZrEZSJ:iaYeb8nZrExg8/JYeb8nZrEZe
MD5:	42712E9E64C06260E29CBA8139994454
SHA1:	B9E62D3D116BD48854F8F9EB1C398BAC69343C7A
SHA-256:	CE2B47EEC4081243E49B28E1DBCC45BE068FDFA7F3887B8C589961C4BBE02DFD
SHA-512:	E62779756485D44F112054310E79F3360398C9BB3815FAE158F59654D2FAD433733A6FAA345B73811523FDCB10343FB01C259609876FBFB433A97863C3A279B5
Malicious:	false
Reputation:	unknown
Preview:	2024/10/02-06:16:27.388 ab8 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold/MANIFEST-000001.2024/10/02-06:16:27.388 ab8 Recovering log #3.2024/10/02-06:16:27.389 ab8 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	1129
Entropy (8bit):	5.5834663169675345
Encrypted:	false
SSDEEP:	24:EAW0urH7euUOuTquW82u29ncuo9nXQOWEFkuYCpGz4A+q+exUiwJd29nn:EA9uzauUOuOuz2u2iuoqOjFoCMz4vyxJ
MD5:	5E043A2095CF1BA9774488E2E67E6A6D
SHA1:	C522E4142301DE7F62D8BC95FAFDE1F0A467075E
SHA-256:	D8BF3BCF779A1797FDC7F56EE2FB9ECC44886BAEF840B83C78E179748DEC7340
SHA-512:	886A723EC48E70E3E488725A184BC6DD62B003BF102DF1C6473DE9D1A34C7FC680D3E65BD41969A3D543BF93D2F4EC1B0B69FBB1186921A12C21E6CC2C9C14D4
Malicious:	false
Reputation:	unknown
Preview:	a....................VERSION.1..META:https://apps.microsoft.com............0_https://apps.microsoft.com..exp-session-expires..Wed, 16 Oct 2024 10:16:48 GMT.+_https://apps.microsoft.com..exp-session-id%.b6d0ece2-29a7-4143-931c-d621648d7cb8."_https://apps.microsoft.com..webId%.13aa730b-741c-48b9-a94c-0a5fea250621.V_https://apps.microsoft.com..Wed Oct 02 2024 06:16:49 GMT-0400 (Eastern Daylight Time).V_https://apps.microsoft.com..Wed Oct 02 2024 06:16:50 GMT-0400 (Eastern Daylight Time).F`.x................META:https://www.microsoft.com.............#_https://www.microsoft.com.._uetsid!.70ac830080a711efa9fc9be06d42c5d1.'_https://www.microsoft.com.._uetsid_exp..Thu, 03 Oct 2024 10:16:51 GMT.#_https://www.microsoft.com.._uetvid!.70acc12080a711efa4bbe5908cfb5aee.'_https://www.microsoft.com.._uetvid_exp..Mon, 27 Oct 2025 10:16:51 GMT.0_https://www.microsoft.com..lastExternalReferrer..empty.4_https://www.microsoft.com..lastExternalReferrerTime..1727864210740.$_https://www.microsoft.com..li_a

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	332
Entropy (8bit):	5.078565125400487
Encrypted:	false
SSDEEP:	6:WwUbH3+q2PRN23oH+Tcwt8a2jMGIFUt8BwUbH+hZmw+BwUbHgQzkwORN23oH+TcL:J+X+vaYeb8EFUt8C+6/+C+AQz5JYeb8N
MD5:	976019A6AB606C47873C5D703F2AC27A
SHA1:	DAF95F1537394579B18405073D7E006AC866BBF1
SHA-256:	E9DAE12490B5045374B451D3199BBB58DC5A20DABF7125E087B3A5F5F193D3EA
SHA-512:	A845545D76B1C3AF5C9D0DED66220CDA9EE22574025C59D3BDEA37ED3CB738BAE220B95DB5E4820C751FA34EFD4FF365401C44C337BA4FD04F6809CC25807470
Malicious:	false
Reputation:	unknown
Preview:	2024/10/02-06:16:26.627 1a10 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb/MANIFEST-000001.2024/10/02-06:16:26.651 1a10 Recovering log #3.2024/10/02-06:16:26.654 1a10 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	332
Entropy (8bit):	5.078565125400487
Encrypted:	false
SSDEEP:	6:WwUbH3+q2PRN23oH+Tcwt8a2jMGIFUt8BwUbH+hZmw+BwUbHgQzkwORN23oH+TcL:J+X+vaYeb8EFUt8C+6/+C+AQz5JYeb8N
MD5:	976019A6AB606C47873C5D703F2AC27A
SHA1:	DAF95F1537394579B18405073D7E006AC866BBF1
SHA-256:	E9DAE12490B5045374B451D3199BBB58DC5A20DABF7125E087B3A5F5F193D3EA
SHA-512:	A845545D76B1C3AF5C9D0DED66220CDA9EE22574025C59D3BDEA37ED3CB738BAE220B95DB5E4820C751FA34EFD4FF365401C44C337BA4FD04F6809CC25807470
Malicious:	false
Reputation:	unknown
Preview:	2024/10/02-06:16:26.627 1a10 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb/MANIFEST-000001.2024/10/02-06:16:26.651 1a10 Recovering log #3.2024/10/02-06:16:26.654 1a10 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\4e3b9932-969c-43c1-ada0-407cedf14c36.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	111
Entropy (8bit):	4.718418993774295
Encrypted:	false
SSDEEP:	3:YLb9N+eAXRfHDH2LS7PMVKJq0nMb1KKtiVY:YHpoeS7PMVKJTnMRK3VY
MD5:	285252A2F6327D41EAB203DC2F402C67
SHA1:	ACEDB7BA5FBC3CE914A8BF386A6F72CA7BAA33C6
SHA-256:	5DFC321417FC31359F23320EA68014EBFD793C5BBED55F77DAB4180BBD4A2026
SHA-512:	11CE7CB484FEE66894E63C31DB0D6B7EF66AD0327D4E7E2EB85F3BCC2E836A3A522C68D681E84542E471E54F765E091EFE1EE4065641B0299B15613EB32DCC0D
Malicious:	false
Reputation:	unknown
Preview:	{"net":{"http_server_properties":{"servers":[],"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\601b84e4-7239-48ed-ae02-5132d10d6273.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Reputation:	unknown
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\7d9354db-2a90-4016-b6e4-541cf526db27.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Reputation:	unknown
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\7ffcda32-34ac-43e3-9780-958e440e6cc7.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Reputation:	unknown
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\881ce1e4-5dc8-41e8-a792-00ab68e2422e.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.1275671571169275
Encrypted:	false
SSDEEP:	3:Y2ktGMxkAXWMSN:Y2xFMSN
MD5:	20D4B8FA017A12A108C87F540836E250
SHA1:	1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
SHA-256:	6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
SHA-512:	507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
Malicious:	false
Reputation:	unknown
Preview:	{"SDCH":{"dictionaries":{},"version":2}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 8, database pages 7, cookie 0x5, schema 4, UTF-8, version-valid-for 8
Category:	dropped
Size (bytes):	28672
Entropy (8bit):	3.319551802902838
Encrypted:	false
SSDEEP:	192:n8iPNoq2NzN4YmrttcfaPfiNpCp1tGldEhAmo:8Y+q2YtXPqalmdEhAmo
MD5:	F4BBB0CBF7738EC27732594860E75CB3
SHA1:	13201D84C4E7A585800E9F1DFD2E306704D83511
SHA-256:	2FC46D410383A338504342692B08DD88DB57FC4F9D1173CC6C01B27235BC69B8
SHA-512:	1451737B4FFCE6200D66C5C237A7E2E39ACBF28FA9B7B2805F0754C2C11F1ABD3BB9BEE866FA1C3D5470ACD6A9E119B31F4B1D297AFC91D2F5A5BB4B6BC778AA
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ ..........................................................................j...$......g..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	111
Entropy (8bit):	4.718418993774295
Encrypted:	false
SSDEEP:	3:YLb9N+eAXRfHDH2LS7PMVKJq0nMb1KKqk1Yn:YHpoeS7PMVKJTnMRKXk1Yn
MD5:	807419CA9A4734FEAF8D8563A003B048
SHA1:	A723C7D60A65886FFA068711F1E900CCC85922A6
SHA-256:	AA10BF07B0D265BED28F2A475F3564D8DDB5E4D4FFEE0AB6F3A0CC564907B631
SHA-512:	F10D496AE75DB5BA412BD9F17BF0C7DA7632DB92A3FABF7F24071E40F5759C6A875AD8F3A72BAD149DA58B3DA3B816077DF125D0D9F3544ADBA68C66353D206C
Malicious:	false
Reputation:	unknown
Preview:	{"net":{"http_server_properties":{"servers":[],"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"3G"}}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State~RF33e62.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	111
Entropy (8bit):	4.718418993774295
Encrypted:	false
SSDEEP:	3:YLb9N+eAXRfHDH2LS7PMVKJq0nMb1KKqk1Yn:YHpoeS7PMVKJTnMRKXk1Yn
MD5:	807419CA9A4734FEAF8D8563A003B048
SHA1:	A723C7D60A65886FFA068711F1E900CCC85922A6
SHA-256:	AA10BF07B0D265BED28F2A475F3564D8DDB5E4D4FFEE0AB6F3A0CC564907B631
SHA-512:	F10D496AE75DB5BA412BD9F17BF0C7DA7632DB92A3FABF7F24071E40F5759C6A875AD8F3A72BAD149DA58B3DA3B816077DF125D0D9F3544ADBA68C66353D206C
Malicious:	false
Reputation:	unknown
Preview:	{"net":{"http_server_properties":{"servers":[],"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"3G"}}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Reporting and NEL

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 6, database pages 9, cookie 0x4, schema 4, UTF-8, version-valid-for 6
Category:	dropped
Size (bytes):	36864
Entropy (8bit):	1.9425541237919715
Encrypted:	false
SSDEEP:	96:uIEumQv8m1ccnvS6csr2VsykDsT+JBBstIPXkz7thsDZ6sMR5w1a:uIEumQv8m1ccnvS6EMUzP
MD5:	5610F0D5B2E95E5C2B8B7F42EF57E01B
SHA1:	FBAA6EC9D4800C8F30053A6D14A002CFCD008E58
SHA-256:	78D25A63DE7B2BE566ED6EA6B64CA0928A5CECBA34DB56DC13E989C37672320E
SHA-512:	302ECC74A499165FA582E0F4AAE604613B6C8F9D524024EC5BCEEDBD293B0654AFFE1E2226FA70244A48662FAEE655619DBC88A062014E03474FDBAA0261D8E2
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ ..........................................................................j..........g...D.........7............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Reputation:	unknown
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports~RF2c171.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Reputation:	unknown
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports~RF31222.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Reputation:	unknown
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.1275671571169275
Encrypted:	false
SSDEEP:	3:Y2ktGMxkAXWMSN:Y2xFMSN
MD5:	20D4B8FA017A12A108C87F540836E250
SHA1:	1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
SHA-256:	6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
SHA-512:	507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
Malicious:	false
Reputation:	unknown
Preview:	{"SDCH":{"dictionaries":{},"version":2}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\TransportSecurity (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	187
Entropy (8bit):	5.417458965971911
Encrypted:	false
SSDEEP:	3:YWRAWNjTfMRRLWAuxtrwWokZ8KB2SKcukqJx8HQXwlm9yJUA6XcIR6RX77XMqb3S:YWyWNfM3LWvrdLAvD8wXwlmUUAnIMp5e
MD5:	091D4188C43F62C3C2A23DA0861B61BA
SHA1:	D26CC21ABADC2BD9FA3CACF290AD6ED3823CF575
SHA-256:	14EAD848C2148B75ED765BC9B313519D2A9BE0EBCC8A8701ECF9B3B556A6810E
SHA-512:	1EB84C6E84249A59F96C16D62603982B75329A8EC51226FDBC2B41DBBEE7980DAAB918F8CB4EE8D99740AB03D5EF3105971050926E14E41E88825375123EDEDE
Malicious:	false
Reputation:	unknown
Preview:	{"sts":[{"expiry":1759400210.644025,"host":"+loO+DGmT6DTr59JZFAnGSlBAwPkO5M/R9ec1Sw/9KA=","mode":"force-https","sts_include_subdomains":true,"sts_observed":1727864210.64403}],"version":2}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\b5d4c9a3-46d7-4bec-8998-10c4f40f3760.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	111
Entropy (8bit):	4.718418993774295
Encrypted:	false
SSDEEP:	3:YLb9N+eAXRfHDH2LS7PMVKJq0nMb1KKqk1Yn:YHpoeS7PMVKJTnMRKXk1Yn
MD5:	807419CA9A4734FEAF8D8563A003B048
SHA1:	A723C7D60A65886FFA068711F1E900CCC85922A6
SHA-256:	AA10BF07B0D265BED28F2A475F3564D8DDB5E4D4FFEE0AB6F3A0CC564907B631
SHA-512:	F10D496AE75DB5BA412BD9F17BF0C7DA7632DB92A3FABF7F24071E40F5759C6A875AD8F3A72BAD149DA58B3DA3B816077DF125D0D9F3544ADBA68C66353D206C
Malicious:	false
Reputation:	unknown
Preview:	{"net":{"http_server_properties":{"servers":[],"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"3G"}}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\df7b5d81-f66f-4355-ad09-d82fb52355d2.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	187
Entropy (8bit):	5.417458965971911
Encrypted:	false
SSDEEP:	3:YWRAWNjTfMRRLWAuxtrwWokZ8KB2SKcukqJx8HQXwlm9yJUA6XcIR6RX77XMqb3S:YWyWNfM3LWvrdLAvD8wXwlmUUAnIMp5e
MD5:	091D4188C43F62C3C2A23DA0861B61BA
SHA1:	D26CC21ABADC2BD9FA3CACF290AD6ED3823CF575
SHA-256:	14EAD848C2148B75ED765BC9B313519D2A9BE0EBCC8A8701ECF9B3B556A6810E
SHA-512:	1EB84C6E84249A59F96C16D62603982B75329A8EC51226FDBC2B41DBBEE7980DAAB918F8CB4EE8D99740AB03D5EF3105971050926E14E41E88825375123EDEDE
Malicious:	false
Reputation:	unknown
Preview:	{"sts":[{"expiry":1759400210.644025,"host":"+loO+DGmT6DTr59JZFAnGSlBAwPkO5M/R9ec1Sw/9KA=","mode":"force-https","sts_include_subdomains":true,"sts_observed":1727864210.64403}],"version":2}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Preferences (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	9557
Entropy (8bit):	5.091056723021349
Encrypted:	false
SSDEEP:	192:stskdAwMIOO2h4FuBr328MbV+FiADscPaYJ:stszwMIO3fBobGims2
MD5:	FCE818A6EDFC1E2EBADCDC5D97290EFD
SHA1:	A10E40CC791E3F5C9358408BE6086969F3AF8B54
SHA-256:	3A8292382D547B4AE770B7920A1111983A80C50BC151EC436C34658C41244EA8
SHA-512:	E1BA0E646773CEB8483F883F22B9B3951047E8D9711A9672E8BE785E7BC5EFA54A1637565309FB0B7567B4E827BF777361F8114721B4E8D5A79629A7678A3225
Malicious:	false
Reputation:	unknown
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13372337786836701","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13341058280410352","arbitration_using_experiment_config":false,"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"should_reset_check_default_browser":false,"toolbar_extensions_hub_button_visibility":0,"underside_chat_bing_signed_in_status":false,"window_placement":{"bottom":974,"left":10,"maximized":true,"right":1060,"top":10,"work_area_bottom":984,"work_area_left":0,"work_area_right":1280,"work_area_top":0}},"browser_content_container_height":914,"browser_content_container_width":1236,"browser_content_container_x":0,"browser_content_container_y":70,"continuous_migration":{"ci_correction_for_holdout_treatment_state":1},"countryid_at_install":17224,"custom_links":{"list":[]},"default_apps_install_state":3,"dips_timer_la

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Preferences~RF30c94.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	9557
Entropy (8bit):	5.091056723021349
Encrypted:	false
SSDEEP:	192:stskdAwMIOO2h4FuBr328MbV+FiADscPaYJ:stszwMIO3fBobGims2
MD5:	FCE818A6EDFC1E2EBADCDC5D97290EFD
SHA1:	A10E40CC791E3F5C9358408BE6086969F3AF8B54
SHA-256:	3A8292382D547B4AE770B7920A1111983A80C50BC151EC436C34658C41244EA8
SHA-512:	E1BA0E646773CEB8483F883F22B9B3951047E8D9711A9672E8BE785E7BC5EFA54A1637565309FB0B7567B4E827BF777361F8114721B4E8D5A79629A7678A3225
Malicious:	false
Reputation:	unknown
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13372337786836701","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13341058280410352","arbitration_using_experiment_config":false,"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"should_reset_check_default_browser":false,"toolbar_extensions_hub_button_visibility":0,"underside_chat_bing_signed_in_status":false,"window_placement":{"bottom":974,"left":10,"maximized":true,"right":1060,"top":10,"work_area_bottom":984,"work_area_left":0,"work_area_right":1280,"work_area_top":0}},"browser_content_container_height":914,"browser_content_container_width":1236,"browser_content_container_x":0,"browser_content_container_y":70,"continuous_migration":{"ci_correction_for_holdout_treatment_state":1},"countryid_at_install":17224,"custom_links":{"list":[]},"default_apps_install_state":3,"dips_timer_la

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Preferences~RF33c20.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	9557
Entropy (8bit):	5.091056723021349
Encrypted:	false
SSDEEP:	192:stskdAwMIOO2h4FuBr328MbV+FiADscPaYJ:stszwMIO3fBobGims2
MD5:	FCE818A6EDFC1E2EBADCDC5D97290EFD
SHA1:	A10E40CC791E3F5C9358408BE6086969F3AF8B54
SHA-256:	3A8292382D547B4AE770B7920A1111983A80C50BC151EC436C34658C41244EA8
SHA-512:	E1BA0E646773CEB8483F883F22B9B3951047E8D9711A9672E8BE785E7BC5EFA54A1637565309FB0B7567B4E827BF777361F8114721B4E8D5A79629A7678A3225
Malicious:	false
Reputation:	unknown
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13372337786836701","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13341058280410352","arbitration_using_experiment_config":false,"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"should_reset_check_default_browser":false,"toolbar_extensions_hub_button_visibility":0,"underside_chat_bing_signed_in_status":false,"window_placement":{"bottom":974,"left":10,"maximized":true,"right":1060,"top":10,"work_area_bottom":984,"work_area_left":0,"work_area_right":1280,"work_area_top":0}},"browser_content_container_height":914,"browser_content_container_width":1236,"browser_content_container_x":0,"browser_content_container_y":70,"continuous_migration":{"ci_correction_for_holdout_treatment_state":1},"countryid_at_install":17224,"custom_links":{"list":[]},"default_apps_install_state":3,"dips_timer_la

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Preferences~RF363eb.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	9557
Entropy (8bit):	5.091056723021349
Encrypted:	false
SSDEEP:	192:stskdAwMIOO2h4FuBr328MbV+FiADscPaYJ:stszwMIO3fBobGims2
MD5:	FCE818A6EDFC1E2EBADCDC5D97290EFD
SHA1:	A10E40CC791E3F5C9358408BE6086969F3AF8B54
SHA-256:	3A8292382D547B4AE770B7920A1111983A80C50BC151EC436C34658C41244EA8
SHA-512:	E1BA0E646773CEB8483F883F22B9B3951047E8D9711A9672E8BE785E7BC5EFA54A1637565309FB0B7567B4E827BF777361F8114721B4E8D5A79629A7678A3225
Malicious:	false
Reputation:	unknown
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13372337786836701","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13341058280410352","arbitration_using_experiment_config":false,"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"should_reset_check_default_browser":false,"toolbar_extensions_hub_button_visibility":0,"underside_chat_bing_signed_in_status":false,"window_placement":{"bottom":974,"left":10,"maximized":true,"right":1060,"top":10,"work_area_bottom":984,"work_area_left":0,"work_area_right":1280,"work_area_top":0}},"browser_content_container_height":914,"browser_content_container_width":1236,"browser_content_container_x":0,"browser_content_container_y":70,"continuous_migration":{"ci_correction_for_holdout_treatment_state":1},"countryid_at_install":17224,"custom_links":{"list":[]},"default_apps_install_state":3,"dips_timer_la

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	24853
Entropy (8bit):	5.566037805390812
Encrypted:	false
SSDEEP:	768:ZgkaHUWPYyfwf8F1+UoAYDCx9Tuqh0VfUC9xbog/OVaXo7Erw7h4pYtug:ZgkaHUWPYyfwfu1jan47d9jtL
MD5:	8F3CE3320CB0F9F45B6667260C9FCB8D
SHA1:	E80306E1008FC96066D8D082D729624DB9F47134
SHA-256:	C4D11A31920432641E55644F61711803609C6882AD17A213B12A83C67651B8D0
SHA-512:	3EB611B140FDB7EF2B343EB051F76B9F4EE3AE3E95A1E8330F65A1E3D1E2C24FCD39C1EA7C52941D1612EA4B9DCA4A6BCFA16F7E29EE4561805781A515454758
Malicious:	false
Reputation:	unknown
Preview:	{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13372337786467250","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13372337786467250","location":5,"ma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences~RF32200.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	24853
Entropy (8bit):	5.566037805390812
Encrypted:	false
SSDEEP:	768:ZgkaHUWPYyfwf8F1+UoAYDCx9Tuqh0VfUC9xbog/OVaXo7Erw7h4pYtug:ZgkaHUWPYyfwfu1jan47d9jtL
MD5:	8F3CE3320CB0F9F45B6667260C9FCB8D
SHA1:	E80306E1008FC96066D8D082D729624DB9F47134
SHA-256:	C4D11A31920432641E55644F61711803609C6882AD17A213B12A83C67651B8D0
SHA-512:	3EB611B140FDB7EF2B343EB051F76B9F4EE3AE3E95A1E8330F65A1E3D1E2C24FCD39C1EA7C52941D1612EA4B9DCA4A6BCFA16F7E29EE4561805781A515454758
Malicious:	false
Reputation:	unknown
Preview:	{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13372337786467250","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13372337786467250","location":5,"ma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Reputation:	unknown
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	80
Entropy (8bit):	4.323098996850684
Encrypted:	false
SSDEEP:	3:chltUQ2Hm4kxH4xRNwBgzNnNurkXn:chXUQI2xH8BzNmen
MD5:	8DA62954B0B14642CF287A260418E39B
SHA1:	E82BF98669AE1D73BBD9294D9F454044D5C2622E
SHA-256:	B7E25784D1B3A3653C618822715DAE7CC86BF0B05FFF0CF3C5D6A1FB169F0614
SHA-512:	E44DC92CAA0579A81CBF176A589493421AAD851D7006603B54684EE8CBFC67F572F2B0219F4483227F3FF9CC614D882B2ADB8060873E358C7D6870CAF9E3865C
Malicious:	false
Reputation:	unknown
Preview:	....I................URES:0...INITDATA_NEXT_RESOURCE_ID.1..INITDATA_DB_VERSION.2

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Reputation:	unknown
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.123458702477582
Encrypted:	false
SSDEEP:	6:WwUHj1RN23oH+TcwtE/a252KLlwwUJ3+q2PRN23oH+TcwtE/a2ZIFUv:JUkYeb8xLR0OvaYeb8J2FUv
MD5:	743957607FC166D95454616A49CC1353
SHA1:	D4B85339D2C5B9F3FBBD25594E80888D3617D0F7
SHA-256:	8325289ED46E92CD201DEABA63206C02D9EC01226C5222E2329EB0BD288ECE5A
SHA-512:	065ED4FC0AB136D8EC7B5BA0D723B9CF9F0F4BC6EAEE16D441D8E737FC4D69F6C14797F45F1A22F320A3EB8140CF9526ADE0194771CF6DAB918BB4BAFC72ABEA
Malicious:	false
Reputation:	unknown
Preview:	2024/10/02-06:16:50.851 1028 Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database since it was missing..2024/10/02-06:16:50.864 1028 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Reputation:	unknown
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\2cc80dabc69f58b6_0

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	75531
Entropy (8bit):	5.215340302476284
Encrypted:	false
SSDEEP:	1536:dCABcSTJBVVxXe+hNygnyF5Tw8/2QOxAAEKliXkd4P:cABRJBVVxXe+hNygy7Tw8/ZOea/d4P
MD5:	E7453C54C053363DF58B14D48918E359
SHA1:	DF99908483923415B2E6D6AC3C48178134DD1A56
SHA-256:	4D1CBFAC113CB8C30E2340B488F283618244999A9403EC25046DBA52D94B3D30
SHA-512:	3380A695B39C49164BD0AEF58BC625C68AF303C51437B146C48B6E1F015A282100DC58294E09824A0601F80D2B6D63A68BA3E2C633D139A07CD1DDD3332B2E15
Malicious:	false
Reputation:	unknown
Preview:	0\r..m..........rSG.....0try {. self["workbox:core:6.6.0"] && _();.} catch {.}.const ee = (s, ...e) => {. let t = s;. return e.length > 0 && (t += ` :: ${JSON.stringify(e)}`), t;.}, te = ee;.class h extends Error {. /*. . * @param {string} errorCode The error code that. * identifies this particular error.. * @param {Object=} details Any relevant arguments. * that will help developers identify issues should. * be added as a key on the context object.. /. constructor(e, t) {. const a = te(e, t);. super(a), this.name = e, this.details = t;. }.}.try {. self["workbox:routing:6.6.0"] && _();.} catch {.}.const $ = "GET", L = (s) => s && typeof s == "object" ? s : { handle: s };.class C {. /. Constructor for Route class.. . @param {workbox-routing~matchCallback} match. * A callback function that determines whether the route matches a given. * `fetch` event by returning a non-falsy value.. * @param {workbox-routing~handlerCallback} handler A cal

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\2cc80dabc69f58b6_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	81449
Entropy (8bit):	6.1385037661479585
Encrypted:	false
SSDEEP:	1536:bFGDI8z92r05NyujLyo4uJPDJy9gIL0nDr1i9gb2peqK8b2z:bFCjQYcu/yo4uJrJ7ILChiCCpU8b2z
MD5:	A8560EE4AFA7D0D05D542F2CA6D0FDDE
SHA1:	8ED3AE0F584B03D87FC2C6A847B7FFD62909893B
SHA-256:	33EB0F35E9710CFAD7474FBB0253B312275728E2928C0F65EA653C2A31CACA30
SHA-512:	D2AA6B4658E068A303FBDF4713C1FE908305F3B29EF1D21248CBEE42BC63F70474CC294B40E7A5B918746D796F2BEA9D8B9764AAF9DDCEE17FEF260F803F708C
Malicious:	false
Reputation:	unknown
Preview:	0\r..m..........rSG.....0....Lp.................;&.......=.......,T.....`(......L`.....1.L`.....,T..`.....<L`......Sb...............`.......Sb.`......n.....Rbb.......ee....Rb..?....te................q...Rb6.......se....Rb........ae....Rb...=....ne..........Rb:..6....re...........Rb.......ie........Rb.G.{....oe....q...Rb..H.....ue....q.......RbbenU....de....Rb.l......fe....1...Rbj.m.....me....1...1.................q...q.......Rb......ke....Rbf?.B....Le.......Rbr..@....De....1.......Rb.......Ue....Rb........Pe....q...Rbz.......Ne....Rb.^......Se....Rb........Ke....1.......Rbr5......We.......1...Rb..8....qe....Rb.......Qe....RbZ..d....Ge....Rb..>R....ze...............................................................................................................................................................................................................................Ib........L,....b....A...r...,T.8.`......L`......Rb"I.O....url...r........Dh............-....-......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	24
Entropy (8bit):	2.1431558784658327
Encrypted:	false
SSDEEP:	3:m+l:m
MD5:	54CB446F628B2EA4A5BCE5769910512E
SHA1:	C27CA848427FE87F5CF4D0E0E3CD57151B0D820D
SHA-256:	FBCFE23A2ECB82B7100C50811691DDE0A33AA3DA8D176BE9882A9DB485DC0F2D
SHA-512:	8F6ED2E91AED9BD415789B1DBE591E7EAB29F3F1B48FDFA5E864D7BF4AE554ACC5D82B4097A770DABC228523253623E4296C5023CF48252E1B94382C43123CB0
Malicious:	false
Reputation:	unknown
Preview:	0\r..m..................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\temp-index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	72
Entropy (8bit):	3.5271500973417917
Encrypted:	false
SSDEEP:	3:WNCoKPyXl/lJlHlxE/lllBlv0+n:WNCoSKsDn
MD5:	9E8233A37B5646B146C035A1B85394CF
SHA1:	C38F69EC943D6B55A2F1F429C8E55A08FCE352B4
SHA-256:	A4C4849913E3C0B4757146ACF9C4818A9A0038499D9E566DC4E39017724B91B0
SHA-512:	E70F7831F0EC1DF634A8BEA7F233FF87995B0A962E836A45AA7D09C8E8B664AA404637B0CEC67B263EA46A2FBE2BB47358322D5E8BFAE59289CD9E1275A5A36E
Malicious:	false
Reputation:	unknown
Preview:	@...c..Moy retne.............f...........X....,.........f......."".../.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	72
Entropy (8bit):	3.5271500973417917
Encrypted:	false
SSDEEP:	3:WNCoKPyXl/lJlHlxE/lllBlv0+n:WNCoSKsDn
MD5:	9E8233A37B5646B146C035A1B85394CF
SHA1:	C38F69EC943D6B55A2F1F429C8E55A08FCE352B4
SHA-256:	A4C4849913E3C0B4757146ACF9C4818A9A0038499D9E566DC4E39017724B91B0
SHA-512:	E70F7831F0EC1DF634A8BEA7F233FF87995B0A962E836A45AA7D09C8E8B664AA404637B0CEC67B263EA46A2FBE2BB47358322D5E8BFAE59289CD9E1275A5A36E
Malicious:	false
Reputation:	unknown
Preview:	@...c..Moy retne.............f...........X....,.........f......."".../.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RF3710a.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	72
Entropy (8bit):	3.5271500973417917
Encrypted:	false
SSDEEP:	3:WNCoKPyXl/lJlHlxE/lllBlv0+n:WNCoSKsDn
MD5:	9E8233A37B5646B146C035A1B85394CF
SHA1:	C38F69EC943D6B55A2F1F429C8E55A08FCE352B4
SHA-256:	A4C4849913E3C0B4757146ACF9C4818A9A0038499D9E566DC4E39017724B91B0
SHA-512:	E70F7831F0EC1DF634A8BEA7F233FF87995B0A962E836A45AA7D09C8E8B664AA404637B0CEC67B263EA46A2FBE2BB47358322D5E8BFAE59289CD9E1275A5A36E
Malicious:	false
Reputation:	unknown
Preview:	@...c..Moy retne.............f...........X....,.........f......."".../.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	24489
Entropy (8bit):	3.7685617655307504
Encrypted:	false
SSDEEP:	384:FLI9O9uwm1S3s6cjOj/EnExMk52NMHXYEG+qy8:CO8wm1S3s6cCDEnExMk52NMHXjG+qy8
MD5:	FAC040EC850BAFB25BE4386796F0C1BD
SHA1:	5A68F7A53FB87D678F644575EF6574D8F5FD81DD
SHA-256:	7E4E929551C4EA21A0886E72DE8D997CDA5A982E35122789EA3D6E2D0619AA35
SHA-512:	9950CD7431451B85447BAE55575F92B8B0DC3948C6B878B2F62B5A02AA1585890EC57FDC95D3AA018850363C0F4BF872A41B49E62E9388804DA761C49173CD52
Malicious:	false
Reputation:	unknown
Preview:	*...#................version.1..namespace-..&f.................&f.................&f.................&f.................&f.................&f...............&.@.h................next-map-id.1.Inamespace-ca2a33be_9d67_41c9_a97f_e03619ed2ccb-https://www.microsoft.com/.0V.e................V.e................V.e................V.e................c.#!i................next-map-id.2.Jnamespace-ca2a33be_9d67_41c9_a97f_e03619ed2ccb-https://apps.microsoft.com/.1....m]...............map-1-AI_buffer..[.".{.\.".t.i.m.e.\.".:.\.".2.0.2.4.-.1.0.-.0.2.T.1.0.:.1.6.:.5.1...4.6.6.Z.\.".,.\.".i.K.e.y.\.".:.\.".5.e.4.3.a.5.f.6.-.a.9.2.a.-.4.0.d.a.-.b.6.b.c.-.5.9.f.0.2.a.7.2.7.2.a.5.\.".,.\.".n.a.m.e.\.".:.\.".M.i.c.r.o.s.o.f.t...A.p.p.l.i.c.a.t.i.o.n.I.n.s.i.g.h.t.s...5.e.4.3.a.5.f.6.a.9.2.a.4.0.d.a.b.6.b.c.5.9.f.0.2.a.7.2.7.2.a.5...R.e.m.o.t.e.D.e.p.e.n.d.e.n.c.y.\.".,.\.".t.a.g.s.\.".:.{.\.".a.i...u.s.e.r...i.d.\.".:.\.".g.P.F.m.7.Q.c.R.2.p.V.4.O./.z.k.Z.S.C.6.d.C.\.".,.\.".a.i...s.e.s.s.i.o.n...i.d.\.".:

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	320
Entropy (8bit):	5.080887970492989
Encrypted:	false
SSDEEP:	6:WwUGIq2PRN23oH+TcwtrQMxIFUt8BwUdyZmw+BwUI8kwORN23oH+TcwtrQMFLJ:JCvaYebCFUt8CIy/+Cj85JYebtJ
MD5:	56C04250F98069F1FF1BCA3F8A83C5A0
SHA1:	D961A75AED6819CF5DD1188E944E4CFEFEDF1899
SHA-256:	7E379DE18F5FE7941DFA78DFC356FF1041111E4D92D96736EF0D5AC9906D5D42
SHA-512:	FB546BB368C71975BEAD3E1A1CB9B5E0D9E46FDE8AB5E5CA3FFA4DA0AB71A9F0BDD62AC8BD1B41903F2B15B26C66D5FCEC003E58635863025BB7D6EE937D3C31
Malicious:	false
Reputation:	unknown
Preview:	2024/10/02-06:16:32.649 1a10 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage/MANIFEST-000001.2024/10/02-06:16:32.658 1a10 Recovering log #3.2024/10/02-06:16:32.662 1a10 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	320
Entropy (8bit):	5.080887970492989
Encrypted:	false
SSDEEP:	6:WwUGIq2PRN23oH+TcwtrQMxIFUt8BwUdyZmw+BwUI8kwORN23oH+TcwtrQMFLJ:JCvaYebCFUt8CIy/+Cj85JYebtJ
MD5:	56C04250F98069F1FF1BCA3F8A83C5A0
SHA1:	D961A75AED6819CF5DD1188E944E4CFEFEDF1899
SHA-256:	7E379DE18F5FE7941DFA78DFC356FF1041111E4D92D96736EF0D5AC9906D5D42
SHA-512:	FB546BB368C71975BEAD3E1A1CB9B5E0D9E46FDE8AB5E5CA3FFA4DA0AB71A9F0BDD62AC8BD1B41903F2B15B26C66D5FCEC003E58635863025BB7D6EE937D3C31
Malicious:	false
Reputation:	unknown
Preview:	2024/10/02-06:16:32.649 1a10 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage/MANIFEST-000001.2024/10/02-06:16:32.658 1a10 Recovering log #3.2024/10/02-06:16:32.662 1a10 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sessions\Session_13372337794869855

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	15007
Entropy (8bit):	3.5994389194826133
Encrypted:	false
SSDEEP:	192:3xfYJasFFFBHwsgG9Sg2/2Sg+0U/ctSg:60sFFFBnvSF2SiUaS
MD5:	F295FA3839E2ACF600992EA3DBBE647F
SHA1:	689AB772ED51EADC39F1567F384C133F79E8E4CE
SHA-256:	183CED566520F4FDE3FFC10BB54733F247B791558F0D36AF09F7140583FD6788
SHA-512:	F7A6A46EF023F850FD27B242279A5F8B59AB868426D6788911973B659121DDB99155B72ADF847E8033C4A03093F9804311CB48C59F6944D636FC727F80833F01
Malicious:	false
Reputation:	unknown
Preview:	SNSS........zt3............zt3......".zt3............zt3........zt3........zt3........zt3....!...zt3................................zt3.zt31..,....zt3$...ca2a33be_9d67_41c9_a97f_e03619ed2ccb....zt3........zt3....Wc..........zt3....zt3........................zt3....................5..0....zt3&...{544A81F3-86CF-4601-B565-C8CB2CA3983A}......zt3........zt3...............................zt3................zt3....Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47...........................Microsoft Edge......117.....Not;A=Brand.....8.......Chromium....117.........Microsoft Edge......117.0.2045.47.......Not;A=Brand.....8.0.0.0.....Chromium....117.0.5938.132......117.0.2045.47.......Windows.....10.0.0......x86.............64..................zt3................zt3....Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47......................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Shortcuts

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 5, cookie 0x2, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.44194574462308833
Encrypted:	false
SSDEEP:	12:TLiNCcUMskMVcIWGhWxBzEXx7AAQlvsdFxOUwa5qgufTJpbZ75fOS:TLisVMnYPhIY5Qlvsd6UwccNp15fB
MD5:	B35F740AA7FFEA282E525838EABFE0A6
SHA1:	A67822C17670CCE0BA72D3E9C8DA0CE755A3421A
SHA-256:	5D599596D116802BAD422497CF68BE59EEB7A9135E3ED1C6BEACC48F73827161
SHA-512:	05C0D33516B2C1AB6928FB34957AD3E03CB0A8B7EEC0FD627DD263589655A16DEA79100B6CC29095C3660C95FD2AFB2E4DD023F0597BD586DD664769CABB67F8
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ ..........................................................................j..........g....."....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	348
Entropy (8bit):	5.141300370941125
Encrypted:	false
SSDEEP:	6:WwUbHkjyq2PRN23oH+Tcwt7Uh2ghZIFUt8BwUbHlq1Zmw+BwUbHQXJUtlRkwORNr:J+EOvaYebIhHh2FUt8C+Fq1/+C+fz5J0
MD5:	3CC31AE5FB30C5FDB6F72C36C3D10A7E
SHA1:	61FCC9853133C3B0F1EDBDF09962EC0626817D1F
SHA-256:	008B9A2D77197E36BE10AF883284C3120372E9B1F39562B85B5F84F884A3117D
SHA-512:	2E92AD6340D84F4558C7AF5C4BC9AE7071B53A07EEDC9D35F2B3C12C2E3217D1B4ADFB9A25FD6ED6C47784D5FB389B529D111ADFCC25FF14280077FCE3955F3E
Malicious:	false
Reputation:	unknown
Preview:	2024/10/02-06:16:26.495 1594 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database/MANIFEST-000001.2024/10/02-06:16:26.497 1594 Recovering log #3.2024/10/02-06:16:26.526 1594 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	348
Entropy (8bit):	5.141300370941125
Encrypted:	false
SSDEEP:	6:WwUbHkjyq2PRN23oH+Tcwt7Uh2ghZIFUt8BwUbHlq1Zmw+BwUbHQXJUtlRkwORNr:J+EOvaYebIhHh2FUt8C+Fq1/+C+fz5J0
MD5:	3CC31AE5FB30C5FDB6F72C36C3D10A7E
SHA1:	61FCC9853133C3B0F1EDBDF09962EC0626817D1F
SHA-256:	008B9A2D77197E36BE10AF883284C3120372E9B1F39562B85B5F84F884A3117D
SHA-512:	2E92AD6340D84F4558C7AF5C4BC9AE7071B53A07EEDC9D35F2B3C12C2E3217D1B4ADFB9A25FD6ED6C47784D5FB389B529D111ADFCC25FF14280077FCE3955F3E
Malicious:	false
Reputation:	unknown
Preview:	2024/10/02-06:16:26.495 1594 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database/MANIFEST-000001.2024/10/02-06:16:26.497 1594 Recovering log #3.2024/10/02-06:16:26.526 1594 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\SiteList.xml

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	XML 1.0 document, ASCII text
Category:	dropped
Size (bytes):	705404
Entropy (8bit):	4.69800839097965
Encrypted:	false
SSDEEP:	3072:C7VKrNcSy5APk9qe8dgCu9rq88Wfq3yfTOr:yyNcf5A08dgQboq3iOr
MD5:	ECF772746DECBE102BD2F0FC75732FF4
SHA1:	9C1F83C067DA762BAD2B4C69EF458801B1F746AB
SHA-256:	351FE304DE3204BDC58413C14E1252541E60D88CAE5FCD88BCEBA5D93074264D
SHA-512:	42DEC8082A017FBE29B570FA6F51634A79BD66E34D0F8D87AA594D2ED5B155AD4D78DA8F6A778815D9CD16DB0CA7CC47B9BE685834D6E8EE9D186F81C2F065B1
Malicious:	false
Reputation:	unknown
Preview:	<?xml version="1.0"?>.<site-list version="97">. <site url="0rga.org">. <open-in allow-redirect="true">MSEdge</open-in>. </site>. <site url="100partnerprogramme.de">. <open-in allow-redirect="true">MSEdge</open-in>. </site>. <site url="10bet.co.uk">. <open-in allow-redirect="true">MSEdge</open-in>. </site>. <site url="12circuit.state.fl.us">. <open-in allow-redirect="true">MSEdge</open-in>. </site>. <site url="12stream.de">. <open-in allow-redirect="true">MSEdge</open-in>. </site>. <site url="12thman.com">. <open-in allow-redirect="true">MSEdge</open-in>. </site>. <site url="17thswscoutsleeds.org.uk">. <open-in allow-redirect="true">MSEdge</open-in>. </site>. <site url="1822direkt-banking.de">. <open-in allow-redirect="true">MSEdge</open-in>. </site>. <site url="1987ser.co.jp">. <open-in allow-redirect="true">MSEdge</open-in>. </site>. <site url="1newhorizon.in">. <open-in allow-redirect="true">MSEdge</open-in>. </site>. <site url="1q.com">. <open-in allow-redirect="true">MSE

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\DawnCache\data_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	270336
Entropy (8bit):	0.0012471779557650352
Encrypted:	false
SSDEEP:	3:MsEllllkEthXllkl2zE:/M/xT02z
MD5:	F50F89A0A91564D0B8A211F8921AA7DE
SHA1:	112403A17DD69D5B9018B8CEDE023CB3B54EAB7D
SHA-256:	B1E963D702392FB7224786E7D56D43973E9B9EFD1B89C17814D7C558FFC0CDEC
SHA-512:	BF8CDA48CF1EC4E73F0DD1D4FA5562AF1836120214EDB74957430CD3E4A2783E801FA3F4ED2AFB375257CAEED4ABE958265237D6E0AACF35A9EDE7A2E8898D58
Malicious:	false
Reputation:	unknown
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\GPUCache\data_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	270336
Entropy (8bit):	0.0012471779557650352
Encrypted:	false
SSDEEP:	3:MsEllllkEthXllkl2zE:/M/xT02z
MD5:	F50F89A0A91564D0B8A211F8921AA7DE
SHA1:	112403A17DD69D5B9018B8CEDE023CB3B54EAB7D
SHA-256:	B1E963D702392FB7224786E7D56D43973E9B9EFD1B89C17814D7C558FFC0CDEC
SHA-512:	BF8CDA48CF1EC4E73F0DD1D4FA5562AF1836120214EDB74957430CD3E4A2783E801FA3F4ED2AFB375257CAEED4ABE958265237D6E0AACF35A9EDE7A2E8898D58
Malicious:	false
Reputation:	unknown
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	430
Entropy (8bit):	5.194473289915632
Encrypted:	false
SSDEEP:	12:J+Aj2IvaYebvqBQFUt8C+x/+C+Z5JYebvqBvJ:vj26aYebvZg8wJYebvk
MD5:	9EBBD458532CBAA99FCAB850166564DF
SHA1:	22A6087C1126CA16FE67479DEBDAA4D650C51B47
SHA-256:	529163E8AA36284EDA19D7F2CD807E982AA5AD71CB956A9E969B5BB15B7331AF
SHA-512:	F1F4F6874000AE8262D819B9F853A1585DD4189B9682BCA52B0FC0E1DC856796B5CA95585AECCC65E5B866BA7E861A58A37D880A54FAE6321FA6262065BB3717
Malicious:	false
Reputation:	unknown
Preview:	2024/10/02-06:16:26.944 1a10 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb/MANIFEST-000001.2024/10/02-06:16:26.953 1a10 Recovering log #3.2024/10/02-06:16:26.959 1a10 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	430
Entropy (8bit):	5.194473289915632
Encrypted:	false
SSDEEP:	12:J+Aj2IvaYebvqBQFUt8C+x/+C+Z5JYebvqBvJ:vj26aYebvZg8wJYebvk
MD5:	9EBBD458532CBAA99FCAB850166564DF
SHA1:	22A6087C1126CA16FE67479DEBDAA4D650C51B47
SHA-256:	529163E8AA36284EDA19D7F2CD807E982AA5AD71CB956A9E969B5BB15B7331AF
SHA-512:	F1F4F6874000AE8262D819B9F853A1585DD4189B9682BCA52B0FC0E1DC856796B5CA95585AECCC65E5B866BA7E861A58A37D880A54FAE6321FA6262065BB3717
Malicious:	false
Reputation:	unknown
Preview:	2024/10/02-06:16:26.944 1a10 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb/MANIFEST-000001.2024/10/02-06:16:26.953 1a10 Recovering log #3.2024/10/02-06:16:26.959 1a10 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\0a69fb75-6943-4da7-b741-1ba32a5a4c45.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	111
Entropy (8bit):	4.718418993774295
Encrypted:	false
SSDEEP:	3:YLb9N+eAXRfHDH2LS7PMVKJq0nMb1KKtiVY:YHpoeS7PMVKJTnMRK3VY
MD5:	285252A2F6327D41EAB203DC2F402C67
SHA1:	ACEDB7BA5FBC3CE914A8BF386A6F72CA7BAA33C6
SHA-256:	5DFC321417FC31359F23320EA68014EBFD793C5BBED55F77DAB4180BBD4A2026
SHA-512:	11CE7CB484FEE66894E63C31DB0D6B7EF66AD0327D4E7E2EB85F3BCC2E836A3A522C68D681E84542E471E54F765E091EFE1EE4065641B0299B15613EB32DCC0D
Malicious:	false
Reputation:	unknown
Preview:	{"net":{"http_server_properties":{"servers":[],"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\151c5496-0e8e-4ff6-9105-59d259de04f1.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Reputation:	unknown
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\3380c30b-a59b-430d-852a-3e1d8d2ea1e0.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Reputation:	unknown
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\Network Persistent State (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	111
Entropy (8bit):	4.718418993774295
Encrypted:	false
SSDEEP:	3:YLb9N+eAXRfHDH2LS7PMVKJq0nMb1KKqk1Yn:YHpoeS7PMVKJTnMRKXk1Yn
MD5:	807419CA9A4734FEAF8D8563A003B048
SHA1:	A723C7D60A65886FFA068711F1E900CCC85922A6
SHA-256:	AA10BF07B0D265BED28F2A475F3564D8DDB5E4D4FFEE0AB6F3A0CC564907B631
SHA-512:	F10D496AE75DB5BA412BD9F17BF0C7DA7632DB92A3FABF7F24071E40F5759C6A875AD8F3A72BAD149DA58B3DA3B816077DF125D0D9F3544ADBA68C66353D206C
Malicious:	false
Reputation:	unknown
Preview:	{"net":{"http_server_properties":{"servers":[],"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"3G"}}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\Network Persistent State~RF33e62.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	111
Entropy (8bit):	4.718418993774295
Encrypted:	false
SSDEEP:	3:YLb9N+eAXRfHDH2LS7PMVKJq0nMb1KKqk1Yn:YHpoeS7PMVKJTnMRKXk1Yn
MD5:	807419CA9A4734FEAF8D8563A003B048
SHA1:	A723C7D60A65886FFA068711F1E900CCC85922A6
SHA-256:	AA10BF07B0D265BED28F2A475F3564D8DDB5E4D4FFEE0AB6F3A0CC564907B631
SHA-512:	F10D496AE75DB5BA412BD9F17BF0C7DA7632DB92A3FABF7F24071E40F5759C6A875AD8F3A72BAD149DA58B3DA3B816077DF125D0D9F3544ADBA68C66353D206C
Malicious:	false
Reputation:	unknown
Preview:	{"net":{"http_server_properties":{"servers":[],"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"3G"}}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\SCT Auditing Pending Reports (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Reputation:	unknown
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\SCT Auditing Pending Reports~RF31222.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Reputation:	unknown
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\Sdch Dictionaries (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.1275671571169275
Encrypted:	false
SSDEEP:	3:Y2ktGMxkAXWMSN:Y2xFMSN
MD5:	20D4B8FA017A12A108C87F540836E250
SHA1:	1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
SHA-256:	6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
SHA-512:	507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
Malicious:	false
Reputation:	unknown
Preview:	{"SDCH":{"dictionaries":{},"version":2}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\Trust Tokens

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 4, database pages 9, cookie 0x7, schema 4, UTF-8, version-valid-for 4
Category:	dropped
Size (bytes):	36864
Entropy (8bit):	0.3886039372934488
Encrypted:	false
SSDEEP:	24:TLqEeWOT/kIAoDJ84l5lDlnDMlRlyKDtM6UwccWfp15fBIe:T2EeWOT/nDtX5nDOvyKDhU1cSB
MD5:	DEA619BA33775B1BAEEC7B32110CB3BD
SHA1:	949B8246021D004B2E772742D34B2FC8863E1AAA
SHA-256:	3669D76771207A121594B439280A67E3A6B1CBAE8CE67A42C8312D33BA18854B
SHA-512:	7B9741E0339B30D73FACD4670A9898147BE62B8F063A59736AFDDC83D3F03B61349828F2AE88F682D42C177AE37E18349FD41654AEBA50DDF10CD6DC70FA5879
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ ..........................................................................j..........g...}.....$.X..............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\b0a06899-c52e-45cc-a036-d2d8b36b4dbb.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.1275671571169275
Encrypted:	false
SSDEEP:	3:Y2ktGMxkAXWMSN:Y2xFMSN
MD5:	20D4B8FA017A12A108C87F540836E250
SHA1:	1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
SHA-256:	6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
SHA-512:	507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
Malicious:	false
Reputation:	unknown
Preview:	{"SDCH":{"dictionaries":{},"version":2}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\c71b5993-5ba1-408c-9af4-c031f06e92db.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	111
Entropy (8bit):	4.718418993774295
Encrypted:	false
SSDEEP:	3:YLb9N+eAXRfHDH2LS7PMVKJq0nMb1KKqk1Yn:YHpoeS7PMVKJTnMRKXk1Yn
MD5:	807419CA9A4734FEAF8D8563A003B048
SHA1:	A723C7D60A65886FFA068711F1E900CCC85922A6
SHA-256:	AA10BF07B0D265BED28F2A475F3564D8DDB5E4D4FFEE0AB6F3A0CC564907B631
SHA-512:	F10D496AE75DB5BA412BD9F17BF0C7DA7632DB92A3FABF7F24071E40F5759C6A875AD8F3A72BAD149DA58B3DA3B816077DF125D0D9F3544ADBA68C66353D206C
Malicious:	false
Reputation:	unknown
Preview:	{"net":{"http_server_properties":{"servers":[],"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"3G"}}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	80
Entropy (8bit):	3.4921535629071894
Encrypted:	false
SSDEEP:	3:S8ltHlS+QUl1ASEGhTFljl:S85aEFljl
MD5:	69449520FD9C139C534E2970342C6BD8
SHA1:	230FE369A09DEF748F8CC23AD70FD19ED8D1B885
SHA-256:	3F2E9648DFDB2DDB8E9D607E8802FEF05AFA447E17733DD3FD6D933E7CA49277
SHA-512:	EA34C39AEA13B281A6067DE20AD0CDA84135E70C97DB3CDD59E25E6536B19F7781E5FC0CA4A11C3618D43FC3BD3FBC120DD5C1C47821A248B8AD351F9F4E6367
Malicious:	false
Reputation:	unknown
Preview:	*...#................version.1..namespace-..&f.................&f...............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	418
Entropy (8bit):	5.164737203853345
Encrypted:	false
SSDEEP:	12:JPd9vaYebvqBZFUt8C61Z/+CD2z5JYebvqBaJ:fhaYebvyg8p1bIJYebvL
MD5:	7F360718D3CE6FDCACA22A9458B73730
SHA1:	49D759965E76D428049F258D8CC62AA0E1A63B7E
SHA-256:	D0ED0952119EDF18ACE4D585CB797B6142B96CBEB4FB434B3D34C76CB6A6E078
SHA-512:	49D7D32D2C5C435194C9B4849368B3368CD325E72070A95742E43B518C21DD1AA2ECF42A694D468D3D926F6DEB976FA2A82BC2070C38FDAF56F5B03FB29F29D7
Malicious:	false
Reputation:	unknown
Preview:	2024/10/02-06:16:42.342 1a10 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage/MANIFEST-000001.2024/10/02-06:16:42.344 1a10 Recovering log #3.2024/10/02-06:16:42.346 1a10 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	418
Entropy (8bit):	5.164737203853345
Encrypted:	false
SSDEEP:	12:JPd9vaYebvqBZFUt8C61Z/+CD2z5JYebvqBaJ:fhaYebvyg8p1bIJYebvL
MD5:	7F360718D3CE6FDCACA22A9458B73730
SHA1:	49D759965E76D428049F258D8CC62AA0E1A63B7E
SHA-256:	D0ED0952119EDF18ACE4D585CB797B6142B96CBEB4FB434B3D34C76CB6A6E078
SHA-512:	49D7D32D2C5C435194C9B4849368B3368CD325E72070A95742E43B518C21DD1AA2ECF42A694D468D3D926F6DEB976FA2A82BC2070C38FDAF56F5B03FB29F29D7
Malicious:	false
Reputation:	unknown
Preview:	2024/10/02-06:16:42.342 1a10 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage/MANIFEST-000001.2024/10/02-06:16:42.344 1a10 Recovering log #3.2024/10/02-06:16:42.346 1a10 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	324
Entropy (8bit):	5.15152692966358
Encrypted:	false
SSDEEP:	6:WwUbHQXjG+q2PRN23oH+TcwtpIFUt8BwUbHQXBfZmw+BwUbHQXBfVkwORN23oH+v:J+WHvaYebmFUt8C+6f/+C+6N5JYebaUJ
MD5:	59E8BB99FB0C757575B23DC0FBDA245E
SHA1:	0AD21B314AB18B2FA2C5A1B00831A21BFE70A963
SHA-256:	5FC83E467E92FB06B8EBA8E3476AA10E33DD7D4445E6BECABF91871EE49F0456
SHA-512:	FFD9CC4AE0501C77E4B8F1E9C28534AD141565E63325D1C2103CF53BA4778B377E31FAC6CC9D2CEABAF28E1C105EC2444004AB4CEE9E340A6E0D67C1BBF60F91
Malicious:	false
Reputation:	unknown
Preview:	2024/10/02-06:16:26.524 1028 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB/MANIFEST-000001.2024/10/02-06:16:26.525 1028 Recovering log #3.2024/10/02-06:16:26.525 1028 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	324
Entropy (8bit):	5.15152692966358
Encrypted:	false
SSDEEP:	6:WwUbHQXjG+q2PRN23oH+TcwtpIFUt8BwUbHQXBfZmw+BwUbHQXBfVkwORN23oH+v:J+WHvaYebmFUt8C+6f/+C+6N5JYebaUJ
MD5:	59E8BB99FB0C757575B23DC0FBDA245E
SHA1:	0AD21B314AB18B2FA2C5A1B00831A21BFE70A963
SHA-256:	5FC83E467E92FB06B8EBA8E3476AA10E33DD7D4445E6BECABF91871EE49F0456
SHA-512:	FFD9CC4AE0501C77E4B8F1E9C28534AD141565E63325D1C2103CF53BA4778B377E31FAC6CC9D2CEABAF28E1C105EC2444004AB4CEE9E340A6E0D67C1BBF60F91
Malicious:	false
Reputation:	unknown
Preview:	2024/10/02-06:16:26.524 1028 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB/MANIFEST-000001.2024/10/02-06:16:26.525 1028 Recovering log #3.2024/10/02-06:16:26.525 1028 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Visited Links

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	131072
Entropy (8bit):	0.016375260082099316
Encrypted:	false
SSDEEP:	3:ImtVC0Td/x/tAGBl0AK98Az/t3t76ll/lMgttdxlll/AfUw1l/jpfll/l2ZiER1S:IiVC0J/8GtKeM+tl7jllo5ldNUm
MD5:	D66A9BDB773E5C98C88E313B0769E286
SHA1:	B2762BAA68312425CCD7CFD9B519339CA5B6F177
SHA-256:	D4D44A2AD295243B33CBA2917DA22B6B594AAB91BB483ADFC1276D6095EC2909
SHA-512:	7494CE5B1BB8494EEDD3075D3B881C8B5B64D5F8E2DBAA30740A2638B055FE9A21D179C350FC6090389DCE1D4DC71EC0815F2B4C44AAD1FC5487BC7A06C03F04
Malicious:	false
Reputation:	unknown
Preview:	VLnk.....?.......v\|..lON................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Web Data

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 10, database pages 91, cookie 0x36, schema 4, UTF-8, version-valid-for 10
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.265462379463826
Encrypted:	false
SSDEEP:	384:8/2qOB1nxCkMlSAELyKOMq+8mKQ0MPVumi:Bq+n0Jl9ELyKOMq+8m5he
MD5:	A146C8311C4FF4130304BCB8178AB126
SHA1:	C4DF8DED94A4BCE002DAD58BCF7965AC1989C701
SHA-256:	3A71B10EB027C6CD2619D048971183F3F609BFC544DE7E1659A19B39855C30D3
SHA-512:	D4F011D9FFA8A9A4900AEB318D9D853B05E360651C624B323B80CC2EB55B7A7B28063EAE57903E9EB1EA73F26802DAEE9998510768DCCD04C45A47F40A97BC10
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ .......[...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\QuotaManager

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 10, cookie 0x7, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.47336253026020764
Encrypted:	false
SSDEEP:	48:Tnj7dojKsKmjKZKAsjZNOjAhts3N8g1j3UcBsu6u6A/uJuET:v7doKsKuKZKlZNmu46yjxsu6uHuJuET
MD5:	0C084BC7019CF0216E90C87F328DEB57
SHA1:	8A91D21A28E8B96CC5EA726D435FFCC47F0DDDED
SHA-256:	C2CD977FC4D0F5B4F28E290654881991FCBF6D4293A53944673CAC7F05841516
SHA-512:	8DD552F5DE356250C72B1B99EA13C2BE650C2C4A341090BD53EE447B099B5EE15CAAD81599A8D17C09CF5CF15DC2B50DD9AABB10AAB762B88BD17A3BC38B9C2A
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ ..........................................................................j.......w..g...........M...w..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\QuotaManager-journal

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	12824
Entropy (8bit):	0.1500652822169083
Encrypted:	false
SSDEEP:	3:Y/lNllHXtXlVq25Elk7tcjaJ3utRU3utXzQf2KnMQw325VetXlVMeR:clFE8vtuD2uxHgqlS4
MD5:	BF662E3A89A483DC18A3E0CE774125FB
SHA1:	03ED9F7C28F808D8E788D01CC4DD1ED57E3B14C5
SHA-256:	35B29EEC375B74D9B5B63EBBEDA2B61FD6480B564611949C397F53EC955CFCB1
SHA-512:	3DD8781504F4F75FF53E7B02249603C8A0ABEAF8C83437674272BBE56D35C6AAF2B6C12DB70D2F4B8DBE9FD016564CEEB01472AFAB3C513B31698E7FE45D6E83
Malicious:	false
Reputation:	unknown
Preview:	...............#........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\a6fbbf97-fb83-4e5b-92f9-2554eff2ce17.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:L:L
MD5:	5058F1AF8388633F609CADB75A75DC9D
SHA1:	3A52CE780950D4D969792A2559CD519D7EE8C727
SHA-256:	CDB4EE2AEA69CC6A83331BBE96DC2CAA9A299D21329EFB0336FC02A82E1839A8
SHA-512:	0B61241D7C17BCBB1BAEE7094D14B7C451EFECC7FFCBD92598A0F13D313CC9EBC2A07E61F007BAF58FBF94FF9A8695BDD5CAE7CE03BBF1E94E93613A00F25F21
Malicious:	false
Reputation:	unknown
Preview:	.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\arbitration_service_config.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with very long lines (3951), with CRLF line terminators
Category:	dropped
Size (bytes):	11755
Entropy (8bit):	5.190465908239046
Encrypted:	false
SSDEEP:	192:hH4vrmqRBB4W4PoiUDNaxvR5FCHFcoaSbqGEDI:hH4vrmUB6W4jR3GaSbqGEDI
MD5:	07301A857C41B5854E6F84CA00B81EA0
SHA1:	7441FC1018508FF4F3DBAA139A21634C08ED979C
SHA-256:	2343C541E095E1D5F202E8D2A0807113E69E1969AF8E15E3644C51DB0BF33FBF
SHA-512:	00ADE38E9D2F07C64648202F1D5F18A2DFB2781C0517EAEBCD567D8A77DBB7CB40A58B7C7D4EC03336A63A20D2E11DD64448F020C6FF72F06CA870AA2B4765E0
Malicious:	false
Reputation:	unknown
Preview:	{.. "DefaultCohort": {.. "21f3388b-c2a5-4791-8f6e-a4cad6d17f4f.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.BingHomePage.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Covid.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Finance.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Jobs.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.KnowledgeCard.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Local.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.NTP3PCLICK.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.NotifySearchPage.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Recipe.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.SearchPage.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Sports.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Travel.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Weather.Bubble": 1,.. "2cb2db96-3bd0-403e-abe2-9269b3761041.Bubble": 1,.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\bdd519c3-512d-435b-8663-94b60fb7b788.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	24853
Entropy (8bit):	5.566037805390812
Encrypted:	false
SSDEEP:	768:ZgkaHUWPYyfwf8F1+UoAYDCx9Tuqh0VfUC9xbog/OVaXo7Erw7h4pYtug:ZgkaHUWPYyfwfu1jan47d9jtL
MD5:	8F3CE3320CB0F9F45B6667260C9FCB8D
SHA1:	E80306E1008FC96066D8D082D729624DB9F47134
SHA-256:	C4D11A31920432641E55644F61711803609C6882AD17A213B12A83C67651B8D0
SHA-512:	3EB611B140FDB7EF2B343EB051F76B9F4EE3AE3E95A1E8330F65A1E3D1E2C24FCD39C1EA7C52941D1612EA4B9DCA4A6BCFA16F7E29EE4561805781A515454758
Malicious:	false
Reputation:	unknown
Preview:	{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13372337786467250","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13372337786467250","location":5,"ma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\ce7cf232-da26-474f-b5bc-1e0b7dc80123.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	699716
Entropy (8bit):	4.553890513727362
Encrypted:	false
SSDEEP:	3072:FpOhNt41h1VwjfczePyCeXnyZle/uJWFkZ:FpeNt4NVwbczeGnKM/Nc
MD5:	13E2404B474D7BCDD3F38FDCD4D8170E
SHA1:	A2B048DBE33C8DCA6D709BECC4509AE3BB7EAD38
SHA-256:	6499D675077031A878EFC4BFB8ED4DADDE0161722A3C39A17103999FFF593358
SHA-512:	EDC12D6770782EBCCE9950FEA20806F704D8B5D998CE1718D6D5A8B622480831B8B0631C393E8FBD63186476E444236B9A28FEB904422CFE081870BB9E685B0D
Malicious:	false
Reputation:	unknown
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13372337786836701","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13341058280410352","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"should_reset_check_default_browser":false,"toolbar_extensions_hub_button_visibility":0,"underside_chat_bing_signed_in_status":false,"window_placement":{"bottom":974,"left":10,"maximized":true,"right":1060,"top":10,"work_area_bottom":984,"work_area_left":0,"work_area_right":1280,"work_area_top":0}},"browser_content_container_height":914,"browser_content_container_width":1236,"browser_content_container_x":0,"browser_content_container_y":70,"continuous_migration":{"ci_correction_for_holdout_treatment_state":1},"countryid_at_install":17224,"custom_links":{"li

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\databases\Databases.db

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 7, cookie 0x4, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	28672
Entropy (8bit):	0.3410017321959524
Encrypted:	false
SSDEEP:	12:TLiqi/nGb0EiDFIlTSFbyrKZb9YwFOqAyl+FxOUwa5qgufTJpbZ75fOSG:TLiMNiD+lZk/Fj+6UwccNp15fBG
MD5:	98643AF1CA5C0FE03CE8C687189CE56B
SHA1:	ECADBA79A364D72354C658FD6EA3D5CF938F686B
SHA-256:	4DC3BF7A36AB5DA80C0995FAF61ED0F96C4DE572F2D6FF9F120F9BC44B69E444
SHA-512:	68B69FCE8EF5AB1DDA2994BA4DB111136BD441BC3EFC0251F57DC20A3095B8420669E646E2347EAB7BAF30CACA4BCF74BD88E049378D8DE57DE72E4B8A5FF74B
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ ..........................................................................j..........g.....P....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\e27d3cc5-ff20-4445-9e6a-e77e8ad4bb29.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4364
Entropy (8bit):	4.235769396185342
Encrypted:	false
SSDEEP:	96:G0eVyxFxKiy1+Tzac8adJK0DwbCD2qXaZj5jdj5eyj5H:GAc2B9FtteBt
MD5:	389D4F86CC16CA4B32BAD5B39976FAA2
SHA1:	0EA8E2E3D8B0D4DDE244C69D1B0A39DB1A298986
SHA-256:	4B17594306803A717F05F2DCDF70F5F607B430060504DA4A43C015E06043A697
SHA-512:	C36C243619B32F4667B89D22DCE7FFBF6925E39A20E5901DD89602AA8A0E63F1893E3CB15F1E0DADF8BD38CF58E6AC6BE454FBB2B1A1D923555B747294BAD4B7
Malicious:	false
Reputation:	unknown
Preview:	{.. "checksum": "45c5e75d52aad358849be76b67352156",.. "roots": {.. "bookmark_bar": {.. "children": [ {.. "date_added": "13351791439314668",.. "date_last_used": "0",.. "guid": "6a2852fd-d4cf-4716-941a-d071da2e9e76",.. "id": "7",.. "name": "Amazon",.. "show_icon": false,.. "source": "import_fre",.. "type": "url",.. "url": "http://www.amazon.com/".. }, {.. "date_added": "13351791439314668",.. "date_last_used": "0",.. "guid": "6a78a7f8-baa9-48e8-b482-2fae1b3d2dd7",.. "id": "8",.. "name": "Facebook",.. "show_icon": false,.. "source": "import_fre",.. "type": "url",.. "url": "http://www.facebook.com/".. }, {.. "date_added": "13351791439314668",.. "date_last_used": "0",.. "guid": "8b97f025-eeed-4a1c-8b8d-15a24412fa55",.. "i

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\ee694d66-5cfd-4210-83bf-4a37bdb1d283.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	9557
Entropy (8bit):	5.091056723021349
Encrypted:	false
SSDEEP:	192:stskdAwMIOO2h4FuBr328MbV+FiADscPaYJ:stszwMIO3fBobGims2
MD5:	FCE818A6EDFC1E2EBADCDC5D97290EFD
SHA1:	A10E40CC791E3F5C9358408BE6086969F3AF8B54
SHA-256:	3A8292382D547B4AE770B7920A1111983A80C50BC151EC436C34658C41244EA8
SHA-512:	E1BA0E646773CEB8483F883F22B9B3951047E8D9711A9672E8BE785E7BC5EFA54A1637565309FB0B7567B4E827BF777361F8114721B4E8D5A79629A7678A3225
Malicious:	false
Reputation:	unknown
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13372337786836701","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13341058280410352","arbitration_using_experiment_config":false,"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"should_reset_check_default_browser":false,"toolbar_extensions_hub_button_visibility":0,"underside_chat_bing_signed_in_status":false,"window_placement":{"bottom":974,"left":10,"maximized":true,"right":1060,"top":10,"work_area_bottom":984,"work_area_left":0,"work_area_right":1280,"work_area_top":0}},"browser_content_container_height":914,"browser_content_container_width":1236,"browser_content_container_x":0,"browser_content_container_y":70,"continuous_migration":{"ci_correction_for_holdout_treatment_state":1},"countryid_at_install":17224,"custom_links":{"list":[]},"default_apps_install_state":3,"dips_timer_la

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\f9554e92-be77-4883-a95c-09a3ccf576be.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:L:L
MD5:	5058F1AF8388633F609CADB75A75DC9D
SHA1:	3A52CE780950D4D969792A2559CD519D7EE8C727
SHA-256:	CDB4EE2AEA69CC6A83331BBE96DC2CAA9A299D21329EFB0336FC02A82E1839A8
SHA-512:	0B61241D7C17BCBB1BAEE7094D14B7C451EFECC7FFCBD92598A0F13D313CC9EBC2A07E61F007BAF58FBF94FF9A8695BDD5CAE7CE03BBF1E94E93613A00F25F21
Malicious:	false
Reputation:	unknown
Preview:	.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\load_statistics.db-shm

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.5130621000505453
Encrypted:	false
SSDEEP:	48:0bAbdonnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnE/yjyjyjyjyjyj4:dlkAHHdPGyw
MD5:	384EDB05F6A48B51BCA3658ECE79B9C2
SHA1:	11BEF4F6B2FF5834168D51F783D6FDA220FEEBE8
SHA-256:	8F3F658E9AE52BC718A045913FB98327A9CF1B00D4785AAF927BE35805C3A821
SHA-512:	BD7A875AFFD53C6473346EEB470934165205047BD376F5AE8A992E5B23555191EE8F406CDFA7FBECF107A2E9A2DBAE5B3C17526E89B757F8811A1458DDB54674
Malicious:	false
Reputation:	unknown
Preview:	..-.....\|...............:d@8.,..^..>l_....b..\|....-.....\|...............:d@8.,..^..>l_....b..\|..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\load_statistics.db-wal

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite Write-Ahead Log, version 3007000
Category:	dropped
Size (bytes):	2175392
Entropy (8bit):	3.5669682814150248
Encrypted:	false
SSDEEP:	6144:dpwlp7/s44vCbq8KJjtrPZO/SBSaqVutfKzMASKYRw3SGGiYkObQQYHo36zkMSNs:U
MD5:	C9690CB377100AE10CA59A33EB684212
SHA1:	4A13C2D1FC508987F314B1A1200693D2A44C27BB
SHA-256:	52B224FB67E6123272A1CE365FFD2B0C135B5E7A4742DB3CDF25F0FCC54953D9
SHA-512:	8D907334ED3F813DDA5600EC89E58B3FEC7E968C0EBBBA3785AB9057695A0C8CB1E33727DB6313F666E2A718180478791683D0A364F235E3FC93E8E7DF9D404E
Malicious:	false
Reputation:	unknown
Preview:	7....-..........^..>l_.....q..$.........^..>l_..X....9I4SQLite format 3......@ ..........................................................................j.............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	645
Entropy (8bit):	3.9316206766098927
Encrypted:	false
SSDEEP:	12:fmtlc8pOuuuuuuuuuuuuuuuu7/XllRLdFgllpq4kT4c8u:fmXr61lRZmlpBY
MD5:	0A3F376096DDD62754ACBAAEB7851812
SHA1:	36D69A226794AC505B7D5E3A8C46171785DBE6EE
SHA-256:	2AD4189AE19FB187CB4F872E42549772992DA0111FF7AEDE689FFF96AEF6489D
SHA-512:	3080CF47C312C56458072EEC41E951DF1FF985A73098ABF8FF4D37AED344F9D237567D762142CB3D953D42A9695BEAF45482F833E6FF4779470C5221B5945367
Malicious:	false
Reputation:	unknown
Preview:	A..r.................20_1_1...1.,U.................20_1_1...1?.Q;0................39_config..........6.....n ...1u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............m..I;...............#38_h.......6.Z..W.F..........................f.Nb:...............#38_h.......6.Z..W.F.........................2B.l................C9s0................39_config..........6.....n ....1

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	320
Entropy (8bit):	5.163875368142694
Encrypted:	false
SSDEEP:	6:WwUbH0L+L+q2PRN23oH+TcwtfrK+IFUt8BwUbH0LoKWZmw+BwUbH2fLVkwORN23h:J+HL+vaYeb23FUt8C+sW/+C+WfLV5JYq
MD5:	ED73D4085F10956E90A97BE553F7CBAE
SHA1:	F8DF34075479B2174F93DD789856BDE9FBD6CCC8
SHA-256:	436728F1220BC1933C7DD3CE950685D1FC86C1A5BEB45669D462F228B62E9BC0
SHA-512:	7BB1D3C7E575A7DD4CA1E8EE5B065B78962ABEC213993E51FB4239137E9C1C49F5AF5BBCA417C325606653100F6168119EA12BF3F421BD6568869B7F08F89540
Malicious:	false
Reputation:	unknown
Preview:	2024/10/02-06:16:26.867 10ec Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db/MANIFEST-000001.2024/10/02-06:16:26.867 10ec Recovering log #3.2024/10/02-06:16:26.868 10ec Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	320
Entropy (8bit):	5.163875368142694
Encrypted:	false
SSDEEP:	6:WwUbH0L+L+q2PRN23oH+TcwtfrK+IFUt8BwUbH0LoKWZmw+BwUbH2fLVkwORN23h:J+HL+vaYeb23FUt8C+sW/+C+WfLV5JYq
MD5:	ED73D4085F10956E90A97BE553F7CBAE
SHA1:	F8DF34075479B2174F93DD789856BDE9FBD6CCC8
SHA-256:	436728F1220BC1933C7DD3CE950685D1FC86C1A5BEB45669D462F228B62E9BC0
SHA-512:	7BB1D3C7E575A7DD4CA1E8EE5B065B78962ABEC213993E51FB4239137E9C1C49F5AF5BBCA417C325606653100F6168119EA12BF3F421BD6568869B7F08F89540
Malicious:	false
Reputation:	unknown
Preview:	2024/10/02-06:16:26.867 10ec Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db/MANIFEST-000001.2024/10/02-06:16:26.867 10ec Recovering log #3.2024/10/02-06:16:26.868 10ec Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	816
Entropy (8bit):	4.0647916882227655
Encrypted:	false
SSDEEP:	12:G0nYUtTNop//z32m5t/yVf9HqlIZfkBA//DtKhKg+rOyBrgxvB1ySxs:G0nYUtypD32m3yWlIZMBA5NgKIvB8Sxs
MD5:	3BE72D8D40752B3A97028FDB2931FABA
SHA1:	A27EA4726857A948F0A4B074062B674469A9A371
SHA-256:	3C18553C8C3F7E801855F3579AC57F3C156D783BBA27FB35C6D2FB6CB89BD902
SHA-512:	8EBD4D6980BB7796615217E72BC65953C920B68B9259341CD52858C1E889EC90339E2A304FE0C971D6C6EF9AFC4A00CFB3E5CC89C7B2DF8737A0C7EC241BDADC
Malicious:	false
Reputation:	unknown
Preview:	.h.6.................__global... .t...................__global... .9..b.................33_..........................33_........v.................21_.....vuNX.................21_.....<...................20_.....X...................20_.....W.J+.................19_......qY.................18_.....'}2..................37_.......c..................38_......i...................39_.....Owa..................20_.....4.9..................20_.....B.I..................19_..........................18_.....2.1..................37_..........................38_......=.%.................39_.....p.j..................9_.....JJ...................9_.....\|.&R.................__global... ./....................__global... ..T...................__global... ...G..................__global... ......................__global... .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	338
Entropy (8bit):	5.148690552951463
Encrypted:	false
SSDEEP:	6:WwUbH+lL+q2PRN23oH+TcwtfrzAdIFUt8BwUbH6qG1KWZmw+BwUbHofLVkwORN2a:J+SL+vaYeb9FUt8C+uAW/+C+QLV5JYe+
MD5:	532E8E260B8B2182923B30AF499BEE89
SHA1:	D52009FA6D756E0D06BAF142029247CA2A627BE6
SHA-256:	93B32922F20EA7A31E2C07773EF2015487157FBEA060F7CD9CA01434513FD84A
SHA-512:	79324E79E46D592B1377910CA4AFB793FFD220244BE484DE16921982C46E5D6D9009646A9BAA2698B5E6CC9ECFC80F581F47CCBD70DA31F4403044A443743709
Malicious:	false
Reputation:	unknown
Preview:	2024/10/02-06:16:26.859 10ec Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata/MANIFEST-000001.2024/10/02-06:16:26.860 10ec Recovering log #3.2024/10/02-06:16:26.862 10ec Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	338
Entropy (8bit):	5.148690552951463
Encrypted:	false
SSDEEP:	6:WwUbH+lL+q2PRN23oH+TcwtfrzAdIFUt8BwUbH6qG1KWZmw+BwUbHofLVkwORN2a:J+SL+vaYeb9FUt8C+uAW/+C+QLV5JYe+
MD5:	532E8E260B8B2182923B30AF499BEE89
SHA1:	D52009FA6D756E0D06BAF142029247CA2A627BE6
SHA-256:	93B32922F20EA7A31E2C07773EF2015487157FBEA060F7CD9CA01434513FD84A
SHA-512:	79324E79E46D592B1377910CA4AFB793FFD220244BE484DE16921982C46E5D6D9009646A9BAA2698B5E6CC9ECFC80F581F47CCBD70DA31F4403044A443743709
Malicious:	false
Reputation:	unknown
Preview:	2024/10/02-06:16:26.859 10ec Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata/MANIFEST-000001.2024/10/02-06:16:26.860 10ec Recovering log #3.2024/10/02-06:16:26.862 10ec Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Last Browser

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	120
Entropy (8bit):	3.32524464792714
Encrypted:	false
SSDEEP:	3:tbloIlrJFlXnpQoWcNylRjlgbYnPdJiG6R7lZAUAl:tbdlrYoWcV0n1IGi7kBl
MD5:	A397E5983D4A1619E36143B4D804B870
SHA1:	AA135A8CC2469CFD1EF2D7955F027D95BE5DFBD4
SHA-256:	9C70F766D3B84FC2BB298EFA37CC9191F28BEC336329CC11468CFADBC3B137F4
SHA-512:	4159EA654152D2810C95648694DD71957C84EA825FCCA87B36F7E3282A72B30EF741805C610C5FA847CA186E34BDE9C289AAA7B6931C5B257F1D11255CD2A816
Malicious:	false
Reputation:	unknown
Preview:	C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.).\.M.i.c.r.o.s.o.f.t.\.E.d.g.e.\.A.p.p.l.i.c.a.t.i.o.n.\.m.s.e.d.g.e...e.x.e.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Last Version

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	13
Entropy (8bit):	2.7192945256669794
Encrypted:	false
SSDEEP:	3:NYLFRQI:ap2I
MD5:	BF16C04B916ACE92DB941EBB1AF3CB18
SHA1:	FA8DAEAE881F91F61EE0EE21BE5156255429AA8A
SHA-256:	7FC23C9028A316EC0AC25B09B5B0D61A1D21E58DFCF84C2A5F5B529129729098
SHA-512:	F0B7DF5517596B38D57C57B5777E008D6229AB5B1841BBE74602C77EEA2252BF644B8650C7642BD466213F62E15CC7AB5A95B28E26D3907260ED1B96A74B65FB
Malicious:	false
Reputation:	unknown
Preview:	117.0.2045.47

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	58117
Entropy (8bit):	6.1058245319628615
Encrypted:	false
SSDEEP:	1536:k/Ps+wsI7yO/3i+EeTTvqrvbtoYKBuSZ+aoo:k/0+zI7yOq+EGTivXKBuWNP
MD5:	A15AFAFE37B48F6BF28CB6305E339894
SHA1:	12CB1308B5A115D65E76225209AFAC83025A6E7D
SHA-256:	9DF0276F2720BCC9BBB7C9107DF139A46F8A45EF67146E3E0FB8984CA6266547
SHA-512:	99071C2B70BD0C9258DCE83FD35EFEC63C0F6F11830D436F6BC1580B69964D93C31EEA2094A296775F6C84AF2142838C8D34E7408D968DD19E0829A9087DD611
Malicious:	false
Reputation:	unknown
Preview:	{"abusive_adblocker_etag":"\"8ABCE35666CBACA121128B98C75E78308AAC1CE803625FAFB4A7AFA722C77CA4\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF2e593.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	58117
Entropy (8bit):	6.1058245319628615
Encrypted:	false
SSDEEP:	1536:k/Ps+wsI7yO/3i+EeTTvqrvbtoYKBuSZ+aoo:k/0+zI7yOq+EGTivXKBuWNP
MD5:	A15AFAFE37B48F6BF28CB6305E339894
SHA1:	12CB1308B5A115D65E76225209AFAC83025A6E7D
SHA-256:	9DF0276F2720BCC9BBB7C9107DF139A46F8A45EF67146E3E0FB8984CA6266547
SHA-512:	99071C2B70BD0C9258DCE83FD35EFEC63C0F6F11830D436F6BC1580B69964D93C31EEA2094A296775F6C84AF2142838C8D34E7408D968DD19E0829A9087DD611
Malicious:	false
Reputation:	unknown
Preview:	{"abusive_adblocker_etag":"\"8ABCE35666CBACA121128B98C75E78308AAC1CE803625FAFB4A7AFA722C77CA4\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF346af.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	58117
Entropy (8bit):	6.1058245319628615
Encrypted:	false
SSDEEP:	1536:k/Ps+wsI7yO/3i+EeTTvqrvbtoYKBuSZ+aoo:k/0+zI7yOq+EGTivXKBuWNP
MD5:	A15AFAFE37B48F6BF28CB6305E339894
SHA1:	12CB1308B5A115D65E76225209AFAC83025A6E7D
SHA-256:	9DF0276F2720BCC9BBB7C9107DF139A46F8A45EF67146E3E0FB8984CA6266547
SHA-512:	99071C2B70BD0C9258DCE83FD35EFEC63C0F6F11830D436F6BC1580B69964D93C31EEA2094A296775F6C84AF2142838C8D34E7408D968DD19E0829A9087DD611
Malicious:	false
Reputation:	unknown
Preview:	{"abusive_adblocker_etag":"\"8ABCE35666CBACA121128B98C75E78308AAC1CE803625FAFB4A7AFA722C77CA4\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Nurturing\campaign_history

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 4, database pages 5, cookie 0x2, schema 4, UTF-8, version-valid-for 4
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.6076734404679848
Encrypted:	false
SSDEEP:	12:TLyeuAFUxOUDaabZXiDiIF8izX4fhhdWeci2oesJaYi3is9kDydUzcQAJmdLRlEk:TLyXOUOq0afDdWec9sJuk802D7J5fc
MD5:	F8EF21D26493A9CCDCC67C57903041B0
SHA1:	4698EBCEDA9BBDBCED60809F8DD4462909D80C21
SHA-256:	EEB4D9CE5D926F93404E8BE393D20EDAD935D2303DDC690885CAEC2DD78D2FF7
SHA-512:	B1EC66B2A2F86503FF3142F911D58B9AE925A61A52BDF3A63A18CA71112D6C5D0A040185E81B5805D2468F12547D6B8D687AAE6BBA0D236926C754DF0042B349
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\customSettings

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	47
Entropy (8bit):	4.3818353308528755
Encrypted:	false
SSDEEP:	3:2jRo6jhM6ceYcUtS2djIn:5I2uxUt5Mn
MD5:	48324111147DECC23AC222A361873FC5
SHA1:	0DF8B2267ABBDBD11C422D23338262E3131A4223
SHA-256:	D8D672F953E823063955BD9981532FC3453800C2E74C0CC3653D091088ABD3B3
SHA-512:	E3B5DB7BA5E4E3DE3741F53D91B6B61D6EB9ECC8F4C07B6AE1C2293517F331B716114BAB41D7935888A266F7EBDA6FABA90023EFFEC850A929986053853F1E02
Malicious:	false
Reputation:	unknown
Preview:	customSettings_F95BA787499AB4FA9EFFF472CE383A14

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\customSettings_F95BA787499AB4FA9EFFF472CE383A14

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	35
Entropy (8bit):	4.014438730983427
Encrypted:	false
SSDEEP:	3:YDMGA2ADH/AYKEqsYq:YQXT/bKE1F
MD5:	BB57A76019EADEDC27F04EB2FB1F1841
SHA1:	8B41A1B995D45B7A74A365B6B1F1F21F72F86760
SHA-256:	2BAE8302F9BD2D87AE26ACF692663DF1639B8E2068157451DA4773BD8BD30A2B
SHA-512:	A455D7F8E0BE9A27CFB7BE8FE0B0E722B35B4C8F206CAD99064473F15700023D5995CC2C4FAFDB8FBB50F0BAB3EC8B241E9A512C0766AAAE1A86C3472C589FFD
Malicious:	false
Reputation:	unknown
Preview:	{"forceServiceDetermination":false}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\topTraffic

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	50
Entropy (8bit):	3.9904355005135823
Encrypted:	false
SSDEEP:	3:0xXF/XctY5GUf+:0RFeUf+
MD5:	E144AFBFB9EE10479AE2A9437D3FC9CA
SHA1:	5AAAC173107C688C06944D746394C21535B0514B
SHA-256:	EB28E8ED7C014F211BD81308853F407DF86AEBB5F80F8E4640C608CD772544C2
SHA-512:	837D15B3477C95D2D71391D677463A497D8D9FFBD7EB42E412DA262C9B5C82F22CE4338A0BEAA22C81A06ECA2DF7A9A98B7D61ECACE5F087912FD9BA7914AF3F
Malicious:	false
Reputation:	unknown
Preview:	topTraffic_170540185939602997400506234197983529371

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\topTraffic_170540185939602997400506234197983529371

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	575056
Entropy (8bit):	7.999649474060713
Encrypted:	true
SSDEEP:	12288:fXdhUG0PlM/EXEBQlbk19RrH76Im4u8C1jJodha:Ji80e9Rb7Tm4u8CnR
MD5:	BE5D1A12C1644421F877787F8E76642D
SHA1:	06C46A95B4BD5E145E015FA7E358A2D1AC52C809
SHA-256:	C1CE928FBEF4EF5A4207ABAFD9AB6382CC29D11DDECC215314B0522749EF6A5A
SHA-512:	FD5B100E2F192164B77F4140ADF6DE0322F34D7B6F0CF14AED91BACAB18BB8F195F161F7CF8FB10651122A598CE474AC4DC39EDF47B6A85C90C854C2A3170960
Malicious:	false
Reputation:	unknown
Preview:	...._+jE.`..}....S..1....G}s..E....y".Wh.^.W.H...-...#.A...KR...9b........>k......bU.IVo...D......Y..[l.yx.......'c=..I0.....E.d...-...1 ....m../C...OQ.........qW..<:N.....38.u..X-..s....<..U.,Mi..._.......`.Y/.........^..,.E..........j@..G8..N.... ..Ea...4.+.79k.!T.-5W..!..@+..!.P..LDG.....V."....L.... .(#..$..&......C.....%A.T}....K_.S..'Q.".d....s....(j.D!......Ov..)d0)."(..%..-..G..L.}....i.....m9;.....t.w..0....f?..-..M.c.3.....N7K.T..D>.3.x...z..u$5!..4..T.....U.O^L{.5..=E..'..;.}(\|.6.:..f!.>...?M.8......P.D.J.I4.<....y.E....>....i%.6..Y.@..n.....M..r..C.f.;..<..0.H...F....h.......HB1]1....u..:...H..k....B.Q..J...@}j~.#...'Y.J~....I...ub.&..L[z..1.W/.Ck....M.......[.......N.F..z.{nZ~d.V.4.u.K.V.......X.<p..cz..>....X...W..da3(..g..Z$.L4.j=~.p.l.\.[e.&&.Y ...U)..._.^r0.,.{_......`S..[....(.\..p.bt.g..%.$+....f.....d....Im..f...W ......G..i_8a..ae..7....pS.....z-H..A.s.4.3..O.r.....u.S......a.}..v.-/..... ...a.x#./:...sS&U.().xL...pg

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Variations

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	86
Entropy (8bit):	4.3751917412896075
Encrypted:	false
SSDEEP:	3:YQ3JYq9xSs0dMEJAELJ2rjozQHn:YQ3Kq9X0dMgAEwjFn
MD5:	E9E365607374115B92E4ABE4B9628101
SHA1:	D5054EA9B22317DCA83801EB3586017BFCC0E2A8
SHA-256:	5CD2C4D9F13524923046198C92213691539407E04FA520CDAE9EADE1BAD3D91D
SHA-512:	A84D65ED53E43883E5ECB7848FBD48F5305A63E6975E6AF480CF85532879720061106BE54F2A5888EBC3569F7123081A0E6EB48CCB8D7DBA3E1DA1C8A3C50401
Malicious:	false
Reputation:	unknown
Preview:	{"user_experience_metrics.stability.exited_cleanly":false,"variations_crash_streak":3}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\bc77f66e-1350-4777-a31a-c767634be11d.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	48460
Entropy (8bit):	6.096605075931475
Encrypted:	false
SSDEEP:	768:tMxDX2IMP3QBKaQK7hfgMb2ITEeTT5oFAqMCoijMYxhJ1ofGJnNjex91Chon:tMlX1M3oKa/i+EeTTvqrvbJnNjex91a4
MD5:	7C4F9AC43FF539C0640BD9EFF5529669
SHA1:	F8EBB1E3EE58ACFDE13AF61B9BAA0C3FB2FDF8CA
SHA-256:	840E7EADB96FEC6CFBC10F0F9B5E99FD0AEECF34B4737BD51FFD7699CCA5A5E0
SHA-512:	491E28586F77EA047795788E917A8753808A8F4A8B42FAFEF0E1CCFE5B118DDE51458605A27634E8A489283366AC2B29EC14093D79A915D641AF7DCA145D7DD0
Malicious:	false
Reputation:	unknown
Preview:	{"abusive_adblocker_etag":"\"5E25271B8190D943537AD3FDB50874FC133E8B4A00380E2A6A888D63386F728B\"","browser":{"browser_build_version":"117.0.2045.47","browser_version_of_last_seen_whats_new":"117.0.2045.47","last_seen_whats_new_page_version":"117.0.2045.47"},"desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"desktop_session_duration_tracker":{"last_session_end_timestamp":"1727864195"},"domain_actions_config":"H4sIAAAAAAAAAL1dWZPktpH+KxP9ZDtU6GMujfykHY9txVpHyHIoYh2ODhBEkWiCAAdHVbEc/u+bCVb1dE8RqEqOdh806mbzw8VEXshM/PuKb27vha2luF9LHqKT96KVoru3G+mcquXVN/++4sOgleBBWeOvvvnn4YGs7wcLz8erb65+HMKPMVx9dVXbnisDT4wMa612TNj+6j9fUSA+xFpZPyH/9dVVQig59Wx4L5+Cwzjg799ubt/jJP48zeE9TuHwDjYBc/Ew+Ktvbv/z1ZWoe+rsjB4/7Abr5U+ajz9LXo9Px+21Mk1hoo/oX6HHjTLyKTjYyMJmCbLnO/hZMpjFAjSvxOIhbxgi5FK85m+ZCkuQu7UyKoxLO97yIFoYvbAluiw2oRoYgIQ2nG2AqJY2U+koRXQbbMm3fMsEX9JMK3GLbeAvNjhrlo5GOJiTA/oXLTdG6qXtmMBDiyS59PvY7eCklyb4QcfFi7tpdwu3VBt1XNor

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\c054c7f1-c047-4457-b7ca-5139e435e1d7.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	48507
Entropy (8bit):	6.096407416074203
Encrypted:	false
SSDEEP:	768:MMxDX2IMP3QBKSQK7hfgMb2ITEeTT5oFAqMCoijMYxhJ1ofGJnNjex91Chon:MMlX1M3oKS/i+EeTTvqrvbJnNjex91a4
MD5:	C2556BAD4DC36B4567B59FD5932FD75C
SHA1:	5B79D31B02953006F4DC3DF1C3FCC23B25A7A6F4
SHA-256:	2A148458903E3E1E4E0D11B259BA77219ECCE6C85187AA5DE14984BA214DE6CE
SHA-512:	4DEAE35843C58A7E71D934F9AA54B340D09CAB1ACB33B2EE7272DA3F36BE89FB5636F0828DD440EBB84D28B3B4235D3DEAE717AE6AB1D003D424EE3DC24BA42C
Malicious:	false
Reputation:	unknown
Preview:	{"abusive_adblocker_etag":"\"5E25271B8190D943537AD3FDB50874FC133E8B4A00380E2A6A888D63386F728B\"","browser":{"browser_build_version":"117.0.2045.47","browser_version_of_last_seen_whats_new":"117.0.2045.47","last_seen_whats_new_page_version":"117.0.2045.47"},"desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"desktop_session_duration_tracker":{"last_session_end_timestamp":"1727864219"},"domain_actions_config":"H4sIAAAAAAAAAL1dWZPktpH+KxP9ZDtU6GMujfykHY9txVpHyHIoYh2ODhBEkWiCAAdHVbEc/u+bCVb1dE8RqEqOdh806mbzw8VEXshM/PuKb27vha2luF9LHqKT96KVoru3G+mcquXVN/++4sOgleBBWeOvvvnn4YGs7wcLz8erb65+HMKPMVx9dVXbnisDT4wMa612TNj+6j9fUSA+xFpZPyH/9dVVQig59Wx4L5+Cwzjg799ubt/jJP48zeE9TuHwDjYBc/Ew+Ktvbv/z1ZWoe+rsjB4/7Abr5U+ajz9LXo9Px+21Mk1hoo/oX6HHjTLyKTjYyMJmCbLnO/hZMpjFAjSvxOIhbxgi5FK85m+ZCkuQu7UyKoxLO97yIFoYvbAluiw2oRoYgIQ2nG2AqJY2U+koRXQbbMm3fMsEX9JMK3GLbeAvNjhrlo5GOJiTA/oXLTdG6qXtmMBDiyS59PvY7eCklyb4QcfFi7tpdwu3VBt1XNor

C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Recovery\Active\RecoveryStore.{60923290-80A7-11EF-8C2E-ECF4BBFF258A}.dat

Download File

Process:	C:\Program Files\Internet Explorer\iexplore.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	5120
Entropy (8bit):	1.9134649084046522
Encrypted:	false
SSDEEP:	24:rGG//+lhhwgGW/+lhhwElhhwqMJdlhhwk9lW84:rGG/ShhRGWShhrhhpihhQ8
MD5:	3D2A2574998AFDA709DC572346E3E1C7
SHA1:	B1D076EF08C524AD19696088E275B0B61DD9F560
SHA-256:	A8369EC4E9A7B6403C6DA30D90CB573E79BEFC6073CA61F792068D7A6E44FFE5
SHA-512:	21EA514F658FEECC61770E03F54C6C7022CB85D143D22CA951A9871FB5F126250927E0C5C396854FB20553D76372B3DF561491952A24BF2FF32A7C0BA7CDB1B3
Malicious:	false
Reputation:	unknown
Preview:	......................>.......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................R.o.o.t. .E.n.t.r.y...........................................................................................w(..................K.j.j.a.q.f.a.j.N.2.c.0.u.z.g.v.1.l.4.q.y.5.n.f.W.e...........8...............................................................F.r.a.m.e.L.i.s.t...............................................................................................................O._.T.S.k.T.K.S.Y.K.e.A.7.x.G.M.L.u.z.0.u.#.8.l.i.g.=.=.........:.......................................

C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Recovery\Active\{60923292-80A7-11EF-8C2E-ECF4BBFF258A}.dat

Download File

Process:	C:\Program Files\Internet Explorer\iexplore.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	4096
Entropy (8bit):	2.179780243777897
Encrypted:	false
SSDEEP:	48:rsGQtG88NplqbDAMc05O168NplqbDAMc05:g98NGHAF0EE8NGHAF0
MD5:	A34D522CD3037D4DE4AFDF3D5365CB28
SHA1:	2E142F28A3AE4FED39581E405E3F591D97CC0795
SHA-256:	5313440281CF6FDBBE4B5E421353CBD62546063C35F63B577ED37C19F38E9FFD
SHA-512:	B61F3D2D865894AFD7C2B07394A8D8B0C007D03D17C6EF75F42D92C5493B7C9829E64C45CEC5717A68692E03F989CBF57559BF109D134C06FA52D78BFEC19F46
Malicious:	false
Reputation:	unknown
Preview:	......................>.......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................R.o.o.t. .E.n.t.r.y...........................................................................................u(..................K.j.j.a.q.f.a.j.N.2.c.0.u.z.g.v.1.l.4.q.y.5.n.f.W.e...........8...............................................................T.r.a.v.e.l.L.o.g.......................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Recovery\Last Active\RecoveryStore.{60923293-80A7-11EF-8C2E-ECF4BBFF258A}.dat

Download File

Process:	C:\Program Files\Internet Explorer\iexplore.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	4608
Entropy (8bit):	1.711996831899571
Encrypted:	false
SSDEEP:	12:rlfFhrEgm8Gj76FOEDrEgmf+IaCyoqw9lTq0tn7HC9lTq0tn7:rVG8GQGv/99lW8n7HC9lW8n7
MD5:	44148A1D94A333ADDFE0EA05ABA928CE
SHA1:	13AE04C4EAF533B29E3F521111810782228976DA
SHA-256:	0F529EC044A1E75CB30B1D0144127089F5AB6736D87D8097BC9B7DA75E029577
SHA-512:	6BEFF8BC65100A3EDCE213AFC137547B243D4E833BC4269B527A6C661FF07062C514DA95D4BBB35D0DCD64A745AB0B3649CBE1F0893023157698461F0A95AE76
Malicious:	false
Reputation:	unknown
Preview:	......................>.......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................R.o.o.t. .E.n.t.r.y...........................................................................................n(..................K.j.j.a.q.f.a.j.N.2.c.0.u.z.g.v.1.l.4.q.y.5.n.f.W.e...........8.......................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Tiles\pin-17529550060\msapplication.xml

Download File

Process:	C:\Program Files\Internet Explorer\iexplore.exe
File Type:	XML 1.0 document, ASCII text, with very long lines (312), with CRLF line terminators
Category:	dropped
Size (bytes):	354
Entropy (8bit):	5.065187052806696
Encrypted:	false
SSDEEP:	6:TMVBdc9EMdLD5Ltqc41Es2bd+ox4A2bd+oxaTD90/QL3WIZK0QhPP55VDHkEtMjv:TMHdNMNxOEaoi+o4nWimI00OR5VbkEty
MD5:	A34D33EBE6D003B260DDDB8842D1EF4A
SHA1:	E15A05D66D30C0672F096F43E1621F6275AD9927
SHA-256:	483BB5FE54F540AB48AF947F6250690E7271B474C3ECD17F88A0F32F2998122C
SHA-512:	ACE2BBFBF580ED494CF1203D43627ECBC2BE0EE9BA58F365AE0943944E5369584349DF327D92AF70B138654B3621F96E60313A62CAF81508BC5A600D4E555777
Malicious:	false
Reputation:	unknown
Preview:	<?xml version="1.0" encoding="utf-8"?>..<browserconfig><msapplication><config><site src="http://www.twitter.com/"/><date>0x3a43a10d,0x01db14b4</date><accdate>0x3a43a10d,0x01db14b4</accdate></config><tile><wide310x150logo/><square310x310logo/><square70x70logo/><favorite src="C:\Users\user\Favorites\Twitter.url"/></tile></msapplication></browserconfig>..

C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Tiles\pin-18270793970\msapplication.xml

Download File

Process:	C:\Program Files\Internet Explorer\iexplore.exe
File Type:	XML 1.0 document, ASCII text, with very long lines (310), with CRLF line terminators
Category:	dropped
Size (bytes):	352
Entropy (8bit):	5.132586257920859
Encrypted:	false
SSDEEP:	6:TMVBdc9EMdLD5Ltqc4fLGTksycEox4AycEoxaTD90/QL3WIZK0QhPP55kI5kU5Es:TMHdNMNxe2kQiU4nWimI00OR5kak6Ety
MD5:	88B780906CA9C40738316ED47D05792C
SHA1:	2B7F7A41B19410FEE5A296D641F8F803B3CD5E6C
SHA-256:	B7792BBACCB7ABD53C434EF7DCF1E1C26608EA22B2BD7F68A4A06413C773DE62
SHA-512:	26B4FE76DBA3D6F9FC92B2860B51740644094843D1AF0A39F1224070061228AA227E8D5B8D2E6E0CA536B03D133B3C365276B3B3481EFA6141B8A5AEFAB4A995
Malicious:	false
Reputation:	unknown
Preview:	<?xml version="1.0" encoding="utf-8"?>..<browserconfig><msapplication><config><site src="http://www.amazon.com/"/><date>0x3a39dd39,0x01db14b4</date><accdate>0x3a39dd39,0x01db14b4</accdate></config><tile><wide310x150logo/><square310x310logo/><square70x70logo/><favorite src="C:\Users\user\Favorites\Amazon.url"/></tile></msapplication></browserconfig>..

C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Tiles\pin-21706820\msapplication.xml

Download File

Process:	C:\Program Files\Internet Explorer\iexplore.exe
File Type:	XML 1.0 document, ASCII text, with very long lines (316), with CRLF line terminators
Category:	dropped
Size (bytes):	358
Entropy (8bit):	5.133741783587324
Encrypted:	false
SSDEEP:	6:TMVBdc9EMdLD5Ltqc4GLs1+BgBox4A1+BgBoxaTD90/QL3WIZK0QhPP55yhBcEEs:TMHdNMNxvLm+BEoiq+BEo4nWimI00OR2
MD5:	DFCEBBD4A7461D3BD714C0CC0C3C9056
SHA1:	F7ABDE0F962A0789347EA780CC4F62686FE6DB3B
SHA-256:	688F6BCADA37D6C972E5D958FF1F91BC0BC30B2E5745401D91C9E8E3AE5C0FB6
SHA-512:	5F5C44FFB87D58C25A7B5442C65FF5B5F241FC189453298FF451E7AA63794C60D7EA9263DEF9CD52D8B16B06E184C97720D57D3C3DACE2FB92817F43AAF26554
Malicious:	false
Reputation:	unknown
Preview:	<?xml version="1.0" encoding="utf-8"?>..<browserconfig><msapplication><config><site src="http://www.wikipedia.com/"/><date>0x3a46124d,0x01db14b4</date><accdate>0x3a46124d,0x01db14b4</accdate></config><tile><wide310x150logo/><square310x310logo/><square70x70logo/><favorite src="C:\Users\user\Favorites\Wikipedia.url"/></tile></msapplication></browserconfig>..

C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Tiles\pin-314712940\msapplication.xml

Download File

Process:	C:\Program Files\Internet Explorer\iexplore.exe
File Type:	XML 1.0 document, ASCII text, with very long lines (333), with CRLF line terminators
Category:	dropped
Size (bytes):	375
Entropy (8bit):	5.177138176274192
Encrypted:	false
SSDEEP:	6:TMVBdc9EMdLD5Ltq08eDPOOKaihM5ycEox4AB2ixaTD90/QL3WIZK0QhPP55cE5t:TMHdNMNxtDPOOKavig4nWimI00OR5cE/
MD5:	D776A5294BF987905E5C09FBD8D35144
SHA1:	493A7D1154E375C5960C69017C9C43265B6BC96E
SHA-256:	A65719F2E7765007BF5F79647907B8593BFBCB64BE93B8123AA238FC9710A238
SHA-512:	E408B63189E7F6416EA5A0F46F30A3A9687051049BCCFE06F95D5B35CFF8EF8C075C6A97646CDBE1526C52B3018F7F5E5705294C8C3F98971345877D8E0AD840
Malicious:	false
Reputation:	unknown
Preview:	<?xml version="1.0" encoding="utf-8"?>..<browserconfig><msapplication><config><site src="http://go.microsoft.com/fwlink/p/?LinkId=255142"/><date>0x3a39dd39,0x01db14b4</date><accdate>0x3a3c4ecb,0x01db14b4</accdate></config><tile><wide310x150logo/><square310x310logo/><square70x70logo/><favorite src="C:\Users\user\Favorites\Bing.url"/></tile></msapplication></browserconfig>..

C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Tiles\pin-4759708130\msapplication.xml

Download File

Process:	C:\Program Files\Internet Explorer\iexplore.exe
File Type:	XML 1.0 document, ASCII text, with very long lines (306), with CRLF line terminators
Category:	dropped
Size (bytes):	348
Entropy (8bit):	5.062632302076915
Encrypted:	false
SSDEEP:	6:TMVBdc9EMdLD5Ltqc4JsHyJ/x4AHyJ/xaTD90/QL3WIZK0QhPP55gE5EtMjwu:TMHdNMNxiwyJ/isyJ/4nWimI00OR5d5t
MD5:	8D25A3DADCEF495437F6517A36C55B65
SHA1:	663A86712FCEC367AECB2A6BC0BA23AC7507237C
SHA-256:	86685E84A1A4F504E05715C8024649C6C09973E5EE784D836488495779D0974E
SHA-512:	F0B3AA14DACD60AAEC643F80494F460963898706177DAB9629CC6A090DF41EBEACFF0542F3EEF4FB21D63979E0FA551759EA5D86E65DAE51120BEC58ADEDF377
Malicious:	false
Reputation:	unknown
Preview:	<?xml version="1.0" encoding="utf-8"?>..<browserconfig><msapplication><config><site src="http://www.live.com/"/><date>0x3a3ebeaa,0x01db14b4</date><accdate>0x3a3ebeaa,0x01db14b4</accdate></config><tile><wide310x150logo/><square310x310logo/><square70x70logo/><favorite src="C:\Users\user\Favorites\Live.url"/></tile></msapplication></browserconfig>..

C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Tiles\pin-6757900\msapplication.xml

Download File

Process:	C:\Program Files\Internet Explorer\iexplore.exe
File Type:	XML 1.0 document, ASCII text, with very long lines (312), with CRLF line terminators
Category:	dropped
Size (bytes):	354
Entropy (8bit):	5.144783077444344
Encrypted:	false
SSDEEP:	6:TMVBdc9EMdLD5Ltqc4UxGws1+BgBox4A1+BgBoxaTD90/QL3WIZK0QhPP558K0QU:TMHdNMNxhGwm+BEoiq+BEo4nWimI00OG
MD5:	02594DCC97BD9E9E4C2D5C92A2E5F50E
SHA1:	A327C9DFBEFA73BA20B5A417F5E1E6F11CE45115
SHA-256:	61A4ED5AF49A3D02C58AFE913C00ACC06CFD0BC7E32AEA5011AB5BBDAAF8FC39
SHA-512:	B32A1EDEBE57E6507C6F5E7F0FB59656D2D27991557F0D2C294C939329A7D8F9D6C9E05143E040F2073606478049E719FABE04F49E29345884B26B8651A519E5
Malicious:	false
Reputation:	unknown
Preview:	<?xml version="1.0" encoding="utf-8"?>..<browserconfig><msapplication><config><site src="http://www.youtube.com/"/><date>0x3a46124d,0x01db14b4</date><accdate>0x3a46124d,0x01db14b4</accdate></config><tile><wide310x150logo/><square310x310logo/><square70x70logo/><favorite src="C:\Users\user\Favorites\Youtube.url"/></tile></msapplication></browserconfig>..

C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Tiles\pin-8760897390\msapplication.xml

Download File

Process:	C:\Program Files\Internet Explorer\iexplore.exe
File Type:	XML 1.0 document, ASCII text, with very long lines (310), with CRLF line terminators
Category:	dropped
Size (bytes):	352
Entropy (8bit):	5.077084988004474
Encrypted:	false
SSDEEP:	6:TMVBdc9EMdLD5Ltqc4QunsPbEix4A2bd+oxaTD90/QL3WIZK0QhPP55AkEtMjwu:TMHdNMNx0nc5i+o4nWimI00OR5xEtMb
MD5:	5E3A7BC50006D4BD7FFA022AAA56A074
SHA1:	8FD36B40098EACF2885B535E81A0E1E3E43DE949
SHA-256:	ACDB1AFFB182F14182CDE651DB6532F68181DBF7317FBF5BEA3FBB51AC1D0990
SHA-512:	EB98064BDD484A27E7FB58631BB6FF5C53097C756D31CDA820F20021208666C583216B7F150D410E7D38A26F9F8F4A7675536EBB64BFC1682150952FBE720DDF
Malicious:	false
Reputation:	unknown
Preview:	<?xml version="1.0" encoding="utf-8"?>..<browserconfig><msapplication><config><site src="http://www.reddit.com/"/><date>0x3a413008,0x01db14b4</date><accdate>0x3a43a10d,0x01db14b4</accdate></config><tile><wide310x150logo/><square310x310logo/><square70x70logo/><favorite src="C:\Users\user\Favorites\Reddit.url"/></tile></msapplication></browserconfig>..

C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Tiles\pin20259167780\msapplication.xml

Download File

Process:	C:\Program Files\Internet Explorer\iexplore.exe
File Type:	XML 1.0 document, ASCII text, with very long lines (312), with CRLF line terminators
Category:	dropped
Size (bytes):	354
Entropy (8bit):	5.130730545491747
Encrypted:	false
SSDEEP:	6:TMVBdc9EMdLD5Ltqc4oTsPbEix4APbEixaTD90/QL3WIZK0QhPP556Kq5EtMjwu:TMHdNMNxxc5iA54nWimI00OR56Kq5Ety
MD5:	CC571069BAD8DB92D67955D13246F46B
SHA1:	756439AC0D5335FAAB5D439669A68D543A8777A9
SHA-256:	E1B0111A686C9C17DA49898D25F7D9B031D1143DC79D4FDAF551FFBB8D754E7D
SHA-512:	148537D783BD4CBFE217C415A282E6188A87A13CAEEDC9A4BB2E6DFDB6F5BFF2AB09BCA1D4781A2A52ABBE866AC95839B3BC4443D7E62B1933BC7CEBB3E4A802
Malicious:	false
Reputation:	unknown
Preview:	<?xml version="1.0" encoding="utf-8"?>..<browserconfig><msapplication><config><site src="http://www.nytimes.com/"/><date>0x3a413008,0x01db14b4</date><accdate>0x3a413008,0x01db14b4</accdate></config><tile><wide310x150logo/><square310x310logo/><square70x70logo/><favorite src="C:\Users\user\Favorites\NYTimes.url"/></tile></msapplication></browserconfig>..

C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Tiles\pin20332743330\msapplication.xml

Download File

Process:	C:\Program Files\Internet Explorer\iexplore.exe
File Type:	XML 1.0 document, ASCII text, with very long lines (314), with CRLF line terminators
Category:	dropped
Size (bytes):	356
Entropy (8bit):	5.0714036739509165
Encrypted:	false
SSDEEP:	6:TMVBdc9EMdLD5Ltqc4YX2nsB2ix4AB2ixaTD90/QL3WIZK0QhPP5502CqEtMjwu:TMHdNMNxc8ig4nWimI00OR5VEtMb
MD5:	8436EA169678955DAF255A9CC89C4C08
SHA1:	09DB12BD5EC7DD8529E61B37FB6AC07EABE7F46F
SHA-256:	6ACA4A1C481D279988110514450360D15F0258461F2FF8BB1BC7A30E6036F391
SHA-512:	54076232CF4961AE702D56A2D3CA4EC541818DE0A905839CD69D64D7EEC3C54783994FBD027607F7462D419AB0685410F75BF155DB219A6F00A73EFD64B38BCB
Malicious:	false
Reputation:	unknown
Preview:	<?xml version="1.0" encoding="utf-8"?>..<browserconfig><msapplication><config><site src="http://www.facebook.com/"/><date>0x3a3c4ecb,0x01db14b4</date><accdate>0x3a3c4ecb,0x01db14b4</accdate></config><tile><wide310x150logo/><square310x310logo/><square70x70logo/><favorite src="C:\Users\user\Favorites\Facebook.url"/></tile></msapplication></browserconfig>..

C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Tiles\pin8215062560\msapplication.xml

Download File

Process:	C:\Program Files\Internet Explorer\iexplore.exe
File Type:	XML 1.0 document, ASCII text, with very long lines (310), with CRLF line terminators
Category:	dropped
Size (bytes):	352
Entropy (8bit):	5.048577527021724
Encrypted:	false
SSDEEP:	6:TMVBdc9EMdLD5Ltqc4InsHyJ/x4AHyJ/xaTD90/QL3WIZK0QhPP55iwE5EtMjwu:TMHdNMNxfnwyJ/isyJ/4nWimI00OR5e/
MD5:	7B49B677A3D4C0A7D980671C87E0AD89
SHA1:	E3EF1D8E452B415616C3D65A566255F4C9A7085E
SHA-256:	7D5322623F563BF5CCBE83821C78D83F1D6B4E3C9B9A9E9C0D8809BB4946BFF1
SHA-512:	53F396FCCDD1ADA64AEA918C13D99CF4E9C25E878602BE70FCBFED3B22BE35D8F88EAA1CED55FDA1327733E2A82B0771824BB6C19681CA416927AFE6AFCF6011
Malicious:	false
Reputation:	unknown
Preview:	<?xml version="1.0" encoding="utf-8"?>..<browserconfig><msapplication><config><site src="http://www.google.com/"/><date>0x3a3ebeaa,0x01db14b4</date><accdate>0x3a3ebeaa,0x01db14b4</accdate></config><tile><wide310x150logo/><square310x310logo/><square70x70logo/><favorite src="C:\Users\user\Favorites\Google.url"/></tile></msapplication></browserconfig>..

C:\Users\user\AppData\Local\Microsoft\Internet Explorer\imagestore\zzotjdg\imagestore.dat

Download File

Process:	C:\Program Files\Internet Explorer\iexplore.exe
File Type:	data
Category:	dropped
Size (bytes):	5672
Entropy (8bit):	3.7518195201746924
Encrypted:	false
SSDEEP:	48:VqbDaO7IJct3xIKIqbDaYxG/7nvWDtZcdYLtX7B6QXL3aqG8Cw:EHvIJct+KbHP47v+rcqlBPG9Bw
MD5:	C69A13EDC6DDE6D1D58B2D949E84A11E
SHA1:	B4E1A02C403031DBC2C264F30AAA700FB8D1FD9F
SHA-256:	3845531CA26D80F4F0C9ECDD2B57C0E0B16F2177E728322A8C11FCA59A3C130B
SHA-512:	8A01A5E93162E6CE516380452A322C966707C8A2C343892F076472458609D5E21AF47890CEA50F577CC164EF12C6D75689EC283AF0C9FC2FB51CBB7370A908C7
Malicious:	false
Reputation:	unknown
Preview:	........&.h.t.t.p.s.:././.s.u.p.p.o.r.t...g.o.o.g.l.e...c.o.m./.f.a.v.i.c.o.n...i.c.o.~............... .h.......(....... ..... ............................................0...................................................................................................................................v.].X.:.X.:.r.Y........................................q.X.S.4.S.4.S.4.S.4.S.4.S.4...X....................0........q.W.S.4.X.:.................J...A...g.........................K.H.V.8..........................F..B.....................,.......................................B..............................................B..B..B..B..B...u..........................................B..B..B..B..B...{.................5.......k...........................................................7R..8F.................................................2........Vb..5C..;I..................R^.....................0................Xc..5C..5C..5C..5C..5C..5C..lv..................................

C:\Users\user\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	2278
Entropy (8bit):	3.846040553863714
Encrypted:	false
SSDEEP:	48:uiTrlKxrgxfxl9Il8ug5AMKyY05AVEBFP3W3mghMd1rc:mGYwAMKX05tlm3mI
MD5:	2C3643A8D13964455F8ABD1ACDD9E050
SHA1:	38244149D0ADE58E56C96076D695E431717A14F8
SHA-256:	19244FD7FC4835948AEF1FABE7BE99A5E8DFD17D51E6E2623C26028A1AC391D0
SHA-512:	F79CA1FB9E49EFDC8AD80D3FE134DF3453A36A493ECC98280A7251327C579EFE902B180A03A1A479F7E94360E50752B6E1F4A44F0660F667D85B08A0F7F0BA2A
Malicious:	false
Reputation:	unknown
Preview:	{.".T.B.D.a.t.a.S.t.o.r.e.O.b.j.e.c.t.".:.{.".H.e.a.d.e.r.".:.{.".O.b.j.e.c.t.T.y.p.e.".:.".T.o.k.e.n.R.e.s.p.o.n.s.e.".,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.a.j.o.r.".:.2.,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.i.n.o.r.".:.1.}.,.".O.b.j.e.c.t.D.a.t.a.".:.{.".S.y.s.t.e.m.D.e.f.i.n.e.d.P.r.o.p.e.r.t.i.e.s.".:.{.".R.e.q.u.e.s.t.I.n.d.e.x.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".W.i.p.w.W.M.+.N.H.l.b.C.D.m.s.Z.p.8.S.O.s.j.h.t.F.B.s.=.".}.,.".E.x.p.i.r.a.t.i.o.n.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".g.L.f.f.h.b.w.U.2.w.E.=.".}.,.".S.t.a.t.u.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".A.A.A.A.A.A.=.=.".}.,.".R.e.s.p.o.n.s.e.B.y.t.e.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.t.r.u.e.,.".V.a.l.u.e.".:.".A.Q.A.A.A.N.C.M.n.d.8.B.F.d.E.R.j.H.o.A.w.E./.C.l.+.s.B.A.A.A.A.+.v.S.m.M.L.

C:\Users\user\AppData\Local\Microsoft\TokenBroker\Cache\cf7513a936f7effbb38627e56f8d1fce10eb12cc.tbres

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4622
Entropy (8bit):	3.99989302826472
Encrypted:	false
SSDEEP:	96:gYwy0X8J8aNV1TwdlxcqEGoE8QTCMgA11qu:gVtXe9FcaqMWCMgA11qu
MD5:	0819243E46FF82271182B171CCFEC517
SHA1:	0BB477B9CAD2802772047976609228576B717209
SHA-256:	3327DFF5DA32F95EABE878B94FB119DC150A84F8BDAA67171693A249F6ECEB9A
SHA-512:	FA7E327CA3A11CFA8C9F5BC678910D53708B08116C2321106BE332EFC0DCCE3E64D74898C92D3A7B7A0352B640ED7ABA62962E05BA8AC528048BA465417F6EB1
Malicious:	false
Reputation:	unknown
Preview:	{.".T.B.D.a.t.a.S.t.o.r.e.O.b.j.e.c.t.".:.{.".H.e.a.d.e.r.".:.{.".O.b.j.e.c.t.T.y.p.e.".:.".T.o.k.e.n.R.e.s.p.o.n.s.e.".,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.a.j.o.r.".:.2.,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.i.n.o.r.".:.1.}.,.".O.b.j.e.c.t.D.a.t.a.".:.{.".S.y.s.t.e.m.D.e.f.i.n.e.d.P.r.o.p.e.r.t.i.e.s.".:.{.".R.e.q.u.e.s.t.I.n.d.e.x.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".z.3.U.T.q.T.b.3.7./.u.z.h.i.f.l.b.4.0.f.z.h.D.r.E.s.w.=.".}.,.".E.x.p.i.r.a.t.i.o.n.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".h.5.8.W.b.L.Q.U.2.w.E.=.".}.,.".S.t.a.t.u.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".A.w.A.A.A.A.=.=.".}.,.".R.e.s.p.o.n.s.e.B.y.t.e.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.t.r.u.e.,.".V.a.l.u.e.".:.".A.Q.A.A.A.N.C.M.n.d.8.B.F.d.E.R.j.H.o.A.w.E./.C.l.+.s.B.A.A.A.A.+.v.S.m.M.L.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\33CUD2J1\cz.seznam.software.libszndesktop-2.1.35-win32[1].zip

Download File

Process:	C:\Users\user\AppData\Roaming\Seznam.cz\sznsetup.exe
File Type:	Zip archive data, at least v2.0 to extract, compression method=deflate
Category:	dropped
Size (bytes):	996238
Entropy (8bit):	7.998295729974593
Encrypted:	true
SSDEEP:	24576:vw33nCkMunMthnhyZjCPm/QJQVak/ziz/ZyRHy1dcG:vw3Xku8cQyVeNyRdG
MD5:	828A732ACF768CEC7F1E965C9A359F9F
SHA1:	8CF44AC1EC915D0073C43FB43171968E0083819B
SHA-256:	B04071A50F342F937C66253BC28A4BA119C75B59CF56851E4265571299023EAB
SHA-512:	639FD4A595AD2ABC428C4D0876217DEB2EA9AE599CF1B73E2D3CC5A514209F124C27AB1ED8AD0EC359A6F0839556CB357F43563B7668F70A3B08C92DEC0B3258
Malicious:	true
Reputation:	unknown
Preview:	PK........\..Mc...............control.inimP.N.0......V..b......N ..sI.8.e;...'L..\|...ph..u.{w.tw.=:.-..D.t(......`....L."....F..>(kD.8[o.2!...Y...f.N..QZS...(..o.i.....+..I..M.D:...Y......c...N4.BiR...<.g.....b..9..'!...K2=......7.......cM...;z.>.B..Q...,..`.....~...\|i..........N......,...8.^p...\|.PK........"..J}.GH...N.......install.batu.QO.0...I..7K..1"...a..qC.iB..i.hk[@x........~7...&Q...x..E....La..`_...?...a&E^.A/...5.+R8^9?..Q.v]<...r_mz..X.n......^........z....q.k..ns...a.'..y..vT].[....B.4lN...(+..!XY0a....Y..q..N\,.ey..?...t...!B..\.......8I..../J.X.....w.......n.S....f..gZ...3.T.../.f.>1m..x.0..%N.V.E\..:+.p.J..[.c.1..%..qs.....r.....PK.........z&F...jX...Z.......reconfigure.bat-... .@.]..Dxk..8....A.../..B_..}{..Y[..3.V....N.U..75.W..n."g.I(....R.\.}.H..'...PK.........z&F........N.......szndesktop.confu..n.0.Dw....]..E......#.6...L.q.......d....c.qJ$..d:E.......#...P..K.......~W....U..3.E."*.~...Y..&...s..J.}.9..d.d...W.......(.~..

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\33CUD2J1\favicon[1].ico

Download File

Process:	C:\Program Files\Internet Explorer\iexplore.exe
File Type:	MS Windows icon resource - 1 icon, 32x32, 32 bits/pixel
Category:	dropped
Size (bytes):	4286
Entropy (8bit):	3.8046022951415335
Encrypted:	false
SSDEEP:	24:suZOWcCXPRS4QAUs/KBy3TYI42Apvl6wheXpktCH2Yn4KgISQggggFpz1k9PAYHu:HBRh+sCBykteatiBn4KWi1+Ne
MD5:	DA597791BE3B6E732F0BC8B20E38EE62
SHA1:	1125C45D285C360542027D7554A5C442288974DE
SHA-256:	5B2C34B3C4E8DD898B664DBA6C3786E2FF9869EFF55D673AA48361F11325ED07
SHA-512:	D8DC8358727590A1ED74DC70356AEDC0499552C2DC0CD4F7A01853DD85CEB3AEAD5FBDC7C75D7DA36DB6AF2448CE5ABDFF64CEBDCA3533ECAD953C061A9B338E
Malicious:	false
Reputation:	unknown
Preview:	...... .... .........(... ...@..... ...................................................................................................................................................................................................N...Sz..R...R...P...N..L..H..DG..........................................................................................R6..U...U...S...R...P...N..L..I..F..B...7...............................................................................S6..V...V...U...S...R...P...N..L..I..F..C...?..:z......................................................................O...W...V...V...U...S...R...P...N..L..I..E..C...?...;..{7..q2$..............................................................T..D..]...S)..p6..J...R...P...N..L..I..E..B..>..;..z7..p2..f,X.........................................................A..O#..N!..N!..N!..P$..q:...P...N..K..I..E..A..=..9..x5..n0..e,...5...................................................Ea.Z,..T$..T$..T

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\33CUD2J1\packages[1].inf

Download File

Process:	C:\Users\user\AppData\Roaming\Seznam.cz\sznsetup-lt.exe
File Type:	Unicode text, UTF-8 text, with very long lines (16520), with no line terminators
Category:	dropped
Size (bytes):	16698
Entropy (8bit):	5.151173870803497
Encrypted:	false
SSDEEP:	384:y6TZfdE2vwcyX8cqXxPnSfTtsoC6soJsEzaGy4wegmenmOyEaDVzbt6mAHmRuahA:y6VFEaZyMTVoBsWs+siV7fnemZrhXUGG
MD5:	A9A99AF9F63F4DD30004A48A42511777
SHA1:	52426A898ED3F97BB81DCFEB942A260B8DDBC8EC
SHA-256:	B2D1EA236251E73CDC15417BC93947790B7B45A46542568BF2568D361BD847EB
SHA-512:	E3082F6A5B0A489B2E16CABED540D03EDCD5EA6EC4255B288F636816490F58E9C25BABB5AC5DC709DFDE0CE743E1BA17E0083DF0DC44421E4AFF1BB38FF9733F
Malicious:	false
Reputation:	unknown
Preview:	"packages"={[ "com.microsoft.msdn.msvcr100" "10.0.40219.325" "instver"={ ""} "depends"={[ "szn-software-base"]} "conflicts"={[]} "replaces"={[]} "implements"={[]} "triggers"={[]} "install"={ "install.bat"} "uninstall"={ "uninstall.bat"} "postInstall"={ ""} "preUninstall"={ ""} "reconfigure"={ ""} "appname"={ "Microsoft Visual C++ Runtime\|Sd.len. knihovny od firmy Microsoft ur.en. pro b.h program. napsan. v jazyce C++"} "md5"={ "cf3b1b6e8062e277c361f5eb155078b2"} "source"={ ""} "size"={529195} "islib"={true} "location"={ "com.microsoft.msdn.msvcr100-10.0.40219.325-win32.zip"} "downloads"={[]} "isgroup"={false} "updateMode"={0}, "com.microsoft.msdn.msvcr110" "11.0.51106.1" "instver"={ ""} "depends"={[ "szn-software-base"]} "conflicts"={[]} "replaces"={[]} "implements"={[]} "triggers"={[]} "install"={ "install.bat"} "uninstall"={ "uninstall.bat"} "postInstall"={ ""} "preUninstall"={ ""} "reconfigure"={ ""} "appname"={ "Microsoft Visual C++ Runtime\|Sd.len. knihovny od firmy Micro

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\90SNK17T\cz.seznam.software.ielisticka3-3.3.5-win32[1].zip

Download File

Process:	C:\Users\user\AppData\Roaming\Seznam.cz\sznsetup.exe
File Type:	Zip archive data, at least v2.0 to extract, compression method=deflate
Category:	dropped
Size (bytes):	724
Entropy (8bit):	6.399861427871824
Encrypted:	false
SSDEEP:	12:5jpmiIYlpYzh+R7/3crzbRGeXE+9Saq16Wjj9miKtSu5dMb3dp8Dt:9uy9R7/aNNXE+waqTP5CCYDt
MD5:	5ACBC4B353AD3034857F370BAA5290D0
SHA1:	B0B15D2F9F98EC1AF8A33869C2ED951B4F85C511
SHA-256:	9CCD54B1817D7C828EA26D70BD6C09026DAC5E32F2C5F884F14BBEC78ECB5C6C
SHA-512:	DF0F9196B95D01C861DF1FB9EB45D230989C5A6EF8B257D55FE285938DA99A484CFB83D16D58C0B56FF38B4BADFFF4118DC92166804AB23AD4A6C390C9B6BBD3
Malicious:	false
Reputation:	unknown
Preview:	PK........vpTL(..?....).......control.ini..ON. ...M..K].....6&.L........ax}.x....s...j.........7C..B.b..$......0...k.F.`....V.....Y^....L:..-#r.l>K.EB2oDl\..F.$....1\|:Y-"..v~.F_........:*.6:.`?~Q..o.\.:-...Ce...P....1zu.....(.e....uM......@.'..QP..]......@x.5:w...K.....S+h_Q...8.<........./....$_0..0..&. .......PK........GA.H...7............install.batrem IE listicka installs..PK........GA.H?GZ.............uninstall.batrem IE listicka uninstallsPK..........vpTL(..?....)............. .......control.iniPK..?.......GA.H...7..........$....... ...A...install.bat.. ................"%/yE..."%/yE..PK..?.......GA.H?GZ...........$....... .......uninstall.bat.. ................"%/yE..."%/yE..PK....................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\90SNK17T\cz.seznam.software.libfoxcub-3.3.8-win32[1].zip

Download File

Process:	C:\Users\user\AppData\Roaming\Seznam.cz\sznsetup.exe
File Type:	Zip archive data, at least v2.0 to extract, compression method=deflate
Category:	dropped
Size (bytes):	2230734
Entropy (8bit):	7.999280543532011
Encrypted:	true
SSDEEP:	49152:zOLLL3mbGTzuP6VCWLpQ3tjNsD4wZMe243iPsV:zOLLL5C6VHydjESoV
MD5:	9CFA7791E8C9F8F8BB6ACE25B444A0C4
SHA1:	BE28F3FA7D582B7CA0CD888C3D18B66D2A2DF18F
SHA-256:	47318D53DF4C940464555D11509D706F3816F4A32A3B6587E164B6C56A4DC9DA
SHA-512:	0B062FA6CB8BECBFCE80736EB917D4D6E4B2ECE5982480A3D919C521CB2EEAFC445E46A6441363EAA2B14D05CAF467674F59B416EA3F64343F8EEB354FD047D1
Malicious:	true
Reputation:	unknown
Preview:	PK.........pTL..-W............control.ini.Q1n.0.........e/Y<.h..C..l3..Y.D.i.~!.........4i...B..;.8>y.,U..Y.c.l.p.J 7.+.......j.F....J(a....1.W.ZE..{n_.....s..j.mYp.G.._+ic[.et^L....o~..33...Q..^7..q.).M.2.w...".Gl3Y.\Ld.2.9.^../.P.I...d.U.g......fa......Q...r.a..Q...}..a.\.Rd.....'.n.;(..b........ g.PK........GA.H..............foxcub.confm.1..0.....Kx..23r....Z%Jp..V..w'.P.6..~.^..".~...1.D`..i5@/.i......R..{9.Y.XS.8......u...-..`..M.]...sG....&......bf..\|h....PK.........vK................install.bat.Vko.H.......4R..Ix.n[.(..U...v#Y..g......@H...w..qX.$...&.{.s...!...pi.f.\|.x.z-Jn f..E.y..1X.{3.3n.\.?:..l.TJ!c..14....}..{....!@$."....u..U+-..yZ8c.No....,X...G....iZ..~<.g.t-4...x8.....9.g..5.'..IB.>?......._...J.aa..cdF./w2}...h.,...Z.Z.."..S.zO....O.8.z-./$.e.X..'...Y..r..bE.r..Z.Y.P...^....K..5.....a..-........@......Z.~..3..g.h}..8.......7K.n5....W.d)CB.b........q3.XlC...$.......>.................d<.~..8..H.%.:..8..*.m..\..R1....3.S!.S.k.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\90SNK17T\cz.seznam.software.sznsetup-1.2.7-win32[1].zip

Download File

Process:	C:\Users\user\AppData\Roaming\Seznam.cz\sznsetup-lt.exe
File Type:	Zip archive data, at least v2.0 to extract, compression method=deflate
Category:	dropped
Size (bytes):	1163119
Entropy (8bit):	7.997519895563342
Encrypted:	true
SSDEEP:	24576:zqTt+ainIUylo3PuIeJABWfas8Sj20EX/lF6vFDihiGQH:usaXnlXIIJ9S0GdF6R2iGS
MD5:	32A5827E232BD4ECDF03AA6E597B9A02
SHA1:	F6D51F9B8371BE92B025B6794CE76BAA0332CFBE
SHA-256:	AAE60F2257D7BB56FB270CC7E23BA88C3D6768D952CDF201C6AE6D8B7EFACB5E
SHA-512:	165C659311B1B9C13240D48873A2FC99CA983691058A640A242F34B7BE586889FEEECEB21B223F37B53EA5B60D50ED3965C600DF2B69049786334C4835839888
Malicious:	true
Reputation:	unknown
Preview:	PK......../v{L-...............control.ini=.=..0.F.H.CN..20.......-..m.(v.Tq....{.R`..>..S...+.."...e.g.... ...%G....r.[.V.X...7m..U._..u.;.&......\|.{_9I.........M...G...9......jo...@Hb...Y.7PK.........T-AbEm.5...Z.......install.bat.LSH..,.QPR.3.)..+N-)-.K.HUR@.)....bQ..._P..T......PK........av{L.G......'.....sznsetup.exe..`...0..I.P....j.U.2W-s....H).@.6m.T...uL.6.24...rg...N....>.jeE...+vZG.:..b+TE`....s.'I...>....E...q..{..{...*FEQL...)J."..)..7....3^.=.+....]Y..;...Xy.W~.{......W....+}..~...Y.R.w..7...........:w.{._.[..}D.}.9....}F..w......{.......o.{........a9....P.BC.....n.]..g.kHR._Z....z..dV...4[$4.>NQ...}......x]E....)!.......V.M.7.....L.\|X~.2....U......r..7o.?t........T.tu%..z."..}5.M..(.oZ.....P..~a.}......I....$.).^..b(..~.m..5.....{.+.Yy.~.....K....._j .()..vx........_....;.V.,y..]E.O.\|.d.....<..2.....n.n.T.......8..........65.<.=w........qJ...i...f.2.......m...m.ur.-.8.SL..Ar...?(Yf...e._s....f@...........Y..t..'..8?.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\90SNK17T\favicon[1].ico

Download File

Process:	C:\Program Files\Internet Explorer\iexplore.exe
File Type:	MS Windows icon resource - 2 icons, 16x16, 32 bits/pixel, 32x32, 32 bits/pixel
Category:	dropped
Size (bytes):	5430
Entropy (8bit):	3.6534652184263736
Encrypted:	false
SSDEEP:	48:wIJct3xIAxG/7nvWDtZcdYLtX7B6QXL3aqG8Q:wIJct+A47v+rcqlBPG9B
MD5:	F3418A443E7D841097C714D69EC4BCB8
SHA1:	49263695F6B0CDD72F45CF1B775E660FDC36C606
SHA-256:	6DA5620880159634213E197FAFCA1DDE0272153BE3E4590818533FAB8D040770
SHA-512:	82D017C4B7EC8E0C46E8B75DA0CA6A52FD8BCE7FCF4E556CBDF16B49FC81BE9953FE7E25A05F63ECD41C7272E8BB0A9FD9AEDF0AC06CB6032330B096B3702563
Malicious:	false
Reputation:	unknown
Preview:	............ .h...&... .... .........(....... ..... ............................................0...................................................................................................................................v.].X.:.X.:.r.Y........................................q.X.S.4.S.4.S.4.S.4.S.4.S.4...X....................0........q.W.S.4.X.:.................J...A...g.........................K.H.V.8..........................F..B.....................,.......................................B..............................................B..B..B..B..B...u..........................................B..B..B..B..B...{.................5.......k...........................................................7R..8F.................................................2........Vb..5C..;I..................R^.....................0................Xc..5C..5C..5C..5C..5C..5C..lv..........................................]i..<J..:G..Zf....................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\AN5UOLP8\cz.seznam.software.libfoxcub64-3.3.8-win32[1].zip

Download File

Process:	C:\Users\user\AppData\Roaming\Seznam.cz\sznsetup.exe
File Type:	Zip archive data, at least v2.0 to extract, compression method=deflate
Category:	dropped
Size (bytes):	1055819
Entropy (8bit):	7.9933051283388
Encrypted:	true
SSDEEP:	24576:Lk1RBMdouoAOPoghHeRElAaPWqWNRmHO2SLP1hGcvw:wO3OPhHU6Aau1EOxT3Gx
MD5:	4298F40FCE8EAED9C7CCE7A4F8614795
SHA1:	40ECB7EDDF1134FF20B7BED0B6CF3714D2E699F9
SHA-256:	455D76DCB35575EF84DBF88DF1F6AD512BAFC0FF3B7DCC8A5B18071018AAC75F
SHA-512:	8B00A83F52AB3CFF187AE229765F3BA192F90369F84A9A37E9FD388390CE447DA96C4125D3832245CED6783D4FFBECB0C1564E54D4604E1876DA85D17EFC9E7B
Malicious:	true
Reputation:	unknown
Preview:	PK.........pTL?S......s.......control.iniuP1N.1..-...C..rQ....M.b}.w.....9.....(y..0.$U....jfg..l..g)<l..N8f......s............B..A...C...-...?...H.....1[.....U2i....B..u5OGPaT.B......]..pW..E..e.R@.O....d...>...ZP..u....R.@\|xG.T....c}...p..y...1...\K..c..0....V..PK........IA.H.}.4............install.bat.....0...{..0.....EX..A0..V.(..K.L1....R=...VEPD....3.......V.t- z8a..S6...~.....x0..=..q?f=loQ.$3.6B.....O.u...[I..LT....X@..rx........1.#`.YCi..6...9{....Zc5mHC..R..q>.#6g#l.....*z.0.q[..,..\|N<.....=.......MCI.(..K......PK........!.TL.........0'.....libfoxcub-x64.dll..\|..0>......B...@. .....~.,.., .E$..X).d..xIN..a$.P..B{Z.^S/\.eC.$..@....j....R.X...<....f..=.....?........}....s...Y./..m.....?.....yu0.r...n.Ho.....rWi.[.n..k..+W..n..U.X.u.+o...OW.t..A....u\...........v;...>.~......_........\|.m.>.~.o.........8..3.?..=.d.u.?......./.......w.}...W...x..s.L..q.i.7.A...]VZ._.N.8...E~...4.....O.,.G.O.{v.?.{.~/.h.w16.s..t..\|....eb...a....

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\AN5UOLP8\cz.seznam.software.szndesktop-2.0.32-win32[1].zip

Download File

Process:	C:\Users\user\AppData\Roaming\Seznam.cz\sznsetup.exe
File Type:	Zip archive data, at least v2.0 to extract, compression method=deflate
Category:	dropped
Size (bytes):	48179
Entropy (8bit):	7.991462255997012
Encrypted:	true
SSDEEP:	768:3XsntXrjmalBk5UiGF0eaGTYqHTn4Xkl46m/OOcXKWm+GLfZXHJLmwv3PnPIg3DD:3XstXrV7ku2eah2746qfcaWSLF0Ef5S0
MD5:	7F307C0A37F68FF9852D5856CF3DA48F
SHA1:	FC3EDACE198C4D1079CED0988915A313D1ED7E14
SHA-256:	D324E8F736643C595A093D30EE55474437B5F8A3FFFBBF3FB55BDCC4EF304EBF
SHA-512:	8745411ED1984B3C5A6C08C63C8FF191764237F3DA04A104A64826D02111D39242CF0421F43B9B2BBC40485C72CDD1C351B209667BFAD762B91C14907521A0DE
Malicious:	true
Reputation:	unknown
Preview:	PK........=\|{L.~h.....N.......control.ini.O...0...y....[q...".8\...4$.B.M...}....Xu.......oa - .%%..(.;...\.=X........Z'K-b........D3y...J....:..~U..K.TghPg.W...7..b..n.M..2....5..1.g.~c2..&l.6t`-0J..b.0......j.,...7..XC.^...xV...)...?..(...(y.PK........%z&F..8y....".......install.bat.....0..w...IG1>...*D.. .gA(Icl..A..]L..n.....E,.ep..!.7.S...J..h....."...=.T..:Y..B..%.<@...,.q~.!KX.3.....'.m...l......[.1.E.F.^fF.~.T.n,.jc...a...y..L..>.d.gE..g..7j.T..G..i!..<z..PK........%z&F...d............uninstall.batE....@.E............,B.6.1}....y...W0....S..6.i..:.y...1...7.Q..u.%wKq.G~.!.'....?V.=lu.k.";..S.~....h[.....R.f6..=.xE..)'...a.....q.fP.\|.....PK........'\|{L\|..............wszndesktop.exe.:.p.Wzo....2..M..b...3.v..D,c.......0..).\.#.R~.TV..)w...4wM..^.u.t.K..S.$....\......y....#.J....+iW.l.n...].......~..{o..<E....~.JH......#.2{....{E...'4}z....+.v..V.oW.....{......+.\|..W.o.X..=.v//)...p.q./....~.,.5;...s.}..../.Ax.+...._.1..1u./y...7.d........J.....!.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\AN5UOLP8\cz.seznam.software.szninstall-1.1.15-win32[1].zip

Download File

Process:	C:\Users\user\AppData\Roaming\Seznam.cz\sznsetup-lt.exe
File Type:	Zip archive data, at least v2.0 to extract, compression method=deflate
Category:	dropped
Size (bytes):	433495
Entropy (8bit):	7.99622148951467
Encrypted:	true
SSDEEP:	12288:H9b1uPLNHQYDTrI4HAVVzgF3ZwRfcn1NS6Mr:TuPLFVTvHYlgpZdnfgr
MD5:	4A72352104BDEB175A01ED156D1B752E
SHA1:	20281025DD3CAF05CF16B1B7756236E6B6646AD0
SHA-256:	B46DB87456EDB53D41462B77B58323E8446892FE876982A8258EE224E3F3CA00
SHA-512:	5DAFB1E2D09A0436F293A626D171FBF049FE5DF4ACDC986719A80548632AD44234AC4EE55C0CB855EFD29E9935310D55674989E7BEA98207E615378643EDEEFE
Malicious:	true
Reputation:	unknown
Preview:	PK.........\|{L.e7.............control.iniuNA..0.......`E<...x.(.....$dS../.._.#..Ym.M.0.3.3....K:Ja.&.u........@..5.#V..g.l....o%.(..!.(E....BN.l..J.b..l....R..c.B.[c.I_.[.....j)LC...g...Wm..e..-..\|pe..uW.]E.u.....u..A.7PK.........e-At...............install.bat}.]O.0....?.,.2.5.E....?.&..3..M[T...Y@..d.8=......f..A....^s.f){......6.X......qmh.8M.....R....C...0.j.'.I1...M.<..oFsR..\|R..Jh..G...S..R)....f....J.\s.].9...}0.`....W.!....d...,;.C.A. ...f!...EI..).da.;.L..&.._M.Z...I.tX...<..Z....s^.q.{.O...X.juOM}...t.\|m..Q..+.....Wb...kc.e...2z...562g...........~;^m.....En.C=h,k....NK.-E.%..0....F...)J....G..>.M.........a..PK.........{{L8..3.....P......szninstall.exe..\|S...~...r!...P...pe.....Yh..hJ............XM.....&8...;u.{.dS.:..XS...i...u...U.....<..$7m......o.$..\|.s...8.s.u.Q0.. .XL....W,.........X..Q/_.n.x..E..m._......;.o..{..~ .;...~/..../]X......v.1.6..)....a\....s7../c.s.......o.w.._.......W?>..>._..../f.+.w.wom.....q.B.!S..M.x.q!.0.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\AN5UOLP8\packages[1].inf

Download File

Process:	C:\Users\user\AppData\Roaming\Seznam.cz\sznsetup.exe
File Type:	Unicode text, UTF-8 text, with very long lines (16520), with no line terminators
Category:	dropped
Size (bytes):	16698
Entropy (8bit):	5.151173870803497
Encrypted:	false
SSDEEP:	384:y6TZfdE2vwcyX8cqXxPnSfTtsoC6soJsEzaGy4wegmenmOyEaDVzbt6mAHmRuahA:y6VFEaZyMTVoBsWs+siV7fnemZrhXUGG
MD5:	A9A99AF9F63F4DD30004A48A42511777
SHA1:	52426A898ED3F97BB81DCFEB942A260B8DDBC8EC
SHA-256:	B2D1EA236251E73CDC15417BC93947790B7B45A46542568BF2568D361BD847EB
SHA-512:	E3082F6A5B0A489B2E16CABED540D03EDCD5EA6EC4255B288F636816490F58E9C25BABB5AC5DC709DFDE0CE743E1BA17E0083DF0DC44421E4AFF1BB38FF9733F
Malicious:	false
Reputation:	unknown
Preview:	"packages"={[ "com.microsoft.msdn.msvcr100" "10.0.40219.325" "instver"={ ""} "depends"={[ "szn-software-base"]} "conflicts"={[]} "replaces"={[]} "implements"={[]} "triggers"={[]} "install"={ "install.bat"} "uninstall"={ "uninstall.bat"} "postInstall"={ ""} "preUninstall"={ ""} "reconfigure"={ ""} "appname"={ "Microsoft Visual C++ Runtime\|Sd.len. knihovny od firmy Microsoft ur.en. pro b.h program. napsan. v jazyce C++"} "md5"={ "cf3b1b6e8062e277c361f5eb155078b2"} "source"={ ""} "size"={529195} "islib"={true} "location"={ "com.microsoft.msdn.msvcr100-10.0.40219.325-win32.zip"} "downloads"={[]} "isgroup"={false} "updateMode"={0}, "com.microsoft.msdn.msvcr110" "11.0.51106.1" "instver"={ ""} "depends"={[ "szn-software-base"]} "conflicts"={[]} "replaces"={[]} "implements"={[]} "triggers"={[]} "install"={ "install.bat"} "uninstall"={ "uninstall.bat"} "postInstall"={ ""} "preUninstall"={ ""} "reconfigure"={ ""} "appname"={ "Microsoft Visual C++ Runtime\|Sd.len. knihovny od firmy Micro

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\AN5UOLP8\szn-software-fflisticka-4.0.8-win32[1].zip

Download File

Process:	C:\Users\user\AppData\Roaming\Seznam.cz\sznsetup.exe
File Type:	Zip archive data, at least v2.0 to extract, compression method=deflate
Category:	dropped
Size (bytes):	5865670
Entropy (8bit):	7.995980482443665
Encrypted:	true
SSDEEP:	98304:tVdsZVuXMlVWlhYcZy/FwydLOX8b9g1VWWER8R:tVGZVTqhvZy/tdLf2V7L
MD5:	ABBCA45AA54E345B96B33238CC1B012C
SHA1:	70FCDEAF39FF2D9A9937B9726E9AA18F860B337F
SHA-256:	DC06DBE4FBE3BBA5BA1C2259312FC35C12459B6241B71770BA13FDA79089DC08
SHA-512:	07221C418EF54701722C38A54A635E0779F51C11D0E128068848DAF5FA412028F4A62CDB0636DB216C721884E66F956BFD3A5413A9FBC9A34F29998328EA3241
Malicious:	true
Reputation:	unknown
Preview:	PK...........M....2...........control.ini.S..0.}...0........R.k.J..P....5.U$KB.lc....>.....4..Q.8.h.6X........u2@.lT...<...[,.b.....Q.w.!.b..`...%7.d..`.N.f.%. .).2:\|...:4".E...@.2h....}....-...:....A3Qc.X.J.nT..&D.59.......wn.._Q.=....g.....4..W.(.'..p+F.S9.....(....\|q..>J.N..........$..;.0.....Q...F....7xT.....j.....mi.....C.%]%.A...)_.....]....Y5w.0...G.e....<"...9O:.:.^.U...F.[.R.y.f.3g...=.x6'.Ib.T.F.+v.^V.....S..SB...i:.o....E...e....?X......"..].A..p....U..c/.l.wU..........>D....y..Zz.....D..'...:.i.x.r......}.E.....!t ..f....z..Y.r......X:...{]...PK...........MK..Q............install.bat...j.0......bPoR...CC............%.....^9....Bt...\|;.8.0.O..2{..G.a6M..4o.al....}.g=*[.Z.G.e..<u...z.N..$....b..".._.\|.r...u]X^V\|...f..Q.a.6... a..jH...NSg.....R..y..p..y..G..2......J.6..........H....\..o..[..vma...~.\...y=<..z.....b?.....M.<.f-....-.....Gd$./..1..g..A.4-..Qa..q.....Q.....PK........g\.M.......Z...!...seznam_doplnek_email-4.4

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\C7S8M5VS\cz.seznam.software.lightspeed-1210-12.10.18-win32[1].zip

Download File

Process:	C:\Users\user\AppData\Roaming\Seznam.cz\sznsetup.exe
File Type:	Zip archive data, at least v2.0 to extract, compression method=deflate
Category:	dropped
Size (bytes):	304459
Entropy (8bit):	7.99452128979458
Encrypted:	true
SSDEEP:	6144:bcqTGZrlMZ8ThLduXR4GdhJ8oMqCjigXkPyosxeiOqA0:/TGZrC6LWdD0xoQON0
MD5:	A59D7278A2A860766D36D8775C3FB73B
SHA1:	469675A55CB7BBAF080B3E76D543DE74CFC05A4F
SHA-256:	74D4F68CF7E01C67CB313C5A3A6C101DDFB022D28460771666A3CA7859EAB082
SHA-512:	2B4E1A25F7EA7CF9F076A5BD4FB0348D384F6AD8E24AAE26E23F8EA6129BFF5C28D5DC6096AE565A6907D2CBF32A3C0AC0699554D518555F8CC063146D186DA9
Malicious:	true
Reputation:	unknown
Preview:	PK.........pTL..%.............control.ini.O;n.0......@..E..:A.......$.%J...5z.....C.........J.$A..GR...n..^)A.@.'.J._....ls...BTbI..b2....Xr.@I...I2u.....J.nvCi.3:...]j....b^.=...9.{...LYY+..S.........G'....N..RP.Bx...D..;T.i.Z.B..f.-.pb..)..3..m.8\|....0.sv..g. .N.........?..>......D)x.{J~.PK........&z&F................install.batcpy lightspeed.dll "%~1\bin"..PK.........TUL...t.....D......lightspeed.dll.}.x....Z..x.m....V.(.6..:.P;.%%ql.I.@H.%.&7@bKq(!.U.z3.}....6....nii{C_K..X.......m./...6.n.....3.+...@o......;;;..3......1..q...4...r.W...g.y...<.gy.]..V....Z.m.li}.s.w....... ...=.....{...4......{..;w.Wo.Sc. ....a..7....O...w....;.....h...?..gO...........u.#..o.....I......N.P-.........\....\|..^..xZ.7..q..F.G..gq\6..K].;.Rb.?>.^W..G...]..'.@..G..Jp.;n3!...A.En.O9..Z....CEs.c.xn.O]...=.pm/..B.W.Z.....u.].8.\|...}.\...z...zV.s~..<.....O..}}k[..pO..}F.rs.........Q.p.\.I..L......o/..>....{..A..L.L....^.."9Z.'....h.>.K./.~..M...<]..m.r*....9..

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\C7S8M5VS\default[1]

Download File

Process:	C:\Program Files (x86)\Google\Picasa3\Picasa3.exe
File Type:	gzip compressed data, from Unix, original size modulo 2^32 58543
Category:	dropped
Size (bytes):	9776
Entropy (8bit):	7.9799688302824014
Encrypted:	false
SSDEEP:	192:xVG2k7sLfVuP+oALKKSd2O7ZKW3REIdtwJJjA0JO2fq:7G20sRxoALtSd2nWhoG
MD5:	4AA0B15FDABBFC4A919DC648EBCEEF07
SHA1:	DD20D9A4208D90B694E0F2899F015B11A3B4CC1D
SHA-256:	AFE8BE40BD99C1AD240FE314CCD007DE69F34C9908F0EA342FB9EAA00584BCDC
SHA-512:	25C0FFE36703EBAC903617989F748ADB6DDF51C9BCD2D37DAFCCCC65017A314D6B83E04980E5857B5B718B7F62515C95B3DD4FCF5762825D0A8B04B08EF64D87
Malicious:	false
Reputation:	unknown
Preview:	...........}.r....}?..'....H,.7.>#.K.m.-....."...`,..~....."..G....d2....n.%.nu.m...YYU._.......Y.9....ZS.K.\|......8{......>^%G..e..X......0..n.>.Lj=...XX..q._W7c.\....O...^...:......%..../.2.k~8.k.b.........0.=3Ck.]nv.Yr=..U..". ..:......!..Qm........\|l;.m.\|..D.....?f...+F..'...9)A..4\4.l.2cX.:\.L..p..c?..A...=.......0.F..4.V..6......I`.1..h.......V...jF..i...........l..S)f...=3.}......].W.>...'gC&....)..; .....'.Q.+.0...L..~.d.u...2w.zp.....}1...n.!.W.......I$..1....~L..HQ=.8..o&n\|.^.%bn..G.nx>~.z,{....=....w...'V.q..foMz.z....j0....C?\|..c.D,..3..u.d?..'.&..~.qY.......Z.h.JS.ac.........C....U.y.....]gl...!.&..w.&...$P.0]...1.9.->N..9.J4._..>......g3.6p..z...X.+...US@..\|.-..'....zv...\\uc?6.w,.....E..o.b3....'j.......S...7.hF..w.....r...X..M.......tp.[\..6s.P.(rT]V...9SA.h h..jr...Bj.F...(sBj^.....;..P.}._(.S&.,.a.%q.o7~....&~....Hv<:..<H.[n..~.....nj...........7...~.D.N......].v..t..o.=....(0..-=...hC...aW..a..I..i..#...c.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\C7S8M5VS\update2[1].xml

Download File

Process:	C:\Program Files (x86)\Google\Picasa3\Picasa3.exe
File Type:	gzip compressed data, original size modulo 2^32 277
Category:	dropped
Size (bytes):	228
Entropy (8bit):	7.0613400010146075
Encrypted:	false
SSDEEP:	6:XtBCO+QY3ixdM7rdG8dURkm6KVCztcAn81/HQH/:X0P3/7rdekwwn8y
MD5:	0A1DDBBC23DB30D462D6BB8EE6193721
SHA1:	844E0CF86E7B901A604A61C76D8B38112BBADCA1
SHA-256:	0A647FCF082BD3A4B88D826FFA7095CF90F38371473BF0FFD8883BDA941CBFA7
SHA-512:	D6C8C6906FABDEE9FE99042FC0E9441D8D1F6C115382E85D6C4D611A712AC2D3325849B362C2F48D780529C7B8F7A4104D96E75ADD316ADB06C7357404736C24
Malicious:	false
Reputation:	unknown
Preview:	..........M..J.0.E.%.{...4..K._....P..LH.[E.wgQ.....\n{\|?o..bZ.k..;`..hW.hx~....]......}..sx.\|..rA\6W.x.?..........3.i8...Ej.@.B.Z.........h.B..c...-....&.F.Z...j.F5E=.}!.I.jz.....(.Q.....l...F....'........B]......

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Low\IE\30EN40B2\93773[1].htm

Download File

Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	HTML document, ASCII text, with CRLF, LF line terminators
Category:	dropped
Size (bytes):	302
Entropy (8bit):	5.537533793843685
Encrypted:	false
SSDEEP:	6:wRkrQWR0iYBtqWt2aSyu5BLCRgycQ30BgkToP:ekrY1tdkys9CRj3Yfi
MD5:	063EEDF9A4C2A3F47CF6CD5118E709AE
SHA1:	874FCF73515CE05BE49FBEF76F1F7FB89548DCFC
SHA-256:	9B302E8650CBBFA21662FC15285605E4801ED41EA6A21018C5066C6488F6DF25
SHA-512:	FE8A99273E601364CA2CD8096DBE767DDB58DE4BC68C88B0BF85714CB4B7A01B57481F86FF1F9CE5F65C56D7924DCADB9D2156FC13651B3DCC4C21C00EC60D2B
Malicious:	false
Reputation:	unknown
Preview:	<HTML><HEAD><meta http-equiv="content-type" content="text/html;charset=utf-8">.<TITLE>301 Moved</TITLE></HEAD><BODY>.<H1>301 Moved</H1>.The document has moved.<A HREF="https://support.google.com/picasa/answer/157000?hl=en&visit_id=638634609885905976-1351747924&rd=1">here</A>...</BODY></HTML>..

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Low\IE\30EN40B2\KFOlCnqEu92Fr1MmEU9fBBc-[1].woff

Download File

Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	Web Open Font Format, TrueType, length 20012, version 1.1
Category:	dropped
Size (bytes):	20012
Entropy (8bit):	7.966842359681559
Encrypted:	false
SSDEEP:	384:Yc6bX9TagDCXKqs4+W5XVgaflKHjsGdZtlh3K/qzWz/scZpuB:YcCVaeCaF4ea9KHYQZtlh3Kgy4B
MD5:	DE8B7431B74642E830AF4D4F4B513EC9
SHA1:	F549F1FE8A0B86EF3FBDCB8D508440AFF84C385C
SHA-256:	3BFE46BB1CA35B205306C5EC664E99E4A816F48A417B6B42E77A1F43F0BC4E7A
SHA-512:	57D3D4DE3816307ED954B796C13BFA34AF22A46A2FEA310DF90E966301350AE8ADAC62BCD2ABF7D7768E6BDCBB3DFC5069378A728436173D07ABFA483C1025AC
Malicious:	false
Reputation:	unknown
Preview:	wOFF......N,................................GDEF.......G...d....GPOS................GSUB............7b..OS/2.......R...`t.#.cmap...4.......L....cvt .......\...\1..Kfpgm...@...2......$.gasp...t............glyf......:...j.'..hdmx..G,...f........head..G....6...6...rhhea..G........$....hmtx..G....a......MOloca..JP........\v@zmaxp..L,... ... ....name..LL..........:.post..M(....... .m.dprep..M<.......S...)x...1..P......PB..U.=l.@..B)..w.......Y.e.u.m.C.s...x.h.~R....R.....2.x...pfK.G...1.c>..`9..m<+;..m.x...bg.M.T...O............l...XU.../{.[_..W....c.._..72.. ." z.+..F.......&.&...`e..T].....K=..K2S....q..d...xf.$~i..$?.d..dU.....@R-/LMO-J6...[]..Z..O.C_."If..d....fS....$d.G>eL`....Tf1.......9.c>..`1.TR..x./d-........q.........7....{...v.....!.....1.QG=.4.D3-..F;=..1'.'q.rw...9..e!.....Q....f......qV.n.h.V.Z]..B..C.[B...V.......v...o.w.{...w..zRO.i=..._.....-.m....].=...[...(1.(.#.....O0/.0?..04rL.G.9.....i6..l..\|.(o.....\|$,..{\|&\|....YJ...x.e8B.#..t;R8.{+....\=.....

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Low\IE\30EN40B2\analytics[1].js

Download File

Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with very long lines (2343)
Category:	dropped
Size (bytes):	52916
Entropy (8bit):	5.51283890397623
Encrypted:	false
SSDEEP:	768:oHzaMKHBCwsZtisP5XqYofL+qviHOlTjdNoVJDe6VyKaqgYUD0ZTTE8yVfZsk:caMKH125hYiM8O9dNoVJ3N48yVL
MD5:	575B5480531DA4D14E7453E2016FE0BC
SHA1:	E5C5F3134FE29E60B591C87EA85951F0AEA36EE1
SHA-256:	DE36E50194320A7D3EF1ACE9BD34A875A8BD458B253C061979DD628E9BF49AFD
SHA-512:	174E48F4FB2A7E7A0BE1E16564F9ED2D0BBCC8B4AF18CB89AD49CF42B1C3894C8F8E29CE673BC5D9BC8552F88D1D47294EE0E216402566A3F446F04ACA24857A
Malicious:	false
Reputation:	unknown
Preview:	(function(){/.. Copyright The Closure Library Authors.. SPDX-License-Identifier: Apache-2.0./.var n=this\|\|self,p=function(a,b){a=a.split(".");var c=n;a[0]in c\|\|"undefined"==typeof c.execScript\|\|c.execScript("var "+a[0]);for(var d;a.length&&(d=a.shift());)a.length\|\|void 0===b?c=c[d]&&c[d]!==Object.prototype[d]?c[d]:c[d]={}:c[d]=b};function q(){for(var a=r,b={},c=0;c<a.length;++c)b[a[c]]=c;return b}function u(){var a="ABCDEFGHIJKLMNOPQRSTUVWXYZ";a+=a.toLowerCase()+"0123456789-_";return a+"."}var r,v;.function aa(a){function b(k){for(;d<a.length;){var m=a.charAt(d++),l=v[m];if(null!=l)return l;if(!/^[\s\xa0]*$/.test(m))throw Error("Unknown base64 encoding at char: "+m);}return k}r=r\|\|u();v=v\|\|q();for(var c="",d=0;;){var e=b(-1),f=b(0),h=b(64),g=b(64);if(64===g&&-1===e)return c;c+=String.fromCharCode(e<<2\|f>>4);64!=h&&(c+=String.fromCharCode(f<<4&240\|h>>2),64!=g&&(c+=String.fromCharCode(h<<6&192\|g)))}};var w={},y=function(a){w.TAGGING=w.TAGGING\|\|[];w.TAGGING[a]=!0};var ba=Array.isArray,c

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Low\IE\30EN40B2\js[1].js

Download File

Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with very long lines (5945)
Category:	dropped
Size (bytes):	267304
Entropy (8bit):	5.568668056567678
Encrypted:	false
SSDEEP:	6144:NySn+yZmn4yzjrgBB9Tch2+4jJeLVcwOuCK/:kpumn4tUO2
MD5:	9ACAF56CC95B2784136BC06C718477CC
SHA1:	329196B8D6EFA1BFE955D65B9BE785A902DAD544
SHA-256:	BA04961D51C0D97C87464FA8B79283C5277564C1C17A8508FDBF52CA36DAC74D
SHA-512:	E8D93921B9F8B2EB40C2F1970DDCBD7C5DBD3EDF936E31635D99CD98E9CE27AD5F8B4146B362D8B2C37B96C8311016B607A6329AF1B82D3D64C32F0E6F84CD74
Malicious:	false
Reputation:	unknown
Preview:	.// Copyright 2012 Google Inc. All rights reserved.. .(function(){..var data = {."resource": {. "version":"2",. . "macros":[{"function":"__e"},{"function":"__c","vtp_value":"undefined"},{"function":"__c","vtp_value":""},{"function":"__c","vtp_value":0}],. "tags":[{"function":"__ogt_dma","priority":6,"vtp_delegationMode":"ON","vtp_dmaDefault":"DENIED","tag_id":111},{"function":"__ogt_1p_data_v2","priority":6,"vtp_isAutoEnabled":true,"vtp_autoCollectExclusionSelectors":["list",["map","exclusionSelector",""]],"vtp_isEnabled":true,"vtp_cityType":"CSS_SELECTOR","vtp_manualEmailEnabled":false,"vtp_firstNameType":"CSS_SELECTOR","vtp_countryType":"CSS_SELECTOR","vtp_cityValue":"","vtp_emailType":"CSS_SELECTOR","vtp_regionType":"CSS_SELECTOR","vtp_autoEmailEnabled":true,"vtp_postalCodeValue":"","vtp_lastNameValue":"","vtp_phoneType":"CSS_SELECTOR","vtp_phoneValue":"","vtp_streetType":"CSS_SELECTOR","vtp_autoPhoneEnabled":false,"vtp_postalCodeType":"CSS_SELECTOR","vtp_emailValue":"","vtp_fir

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Low\IE\A6YW1NKY\6383491[1].htm

Download File

Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (62332)
Category:	dropped
Size (bytes):	1091996
Entropy (8bit):	5.693451158794706
Encrypted:	false
SSDEEP:	24576:G0W8zFU6z1WJlJxxtvPn7crqWcZvni0ocL3aMcrX5S8q7zPTWv:G0W8zFU641xxtvPn7crFXXo8q7zPTWv
MD5:	7278ADD413B4FDD3835D6D7535B315CA
SHA1:	CC6B616C988AD664F7FAFBCE75E0BD3F1669E3D7
SHA-256:	5F018E7C6B3DFBF224FEEFAED16BE9F22D374379FCC306A285A2FB7D081EF81D
SHA-512:	CCA1519F2C2880FED39E7F039C11A88C1E82EDB0B353B5A32F1270EA4C9D077D2C9D9C5952F7F16EFD98AEC50B2696DE4A6A6721D9602DF2371F23F8AAE809AB
Malicious:	false
Reputation:	unknown
Preview:	<!doctype html><html class="hcfe" data-page-type="ANSWER" lang="en"><head><title>What's happening to Picasa, Picasa Web Albums, and the Picasa Web Albums API? - Picasa and Picasa Web Albums Help</title><meta content="email=no" name="format-detection"><meta content="follow,index" name="robots"><meta content="IE=edge,chrome=1" http-equiv="X-UA-Compatible"><meta content="What's happening to Picasa? Picasa is now retired. (If you speak English, you can read the blog post here.) After Picasa is retired: Picasa should continue to work" name="description"><meta content="XDaf09mosy9iTj6dOnwb6sKTrNhfKwOS6v98lPV0dEE" name="google-site-verification"><link href="https://support.google.com/picasa/answer/6383491?hl=en" rel="canonical"><meta content="width=device-width,initial-scale=1,minimum-scale=1,maximum-scale=3,user-scalable=yes" name="viewport"><style>@font-face{font-family:'Roboto';font-style:normal;font-weight:400;src:url(https://fonts.gstatic.com/s/roboto/v18/KFOmCnqEu92Fr1Mu4mxM.woff)format

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Low\IE\A6YW1NKY\answer[1].htm

Download File

Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	HTML document, ASCII text, with CRLF, LF line terminators
Category:	dropped
Size (bytes):	249
Entropy (8bit):	5.315300375639648
Encrypted:	false
SSDEEP:	3:IskN20EFNjJ8S/7A+KWRIJiYEUFLZxs4bSl02rBsSZ7NE7uR0Lq9DGCBLCRvzMGx:wRkrQWR0iYBtqWt2aSyu5BLCRgyWZ3oP
MD5:	F2DCE10F6EA05E0E03BEE3822E4CEE85
SHA1:	38467B518B24D1E417D93EE34D463D7F99337B46
SHA-256:	F2E94AC541798C704A673446D508BF477C4A40A3B0E2AC7B7EFB836E45F0A457
SHA-512:	5DC67395D6B60AD6FFD9F9174BFA3D6CBB80C3FD8011D70314A3DB5BE052F16B1C04BA75F8DC3A575A4974EFCB6EA4F95909E36490B67F6ADE0F8CB06A6108C7
Malicious:	false
Reputation:	unknown
Preview:	<HTML><HEAD><meta http-equiv="content-type" content="text/html;charset=utf-8">.<TITLE>301 Moved</TITLE></HEAD><BODY>.<H1>301 Moved</H1>.The document has moved.<A HREF="https://support.google.com/picasa/answer/93773?hl=en">here</A>...</BODY></HTML>..

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Low\IE\A6YW1NKY\cb=gapi[1].js

Download File

Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with very long lines (1885)
Category:	dropped
Size (bytes):	126135
Entropy (8bit):	5.498654960721984
Encrypted:	false
SSDEEP:	3072:AkyvF6US20FCdrgVr3dfPeIofdhIUsTx0wVnX9Mb:AkygUS29rWPeIofdCVnX9Mb
MD5:	C299A572DF117831926BC3A0A25BA255
SHA1:	673F2AC4C7A41AB95FB14E2687666E81BC731E95
SHA-256:	F847294692483E4B7666C0F98CBE2BD03B86AE27B721CAE332FEB26223DDE9FC
SHA-512:	B418A87A350DBC0DEF9FAF3BE4B910CB21AE6FFFC6749EECEA486E3EB603F5AF92F70B936C3D440009482EDE572EE9736422CF89DCDD2B758DFA829216049179
Malicious:	false
Reputation:	unknown
Preview:	gapi.loaded_0(function(_){var window=this;._._F_toggles_initialize=function(a){(typeof globalThis!=="undefined"?globalThis:typeof self!=="undefined"?self:this)._F_toggles=a\|\|[]};(0,_._F_toggles_initialize)([0x800000, ]);.var ba,fa,ha,na,oa,sa,ua,wa;ba=function(a){var b=0;return function(){return b<a.length?{done:!1,value:a[b++]}:{done:!0}}};fa=typeof Object.defineProperties=="function"?Object.defineProperty:function(a,b,c){if(a==Array.prototype\|\|a==Object.prototype)return a;a[b]=c.value;return a};.ha=function(a){a=["object"==typeof globalThis&&globalThis,a,"object"==typeof window&&window,"object"==typeof self&&self,"object"==typeof global&&global];for(var b=0;b<a.length;++b){var c=a[b];if(c&&c.Math==Math)return c}throw Error("a");};_.ma=ha(this);na=function(a,b){if(b)a:{var c=_.ma;a=a.split(".");for(var d=0;d<a.length-1;d++){var e=a[d];if(!(e in c))break a;c=c[e]}a=a[a.length-1];d=c[a];b=b(d);b!=d&&b!=null&&fa(c,a,{configurable:!0,writable:!0,value:b})}};.na("Symbol",function(a){if(a)r

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Low\IE\A6YW1NKY\rs=AA2YrTu4yKUthdSOsX4mIF3MpnvWpdwnvw[1].css

Download File

Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with very long lines (3223), with no line terminators
Category:	dropped
Size (bytes):	3223
Entropy (8bit):	5.395416266218631
Encrypted:	false
SSDEEP:	48:46ErcIGsbs8ws15PCZQVJYo7+beALHZSEHA5brqlEHUG1l1UvGws6cO40+5cdUG1:42yb1Z14o7sRxiDHzxOZL2GJYuX
MD5:	B04DEAC931153CB0547F20D6F737A552
SHA1:	99454290FA1F377032FB2F1FCFB7A96472BAA5C9
SHA-256:	07F32C5F6E209A3EFD430FB0D293D213BB5BF6AA54B7CAD0100B333DBC6D03AC
SHA-512:	0D4A7CB7E7022DE29B31FA2C59493671E7747A29775619266D4A2887B693508E63B46661E73F2A4FC0CF96ED39A3421FBFB8513982C9F7E263F5059B27F62FE6
Malicious:	false
Reputation:	unknown
Preview:	.gb_Q{border-radius:50%;bottom:2px;height:18px;position:absolute;right:0;width:18px;background-color:white}.gb_F .gb_Q{background-color:#2d2e30}.gb_Ka{border-radius:50%;box-shadow:0px 1px 2px 0px rgba(60,64,67,.30),0px 1px 3px 1px rgba(60,64,67,.15);margin:2px}.gb_La{fill:#f9ab00}.gb_F .gb_La{fill:#fdd663}.gb_Ma>.gb_La{fill:#d93025}.gb_F .gb_Ma>.gb_La{fill:#f28b82}.gb_Ma>.gb_Na{fill:white}.gb_Na,.gb_F .gb_Ma>.gb_Na{fill:#202124}.gb_Oa{clip-path:path("M16 0C24.8366 0 32 7.16344 32 16C32 16.4964 31.9774 16.9875 31.9332 17.4723C30.5166 16.5411 28.8215 16 27 16C22.0294 16 18 20.0294 18 25C18 27.4671 18.9927 29.7024 20.6004 31.3282C19.1443 31.7653 17.5996 32 16 32C7.16344 32 0 24.8366 0 16C0 7.16344 7.16344 0 16 0Z")}.gb_A .gb_Q{display:block}.gb_Ac{background:rgba(60,64,67,.9);border-radius:4px;color:#fff;font:500 12px "Roboto",arial,sans-serif;letter-spacing:.8px;line-height:16px;margin-top:4px;min-height:14px;padding:4px 8px;position:absolute;-ms-user-select:text;-ms-user-select:text;z-i

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Low\IE\HN3J204T\157000[1].htm

Download File

Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	HTML document, ASCII text, with CRLF, LF line terminators
Category:	dropped
Size (bytes):	302
Entropy (8bit):	5.548279199465662
Encrypted:	false
SSDEEP:	6:wRkrQWR0iYBtqWt2aSyu5BLCRgyDlQ30BgXHYA3oP:ekrY1tdkys9CRhC3Y0YAW
MD5:	63C2E88362DCB4339E97CFAFBA8B3892
SHA1:	9DBB5FDFA3C2C5076D0ED78E9727546F8EA19208
SHA-256:	B72DA2519D1BE91AD47E2A0888416F0118468F581E9BFA7F211CF1BAE6EBFA34
SHA-512:	E2B96D6C58A2644041628CB4C257EB63BB3117ADCB23773FC1DDE89D6594E06E4E4BA90935CEC970B14E46C21716F46D4A4D8E5FFA3F77E94152EB2C9BBA3764
Malicious:	false
Reputation:	unknown
Preview:	<HTML><HEAD><meta http-equiv="content-type" content="text/html;charset=utf-8">.<TITLE>301 Moved</TITLE></HEAD><BODY>.<H1>301 Moved</H1>.The document has moved.<A HREF="https://support.google.com/picasa/answer/156347?hl=en&visit_id=638634609885905976-1351747924&rd=2">here</A>...</BODY></HTML>..

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Low\IE\HN3J204T\al-icon[1].png

Download File

Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	PNG image data, 24 x 24, 8-bit gray+alpha, non-interlaced
Category:	dropped
Size (bytes):	112
Entropy (8bit):	5.4155519477644045
Encrypted:	false
SSDEEP:	3:yionv//thPlT/XtSAqr756ecb/zdlHULdws2Htjp:6v/lhPXJqrdyrjULnidp
MD5:	72A6EB216F6B2AE35647F831E5709FCF
SHA1:	37562DF0ABAFC572A547481BE590B93CE40F56FD
SHA-256:	27947D517EBDB6BC430049DCF8CD5BED0B182E1A3EF9A972CF0B3569D5F53638
SHA-512:	87F2F71CDE24818437DCF63FC10D160750074110865329108B963C85DBC90D6E53F9D564F0A54B438446FE9508148B7E32EB1BDBFECBF437EB23C9FA52D71234
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR.............J~.s...7IDAT8.c`.N...>.:.e.......>^6....x.....@.=.J..4DC.V...`lI.f^....IEND.B`.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Low\IE\HN3J204T\js[1].js

Download File

Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with very long lines (2345)
Category:	dropped
Size (bytes):	207197
Entropy (8bit):	5.533063207523211
Encrypted:	false
SSDEEP:	3072:LHFkUeQ65WHe7JKQE0+0dO2OJjt+/Kjh+KWzch2+4jR19e+z:Dn+yOJsvj6ch2+4jZ9
MD5:	C56061E475297142D76CFAB573E8E9E1
SHA1:	B3A5FB69663738E353FB6B5CB337F709291F4C76
SHA-256:	7BE04A7BAD71CCFCB7D5F7570F2971778DD264D66F4A7C7688AB17152DC02348
SHA-512:	1F0ADF518E6D1D9A3C434C06416694309DCBBB59141C6CE417EE7DE7639DACEE2D6448F88B01C3853942B3DDCD996D96E6C30C45C8CAC2162F7D9CE25F25AC57
Malicious:	false
Reputation:	unknown
Preview:	.// Copyright 2012 Google Inc. All rights reserved.. .(function(){..var data = {."resource": {. "version":"1",. . "macros":[{"function":"__e"},{"function":"__cid"}],. "tags":[{"function":"__rep","once_per_event":true,"vtp_containerId":["macro",1],"tag_id":1}],. "predicates":[{"function":"_eq","arg0":["macro",0],"arg1":"gtm.js"}],. "rules":[[["if",0],["add",0]]].},."runtime":[ [50,"__cid",[46,"a"],[36,[17,[13,[41,"$0"],[3,"$0",["require","getContainerVersion"]],["$0"]],"containerId"]]]. ,[50,"__e",[46,"a"],[36,[13,[41,"$0"],[3,"$0",["require","internal.getEventData"]],["$0","event"]]]]. .].,"entities":{."__cid":{"2":true,"4":true,"3":true}.,."__e":{"2":true,"4":true}...}.,"blob":{"1":"1"}.,"permissions":{."__cid":{"read_container_data":{}}.,."__e":{"read_event_data":{"eventDataAccess":"specific","keyPatterns":["event"]}}...}....,"security_groups":{."google":[."__cid".,."__e"..]...}....};.....var h,aa=function(a){var b=0;return function(){return b<a.length?{done:!1,value:a[b++]}:{d

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Low\IE\XVDYWN9F\156347[1].htm

Download File

Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	HTML document, ASCII text, with CRLF, LF line terminators
Category:	dropped
Size (bytes):	303
Entropy (8bit):	5.538100735993021
Encrypted:	false
SSDEEP:	6:wRkrQWR0iYBtqWt2aSyu5BLCRgy8TIQ30Bg+ZoP:ekrY1tdkys9CRA3YvQ
MD5:	A7CD59914276D08AFA43B570D87DC120
SHA1:	AFF0E7DBA0E999F19257261EDB824DCB38B359DD
SHA-256:	847C113E635F89AFB878B4EE47D4F70DA09E67826F890C3C2FDC131B39086565
SHA-512:	2E36C88D2A3C8336A2E467FD39A33FE9EA1BDC944D0056B94A2EA2AA87916394422A4F625FB8BD971DC1AA3986E5D9FFFD66144E2880AA94EE0B7856C0500961
Malicious:	false
Reputation:	unknown
Preview:	<HTML><HEAD><meta http-equiv="content-type" content="text/html;charset=utf-8">.<TITLE>301 Moved</TITLE></HEAD><BODY>.<H1>301 Moved</H1>.The document has moved.<A HREF="https://support.google.com/picasa/answer/6383491?hl=en&visit_id=638634609885905976-1351747924&rd=3">here</A>...</BODY></HTML>..

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Low\IE\XVDYWN9F\4UaGrENHsxJlGDuGo1OIlL3Owpg[1].woff

Download File

Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	Web Open Font Format, TrueType, length 26228, version 1.1
Category:	dropped
Size (bytes):	26228
Entropy (8bit):	7.98323449413518
Encrypted:	false
SSDEEP:	768:DBOEuz6T0146JY/J6unqhOYK0GJenzOoyo6:DBHuea4j/vnqo304enzUo6
MD5:	6DD4AD69D53830BDF5232A13482BD50D
SHA1:	6FFF1079D7E5D02A2259CB5D7833E790239E01CF
SHA-256:	5CE48D9E9D748AD4686094D3CC33F5AE1E272A5B618F5C6D146C4D12EF02E4A6
SHA-512:	FC91E8C4EAE384D38667E330C5A5E4BF82EBAC9A23AB88439D7C22CCDD125DE7F1371DD953F18DEE60EF68B680DF49A32F684157D90F20E1DAC3BFFC9DF84118
Malicious:	false
Reputation:	unknown
Preview:	wOFF......ft.......`........................GDEF.......\.......RGPOS.......#..+..P.LGSUB................OS/2.......U...`h...cmap...........~n..cvt .......y........fpgm...$.......uo..gasp................glyf......=...m..N..head..Z....6...6..'.hhea..[.... ...$.0.6hmtx..[<.........})9loca..]....z.....&..maxp..`p... ... .>..name..`........r.i6Ppost..a<........O...prep..e....p..... ..x.U....Q.F..=#.`ZD.@@<..... "...Zp....+.c.f...).>Z.bm.Om..?...\\.zi.f.^b...[y/.........x..Z.......%......033333333...e....r......U..u.r.....sV..Z..^..c..>v..p7.x...w.i...Y.....X...N<.k...0...kc];.u......4.j...@....y."......,....#.;..........9...1....q..b..c...{....i2.H..g..:.....du.FX.].w3...{y...G....E.....~..RdX.\|.\..U.^.x!....e.\|.:.RX.Wxg....&.5....2n.Q...5.{..2....Ia.Vb%....:.Yn..QI.Z...x..Z.6..?........G..W.^#.e..#\|l2p.S+.?'.<E..<....M.H..".>..d....>n%.(..."....<"........U/z.%..=...Le.cL3.4..4..znxgX!JD%.....s....&.a..z1._....O+..g.dm.?.9Vj.1...B...8..S........ ._.E.... .[#_..

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Low\IE\XVDYWN9F\4UabrENHsxJlGDuGo1OIlLU94YtzCwA[1].woff

Download File

Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	Web Open Font Format, TrueType, length 26464, version 1.1
Category:	dropped
Size (bytes):	26464
Entropy (8bit):	7.981932066790926
Encrypted:	false
SSDEEP:	768:OIYb4Auz6mM1gBEL1WuL1BU91c6HJ8Y4mAS:OI84AueNmwHpBU91qY4m7
MD5:	08F80DE0ACF68D82AABAB974A47D9E5F
SHA1:	E6F1C0F5395A9C297AA162468961C1FAF0EC1ED9
SHA-256:	4070911A1BB9CC52C4E4CD5E85CA186DCDE89308A0517A8FAA4715C2E0A9D45E
SHA-512:	720DE47FDDA648AF7CE5F3F574EFA3322191C4D0001E31181739D65FFE0CCECED56635AF58E5E828072A17EEE1ED1E318AF467B8ED7F4185EE0F5155501CD8D0
Malicious:	false
Reputation:	unknown
Preview:	wOFF......g`.......d........................GDEF.......q........GPOS.......$..+..K.MGSUB................OS/2.......U...`i`..cmap...........~n..cvt ................fpgm...T.......uo..gasp................glyf...(..>W..mNU!.)head..[....6...6..'.hhea..[.... ...$...4hmtx..[..........1'jloca..^....~......t.maxp..a.... ... ....name..a4.......V..4.post..a.........O...prep..e........^....x.D...Q...3..I.=D.@@....@....."...}......`.%.....x.........umW...g.WwO.....J..^?.Jci^N{.Nr..Jw@.n(.....t4....i...x..Z...6.=r...............q`.>....m.....fy.g..y4N...tAg.."KWWW.j.....8...n.3..:..1....9.+.}...b]....0..6V..).G.r........N...,R(.o.t.LU....;.{.l.y....i..w.{F..;p'.....,.........:3...\|..,.`pGPAV.?....q!......=.(cn.'<......sK_...]..U.W.......b....E\|.o..Jp.n.uX....J.q'SFy...l..Cd..XZ..RP...#.w...C)..s../..D..1.G...Sx...e.....x.o.mJ...~./L..r...Y..sD./.......>$R`..&.v......D..w.). .f.Y."<..V/.zQ{.8./...X................B..Jp#%.7.e>+L.Q.1..hd..k._...f..u....+....Q...N..\|....$Lv.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Low\IE\XVDYWN9F\KFOlCnqEu92Fr1MmWUlfBBc-[1].woff

Download File

Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	Web Open Font Format, TrueType, length 19888, version 1.1
Category:	dropped
Size (bytes):	19888
Entropy (8bit):	7.96899630573477
Encrypted:	false
SSDEEP:	384:0c6bX9TSzYzCrQH+qXM6C0ouF0xcYye+5x/U3S0X5v+obEgm:0cCV8GuPVyzx/MS0X5v+oI/
MD5:	CF6613D1ADF490972C557A8E318E0868
SHA1:	B2198C3FC1C72646D372F63E135E70BA2C9FED8E
SHA-256:	468E579FE1210FA55525B1C470ED2D1958404512A2DD4FB972CAC5CE0FF00B1F
SHA-512:	1866D890987B1E56E1337EC1E975906EE8202FCC517620C30E9D3BE0A9E8EAF3105147B178DEB81FA0604745DFE3FB79B3B20D5F2FF2912B66856C38A28C07EE
Malicious:	false
Reputation:	unknown
Preview:	wOFF......M.................................GDEF.......G...d....GPOS................GSUB............7b..OS/2.......P...`u.#.cmap...0.......L....cvt .......H...H+~..fpgm...(...3...._...gasp...\............glyf...h..:q..i..+ Ohdmx..F....f........head..GD...6...6...\hhea..G\|.......$.&..hmtx..G....d.....E#loca..J.........\s@.maxp..K.... ... ....name..K........~..9.post..L........ .m.dprep..L........)*v60x...1..P......PB..U.=l.@..B)..w.......Y.e.u.m.C.s...x.h.~R....R.....2.x...pfK.G...1.c>..`9..m<+;..m.x...bg.M.T...O............l...XU.../{.[_..W....c.._..72.. ." z.+..F.......&.&...`e..T].....K=..K2S....q..d...xf.$~i..$?.d..dU.....@R-/LMO-J6...[]..Z..O.C_."If..d....fS....$d.G>eL`....Tf1.......9.c>..`1.TR..x./d-........q.........7....{...v.....!.....1.QG=.4.D3-..F;=..1'.'q.rw...9..e!.....Q....f......qV.n.h.V.Z]..B..C.[B...V.......v...o.w.{...w..zRO.i=..._.....-.m....].=...[...(1.(.#.....O0/.0?..04rL.G.9.....i6..l..\|.(o.....\|$,..{\|&\|....YJ...x.e8B.#..t;R8.{+....\=.....

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Low\IE\XVDYWN9F\KFOmCnqEu92Fr1Mu4mxM[1].woff

Download File

Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	Web Open Font Format, TrueType, length 19824, version 1.1
Category:	dropped
Size (bytes):	19824
Entropy (8bit):	7.970306766642997
Encrypted:	false
SSDEEP:	384:ozNCb8EbW9Wg166uwroOp/taiap3K6MC4fsPPuzt+7NCXzS65XZELt:K4zbWcDVwt230hfs+x+Bb65X2
MD5:	BAFB105BAEB22D965C70FE52BA6B49D9
SHA1:	934014CC9BBE5883542BE756B3146C05844B254F
SHA-256:	1570F866BF6EAE82041E407280894A86AD2B8B275E01908AE156914DC693A4ED
SHA-512:	85A91773B0283E3B2400C773527542228478CC1B9E8AD8EA62435D705E98702A40BEDF26CB5B0900DD8FECC79F802B8C1839184E787D9416886DBC73DFF22A64
Malicious:	false
Reputation:	unknown
Preview:	wOFF......Mp.......P........................GDEF.......G...d....GPOS...............hGSUB............7b..OS/2.......R...`tq#.cmap...........L....cvt .......T...T+...fpgm.......5....w.`.gasp...@............glyf...L..:+..j.....hdmx..Fx...g........head..F....6...6.j.zhhea..G........$....hmtx..G8...]......Vlloca..I.........?.#.maxp..Kt... ... ....name..K........t.U9.post..Ld....... .m.dprep..Lx.......I.f..x...1..P......PB..U.=l.@..B)..w.......Y.e.u.m.C.s...x.h.~R....R.....2.x.....[....#N..m.m.m.mfm....SP..NuM..9]..=.U..!...[........w...\|......^p....H......;...)..........;..EoDo....E.E.D...`.0.GG.aA.H.V.Mx\xA....../..d3.Eb_.J...R.^v........\^ob.}.z..k.x).v$f$..O)+.2..*....y}6`C6b.6cs...l...........!.........<..\|.\|..\|..\|..\|.\|....o....I%.4.L.SI.&C.6..!`...{...c..\.J.(.2.C....V.A..?.M<nG......v..m.;..R.C..aj.H...=..{.>.:.....}i_Y......:....o.&k..KY.2..6k....i]..{,.p}../.....VO3.o].fJ....R-TZ..;...RN..&V...C...3.?.......&..z.s&.D....r,.I...t.R..a$k..Mm..Y.U...+b.%kQ..

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Low\IE\XVDYWN9F\rs=AA2YrTs7yJgcuKgg907WfmLvLVlxIh60vw[1].js

Download File

Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with very long lines (1913)
Category:	dropped
Size (bytes):	188379
Entropy (8bit):	5.5430326551622375
Encrypted:	false
SSDEEP:	1536:MrSWp1E+yYwU+SUma9FXz5VEIAGRGQCz/uhYJ0z5gqcMSrqJXwNawtGaYyD3EfgF:oEV/Z9riuhYCVDSrWXZYGaAH9KsmsC
MD5:	521FD6C2EFEA3C2C5DD67C3DC3ACA40D
SHA1:	33B6FAA0A0CE411079FF1E1AC5540BD54A053875
SHA-256:	84FCEFAECB5BF7B30CF8C9D85ECE1CEB4A415F30C05A3E3FF4D4C82681A0D54B
SHA-512:	97B5F83C453C53061765FA73CDFBAB80B3A91FE23D0A52B64D185B470EB3274C0581F4E33CC56981AC5846097E041E4DDB9E90F8B85387FEEF58D15D5E25C23B
Malicious:	false
Reputation:	unknown
Preview:	this.gbar_=this.gbar_\|\|{};(function(_){var window=this;.try{._.Zj=function(a){this.J=_.w(a)};_.D(_.Zj,_.S);.}catch(e){_._DumpException(e)}.try{.var ak,bk,dk,gk,jk,ik,ck,hk;ak=function(a){try{return a.toString().indexOf("[native code]")!==-1?a:null}catch(b){return null}};bk=function(){_.Pa()};dk=function(){ck===void 0&&(ck=typeof WeakMap==="function"?ak(WeakMap):null);return ck};gk=function(a,b){(_.ek\|\|(_.ek=new ck)).set(a,b);(_.fk\|\|(_.fk=new ck)).set(b,a)};.jk=function(a){if(hk===void 0){var b=new ik([],{});hk=Array.prototype.concat.call([],b).length===1}hk&&typeof Symbol==="function"&&Symbol.isConcatSpreadable&&(a[Symbol.isConcatSpreadable]=!0)};_.kk=function(a,b,c,d){a=_.Hb(a,b,c,d);return Array.isArray(a)?a:_.ud};_.lk=function(a,b){a=(2&b?a\|2:a&-3)\|32;return a&=-2049};_.mk=function(a,b){a===0&&(a=_.lk(a,b));return a\|1};_.nk=function(a){return!!(2&a)&&!!(4&a)\|\|!!(2048&a)};_.ok=function(a,b,c){32&b&&c\|\|(a&=-33);return a};._.sk=function(a,b,c,d,e,f,g){var h=a.J,k=!!(2&b);e=k?1:e;f=!!f;

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Low\IE\XVDYWN9F\unnamed[1].png

Download File

Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	PNG image data, 24 x 24, 8-bit gray+alpha, non-interlaced
Category:	dropped
Size (bytes):	213
Entropy (8bit):	6.696528780470293
Encrypted:	false
SSDEEP:	6:6v/lhPX5AxcVJiWLeaAfumJX8OqEEYFm5zmGDe9bp:6v/7BHVtLEpJzn+zmGDeb
MD5:	93DEFA78DD419B2BEC71B80C2D02F9EC
SHA1:	3F9D86FCC1B905B1B9559139984F8306969F4FAB
SHA-256:	8DC479998BAF745C9FF0E3010565ED5566F39FF532901CA2728DE51F8524FCB7
SHA-512:	36DF40EB8EE508BB216969152D41116A6E53D2D637E09C55A2056A58CD967B5B59579FA5BCC85BA84BEB9F86E80CE714A7DB3E7404F9831621C31E41068698C2
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR.............J~.s....IDATx...U..!......d2..L.%..........{/n...:.B!........l..............?....W.....r-.../.BP.#..`...B......(.l../..i......X.\|.p.Q...g..:@...."......(B.k..+.'.......IEND.B`.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Low\MSIMGSIZ.DAT

Download File

Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	data
Category:	dropped
Size (bytes):	49120
Entropy (8bit):	0.0017331682157558962
Encrypted:	false
SSDEEP:	3:Ztt:T
MD5:	0392ADA071EB68355BED625D8F9695F3
SHA1:	777253141235B6C6AC92E17E297A1482E82252CC
SHA-256:	B1313DD95EAF63F33F86F72F09E2ECD700D11159A8693210C37470FCB84038F7
SHA-512:	EF659EEFCAB16221783ECB258D19801A1FF063478698CF4FCE3C9F98059CA7B1D060B0449E6FD89D3B70439D9735FA1D50088568FF46C9927DE45808250AEC2E
Malicious:	false
Reputation:	unknown
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\4f85221c-75d0-4487-a258-184d8c64933e.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Google Chrome extension, version 3
Category:	dropped
Size (bytes):	79436
Entropy (8bit):	7.993864503573032
Encrypted:	true
SSDEEP:	1536:J+kRVMMNiuC07fpVrunnqgiVaA7Oec0y8JsHWrq9p8yb8GVFLC6ncNG6Nzr4NbqB:UkRVM2UmpEnnqpVaA7OtL8JsHWrq9p8Z
MD5:	5DDDB5AB7BB537D99A7F54EF43217B71
SHA1:	C8FBDCE03FDE442AF37C89FB36B058E7E066157D
SHA-256:	732EFB155E999831FBCF7EEA8C95480FA18E36A74ACAA2D616A2E8B60446F6C1
SHA-512:	D9E1A7D4AACACCDDE0A4367E601FF7FEE996C843C81F2C737B4A80D2E0E702EDE8AAD480B5B749BA8FAEEF369C52FA2C634B1CCB35ED3C31075054117AD5B487
Malicious:	false
Reputation:	unknown
Preview:	Cr24..............0.."0....H.............0.........^...1"...w.g..t..2J.G1.)X4..=&.?[j,Lz..j.u.e[I.qBa/X...P.h..L.....2%3_o.......H.)'.=.e...?.......j..3UH.\|.X.M..u..s[...?$....F%....I....)..,-./.e5).f..O.q.^........9..(.._.ph2..^.YBPXf_8....h[.v...S.1`.#..5.SF.:f-.#.65.i..b.]9...y2.'....k[........K..A9..(....-.U..O.w...!....1..!..<.....^..Z.v%....ch.....K..........I^....TS......2.=WqD...^U&s&.nw.+.!..u.4..;...oc.8...mkGJ..-.?.. b6Ktn.i.'a.Kw.^..........sT.n....2...2..o(..}h. I.H.'.5.n.O.....c..R&...N..=tX...A.$,...~y..................[0Y0....H.=....*.H.=....B..............r...2..+Y.I...k..bR.j5Sl..8.......H"i.-l..`.Q.{...F0D. gJ...{@U.a.....V..n.l.q...wG.;. ..../.d.~......._..26F...O..".%............mo.:......<[.......`......G..`....4..........p8.T.6...Z...._..CV...2..k../?....[..........q...J....c.?...C.T.\..W.)L...6R..K.V.....%...O..^DrxA..6.<..S.H.qh....:l.y..{.n"./...=.N-..%....9.K..?Sv./...,E.....q.4&....1bp.....uyG.....B@

C:\Users\user\AppData\Local\Temp\6c7ce5d1-770d-4ec3-a2ae-567f38878ca3.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JPEG image data, Exif standard: [TIFF image data, little-endian, direntries=0], baseline, precision 8, 1366x720, components 3
Category:	dropped
Size (bytes):	31335
Entropy (8bit):	7.694019108205432
Encrypted:	false
SSDEEP:	768:514ugFV0910SWyR5kNVdS3sNp/xm3MbiMuYEDlyFUyv6E/ty8:5WcDWyRKNVd2M/IxMuYEDlymsTQ8
MD5:	6B72597205C77D3E40E1A35BEE403801
SHA1:	6BECEE055C6E057AF9475B6D651B4EE561D02F20
SHA-256:	C899297FBDFC88C1634B1145A087FDB5BE17172FD786C078B299557B22F06DEB
SHA-512:	7CB1A98E0C7FBB349D9CB681233A9F4ED22A1C3FAADCDF1BC270B04BD97D3FC41AB6F762B2F5F231281D63D96AC3D243640BA81D5E8CCD9F54486B4F538CA8B4
Malicious:	false
Reputation:	unknown
Preview:	......Exif..II.................Ducky.......2......Adobe.d...........................................................#"""#''''''''''..................................................!! !!''''''''''........V.."....................................................................................!1..AQ..aq."2....R..T....Br.#S.U..b..3Cs...t6.c.$D.5uV...4d.E&....%F......................!1..AQaq....."2......BRbr3CS....#..4.............?......1f.n..T......TP....E...........P.....@.........E..@......E.P........@........E.....P.P..A@@.E..@.P.P..AP.P..AP..@....T..AP.E..P.Z .. ....."... .....7.H...w.....t.....T....M.."... P..n.n..t5..B.P..(......................................( .................... .".... .".......(.. ."....... ....o......E.6... ....."........."J......Ah......@.@@....:@{6..wCp..3...((.(.........................@..(...."............................ ........T.......@.@@........AP.P..@.E@....E@.d.E@.@@..@.P.T..@..@..P.D...@M........EO..."...=.wCp.....R......P.@......

C:\Users\user\AppData\Local\Temp\9a902492-30d1-4a1d-8d4f-7dc54dc087d6.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:L:L
MD5:	5058F1AF8388633F609CADB75A75DC9D
SHA1:	3A52CE780950D4D969792A2559CD519D7EE8C727
SHA-256:	CDB4EE2AEA69CC6A83331BBE96DC2CAA9A299D21329EFB0336FC02A82E1839A8
SHA-512:	0B61241D7C17BCBB1BAEE7094D14B7C451EFECC7FFCBD92598A0F13D313CC9EBC2A07E61F007BAF58FBF94FF9A8695BDD5CAE7CE03BBF1E94E93613A00F25F21
Malicious:	false
Reputation:	unknown
Preview:	.

C:\Users\user\AppData\Local\Temp\Importer_0_4\RecoveryStore.{60923290-80A7-11EF-8C2E-ECF4BBFF258A}.dat

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	5632
Entropy (8bit):	2.0314942433275727
Encrypted:	false
SSDEEP:	24:rOGo/Q0lhhw3GW/glhhwrlhhw8slhhw69lW84n9lW84:rOGo4chhKGWYhhOhhzEhhi8Z8
MD5:	60FF3FC3523108033B41D3AEE508281A
SHA1:	8A1120EFE8BB45BB72A002F398A9393D3DB153DA
SHA-256:	A18B472CEDD4D13CB2DCC553803D6EBF38989A44CD7190080AEBB73664B74123
SHA-512:	11159DE2FF2F6E79CAD3E792A93EBB831F7C1CC937F3A987A2C008751E0D069AC5BE1A63620271B97CF03409848DFE956037DBB4B1F21082D48769E562146A64
Malicious:	false
Reputation:	unknown
Preview:	......................>.......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................R.o.o.t. .E.n.t.r.y..........................................................................................*#..................K.j.j.a.q.f.a.j.N.2.c.0.u.z.g.v.1.l.4.q.y.5.n.f.W.e...........8...............................................................F.r.a.m.e.L.i.s.t.......................................................................................................0.......O._.T.S.k.T.K.S.Y.K.e.A.7.x.G.M.L.u.z.0.u.#.8.l.i.g.=.=.........:.......................................

C:\Users\user\AppData\Local\Temp\Importer_0_4\{60923292-80A7-11EF-8C2E-ECF4BBFF258A}.dat

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	4608
Entropy (8bit):	1.9993721604231935
Encrypted:	false
SSDEEP:	24:rAJGOGV5o9lbc8LM5DnI1rN09lFm8QN75qbDKdMc05:rAJGOGV5b8LM5DnIbb8ylqbDAMc05
MD5:	5E465F31D50850A747F66E0C36476467
SHA1:	9D9227741891C4780F02DFC08BBF5D116FEA915C
SHA-256:	16B2FF57F3CF8A4C39DBD7CB69F4E4EE96F5FF94577E68E36AE578D7862E42AE
SHA-512:	233CD0986C4610FB71BA2FA6FC260997EE52E15784C9B9C2585317E25C25226E2B65BDA07FE1672A51DB9637327D87ABB74170FD70DFE78CCDE926A6C1F094B5
Malicious:	false
Reputation:	unknown
Preview:	......................>.......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................R.o.o.t. .E.n.t.r.y............................................................................................%..................K.j.j.a.q.f.a.j.N.2.c.0.u.z.g.v.1.l.4.q.y.5.n.f.W.e...........8...............................................................T.r.a.v.e.l.L.o.g.......................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Importer_0_Importer_0_4_4\cookies.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	modified
Size (bytes):	1310
Entropy (8bit):	5.405516036398781
Encrypted:	false
SSDEEP:	24:hEq08yvE6YxLo9uZOF3IZHhyYxI5PhI6YxwaZBhJYxgQIh3pYx36I6:hk/qokZiYByBJbWnJKa3pi2
MD5:	967C7C8D46530472D0710430F653D975
SHA1:	FEAAFCFA0B63B9FCDA9F0682E62B27FF476AEE5F
SHA-256:	1FA5A4696C71E3A8DB9422C747D44722CCFA8A9E9A438BDC088E8FF710915D03
SHA-512:	3A1B776E6C4CAB41D4F8CCC4333FAEFD8C0CD2E595172977E32FCDE7FDFCB4776513452C1AEFC4C342E4FF96E7622EC988866BEB10BEA379EC5B8E8014E46DB0
Malicious:	false
Reputation:	unknown
Preview:	[{"domain":"google.com","expiration":1.743675389458314e+12,"hostonly":false,"httponly":true,"msft_browser_legacy":false,"name":"NID","path":"/","same_site":-1,"secure":true,"value":"517=m-X95JoeCPCfoIHtcSxsmDi2wuwakqGlxl54bZGUpbMC8a-isGAbpG2Na1kJthkxyJutWyJR96BInrx1gm8GqFOkcoEY6cxDpArB931-8AEywgrSdlj_NkfkwtkvrNVCdHigO3n64T5OJjG2D0NbQ4RfOIRTD2zql-Sl_sWD3ScVAutPLTLnrvnwfcdARGW7_nOeLc_Xx6R7hL6-4RWij2UVns3pTxlpxWQcdbV_SDnZauyMgzVrmQ"},{"domain":"support.google.com","expiration":1.727864252e+12,"hostonly":false,"httponly":false,"msft_browser_legacy":false,"name":"_gat_gtag_UA_175894890_5","path":"/","same_site":-1,"secure":false,"value":"1"},{"domain":"support.google.com","expiration":1.727950592e+12,"hostonly":false,"httponly":false,"msft_browser_legacy":false,"name":"_gid","path":"/","same_site":-1,"secure":false,"value":"GA1.3.260907685.1727864192"},{"domain":"support.google.com","expiration":1.790936192e+12,"hostonly":false,"httponly":false,"msft_browser_legacy":false,"name":"_ga","path

C:\Users\user\AppData\Local\Temp\Low\JavaDeployReg.log

Download File

Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	89
Entropy (8bit):	4.545064330302034
Encrypted:	false
SSDEEP:	3:oVXR6vTUbQmihW8JOGXnB6vTUbQmivrFovn:o9wAbQmDqgAbQmlv
MD5:	5ADCA944B45B3DC98716F8AB06859C1F
SHA1:	B658468589ACB1FE7CA6A864DE0C9AC688EA6AF9
SHA-256:	DC08F328E149EAEE63B020D73945C5110225CE7299224959300CE68B3F463EDE
SHA-512:	6DF402DA61726CDD3190A224CA1CA5CD5C750F8D21D5DF900BF7916442F251DA5C3C2821E831C96C40839CC8499DD665E2710769E6113A2CC0526360F50CC807
Malicious:	false
Reputation:	unknown
Preview:	[2024/10/02 06:16:25.773] Latest deploy version: ..[2024/10/02 06:16:25.773] 11.381.2 ..

C:\Users\user\AppData\Local\Temp\aa06e7f6-4aa9-4dd9-a175-bcc9f132bc6a.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	PNG image data, 75 x 75, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	7475
Entropy (8bit):	7.930893376019492
Encrypted:	false
SSDEEP:	192:84TTRBK2651s1luMuYT/tWmrgXEoRDLewZlm4zjUUhyU:84vR5uMlT/omjki+4ajwU
MD5:	D4528BBDF8BF9ADDCACDEF32DB635348
SHA1:	86AD05B564582D14A7132B6F7E45FB845F10BF3A
SHA-256:	A9D98EE4FA2CCB5BD8C7DABA3D3B3DFD79D08C1329B9119308B49CE9923AD475
SHA-512:	998FCE67307DBFE4E6240E58677BCCD86EB1EB3FE7E8CFFFDBB13812FFBA51EF3A81EBBCAABD1734255E4FCD409EC13B9C55FEFED7F0875E4F5BE512C96F45D8
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR...K...K.....8Nz.....sRGB.........gAMA......a.....pHYs..........o.d....IDATx^.ilTU..g..e... .lJ..F.KX.V.5.....(.R.........E...h@v..,-..P...Rca......9.s.+..Tcb./...w.{...........`..Ro.A.< ...TI...g...B.J.)K.)K.)K.)K.)K.)K.)K.)K.)K.)K.)K.)K.)K.)K.)K.)K.)K.)K.)K.)K.)K.)K.)K.)K.)K.MY./8f?......-j.......'.m.x....d.R6........5e.Dp--.6..;.6rLl=....u.<D.a..9..c...?..>.Q...W.a....%x...]......q4...E.....-/_..rF....l,.....jz7.."N..3.C.N......C..N....Q..W.N(.-]:.[]..]{s.w.j.K.o.R.4...{w\|..P....1.c]M?.wt... x..?S.........i.g?g.R0.sV1e.g.5w$g..p.hR...r...C\|..>....p.(>..]3<.t..WN6.w.2c..`...l..N.......1.en...,..rn..R2..;..c...S.......A0.4.s.^w......q8...<]..j....r.u.........j.s^`...9....]....3..L-.....;......%.E..l.A.....w.1g..(D.-,...k.i,....Y.}.zDW}.9............Dm...eQ1w.c9...EMY..a.....E.....eA(..^..<....S...7>..g.....,c...i....k.k.....3-..z.95Q..U..D.A...X.j...B<.7`..cZ&.S3..&..{5..Jo....s.B^.4.Gsq.......<.<P.,....(x...z.u.H.z*.MCe.o..

C:\Users\user\AppData\Local\Temp\cedb937c-0229-4a61-a410-85deb5d517dd.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	PNG image data, 301 x 310, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	5137190
Entropy (8bit):	7.994808286697945
Encrypted:	true
SSDEEP:	98304:Dt0Qdo7GwBgV4QUoJLTI7/4Uhwt+DpBotJrGfNOgJMIgq1akh:RYOE6/g/4UnYtqEg6UaC
MD5:	97339AA158E91E6165676A6A148B16E6
SHA1:	F510BC11E57785AAFAC81F5388D9E945D8956522
SHA-256:	F6D125CAF291F430DDA4A8ED9D463562E3C88A838A3D15952485E981A3B7B2E3
SHA-512:	68FAD186F4265F01A44D611E80D1750A3E1992AD616A7CE71E5B4AEEDF51F2B24898911BB913607637C6C3B4F9A514685DBC1049BACFBBE2DA070A1DE7556BA0
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR...-...6.....4......pHYs..!8..!8.E.1`....sRGB.........gAMA......a.....IDATx...k.f.u...u......-....U.dd.$R.d'..G.$..r.D...`.R...Re..*kf\....D.G~........Hd...d..$-..E.D......e.......}g.....Yk...`p....\|.....z..^{......p\...{_w..w..3.7..}....z...k..k......]../.[...v..._..i.M..................S~q.D....W....[n...............U;.?...6.....5...m.............ou..3.W...u.....Lx....~.?..x./..X...._....y...........q.....5..^.re...X.w....k;3...f'I.].$....F ..B..(.. V..h.-/......2..=..-...Hg<.4....X.z..x...........`..z....#.........6....\|4..7.@3 !qC.................!.~].da.=.7..Y.L._..(k.ES.q.`V.,.....c.1.-.G.\.c.z.....=^..].z........s..z..v..[7.o...&.`...$...R..@l.x..b...,..H.+.&u.n.!.....2.(.s.7z7'.".'.C......G..0,.e.........j..v....w.G.....w...W..{..W..W.......uz....g"N.J.f...B..:\..c>..nF.4......nd_..:.uv.r.\.3{.........X..e#..W......b.}._...5)_..].z...?~.._Y.....6a.....g..(....F'...2...._;.0..&?W....L... .N.....u.u`[.....U..d..@..#..s.N.

C:\Users\user\AppData\Local\Temp\cv_debug.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1420
Entropy (8bit):	5.406294077427951
Encrypted:	false
SSDEEP:	24:YemMjYJ52mMtmZ52mMRb0VA0I+dt50qC0yZRj05NsP07F6L51P0J8T5y85Lv5y8h:YIE5QwZ5Q50i0Im50l0yZ505NsP07F6n
MD5:	3752E05C357017291F2888376CF5BCD0
SHA1:	878251A10768ABC16742408B941D9D6D0D696F67
SHA-256:	DD1ABDCFC8EEDF7913DEEAD779900930B64FC3F59D9C57A0DABDDA9FC76A3076
SHA-512:	5EE360F21FC024B0C41E27BCE16938336CC5EF66E739B7D9563EFD75E39096F6DD3F05F6394BBA1AC0B8A01A2344F0588C0C63C9773C12F5C651052A548BAC8B
Malicious:	false
Reputation:	unknown
Preview:	{"logTime": "1006/090722", "correlationVector":"rmkayOhJfEabcRCB2/Bp31","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "1006/090722", "correlationVector":"jqHPV/yTVN5KYgOfDN/5Rr","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "1006/090722", "correlationVector":"25C1A0EE3BD244A1BB83CF2641B12F1A","action":"FETCH_UX_CONFIG", "result":""}.{"logTime": "1006/093120", "correlationVector":"a/GaihlkzouX6tpAQ3civy","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "1006/093121", "correlationVector":"2831F27CA5B645488E2DF2452C16A59E","action":"FETCH_UX_CONFIG", "result":""}.{"logTime": "1006/093243", "correlationVector":"7DhT8FK3VbHYWFgub0ZtsN","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "1006/093243", "correlationVector":"83EFC8979E1A419495133BAFAFA5A23F","action":"FETCH_UX_CONFIG", "result":""}.{"logTime": "1006/093745", "correlationVector":"Bxyvid0fodNJ7Wehc/BC7P","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "1006/093746", "correlationVector":"B1516CBB

C:\Users\user\AppData\Local\Temp\effbbae1-73cb-496b-8203-13248af4d378.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Google Chrome extension, version 3
Category:	dropped
Size (bytes):	11185
Entropy (8bit):	7.951995436832936
Encrypted:	false
SSDEEP:	192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
MD5:	78E47DDA17341BED7BE45DCCFD89AC87
SHA1:	1AFDE30E46997452D11E4A2ADBBF35CCE7A1404F
SHA-256:	67D161098BE68CD24FEBC0C7B48F515F199DDA72F20AE3BBB97FCF2542BB0550
SHA-512:	9574A66D3756540479DC955C4057144283E09CAE11CE11EBCE801053BB48E536E67DC823B91895A9E3EE8D3CB27C065D5E9030C39A26CBF3F201348385B418A5
Malicious:	false
Reputation:	unknown
Preview:	Cr24..............0.."0....H.............0.........N.......E#......9e.u.q...VYY..@.+.C..k.O..bK.`..6.G..%.....3Z...e _.6....F..1p..K.Z......./ .3...OT..`..0...Y...FT..43.th.y...}....p.L...2S.&i.`..o...f.oH.....N..:..ijT.3.F{.0.,.f?'f.CQt;b_"Pc.. ..~S.I.c.8Z.;.....{G.a......k...>.`.o..%.$>;.....g.............jg?.R..@.:..........&..{...x@.Py..;kT....%F".S..w...N....9...A..@X.t!i.@..1;......1E..X.....[.~$....J......;=T.;)k..Y...$......S......M.P..P..>..=..u.....2p...w.9..1qw.a\A..Vj .C.....A..Cf1.r6.A...L. _m...[..l.Wr_../.. .B..9!.!+..ZG.K.......0.."0....H.............0.........^SUd%Q.L].......Cl2o...\[.....'*...;R=....N.C5....d. .....J.C>u.kr..Y..syJC.XS.q..E.n?....(G.5..)2.G..!.M.SS.{..U....!.EE..M[.#qs.A.1...g)nQ.c..G....Bd..7... .O.BI..KXQ..4.d.K.0......g.....-p....Z.E{...M&.~n.TE7..{0....5.#.C+3.y)pd9.e.........@..3.9..B.....I....2nX........2.?.~..S....]G.N.....Lr.O.Ve....9..D1.G..W)...P.?=.#..7.R.lz..a.wX.e..h.h.~....v..RP.@X....d.G

C:\Users\user\AppData\Local\Temp\nsm983C.tmp\listicka.exe

Download File

Process:	C:\Users\user\Desktop\1a4e5ccd35a56d84281a143f831563be.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive
Category:	dropped
Size (bytes):	11265280
Entropy (8bit):	7.999733434812855
Encrypted:	true
SSDEEP:	196608:kdj55vVVlA1+bzOkUHQGuhlL3indHXPhiSpIUi5cOong7YflZP9uKy8Mpg:o5FHW1+zOkT7Kd3P43Uz5gglZPAg
MD5:	B29BFD8EE3A426894B4CA3753E5B62A8
SHA1:	47DCA130179D877ABC85CD7046A469C3AC74F502
SHA-256:	D3D7E6B3F65BA7375D356DA4818F8CAF09B185E200DD97310ABEADA793D82077
SHA-512:	2DDBF6C4D38029089DB20BBF8D942BC852E6E48DDA834E492BE423AB5556C33BD180B2B4EA2DE791D48EDC581ED819F36583D3142293AD6FC53EC794EC5A4EB3
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......1..:u..iu..iu..i..iw..iu..i...i..id..i!..i...i...it..iRichu..i........................PE..L......K.................\..........<2.......p....@..........................`......n........................................s..........hI.............8............................................................p...............................text...ZZ.......\.................. ..`.rdata.......p.......`..............@..@.data................r..............@....ndata.......@...........................rsrc...hI.......J...v..............@..@................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe

Download File

Process:	C:\Users\user\Desktop\1a4e5ccd35a56d84281a143f831563be.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive
Category:	dropped
Size (bytes):	13675184
Entropy (8bit):	7.999443347465706
Encrypted:	true
SSDEEP:	393216:1pOtxS2JzVMrK5r8KmON15WytJQmA79/uFJOV:1pgxSezmdq1ztJQl
MD5:	3DF3D3C125D3BB1A5BD55E88F9E48920
SHA1:	72F3E2F18E83D60EC657F03C341A3C1DF701C2A9
SHA-256:	CC36161B6D8EA29528BED7D5883AD260CFC8D8E32825938C52E93C1A495C355B
SHA-512:	A171CB62B35F63749F25196F5F94805F44B1795BA9D0C4E9A26F2511AFFF82F500F76B913B96F83E777E0A4089A4DCD5D804B1FCD5A655DC094B741198B25BCB
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......1.D9u.ju.ju.j..ujw.ju.+j..j..wjd.j!..j..j..,jt.jRichu.j........PE..L....n3T.................`.........Z3.......p....@..................................s....@..................................t...........<..........h...H............................................................p...............................text....^.......`.................. ..`.rdata..T....p.......d..............@..@.data................x..............@....ndata...................................rsrc....<.......>...~..............@..@................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\nsrF0EA.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsm983C.tmp\listicka.exe
File Type:	data
Category:	dropped
Size (bytes):	14311503
Entropy (8bit):	7.9668883046498875
Encrypted:	false
SSDEEP:	196608:Xl5ln+DosMIrlh/553RShz6/2pEDq9scu1/0fAhN87Mumb9rD9yVbhT0dJ:FeMIrX3hca2peqg0f8CFmtkw
MD5:	BBB12719E565C13582BFEF4DD2B67F39
SHA1:	133B26AA91BFB21993ED6143D93415D426D203E0
SHA-256:	96160A98242CE256D2305AC7FB5D3FC87888B963A21A8E987ACF4CEF8268DC51
SHA-512:	9889D55CF57C560A2A543CBC20BA3DC1523CD4D7F00B64AB10E32487952686A91CF72A133B0D0E63D38AC0FF42C58BE9564EE396D34A3907B03D394DE6DC5424
Malicious:	false
Reputation:	unknown
Preview:	.=......,......................../.......<.......=..........................................................................:...!...............................................................................................................................................................................j...........................................................................................................................................;...7...s6..................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\nsrF139.tmp\System.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsm983C.tmp\listicka.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	11264
Entropy (8bit):	5.568877095847681
Encrypted:	false
SSDEEP:	192:7DKnJZCv6VmbJQC+tFiUdK7ckD4gRXKQx+LQ2CSF:7ViJrtFRdbmXK8+PCw
MD5:	C17103AE9072A06DA581DEC998343FC1
SHA1:	B72148C6BDFAADA8B8C3F950E610EE7CF1DA1F8D
SHA-256:	DC58D8AD81CACB0C1ED72E33BFF8F23EA40B5252B5BB55D393A0903E6819AE2F
SHA-512:	D32A71AAEF18E993F28096D536E41C4D016850721B31171513CE28BBD805A54FD290B7C3E9D935F72E676A1ACFB4F0DCC89D95040A0DD29F2B6975855C18986F
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......)...m.m.m...k.m.~....j....l.9..i....l.Richm.........................PE..L......K...........!................0).......0...............................`......................................p2......t0..P............................P.......................................................0..X............................text...1........................... ..`.rdata.......0......."..............@..@.data...d....@.......&..............@....reloc.......P.......(..............@..B................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\nsrF139.tmp\UserInfo.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsm983C.tmp\listicka.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	4096
Entropy (8bit):	3.331979080664426
Encrypted:	false
SSDEEP:	48:iViF7LLM4wXqQH1wRrOpArXMVyjlZSXRN:ky7EcQHu4tVy4R
MD5:	7579ADE7AE1747A31960A228CE02E666
SHA1:	8EC8571A296737E819DCF86353A43FCF8EC63351
SHA-256:	564C80DEC62D76C53497C40094DB360FF8A36E0DC1BDA8383D0F9583138997F5
SHA-512:	A88BC56E938374C333B0E33CB72951635B5D5A98B9CB2D6785073CBCAD23BF4C0F9F69D3B7E87B46C76EB03CED9BB786844CE87656A9E3DF4CA24ACF43D7A05B
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.....................4..............Rich..................PE..L......K...........!......................... ...............................P...................................... "......L ..<............................@..d.................................................... ..L............................text............................... ..`.rdata....... ......................@..@.data...X....0......................@....reloc.......@......................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\nsrF139.tmp\nsExec.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsm983C.tmp\listicka.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	6656
Entropy (8bit):	5.036651327230889
Encrypted:	false
SSDEEP:	96:M7GUb+YNfwgcr8zyKwZ5S4JxN8BS0ef9/3VI9d0qqyVgNk32E:eKgfwgcr8zylsB49Ud0qJVgNX
MD5:	ACC2B699EDFEA5BF5AAE45ABA3A41E96
SHA1:	D2ACCF4D494E43CEB2CFF69ABE4DD17147D29CC2
SHA-256:	168A974EAA3F588D759DB3F47C1A9FDC3494BA1FA1A73A84E5E3B2A4D58ABD7E
SHA-512:	E29EA10ADA98C71A18273B04F44F385B120D4E8473E441CE5748CFA44A23648814F2656F429B85440157988C88DE776C6AC008DC38BF09CBB746C230A46C69FE
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........................,.................Rich...........PE..L......K...........!......................... ...............................P.......................................$..l.... ..P............................@....................................................... ...............................text...H........................... ..`.rdata..,.... ......................@..@.data........0......................@....reloc.......@......................@..B................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\nst9CA0.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe
File Type:	data
Category:	dropped
Size (bytes):	69963569
Entropy (8bit):	6.8597847627497766
Encrypted:	false
SSDEEP:	786432:KhzomEQ6MeKCjUAb1Olphfd7hbvTTyQ6MneaivIsXHPTqO2D8CYjzyGJDYBCZW0o:KNo1ymaZmakDsG
MD5:	D464B2FC26B687DA72E97A2413856CAA
SHA1:	12DA840880FE1CDBDE2FF8F6F35C7D79CF434095
SHA-256:	515E46D63DC1DEF0B5D012DC647D8BB32128C4469ECB94E5395544581617D8F2
SHA-512:	1B2507DF325415B152F26A80AB1CC8CB39402FBC3A2F1905A007D9478EFA1AF3034CD90F7D2A1FABF39A08CA2FC884E60D8B4DFD1B27B6DA75EC769C1550F1CE
Malicious:	false
Reputation:	unknown
Preview:	:.......,.......l...............h......."t..(..............................Y...p.......................r.......................k...........................................................................................................................................................G...Q...........N...................................................................g.......r...u...}.......A.......................................j.......~...............A......................................................................................................................._.......A........................................=......................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\nst9CEF.tmp\NSIS_Picasa_Unicode.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	118784
Entropy (8bit):	5.899572345296594
Encrypted:	false
SSDEEP:	1536:dOtqwO74MR/Ynna5Rig8fsrjPxSh7Y4MzpI3i0ALxAgfIVFBkIw9PntNHP6oHj:dOtq97b5oNqzv0WAZVFmIw9vtNv6C
MD5:	BA1FAB5556089B2F83B816DDE35C6132
SHA1:	5318B0C62B993377DE2E0295F1E2B7A1675C595E
SHA-256:	9E95B4566EA243C0A6743B5B0626FCF18EC98E38415B62F94F6CBF38276D7FC4
SHA-512:	4C04E5CE6CB339AD22A77889C11775A263EF13322F37BC9C982FF208852B091809A0C63A7C9515949F81F3AB253A417F93ADC6D2EEED9A801F2254FBB5236A50
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........O..........T......T.....T.......................N....T......T......T......T.....Rich...........................PE..L......R...........!..... ...........f.......0......................................................................pn.......b..................................t...p2...............................[..@............0..0............................text...8........ .................. ..`.rdata..Y@...0...P...0..............@..@.data...X3....... ..................@....rsrc...............................@..@.reloc..,........ ..................@..B........................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\nst9CEF.tmp\StdUtils.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	23040
Entropy (8bit):	5.991034918923395
Encrypted:	false
SSDEEP:	384:/ZXKPdeCX+qEHZT7QtPbCqET5E1lMFCUjaAWhTGBgFJKsddmAkBUG:/ZXsdeCXCHdctPbCqpgyVFJ4
MD5:	56902114955A13EC66BD3A43EAEB46ED
SHA1:	0D0BF7E94DAD5B04B6DA52ED5E4425B17355E10D
SHA-256:	5B7070E98320F38CD913893C813E59863EC833EC598208F5D33217A120E3E043
SHA-512:	028C79FF7B4C3B9E731904108DFDFE359BAB1C29B53FEEA758714C7D8E86A1C93193CF80B3E41D691E6A4DA08C2DE18851A6FF53AC4E612C1000B1930780251C
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............v...v...v....@..v...v...v...i...v...j...v....P..v....x..v....H..v....I..v....N..v..Rich.v..........................PE..L....j/S...........!.....:...........#.......P............................................@..........................[..:...lV.......p...............................................................................P...............................text....8.......:.................. ..`.rdata.......P.......>..............@..@.data........`.......N..............@....rsrc........p.......P..............@..@.reloc...............T..............@..B................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\nst9CEF.tmp\System.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	11776
Entropy (8bit):	5.656006343879828
Encrypted:	false
SSDEEP:	192:eP24sihno00Wfl97nH6T2enXwWobpWBTU4VtHT7dmN35OlbSl:T8QIl975eXqlWBrz7YLOlb
MD5:	3E6BF00B3AC976122F982AE2AADB1C51
SHA1:	CAAB188F7FDC84D3FDCB2922EDEEB5ED576BD31D
SHA-256:	4FF9B2678D698677C5D9732678F9CF53F17290E09D053691AAC4CC6E6F595CBE
SHA-512:	1286F05E6A7E6B691F6E479638E7179897598E171B52EB3A3DC0E830415251069D29416B6D1FFC6D7DCE8DA5625E1479BE06DB9B7179E7776659C5C1AD6AA706
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......1...u.u.u...s.u.a....r.!..q....t....t.Richu.........................PE..L....n3T...........!..... ...........'.......0...............................`.......................................2.......0..P............................P.......................................................0..X............................text............ .................. ..`.rdata..S....0.......$..............@..@.data...x....@.......(..............@....reloc..b....P.......*..............@..B................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\nst9CEF.tmp\modern-wizard.bmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe
File Type:	PC bitmap, Windows 3.x format, 164 x 314 x 4, image size 26376, resolution 2834 x 2834 px/m, cbSize 26494, bits offset 118
Category:	dropped
Size (bytes):	26494
Entropy (8bit):	1.9568109962493656
Encrypted:	false
SSDEEP:	24:Qwika6aSaaDaVYoG6abuJsnZs5GhI11BayNXPcDrSsUWcSphsWwlEWqCl6aHAX2x:Qoi47a5G8SddzKFIcsOz3Xz
MD5:	CBE40FD2B1EC96DAEDC65DA172D90022
SHA1:	366C216220AA4329DFF6C485FD0E9B0F4F0A7944
SHA-256:	3AD2DC318056D0A2024AF1804EA741146CFC18CC404649A44610CBF8B2056CF2
SHA-512:	62990CB16E37B6B4EFF6AB03571C3A82DCAA21A1D393C3CB01D81F62287777FB0B4B27F8852B5FA71BC975FEAB5BAA486D33F2C58660210E115DE7E2BD34EA63
Malicious:	false
Reputation:	unknown
Preview:	BM~g......v...(.......:............g..................................................................................DDD@@@@DDDDDD@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@DDDDDDDDDD@@@@DDDDDDDDD@@@@@@..DDD....DDDDDD........................................DDDDDDDDDD....DDDDDDDDD........DD@@@@DDDDDD@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@DDDDDDDDD@@@@DDDDDDDDDD@@@@@@D..DD....DDDDDDD......................................DDDDDDDDDD....DDDDDDDDDD......D..D@@@@@DDDDDD@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@DDDDDDDDDD@@@@DDDDDDDDDD@@@@@DDD..D.....DDDDDD......................................DDDDDDDDD.....DDDDDDDDD......DDD..@@@@@DDDDDD@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@DDDDDDDDDD@@@@DDDDDDDDDD@@@@@@DDDD.......DDDDDD.....................................DDDDDDDDDD....DDDDDDDDDD.....DDDDD..@@@@@DDDDDD@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@DDDDDDDDDD@@@@DDDDDDDDD@@@@@@DDDDDD.......DDDDDD....................................DDDDDDDDD....DDDDDDDDDD......DDDDDD..@@@@DDDDDD@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@

C:\Users\user\AppData\Local\Temp\nst9CEF.tmp\nsDialogs.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	9728
Entropy (8bit):	5.085052165111978
Encrypted:	false
SSDEEP:	96:33YnIxFkDUGZpKSmktse3GpmD8pevbE9cxSgB5PKtAtYE9v5E9KntrmfVEB3YdkS:33YIvGZDdtP8pevbg0PuAYK56NyoIFI
MD5:	DBDBF4017FF91C9DE328697B5FD2E10A
SHA1:	B597A5E9A8A0B252770933FEED51169B5060A09F
SHA-256:	BE60A00F32924CCBE03F9914E33B8E1AD8C8A1CA442263A69896EFBA74925B36
SHA-512:	3BEFC15AAB0A5DBE7FDE96155B0499D385F2799B1A2D47CE04F37B5804006B1C6C4FFF93D3CEDB56A2A8172B23752B6F9DC6168CFCE3596B91DEF3247836CF10
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......../.c.N`0.N`0.N`0.Na0.N`0{A=0.N`0.mP0.N`0.Hf0.N`0Gnd0.N`0Rich.N`0........................PE..L....n3T...........!.........0...............0.......................................................................6..k....0.......p...............................................................................0...............................text...t........................... ..`.rdata..k....0......................@..@.data...h!...@......................@....rsrc........p....... ..............@..@.reloc..r............"..............@..B................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\nsu8781.tmp\ButtonEvent.dll

Download File

Process:	C:\Users\user\Desktop\1a4e5ccd35a56d84281a143f831563be.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	4608
Entropy (8bit):	4.423022883583039
Encrypted:	false
SSDEEP:	96:hrA2+5HGZFYJf9D8IjDflDCoMzncsGSmE:hE2+5mMJfJ8v1zFGSm
MD5:	55788069D3FA4E1DAF80F3339FA86FE2
SHA1:	D64E05C1879A92D5A8F9FF2FD2F1A53E1A53AE96
SHA-256:	D6E429A063ADF637F4D19D4E2EB094D9FF27382B21A1F6DCCF9284AFB5FF8C7F
SHA-512:	D3B1EEC76E571B657DF444C59C48CAD73A58D1A10FF463CE9F3ACD07ACCE17D589C3396AD5BDB94DA585DA08D422D863FFE1DE11F64298329455F6D8EE320616
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......%Nr.a/..a/..a/..hW..d/..a/..j/..5.,.`/...Y..`/...Y..`/...Y..`/...Y..`/..Richa/..........PE..L...3*.M...........!......................... ...............................`............@.........................p!......H ..<....@.......................P....................................................... ..4............................text...;........................... ..`.rdata....... ......................@..@.data...l....0......................@....rsrc........@......................@..@.reloc.......P......................@..B................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\nsu8781.tmp\System.dll

Download File

Process:	C:\Users\user\Desktop\1a4e5ccd35a56d84281a143f831563be.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	27136
Entropy (8bit):	5.98616973067504
Encrypted:	false
SSDEEP:	384:Hh2aeOfOkR+nMsNNtnQ8+y4nLD/B6D8p/Ykv7HyVOIgMHciS6hM:SOj4MWNxl+yCIDIv+nHI6
MD5:	4F25D99BF1375FE5E61B037B2616695D
SHA1:	958FAD0E54DF0736DDAB28FF6CB93E6ED580C862
SHA-256:	803931797D95777248DEE4F2A563AED51FE931D2DD28FAEC507C69ED0F26F647
SHA-512:	96A8446F322CD62377A93D2088C0CE06087DA27EF95A391E02C505FB4EB1D00419143D67D89494C2EF6F57AE2FD7F049C86E00858D1B193EC6DDE4D0FE0E3130
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...<.J_...........#...".F...f....../4.......`....td......................................@... .................................................................x...........................Tt......................4................................text....E.......F..................`.P`.data...4....`.......J..............@.0..rdata.......p.......L..............@.`@.bss..................................`..edata...............V..............@.0@.idata...............X..............@.0..CRT....,............`..............@.0..tls.................b..............@.0..reloc..x............d..............@.0B........................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\nsu8781.tmp\nsDialogs.dll

Download File

Process:	C:\Users\user\Desktop\1a4e5ccd35a56d84281a143f831563be.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	5.528984088103622
Encrypted:	false
SSDEEP:	192:lGqmrBw8Xk21Nu4xfuM5/x9e1oh6YYkvQh+hlfqO1OoAs546QN:gqmr3i4xm+/x9Ooh6YYkvblfVgocTN
MD5:	2029C44871670EEC937D1A8C1E9FAA21
SHA1:	E8D53B9E8BC475CC274D80D3836B526D8DD2747A
SHA-256:	A4AE6D33F940A80E8FE34537C5CC1F8B8679C979607969320CFB750C15809AC2
SHA-512:	6F151C9818AC2F3AEF6D4CABD8122C7E22CCF0B84FA5D4BCC951F8C3D00E8C270127EAC1E9D93C5F4594AC90DE8AFF87DC6E96562F532A3D19C0DA63A28654B7
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...<.J_...........#..."........."..."............4c......................................@... ......................p..k.......4....................................................................................................................text............................... .0`.rdata.......0......................@.0@.bss....T ...@........................`..edata..k....p....... ..............@.0@.idata..4............"..............@.0..rsrc................*..............@.0..reloc...............,..............@.0B........................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\nsu8781.tmp\pozadi.bmp

Download File

Process:	C:\Users\user\Desktop\1a4e5ccd35a56d84281a143f831563be.exe
File Type:	PC bitmap, Windows 3.x format, 452 x 230 x 24, image size 311880, resolution 2835 x 2835 px/m, cbSize 311934, bits offset 54
Category:	dropped
Size (bytes):	311934
Entropy (8bit):	5.29529776926217
Encrypted:	false
SSDEEP:	3072:PA44dysbt111oWDTUCODRtEWkmXUU5pnCMvzepjo+5F5pppppUQ:2y81o6TUCOQWkmXUU5pnCMvzeFo+5F0Q
MD5:	B1201AA44B5E7FC961CC8066990942BF
SHA1:	F592AB4BA98DB14D13E470F1260808E219C92467
SHA-256:	08BBE10B17ADBABE84FAD5337E5688E1D6C837F5F5252962378766F693F62E4B
SHA-512:	9316E82FF68BD810F69E18BA2819DC62D6A60C7090592B1DFE765849C5B0370C8715244822A465BC4A5A49866BE82743CA80A610CE24AB37BB4C94F33FE1394D
Malicious:	false
Reputation:	unknown
Preview:	BM~.......6...(...................H.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\scoped_dir2064_1890881398\CRX_INSTALL\_metadata\verified_contents.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1753
Entropy (8bit):	5.8889033066924155
Encrypted:	false
SSDEEP:	48:Pxpr7Xka2NXDpfsBJODI19Kg1JqcJW9O//JE3ZBDcpu/x:L3XgNSz9/4kIO3u3Xgpq
MD5:	738E757B92939B24CDBBD0EFC2601315
SHA1:	77058CBAFA625AAFBEA867052136C11AD3332143
SHA-256:	D23B2BA94BA22BBB681E6362AE5870ACD8A3280FA9E7241B86A9E12982968947
SHA-512:	DCA3E12DD5A9F1802DB6D11B009FCE2B787E79B9F730094367C9F26D1D87AF1EA072FF5B10888648FB1231DD83475CF45594BB0C9915B655EE363A3127A5FFC2
Malicious:	false
Reputation:	unknown
Preview:	[.. {.. "description": "treehash per file",.. "signed_content": {.. "payload": "eyJpdGVtX2lkIjoiam1qZmxnanBjcGVwZWFmbW1nZHBma29na2doY3BpaGEiLCJpdGVtX3ZlcnNpb24iOiIxLjIuMSIsInByb3RvY29sX3ZlcnNpb24iOjEsImNvbnRlbnRfaGFzaGVzIjpbeyJmb3JtYXQiOiJ0cmVlaGFzaCIsImRpZ2VzdCI6InNoYTI1NiIsImJsb2NrX3NpemUiOjQwOTYsImhhc2hfYmxvY2tfc2l6ZSI6NDA5NiwiZmlsZXMiOlt7InBhdGgiOiJjb250ZW50LmpzIiwicm9vdF9oYXNoIjoiQS13R1JtV0VpM1lybmxQNktneUdrVWJ5Q0FoTG9JZnRRZGtHUnBEcnp1QSJ9LHsicGF0aCI6ImNvbnRlbnRfbmV3LmpzIiwicm9vdF9oYXNoIjoiVU00WVRBMHc5NFlqSHVzVVJaVTFlU2FBSjFXVENKcHhHQUtXMGxhcDIzUSJ9LHsicGF0aCI6Im1hbmlmZXN0Lmpzb24iLCJyb290X2hhc2giOiJKNXYwVTkwRmN0ejBveWJMZmZuNm5TbHFLU0h2bHF2YkdWYW9FeWFOZU1zIn1dfV19",.. "signatures": [.. {.. "header": {.. "kid": "publisher".. },.. "protected": "eyJhbGciOiJSUzI1NiJ9",.. "signature": "UglEEilkOml5P1W0X6wc-_dB87PQB73uMir11923av57zPKujb4IUe_lbGpn7cRZsy6x-8i9eEKxAW7L2TSmYqrcp4XtiON6ppcf27FWACXOUJDax9wlMr-EOtyZhykCnB9vR

C:\Users\user\AppData\Local\Temp\scoped_dir2064_1890881398\CRX_INSTALL\content.js

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Unicode text, UTF-8 text, with very long lines (8031), with no line terminators
Category:	dropped
Size (bytes):	9815
Entropy (8bit):	6.1716321262973315
Encrypted:	false
SSDEEP:	192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3zEScQZBMX:+ThBVq3npozftROQIyVfjRZGB365Ey97
MD5:	3D20584F7F6C8EAC79E17CCA4207FB79
SHA1:	3C16DCC27AE52431C8CDD92FBAAB0341524D3092
SHA-256:	0D40A5153CB66B5BDE64906CA3AE750494098F68AD0B4D091256939EEA243643
SHA-512:	315D1B4CC2E70C72D7EB7D51E0F304F6E64AC13AE301FD2E46D585243A6C936B2AD35A0964745D291AE9B317C316A29760B9B9782C88CC6A68599DB531F87D59
Malicious:	false
Reputation:	unknown
Preview:	(()=>{"use strict";var e={1:(e,o)=>{Object.defineProperty(o,"__esModule",{value:!0}),o.newCwsPromotionalButtonCta=o.chromeToEdgeCwsButtonCtaMapping=void 0,o.chromeToEdgeCwsButtonCtaMapping={"...... ... Chrome":"...... ....","........ .. Chrome":".....",........:"..........",".......... .. Chrome":"..........","Chrome . .....":"...","Chrome .... ....":"....","Afegeix a Chrome":"Obt.n","Suprimeix de Chrome":"Suprimeix","P.idat do Chromu":"Z.skat","Odstranit z Chromu":"Odebrat","F.j til Chrome":"F.","Fjern fra Chrome":"Fjerne",Hinzuf.gen:"Abrufen","Aus Chrome entfernen":"Entfernen","Add to Chrome":"Get","Remove from Chrome":"Remove","A.adir a Chrome":"Obtener",Desinstalar:"Quitar","Agregar a Chrome":"Obtener","Eliminar de Chrome":"Quitar","Lisa Chrome'i":"Hangi","Chrome'ist eemaldamine":"Eemalda",.......H:"........","......... ... .. Chr

C:\Users\user\AppData\Local\Temp\scoped_dir2064_1890881398\CRX_INSTALL\content_new.js

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Unicode text, UTF-8 text, with very long lines (8604), with no line terminators
Category:	dropped
Size (bytes):	10388
Entropy (8bit):	6.174387413738973
Encrypted:	false
SSDEEP:	192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
MD5:	3DE1E7D989C232FC1B58F4E32DE15D64
SHA1:	42B152EA7E7F31A964914F344543B8BF14B5F558
SHA-256:	D4AA4602A1590A4B8A1BCE8B8D670264C9FB532ADC97A72BC10C43343650385A
SHA-512:	177E5BDF3A1149B0229B6297BAF7B122602F7BD753F96AA41CCF2D15B2BCF6AF368A39BB20336CCCE121645EC097F6BEDB94666C74ACB6174EB728FBFC43BC2A
Malicious:	false
Reputation:	unknown
Preview:	(()=>{"use strict";var e={1:(e,o)=>{Object.defineProperty(o,"__esModule",{value:!0}),o.newCwsPromotionalButtonCta=o.chromeToEdgeCwsButtonCtaMapping=void 0,o.chromeToEdgeCwsButtonCtaMapping={"...... ... Chrome":"...... ....","........ .. Chrome":".....",........:"..........",".......... .. Chrome":"..........","Chrome . .....":"...","Chrome .... ....":"....","Afegeix a Chrome":"Obt.n","Suprimeix de Chrome":"Suprimeix","P.idat do Chromu":"Z.skat","Odstranit z Chromu":"Odebrat","F.j til Chrome":"F.","Fjern fra Chrome":"Fjerne",Hinzuf.gen:"Abrufen","Aus Chrome entfernen":"Entfernen","Add to Chrome":"Get","Remove from Chrome":"Remove","A.adir a Chrome":"Obtener",Desinstalar:"Quitar","Agregar a Chrome":"Obtener","Eliminar de Chrome":"Quitar","Lisa Chrome'i":"Hangi","Chrome'ist eemaldamine":"Eemalda",.......H:"........","......... ... .. Chr

C:\Users\user\AppData\Local\Temp\scoped_dir2064_1890881398\CRX_INSTALL\manifest.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	962
Entropy (8bit):	5.698567446030411
Encrypted:	false
SSDEEP:	24:1Hg9+D3DRnbuF2+sUrzUu+Y9VwE+Fg41T1O:NBqY+6E+F7JO
MD5:	E805E9E69FD6ECDCA65136957B1FB3BE
SHA1:	2356F60884130C86A45D4B232A26062C7830E622
SHA-256:	5694C91F7D165C6F25DAF0825C18B373B0A81EA122C89DA60438CD487455FD6A
SHA-512:	049662EF470D2B9E030A06006894041AE6F787449E4AB1FBF4959ADCB88C6BB87A957490212697815BB3627763C01B7B243CF4E3C4620173A95795884D998A75
Malicious:	false
Reputation:	unknown
Preview:	{.. "content_scripts": [ {.. "js": [ "content.js" ],.. "matches": [ "https://chrome.google.com/webstore/" ].. }, {.. "js": [ "content_new.js" ],.. "matches": [ "https://chromewebstore.google.com/" ].. } ],.. "description": "Edge relevant text changes on select websites to improve user experience and precisely surfaces the action they want to take.",.. "key": "MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAu06p2Mjoy6yJDUUjCe8Hnqvtmjll73XqcbylxFZZWe+MCEAEK+1D0Nxrp0+IuWJL02CU3jbuR5KrJYoezA36M1oSGY5lIF/9NhXWEx5GrosxcBjxqEsdWv/eDoOOEbIvIO0ziMv7T1SUnmAA07wwq8DXWYuwlkZU/PA0Mxx0aNZ5+QyMfYqRmMpwxkwPG8gyU7kmacxgCY1v7PmmZo1vSIEOBYrxl064w5Q6s/dpalSJM9qeRnvRMLsszGY/J2bjQ1F0O2JfIlBjCOUg/89+U8ZJ1mObOFrKO4um8QnenXtH0WGmsvb5qBNrvbWNPuFgr2+w5JYlpSQ+O8zUCb8QZwIDAQAB",.. "manifest_version": 3,.. "name": "Edge relevant text changes",.. "update_url": "https://edge.microsoft.com/extensionwebstorebase/v1/crx",.. "version": "1.2.1"..}..

C:\Users\user\AppData\Local\Temp\scoped_dir2064_1890881398\effbbae1-73cb-496b-8203-13248af4d378.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Google Chrome extension, version 3
Category:	dropped
Size (bytes):	11185
Entropy (8bit):	7.951995436832936
Encrypted:	false
SSDEEP:	192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
MD5:	78E47DDA17341BED7BE45DCCFD89AC87
SHA1:	1AFDE30E46997452D11E4A2ADBBF35CCE7A1404F
SHA-256:	67D161098BE68CD24FEBC0C7B48F515F199DDA72F20AE3BBB97FCF2542BB0550
SHA-512:	9574A66D3756540479DC955C4057144283E09CAE11CE11EBCE801053BB48E536E67DC823B91895A9E3EE8D3CB27C065D5E9030C39A26CBF3F201348385B418A5
Malicious:	false
Reputation:	unknown
Preview:	Cr24..............0.."0....H.............0.........N.......E#......9e.u.q...VYY..@.+.C..k.O..bK.`..6.G..%.....3Z...e _.6....F..1p..K.Z......./ .3...OT..`..0...Y...FT..43.th.y...}....p.L...2S.&i.`..o...f.oH.....N..:..ijT.3.F{.0.,.f?'f.CQt;b_"Pc.. ..~S.I.c.8Z.;.....{G.a......k...>.`.o..%.$>;.....g.............jg?.R..@.:..........&..{...x@.Py..;kT....%F".S..w...N....9...A..@X.t!i.@..1;......1E..X.....[.~$....J......;=T.;)k..Y...$......S......M.P..P..>..=..u.....2p...w.9..1qw.a\A..Vj .C.....A..Cf1.r6.A...L. _m...[..l.Wr_../.. .B..9!.!+..ZG.K.......0.."0....H.............0.........^SUd%Q.L].......Cl2o...\[.....'*...;R=....N.C5....d. .....J.C>u.kr..Y..syJC.XS.q..E.n?....(G.5..)2.G..!.M.SS.{..U....!.EE..M[.#qs.A.1...g)nQ.c..G....Bd..7... .O.BI..KXQ..4.d.K.0......g.....-p....Z.E{...M&.~n.TE7..{0....5.#.C+3.y)pd9.e.........@..3.9..B.....I....2nX........2.?.~..S....]G.N.....Lr.O.Ve....9..D1.G..W)...P.?=.#..7.R.lz..a.wX.e..h.h.~....v..RP.@X....d.G

C:\Users\user\AppData\Local\Temp\~0069FB97.00001B74.sznpkg\REG.EXE

Download File

Process:	C:\Users\user\AppData\Roaming\Seznam.cz\sznsetup-lt.exe
File Type:	PE32 executable (console) Intel 80386, for MS Windows, UPX compressed
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	7.46636516722735
Encrypted:	false
SSDEEP:	384:REIT5kXU5oFOHBUjR92sdsApBkZzziOnXjPQ7elTVfN+yWMWgSJ:GITmXU5ocHBuf2AEPnXj47UTV1+yWyS
MD5:	F0C0D05727A4E1E91F4347C2270500AA
SHA1:	8F26B474CB7A8F8ACE40E98574034D7322B1FBE8
SHA-256:	AA7C78CEDE348C8DB9F932C2C54EE746E6B528691811DE44578D238BA02721E2
SHA-512:	7FE720EFD2A94624DFA5492AFA6D0342CAD232BCF8159D59AD2E52D8A21BE1566BC457E980185BBF8E1332FD48199A1AD9D18B076CBB39F1011DC24B2601A25A
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......<.p.x..Px..Px..P...Pz..Px..P...P..CPq..P..@Py..P..APb..P..DPy..PRichx..P................PE..L....R.H.................P.......p..............................................................................................@.......................................................................H...........................................UPX0.....p..............................UPX1.....P.......D..................@....rsrc................H..............@......................................................................................................................................................................................................................................................................................................................................................................................................................3.08.UPX!....

C:\Users\user\AppData\Local\Temp\~0069FB97.00001B74.sznpkg\UNZIP.EXE

Download File

Process:	C:\Users\user\AppData\Roaming\Seznam.cz\sznsetup-lt.exe
File Type:	PE32 executable (console) Intel 80386, for MS Windows, UPX compressed
Category:	dropped
Size (bytes):	73728
Entropy (8bit):	7.863576242567582
Encrypted:	false
SSDEEP:	1536:LR0NFZXT9oWZFiKnMFzPMKv51BmFiU8HqyDyU3irQI:LspoWZ4KMFQKv5XyiqyDyUcQI
MD5:	3FC25896B5B2FB8E20F28FAB8C0E1143
SHA1:	4019015ABA1D7B6BCF4C3CA422B981EB2C0AA4D3
SHA-256:	B6D228616B5AD31449F4DA41AEEC9A6FC7A18FE51F672233FC7F6CAE07E7F117
SHA-512:	6175FE637408D0D5C4EBC27FC39593D9B92FDDD247303DBED652D7A5C7A05454DDFA21C8AFF9A470894DC5DFA581123A53C02DA650843E4F18156254B63802D1
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........R.D.3...3...3...,...3...3...3.../...3.......3.../...3.......3..Rich.3..........................PE..L...P.#B................. ........................@.................................................................................................................................................................................................UPX0....................................UPX1..... ..........................@...UPX2................................@..............................................................................................................................................................................................................................................................................................................................................................................................................3.08.UPX!....

C:\Users\user\AppData\Local\Temp\~0069FB97.00001B74.sznpkg\download\cz.seznam.software.szninstall-1.1.15-win32.zip

Download File

Process:	C:\Users\user\AppData\Roaming\Seznam.cz\sznsetup-lt.exe
File Type:	Zip archive data, at least v2.0 to extract, compression method=deflate
Category:	dropped
Size (bytes):	433495
Entropy (8bit):	7.99622148951467
Encrypted:	true
SSDEEP:	12288:H9b1uPLNHQYDTrI4HAVVzgF3ZwRfcn1NS6Mr:TuPLFVTvHYlgpZdnfgr
MD5:	4A72352104BDEB175A01ED156D1B752E
SHA1:	20281025DD3CAF05CF16B1B7756236E6B6646AD0
SHA-256:	B46DB87456EDB53D41462B77B58323E8446892FE876982A8258EE224E3F3CA00
SHA-512:	5DAFB1E2D09A0436F293A626D171FBF049FE5DF4ACDC986719A80548632AD44234AC4EE55C0CB855EFD29E9935310D55674989E7BEA98207E615378643EDEEFE
Malicious:	true
Reputation:	unknown
Preview:	PK.........\|{L.e7.............control.iniuNA..0.......`E<...x.(.....$dS../.._.#..Ym.M.0.3.3....K:Ja.&.u........@..5.#V..g.l....o%.(..!.(E....BN.l..J.b..l....R..c.B.[c.I_.[.....j)LC...g...Wm..e..-..\|pe..uW.]E.u.....u..A.7PK.........e-At...............install.bat}.]O.0....?.,.2.5.E....?.&..3..M[T...Y@..d.8=......f..A....^s.f){......6.X......qmh.8M.....R....C...0.j.'.I1...M.<..oFsR..\|R..Jh..G...S..R)....f....J.\s.].9...}0.`....W.!....d...,;.C.A. ...f!...EI..).da.;.L..&.._M.Z...I.tX...<..Z....s^.q.{.O...X.juOM}...t.\|m..Q..+.....Wb...kc.e...2z...562g...........~;^m.....En.C=h,k....NK.-E.%..0....F...)J....G..>.M.........a..PK.........{{L8..3.....P......szninstall.exe..\|S...~...r!...P...pe.....Yh..hJ............XM.....&8...;u.{.dS.:..XS...i...u...U.....<..$7m......o.$..\|.s...8.s.u.Q0.. .XL....W,.........X..Q/_.n.x..E..m._......;.o..{..~ .;...~/..../]X......v.1.6..)....a\....s7../c.s.......o.w.._.......W?>..>._..../f.+.w.wom.....q.B.!S..M.x.q!.0.

C:\Users\user\AppData\Local\Temp\~0069FB97.00001B74.sznpkg\download\cz.seznam.software.sznsetup-1.2.7-win32.zip

Download File

Process:	C:\Users\user\AppData\Roaming\Seznam.cz\sznsetup-lt.exe
File Type:	Zip archive data, at least v2.0 to extract, compression method=deflate
Category:	dropped
Size (bytes):	1163119
Entropy (8bit):	7.997519895563342
Encrypted:	true
SSDEEP:	24576:zqTt+ainIUylo3PuIeJABWfas8Sj20EX/lF6vFDihiGQH:usaXnlXIIJ9S0GdF6R2iGS
MD5:	32A5827E232BD4ECDF03AA6E597B9A02
SHA1:	F6D51F9B8371BE92B025B6794CE76BAA0332CFBE
SHA-256:	AAE60F2257D7BB56FB270CC7E23BA88C3D6768D952CDF201C6AE6D8B7EFACB5E
SHA-512:	165C659311B1B9C13240D48873A2FC99CA983691058A640A242F34B7BE586889FEEECEB21B223F37B53EA5B60D50ED3965C600DF2B69049786334C4835839888
Malicious:	true
Reputation:	unknown
Preview:	PK......../v{L-...............control.ini=.=..0.F.H.CN..20.......-..m.(v.Tq....{.R`..>..S...+.."...e.g.... ...%G....r.[.V.X...7m..U._..u.;.&......\|.{_9I.........M...G...9......jo...@Hb...Y.7PK.........T-AbEm.5...Z.......install.bat.LSH..,.QPR.3.)..+N-)-.K.HUR@.)....bQ..._P..T......PK........av{L.G......'.....sznsetup.exe..`...0..I.P....j.U.2W-s....H).@.6m.T...uL.6.24...rg...N....>.jeE...+vZG.:..b+TE`....s.'I...>....E...q..{..{...*FEQL...)J."..)..7....3^.=.+....]Y..;...Xy.W~.{......W....+}..~...Y.R.w..7...........:w.{._.[..}D.}.9....}F..w......{.......o.{........a9....P.BC.....n.]..g.kHR._Z....z..dV...4[$4.>NQ...}......x]E....)!.......V.M.7.....L.\|X~.2....U......r..7o.?t........T.tu%..z."..}5.M..(.oZ.....P..~a.}......I....$.).^..b(..~.m..5.....{.+.Yy.~.....K....._j .()..vx........_....;.V.,y..]E.O.\|.d.....<..2.....n.n.T.......8..........65.<.=w........qJ...i...f.2.......m...m.ur.-.8.SL..Ar...?(Yf...e._s....f@...........Y..t..'..8?.

C:\Users\user\AppData\Local\Temp\~006A18C4.00001B74.sznpkg\control.ini

Download File

Process:	C:\Users\user\AppData\Local\Temp\~0069FB97.00001B74.sznpkg\UNZIP.EXE
File Type:	Unicode text, UTF-8 text, with CRLF line terminators
Category:	dropped
Size (bytes):	199
Entropy (8bit):	4.774815712414516
Encrypted:	false
SSDEEP:	3:hr39Ax8SERLW0QVAFQUjLnE4MZFVTyZQG3Vjl1/LWiMuM4xQ9ot2VBEpINqU0Kpj:x39xRiGnE4kzyZ9KiMuMnyYICNq1y
MD5:	723B8C5F1FA2D9C5C1D9830C34BA08AD
SHA1:	34C12369A988E5D30F2BEAB2F1C7ACC018761959
SHA-256:	57ACE0B4E76F0045A7DAE3E39B59C50193D9E45AB8BFA17A1F1D21DFB99DD3C8
SHA-512:	951ACB2FA97AB2647DE41549AC4E4D46FA0D8B7994A39AE293C1EB5A543FC562A76B3B87C3DAC68B66F876FDB6EEF694C5F62B885D5288993D14E2F272085904
Malicious:	false
Reputation:	unknown
Preview:	[package]..name=cz.seznam.software.sznsetup..version=1.2.7..install=install.bat..uninstall=uninstall.bat..platform=win32..isLib=true..appName=Seznam Setup\|Zaji..uje instalaci komponent od Seznamu..

C:\Users\user\AppData\Local\Temp\~006A18C4.00001B74.sznpkg\install.bat

Download File

Process:	C:\Users\user\AppData\Local\Temp\~0069FB97.00001B74.sznpkg\UNZIP.EXE
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	90
Entropy (8bit):	4.290353127049867
Encrypted:	false
SSDEEP:	3:C6dUPipVkisfj2Vkg1YFgbTipVkiyGk2Vkgxyy:C2SiQhfL5ibTiQbG0vy
MD5:	7BE26BBB7D13C3C854F880E2D7C77F47
SHA1:	E2C44ACBC3E683FE54E4C24CC52BD5C64714C8CC
SHA-256:	0C58CA6AFAB9755BD17C25D4AC3C602BC12C78B2064FD36E781D7BFD3D55F200
SHA-512:	8E9CFDC1679A49E5053373E4583BF77D9C9DC4C18BCC4A01AD025D6DE644EC0CBE72DADB4F3BFBF1E6873EE588B334B6A91310543C959766C48EC5095B0537D6
Malicious:	false
Reputation:	unknown
Preview:	if exist "%~1\sznsetup.exe" sznsetup.exe --rm "%~1\sznsetup.exe"..copy sznsetup.exe %1....

C:\Users\user\AppData\Local\Temp\~006A18C4.00001B74.sznpkg\sznsetup.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\~0069FB97.00001B74.sznpkg\UNZIP.EXE
File Type:	PE32 executable (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2596080
Entropy (8bit):	6.581958589749376
Encrypted:	false
SSDEEP:	49152:yUPwoS+FWk6IIv4pN4erBKXFia3JdpoTG/1hd5VBsoKJqZij:IiFWbIPKXIGvcoKA6
MD5:	D0F5D99C74D568EB9909C7582A775DC7
SHA1:	4D7D588C789B26E0A6AFD6C2E3685A01DA7B1351
SHA-256:	30CAEDF510C447A3DC0F8A068B6ED8C55409818C77FAEB7E01E86DF1C3949B2D
SHA-512:	5424989B78E418AF100C10D8F6D12B13B78643CE2F5F7A9E0462A9571827DC8C1EEF60324D64BB4CA7651262523434ADA0B564A757A1B15D338DDAF47DCFCF01
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........* ..KN..KN..KN......KN.....EKN......KN..KO..KN..3...KN......KN......KN......KN.Rich.KN.........................PE..L...w.Q.........................................@...........................'......S(...@..................................M....... ...y...........l'..0....&.$.......................................@...............<............................text..._........................... ..`.rdata..............................@..@.data...D....`.......F..............@....rsrc....y... ...z..................@..@.reloc........&......P&.............@..B........................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\~006A18C4.00001B74.sznpkg\uninstall.bat

Download File

Process:	C:\Users\user\AppData\Local\Temp\~0069FB97.00001B74.sznpkg\UNZIP.EXE
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	21
Entropy (8bit):	3.7849418274376423
Encrypted:	false
SSDEEP:	3:ynW72Vk0:ynWD0
MD5:	0F2A9391C79202E47E212C8D2C4D6D43
SHA1:	79B8DF7D9AA3841AC189129472BB1A5020E9B4BF
SHA-256:	448E9C54E2079DCF42F4211C2B5A6415A0B9F7E80C351CCC32EE3236D6E5520A
SHA-512:	A649ACEA21DB5FE3DE14D4800939280204D1A69F6394EAC68C211302F3AC240F21DF10D4E4F0C4F07E6A2086E371E894360973A43DC0AF87A8A08DC594B03D9D
Malicious:	false
Reputation:	unknown
Preview:	%rm% sznsetup.exe....

C:\Users\user\AppData\Local\Temp\~006A1AF6.00001B74.sznpkg\control.ini

Download File

Process:	C:\Users\user\AppData\Local\Temp\~0069FB97.00001B74.sznpkg\UNZIP.EXE
File Type:	Unicode text, UTF-8 text, with CRLF line terminators
Category:	dropped
Size (bytes):	274
Entropy (8bit):	4.789699077906861
Encrypted:	false
SSDEEP:	6:x39xR4LUgsE4kzyZEJRiQAKiMuMnZEgX+tdqqm4KVJgkE1v:2UlZkkPQtDnZBXc3K0v
MD5:	0A96EB2E0F4C2050CB65AC5E0EFC9095
SHA1:	844345F999BE26A5248FCAB702915B79F5268237
SHA-256:	7238AC1A9F601DA52D6D12A61C5D4D15474F02766A9E56830999E9D59F7BEBDC
SHA-512:	546E6042EE0CCE3E775CD21F0CDA56B6236CD59C0A4CA043DB57802E767F2A91D2F89D82BF59A28389C7C47F7267628ABCBB2D05C55093C69B70A9748DDAE9ED
Malicious:	false
Reputation:	unknown
Preview:	[package]..name=cz.seznam.software.szninstall..version=1.1.15..install=install.bat..uninstall=uninstall.bat..depends=cz.seznam.software.sznsetup (1.2.7)..platform=win32..isLib=true..installer=1.1.15..appName=Seznam Install\|Instal.tor program. spole.nosti Seznam.cz a.s...

C:\Users\user\AppData\Local\Temp\~006A1AF6.00001B74.sznpkg\install.bat

Download File

Process:	C:\Users\user\AppData\Local\Temp\~0069FB97.00001B74.sznpkg\UNZIP.EXE
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	908
Entropy (8bit):	5.305590837067523
Encrypted:	false
SSDEEP:	24:cizQsyV/yXA7Mp7vKLyPJFkJbxbp9MayHp:QkXAoxvfkJN35yHp
MD5:	93C3AFFD6E3E86AD9FC944356E55712A
SHA1:	8B2ABEA2446AEE93D17CDD58D95B6494AEE4783E
SHA-256:	5E3AEBCF7AB3579B7EC48A0589130A961D4A2B7035F99FC9F196B260B62C156A
SHA-512:	83767A58B605E764A8CF199FB98691B371CB6DA2FD7A6CC392632F0188F2D0251A9E6F73381F3212BF41ADD10B32F187E31C615FA799E4BA5D6CAC7C36A2DE66
Malicious:	false
Reputation:	unknown
Preview:	SET rm="%~1\sznsetup.exe" --rm..if exist "%~1\szninstall.exe" %rm% "%~1\szninstall.exe" ..copy szninstall.exe %1....SET UNINSTALLKEY="HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall\SeznamInstall"..SET SETUNINST=REG ADD %UNINSTALLKEY% /f....REG DELETE %UNINSTALLKEY% /f /va..%SETUNINST%..%SETUNINST% /v "InstallLocation" /d %1..%SETUNINST% /v "DisplayName" /d "Seznam Software"..%SETUNINST% /v "DisplayIcon" /d "%~1\szninstall.exe,0"..%SETUNINST% /v "UninstallString" /d "\"%~1\szninstall.exe\" -X"..%SETUNINST% /v "ModifyPath" /d "%~1\szninstall.exe"..%SETUNINST% /v "Publisher" /d "Seznam.cz"..%SETUNINST% /v "URLInfoAbout" /d "http://software.seznam.cz"..%SETUNINST% /v "HelpLink" /d "http://napoveda.seznam.cz/cz/software.html"..%SETUNINST% /v "Comments" /d "Vsechny aplikace spolecnosti Seznam.cz a.s."..%SETUNINST% /v "NoRepair" /t REG_DWORD /d 1..%SETUNINST% /v "NoModify" /t REG_DWORD /d 0..

C:\Users\user\AppData\Local\Temp\~006A1AF6.00001B74.sznpkg\szninstall.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\~0069FB97.00001B74.sznpkg\UNZIP.EXE
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1069296
Entropy (8bit):	6.42377685493426
Encrypted:	false
SSDEEP:	24576:FCZGGSEniyqZsG0YyPXDKGeN/jBeaj2TZ/UN:fGeIYx1yTZ/UN
MD5:	C73E94B86ED9B6BDFF199BB7E8BF9D77
SHA1:	81187638DF3B943E9A990A8DFAA5AE70D4AE360B
SHA-256:	ABCBBDCC62338959F0F74B257E34AC86ABA9132675F34A389756F624909C0115
SHA-512:	56347635037935771708E803278678520E6CF6F16AC532D53EF571FD25BB86FF16677CB5832A16DCA8D6921D5A9BF7672540BF29A92063627BFAC8E6B6D79FF0
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........p..Y..Y..Y..B.u.G..B.A.$..B.@.m..Pih.[..Y..t..Pix.B..B.D.g..B.q.X..B.v.X..RichY..................PE..L...&.Q.....................".......J............@..........................p......lR....@.................................l........................ ...0.......................................... ...@...............\|............................text............................... ..`.rdata..............................@..@.data........0...\|..................@....rsrc...............................@..@.reloc..8............6..............@..B........................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\~006A1AF6.00001B74.sznpkg\uninstall.bat

Download File

Process:	C:\Users\user\AppData\Local\Temp\~0069FB97.00001B74.sznpkg\UNZIP.EXE
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	181
Entropy (8bit):	5.159345752239915
Encrypted:	false
SSDEEP:	3:ynWpY6Cbjp/g52KD9so3KRfyM1K7eELNREZ4tWUEJABK2xkpVoIueABK2xkpVoyy:ynWfUpYRtuH1jEBRE0BDkpSIaBDkpSyy
MD5:	1FEFF19973A4F9158C152836AA645DA9
SHA1:	5235DA552796A62FB9A88394A049829BB43B3E22
SHA-256:	2DE87146ED0503AADACC414FE9DF49635D9722AFFEFDFEC0D485BFBAF2173B43
SHA-512:	E275593A178C32434A1C748908BFC70856E71EC49D9EF7CAC71F03DC1602A8891FB891A8C09C4F94FDF88701BFF2AC27742D92CC4F71D965D98B6A5FA093F155
Malicious:	false
Reputation:	unknown
Preview:	%rm% szninstall.exe....SET UNINSTALLKEY="HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall\SeznamInstall"..REG DELETE %UNINSTALLKEY% /f /va..REG DELETE %UNINSTALLKEY% /f ....

C:\Users\user\AppData\Local\Temp\~006A2DE2.00000DD4.sznpkg\CPY.EXE

Download File

Process:	C:\Users\user\AppData\Roaming\Seznam.cz\sznsetup.exe
File Type:	PE32 executable (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	201728
Entropy (8bit):	6.481297570498218
Encrypted:	false
SSDEEP:	3072:4z5eZN175AA1KUyMCl3Ecf6YiCEC6ATkO4sgIi:4VejAWKUyzlqCEC6AS
MD5:	68F44C9CCFF3A00B357BD2006F536AA1
SHA1:	2AE60DE7F2AD6A971686B5FA9B7336F126AB927F
SHA-256:	9CAB64C3E95E386B6A4D64F4BDB7875E7E8E7F28F8672AD1C378F621634210D9
SHA-512:	FD2AE4FFF9CEA22573296633EA90688A162D60B89ACD0527E8170AFCFFCFE06A0A2DDD411FA853B4C223671085116DDE618C73BBD5B3111D54F2723ED01CA6DB
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........K............Rj...........g......S.....V......R......d....Rich...........PE..L...K.Q................. ...................0....@..........................P............@.................................4...(................................"......................................@............0.. ............................text............ .................. ..`.rdata.......0.......$..............@..@.data....<..........................@....reloc..\0.......2..................@..B........................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\~006A2DE2.00000DD4.sznpkg\MKLNK.EXE

Download File

Process:	C:\Users\user\AppData\Roaming\Seznam.cz\sznsetup.exe
File Type:	PE32 executable (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	203264
Entropy (8bit):	6.497748495775027
Encrypted:	false
SSDEEP:	3072:KiSDKqcxePbY5gNlc4jHCIQvFa+XBkk+/H2kRZJfj:XSDKzxRa8IQvFa+XBQzN
MD5:	D643EE3A4772C50F5C05853B2260ECE6
SHA1:	213CB142FD4AED0DAFAC33200857002DD2D9E25A
SHA-256:	50045AB9E25136E2920817E35E36C0D308F11516C3FA1889A28A9AEDBBA1C75B
SHA-512:	706934733D161ED673A5C798CD2F89362982501F9562757C67B8271750610280BD7F23B46AC8E08D08E25428B4D164808FE64BA8B2F976D342841BDAAF6C7082
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........)...z...z...z.6}z...z.6Iz..z...z...z..pz...z..`z...z.6Lz...z.6Hz...z.6~z...zRich...z................PE..L...N.Q................."..........>........@....@..........................p............@.....................................P............................0...#......................................@............@..,............................text...F!.......".................. ..`.rdata.......@.......&..............@..@.data....<..........................@....reloc...1...0...2..................@..B........................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\~006A2DE2.00000DD4.sznpkg\REG.EXE

Download File

Process:	C:\Users\user\AppData\Roaming\Seznam.cz\sznsetup.exe
File Type:	PE32 executable (console) Intel 80386, for MS Windows, UPX compressed
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	7.46636516722735
Encrypted:	false
SSDEEP:	384:REIT5kXU5oFOHBUjR92sdsApBkZzziOnXjPQ7elTVfN+yWMWgSJ:GITmXU5ocHBuf2AEPnXj47UTV1+yWyS
MD5:	F0C0D05727A4E1E91F4347C2270500AA
SHA1:	8F26B474CB7A8F8ACE40E98574034D7322B1FBE8
SHA-256:	AA7C78CEDE348C8DB9F932C2C54EE746E6B528691811DE44578D238BA02721E2
SHA-512:	7FE720EFD2A94624DFA5492AFA6D0342CAD232BCF8159D59AD2E52D8A21BE1566BC457E980185BBF8E1332FD48199A1AD9D18B076CBB39F1011DC24B2601A25A
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......<.p.x..Px..Px..P...Pz..Px..P...P..CPq..P..@Py..P..APb..P..DPy..PRichx..P................PE..L....R.H.................P.......p..............................................................................................@.......................................................................H...........................................UPX0.....p..............................UPX1.....P.......D..................@....rsrc................H..............@......................................................................................................................................................................................................................................................................................................................................................................................................................3.08.UPX!....

C:\Users\user\AppData\Local\Temp\~006A2DE2.00000DD4.sznpkg\RM.EXE

Download File

Process:	C:\Users\user\AppData\Roaming\Seznam.cz\sznsetup.exe
File Type:	PE32 executable (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	534528
Entropy (8bit):	6.4552641045875525
Encrypted:	false
SSDEEP:	6144:khSMd1VPqX0cub3L4T7pNAnRm9/UVyj42zuVnYENgCoJz:eJd8SQXAnRm9/syjlzyYENgx
MD5:	091235F94956B7824F2FDC73E0288BB1
SHA1:	B4A0DBDC3E14DD8137C2D38272743004385BD40D
SHA-256:	D01DCAF334BE7E80FEF076DC8156578B00A2295B539D5C55B8926B0A26A7859E
SHA-512:	A73C425DE804811F992B837D8560D81820F99D79730E0945B1075C3D166F348C45AB3F6E09B2C70BA4E436CBB24EBBB6B38B68F3AD8276FDB5F275FC59C3E29F
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.................#.....#6.....#3...........K....#7.....#....Rich..........................PE..L...X.Q.................b........................@..........................p............@..................................Z..................................@h......................................@............................................text...)a.......b.................. ..`.rdata...............f..............@..@.data....h...p...J...P..............@....reloc.............................@..B........................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\~006A2DE2.00000DD4.sznpkg\RUNBG.EXE

Download File

Process:	C:\Users\user\AppData\Roaming\Seznam.cz\sznsetup.exe
File Type:	PE32 executable (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	184320
Entropy (8bit):	6.462741668421283
Encrypted:	false
SSDEEP:	3072:KxrHniEBmhWbUc6LBswZYk1hd5VB7Pu4PTM7JnmET:KBH3BmQKZYk1hd5VBTu4wn1
MD5:	CDAEFC2BA0321FC94E632DCC51AED1FA
SHA1:	6DBEBD0A561AA0D0608E711103CA165814C327DC
SHA-256:	E851C1ED85A2729335A33951A850100B09845A51D5A498F31601EED248D74875
SHA-512:	F1654CD7B4E264F25A788D5EED990DA3843A655BD7F450D96DBE4C983D1ED7896052BF0C82203018624757C3BCF13F41D3F3F5A44AC291EA14B66F5C06A3F42C
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......y...=.v,=.v,=.v,&:.,&.v,&:.,N.v,&:.,1.v,4..,8.v,=.w,r.v,&:.,..v,&:.,<.v,Rich=.v,........................PE..L...Z.Q.........................................@.......................................@.....................................<...............................8!...................................e..@............................................text............................... ..`.rdata..............................@..@.data...0<..........................@....reloc..J-..........................@..B........................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\~006A2DE2.00000DD4.sznpkg\SHELLFLD.EXE

Download File

Process:	C:\Users\user\AppData\Roaming\Seznam.cz\sznsetup.exe
File Type:	PE32 executable (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	188416
Entropy (8bit):	6.473175773935069
Encrypted:	false
SSDEEP:	3072:EU0uK6SYgYY26KfB2u8H6m0NRra3wKcF42a2JokcHmBX8W64c+QPH7OEIsx6po:EYSNYB6KZ2u8H6m0NRlk2J1pfRchPHfQ
MD5:	D27871C45414A3C19072E85182A89404
SHA1:	22938FEBC87973CA3661856CECB7DCB19FA8B7AE
SHA-256:	A0106EFE7B5CE8A421500346E09EEEBD1433F7451B53D48BB8C91695971DA912
SHA-512:	389F07A34168A7C2AF0C07A715F33B56CCB2923B62A93EA2B800539775954181BAAE7B37DC26A4F290DE00E293C60281438123E3BDBB590FC5302E2870D52F64
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........O.~.O.~.O.~.T..T.~.T..3.~.O.....~.Ff.J.~.T..C.~.T..b.~.T..N.~.RichO.~.........................PE..L...\.Q............................6.............@.......................... ............@.....................................<................................ ...................................u..@............................................text............................... ..`.rdata..0...........................@..@.data....<..........................@....reloc.../.......0..................@..B........................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\~006A2DE2.00000DD4.sznpkg\UNZIP.EXE

Download File

Process:	C:\Users\user\AppData\Roaming\Seznam.cz\sznsetup.exe
File Type:	PE32 executable (console) Intel 80386, for MS Windows, UPX compressed
Category:	dropped
Size (bytes):	73728
Entropy (8bit):	7.863576242567582
Encrypted:	false
SSDEEP:	1536:LR0NFZXT9oWZFiKnMFzPMKv51BmFiU8HqyDyU3irQI:LspoWZ4KMFQKv5XyiqyDyUcQI
MD5:	3FC25896B5B2FB8E20F28FAB8C0E1143
SHA1:	4019015ABA1D7B6BCF4C3CA422B981EB2C0AA4D3
SHA-256:	B6D228616B5AD31449F4DA41AEEC9A6FC7A18FE51F672233FC7F6CAE07E7F117
SHA-512:	6175FE637408D0D5C4EBC27FC39593D9B92FDDD247303DBED652D7A5C7A05454DDFA21C8AFF9A470894DC5DFA581123A53C02DA650843E4F18156254B63802D1
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........R.D.3...3...3...,...3...3...3.../...3.......3.../...3.......3..Rich.3..........................PE..L...P.#B................. ........................@.................................................................................................................................................................................................UPX0....................................UPX1..... ..........................@...UPX2................................@..............................................................................................................................................................................................................................................................................................................................................................................................................3.08.UPX!....

C:\Users\user\AppData\Local\Temp\~006A2DE2.00000DD4.sznpkg\download\cz.seznam.software.ielisticka3-3.3.5-win32.zip

Download File

Process:	C:\Users\user\AppData\Roaming\Seznam.cz\sznsetup.exe
File Type:	Zip archive data, at least v2.0 to extract, compression method=deflate
Category:	dropped
Size (bytes):	724
Entropy (8bit):	6.399861427871824
Encrypted:	false
SSDEEP:	12:5jpmiIYlpYzh+R7/3crzbRGeXE+9Saq16Wjj9miKtSu5dMb3dp8Dt:9uy9R7/aNNXE+waqTP5CCYDt
MD5:	5ACBC4B353AD3034857F370BAA5290D0
SHA1:	B0B15D2F9F98EC1AF8A33869C2ED951B4F85C511
SHA-256:	9CCD54B1817D7C828EA26D70BD6C09026DAC5E32F2C5F884F14BBEC78ECB5C6C
SHA-512:	DF0F9196B95D01C861DF1FB9EB45D230989C5A6EF8B257D55FE285938DA99A484CFB83D16D58C0B56FF38B4BADFFF4118DC92166804AB23AD4A6C390C9B6BBD3
Malicious:	false
Reputation:	unknown
Preview:	PK........vpTL(..?....).......control.ini..ON. ...M..K].....6&.L........ax}.x....s...j.........7C..B.b..$......0...k.F.`....V.....Y^....L:..-#r.l>K.EB2oDl\..F.$....1\|:Y-"..v~.F_........:*.6:.`?~Q..o.\.:-...Ce...P....1zu.....(.e....uM......@.'..QP..]......@x.5:w...K.....S+h_Q...8.<........./....$_0..0..&. .......PK........GA.H...7............install.batrem IE listicka installs..PK........GA.H?GZ.............uninstall.batrem IE listicka uninstallsPK..........vpTL(..?....)............. .......control.iniPK..?.......GA.H...7..........$....... ...A...install.bat.. ................"%/yE..."%/yE..PK..?.......GA.H?GZ...........$....... .......uninstall.bat.. ................"%/yE..."%/yE..PK....................

C:\Users\user\AppData\Local\Temp\~006A2DE2.00000DD4.sznpkg\download\cz.seznam.software.libfoxcub-3.3.8-win32.zip

Download File

Process:	C:\Users\user\AppData\Roaming\Seznam.cz\sznsetup.exe
File Type:	Zip archive data, at least v2.0 to extract, compression method=deflate
Category:	dropped
Size (bytes):	2230734
Entropy (8bit):	7.999280543532011
Encrypted:	true
SSDEEP:	49152:zOLLL3mbGTzuP6VCWLpQ3tjNsD4wZMe243iPsV:zOLLL5C6VHydjESoV
MD5:	9CFA7791E8C9F8F8BB6ACE25B444A0C4
SHA1:	BE28F3FA7D582B7CA0CD888C3D18B66D2A2DF18F
SHA-256:	47318D53DF4C940464555D11509D706F3816F4A32A3B6587E164B6C56A4DC9DA
SHA-512:	0B062FA6CB8BECBFCE80736EB917D4D6E4B2ECE5982480A3D919C521CB2EEAFC445E46A6441363EAA2B14D05CAF467674F59B416EA3F64343F8EEB354FD047D1
Malicious:	true
Reputation:	unknown
Preview:	PK.........pTL..-W............control.ini.Q1n.0.........e/Y<.h..C..l3..Y.D.i.~!.........4i...B..;.8>y.,U..Y.c.l.p.J 7.+.......j.F....J(a....1.W.ZE..{n_.....s..j.mYp.G.._+ic[.et^L....o~..33...Q..^7..q.).M.2.w...".Gl3Y.\Ld.2.9.^../.P.I...d.U.g......fa......Q...r.a..Q...}..a.\.Rd.....'.n.;(..b........ g.PK........GA.H..............foxcub.confm.1..0.....Kx..23r....Z%Jp..V..w'.P.6..~.^..".~...1.D`..i5@/.i......R..{9.Y.XS.8......u...-..`..M.]...sG....&......bf..\|h....PK.........vK................install.bat.Vko.H.......4R..Ix.n[.(..U...v#Y..g......@H...w..qX.$...&.{.s...!...pi.f.\|.x.z-Jn f..E.y..1X.{3.3n.\.?:..l.TJ!c..14....}..{....!@$."....u..U+-..yZ8c.No....,X...G....iZ..~<.g.t-4...x8.....9.g..5.'..IB.>?......._...J.aa..cdF./w2}...h.,...Z.Z.."..S.zO....O.8.z-./$.e.X..'...Y..r..bE.r..Z.Y.P...^....K..5.....a..-........@......Z.~..3..g.h}..8.......7K.n5....W.d)CB.b........q3.XlC...$.......>.................d<.~..8..H.%.:..8..*.m..\..R1....3.S!.S.k.

C:\Users\user\AppData\Local\Temp\~006A2DE2.00000DD4.sznpkg\download\cz.seznam.software.libfoxcub64-3.3.8-win32.zip

Download File

Process:	C:\Users\user\AppData\Roaming\Seznam.cz\sznsetup.exe
File Type:	Zip archive data, at least v2.0 to extract, compression method=deflate
Category:	dropped
Size (bytes):	1055819
Entropy (8bit):	7.9933051283388
Encrypted:	true
SSDEEP:	24576:Lk1RBMdouoAOPoghHeRElAaPWqWNRmHO2SLP1hGcvw:wO3OPhHU6Aau1EOxT3Gx
MD5:	4298F40FCE8EAED9C7CCE7A4F8614795
SHA1:	40ECB7EDDF1134FF20B7BED0B6CF3714D2E699F9
SHA-256:	455D76DCB35575EF84DBF88DF1F6AD512BAFC0FF3B7DCC8A5B18071018AAC75F
SHA-512:	8B00A83F52AB3CFF187AE229765F3BA192F90369F84A9A37E9FD388390CE447DA96C4125D3832245CED6783D4FFBECB0C1564E54D4604E1876DA85D17EFC9E7B
Malicious:	true
Reputation:	unknown
Preview:	PK.........pTL?S......s.......control.iniuP1N.1..-...C..rQ....M.b}.w.....9.....(y..0.$U....jfg..l..g)<l..N8f......s............B..A...C...-...?...H.....1[.....U2i....B..u5OGPaT.B......]..pW..E..e.R@.O....d...>...ZP..u....R.@\|xG.T....c}...p..y...1...\K..c..0....V..PK........IA.H.}.4............install.bat.....0...{..0.....EX..A0..V.(..K.L1....R=...VEPD....3.......V.t- z8a..S6...~.....x0..=..q?f=loQ.$3.6B.....O.u...[I..LT....X@..rx........1.#`.YCi..6...9{....Zc5mHC..R..q>.#6g#l.....*z.0.q[..,..\|N<.....=.......MCI.(..K......PK........!.TL.........0'.....libfoxcub-x64.dll..\|..0>......B...@. .....~.,.., .E$..X).d..xIN..a$.P..B{Z.^S/\.eC.$..@....j....R.X...<....f..=.....?........}....s...Y./..m.....?.....yu0.r...n.Ho.....rWi.[.n..k..+W..n..U.X.u.+o...OW.t..A....u\...........v;...>.~......_........\|.m.>.~.o.........8..3.?..=.d.u.?......./.......w.}...W...x..s.L..q.i.7.A...]VZ._.N.8...E~...4.....O.,.G.O.{v.?.{.~/.h.w16.s..t..\|....eb...a....

C:\Users\user\AppData\Local\Temp\~006A2DE2.00000DD4.sznpkg\download\cz.seznam.software.libszndesktop-2.1.35-win32.zip

Download File

Process:	C:\Users\user\AppData\Roaming\Seznam.cz\sznsetup.exe
File Type:	Zip archive data, at least v2.0 to extract, compression method=deflate
Category:	dropped
Size (bytes):	996238
Entropy (8bit):	7.998295729974593
Encrypted:	true
SSDEEP:	24576:vw33nCkMunMthnhyZjCPm/QJQVak/ziz/ZyRHy1dcG:vw3Xku8cQyVeNyRdG
MD5:	828A732ACF768CEC7F1E965C9A359F9F
SHA1:	8CF44AC1EC915D0073C43FB43171968E0083819B
SHA-256:	B04071A50F342F937C66253BC28A4BA119C75B59CF56851E4265571299023EAB
SHA-512:	639FD4A595AD2ABC428C4D0876217DEB2EA9AE599CF1B73E2D3CC5A514209F124C27AB1ED8AD0EC359A6F0839556CB357F43563B7668F70A3B08C92DEC0B3258
Malicious:	true
Reputation:	unknown
Preview:	PK........\..Mc...............control.inimP.N.0......V..b......N ..sI.8.e;...'L..\|...ph..u.{w.tw.=:.-..D.t(......`....L."....F..>(kD.8[o.2!...Y...f.N..QZS...(..o.i.....+..I..M.D:...Y......c...N4.BiR...<.g.....b..9..'!...K2=......7.......cM...;z.>.B..Q...,..`.....~...\|i..........N......,...8.^p...\|.PK........"..J}.GH...N.......install.batu.QO.0...I..7K..1"...a..qC.iB..i.hk[@x........~7...&Q...x..E....La..`_...?...a&E^.A/...5.+R8^9?..Q.v]<...r_mz..X.n......^........z....q.k..ns...a.'..y..vT].[....B.4lN...(+..!XY0a....Y..q..N\,.ey..?...t...!B..\.......8I..../J.X.....w.......n.S....f..gZ...3.T.../.f.>1m..x.0..%N.V.E\..:+.p.J..[.c.1..%..qs.....r.....PK.........z&F...jX...Z.......reconfigure.bat-... .@.]..Dxk..8....A.../..B_..}{..Y[..3.V....N.U..75.W..n."g.I(....R.\.}.H..'...PK.........z&F........N.......szndesktop.confu..n.0.Dw....]..E......#.6...L.q.......d....c.qJ$..d:E.......#...P..K.......~W....U..3.E."*.~...Y..&...s..J.}.9..d.d...W.......(.~..

C:\Users\user\AppData\Local\Temp\~006A2DE2.00000DD4.sznpkg\download\cz.seznam.software.lightspeed-1210-12.10.18-win32.zip

Download File

Process:	C:\Users\user\AppData\Roaming\Seznam.cz\sznsetup.exe
File Type:	Zip archive data, at least v2.0 to extract, compression method=deflate
Category:	dropped
Size (bytes):	304459
Entropy (8bit):	7.99452128979458
Encrypted:	true
SSDEEP:	6144:bcqTGZrlMZ8ThLduXR4GdhJ8oMqCjigXkPyosxeiOqA0:/TGZrC6LWdD0xoQON0
MD5:	A59D7278A2A860766D36D8775C3FB73B
SHA1:	469675A55CB7BBAF080B3E76D543DE74CFC05A4F
SHA-256:	74D4F68CF7E01C67CB313C5A3A6C101DDFB022D28460771666A3CA7859EAB082
SHA-512:	2B4E1A25F7EA7CF9F076A5BD4FB0348D384F6AD8E24AAE26E23F8EA6129BFF5C28D5DC6096AE565A6907D2CBF32A3C0AC0699554D518555F8CC063146D186DA9
Malicious:	true
Reputation:	unknown
Preview:	PK.........pTL..%.............control.ini.O;n.0......@..E..:A.......$.%J...5z.....C.........J.$A..GR...n..^)A.@.'.J._....ls...BTbI..b2....Xr.@I...I2u.....J.nvCi.3:...]j....b^.=...9.{...LYY+..S.........G'....N..RP.Bx...D..;T.i.Z.B..f.-.pb..)..3..m.8\|....0.sv..g. .N.........?..>......D)x.{J~.PK........&z&F................install.batcpy lightspeed.dll "%~1\bin"..PK.........TUL...t.....D......lightspeed.dll.}.x....Z..x.m....V.(.6..:.P;.%%ql.I.@H.%.&7@bKq(!.U.z3.}....6....nii{C_K..X.......m./...6.n.....3.+...@o......;;;..3......1..q...4...r.W...g.y...<.gy.]..V....Z.m.li}.s.w....... ...=.....{...4......{..;w.Wo.Sc. ....a..7....O...w....;.....h...?..gO...........u.#..o.....I......N.P-.........\....\|..^..xZ.7..q..F.G..gq\6..K].;.Rb.?>.^W..G...]..'.@..G..Jp.;n3!...A.En.O9..Z....CEs.c.xn.O]...=.pm/..B.W.Z.....u.].8.\|...}.\...z...zV.s~..<.....O..}}k[..pO..}F.rs.........Q.p.\.I..L......o/..>....{..A..L.L....^.."9Z.'....h.>.K./.~..M...<]..m.r*....9..

C:\Users\user\AppData\Local\Temp\~006A2DE2.00000DD4.sznpkg\download\cz.seznam.software.szndesktop-2.0.32-win32.zip

Download File

Process:	C:\Users\user\AppData\Roaming\Seznam.cz\sznsetup.exe
File Type:	Zip archive data, at least v2.0 to extract, compression method=deflate
Category:	dropped
Size (bytes):	48179
Entropy (8bit):	7.991462255997012
Encrypted:	true
SSDEEP:	768:3XsntXrjmalBk5UiGF0eaGTYqHTn4Xkl46m/OOcXKWm+GLfZXHJLmwv3PnPIg3DD:3XstXrV7ku2eah2746qfcaWSLF0Ef5S0
MD5:	7F307C0A37F68FF9852D5856CF3DA48F
SHA1:	FC3EDACE198C4D1079CED0988915A313D1ED7E14
SHA-256:	D324E8F736643C595A093D30EE55474437B5F8A3FFFBBF3FB55BDCC4EF304EBF
SHA-512:	8745411ED1984B3C5A6C08C63C8FF191764237F3DA04A104A64826D02111D39242CF0421F43B9B2BBC40485C72CDD1C351B209667BFAD762B91C14907521A0DE
Malicious:	true
Reputation:	unknown
Preview:	PK........=\|{L.~h.....N.......control.ini.O...0...y....[q...".8\...4$.B.M...}....Xu.......oa - .%%..(.;...\.=X........Z'K-b........D3y...J....:..~U..K.TghPg.W...7..b..n.M..2....5..1.g.~c2..&l.6t`-0J..b.0......j.,...7..XC.^...xV...)...?..(...(y.PK........%z&F..8y....".......install.bat.....0..w...IG1>...*D.. .gA(Icl..A..]L..n.....E,.ep..!.7.S...J..h....."...=.T..:Y..B..%.<@...,.q~.!KX.3.....'.m...l......[.1.E.F.^fF.~.T.n,.jc...a...y..L..>.d.gE..g..7j.T..G..i!..<z..PK........%z&F...d............uninstall.batE....@.E............,B.6.1}....y...W0....S..6.i..:.y...1...7.Q..u.%wKq.G~.!.'....?V.=lu.k.";..S.~....h[.....R.f6..=.xE..)'...a.....q.fP.\|.....PK........'\|{L\|..............wszndesktop.exe.:.p.Wzo....2..M..b...3.v..D,c.......0..).\.#.R~.TV..)w...4wM..^.u.t.K..S.$....\......y....#.J....+iW.l.n...].......~..{o..<E....~.JH......#.2{....{E...'4}z....+.v..V.oW.....{......+.\|..W.o.X..=.v//)...p.q./....~.,.5;...s.}..../.Ax.+...._.1..1u./y...7.d........J.....!.

C:\Users\user\AppData\Local\Temp\~006A2DE2.00000DD4.sznpkg\download\szn-software-fflisticka-4.0.8-win32.zip

Download File

Process:	C:\Users\user\AppData\Roaming\Seznam.cz\sznsetup.exe
File Type:	Zip archive data, at least v2.0 to extract, compression method=deflate
Category:	dropped
Size (bytes):	5865670
Entropy (8bit):	7.995980482443665
Encrypted:	true
SSDEEP:	98304:tVdsZVuXMlVWlhYcZy/FwydLOX8b9g1VWWER8R:tVGZVTqhvZy/tdLf2V7L
MD5:	ABBCA45AA54E345B96B33238CC1B012C
SHA1:	70FCDEAF39FF2D9A9937B9726E9AA18F860B337F
SHA-256:	DC06DBE4FBE3BBA5BA1C2259312FC35C12459B6241B71770BA13FDA79089DC08
SHA-512:	07221C418EF54701722C38A54A635E0779F51C11D0E128068848DAF5FA412028F4A62CDB0636DB216C721884E66F956BFD3A5413A9FBC9A34F29998328EA3241
Malicious:	true
Reputation:	unknown
Preview:	PK...........M....2...........control.ini.S..0.}...0........R.k.J..P....5.U$KB.lc....>.....4..Q.8.h.6X........u2@.lT...<...[,.b.....Q.w.!.b..`...%7.d..`.N.f.%. .).2:\|...:4".E...@.2h....}....-...:....A3Qc.X.J.nT..&D.59.......wn.._Q.=....g.....4..W.(.'..p+F.S9.....(....\|q..>J.N..........$..;.0.....Q...F....7xT.....j.....mi.....C.%]%.A...)_.....]....Y5w.0...G.e....<"...9O:.:.^.U...F.[.R.y.f.3g...=.x6'.Ib.T.F.+v.^V.....S..SB...i:.o....E...e....?X......"..].A..p....U..c/.l.wU..........>D....y..Zz.....D..'...:.i.x.r......}.E.....!t ..f....z..Y.r......X:...{]...PK...........MK..Q............install.bat...j.0......bPoR...CC............%.....^9....Bt...\|;.8.0.O..2{..G.a6M..4o.al....}.g=*[.Z.G.e..<u...z.N..$....b..".._.\|.r...u]X^V\|...f..Q.a.6... a..jH...NSg.....R..y..p..y..G..2......J.6..........H....\..o..[..vma...~.\...y=<..z.....b?.....M.<.f-....-.....Gd$./..1..g..A.4-..Qa..q.....Q.....PK........g\.M.......Z...!...seznam_doplnek_email-4.4

C:\Users\user\AppData\Local\Temp\~006A81A0.00000DD4.sznpkg\control.ini

Download File

Process:	C:\Users\user\AppData\Local\Temp\~006A2DE2.00000DD4.sznpkg\UNZIP.EXE
File Type:	Unicode text, UTF-8 text, with CRLF line terminators
Category:	dropped
Size (bytes):	298
Entropy (8bit):	4.856414756802041
Encrypted:	false
SSDEEP:	6:x39xJvVdqi4kzyZEJR4Ld1KiMuMnyM5uNyI4YlZIFM+UyEgX+s:XvVdQkkhqDnyM52ZMMZyBXb
MD5:	179CF2126D63ACB096BCF31D9E755A28
SHA1:	148F948EA0DF3D1EB9A5EDF9D4EC98895D64BEA9
SHA-256:	B0398A91EAA0ADD38C0A75FA398952E8DF4EFF4010D0957819E8DD55CFB33C94
SHA-512:	767B7E7C1A9C75E90631F020C72FDBCEAC054F789A899D972F6231EE236738D489A7269F80F2E5F64182E494BBB60F9CE89FB6819C4B4112E4A352EAE9FC8508
Malicious:	false
Reputation:	unknown
Preview:	[package]..name=cz.seznam.software.autoupdate..version=1.0.8..install=install.bat..uninstall=uninstall.bat..depends=cz.seznam.software.szninstall (1.1.8)..platform=win32..isLib=true..appName=Automatick. aktualizace\|Zaji..uje automatick. aktualizace nainstalovan.ho software..installer=1.1.15..

C:\Users\user\AppData\Local\Temp\~006A81A0.00000DD4.sznpkg\install.bat

Download File

Process:	C:\Users\user\AppData\Local\Temp\~006A2DE2.00000DD4.sznpkg\UNZIP.EXE
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	133
Entropy (8bit):	4.999643899132137
Encrypted:	false
SSDEEP:	3:kgJtm2KD9so3KRfyM1K7eDoK0T9Gcx8SE0nwi4iYrE:9CtuH1j0Kq9G90wi4E
MD5:	F45C071FD1ABA066C0A5877DCCC37F07
SHA1:	73C90D2A48ADC0BC7CA8A5232C0B15C4D3304853
SHA-256:	24BC6E07585B3D7CF3812E5B1B377AC0E39A154D8C14B8B7B3AE03DDA9C85803
SHA-512:	0027B487FCD0A9F51AED2D76551273F60FA2945B78EA68FF1E9F2F79C7B52944DA40F063E29A815557B79504812402A151FEC817B9A30BD8D6F5CE9EDDB274EB
Malicious:	false
Reputation:	unknown
Preview:	..REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "cz.seznam.software.autoupdate" /d "\"%~1\szninstall.exe\" -c"..

C:\Users\user\AppData\Local\Temp\~006A81A0.00000DD4.sznpkg\uninstall.bat

Download File

Process:	C:\Users\user\AppData\Local\Temp\~006A2DE2.00000DD4.sznpkg\UNZIP.EXE
File Type:	ASCII text, with CRLF line terminators
Category:	modified
Size (bytes):	104
Entropy (8bit):	4.908191555872355
Encrypted:	false
SSDEEP:	3:7Ac2KD9so3KRfyM1K7eDoK0T9Gcx8SE0a:M4tuH1j0Kq9G9r
MD5:	5D379CB847043D49E99717CBE5CFD1B1
SHA1:	F9E82F6CC4EAE5B60366D71A3446E439887F5491
SHA-256:	F9774B7B55CA1144C478108B561C1DEAB3BB1DECBA3212D07F136F7A00EDF952
SHA-512:	E0FD611D55EE78F1978D3AACE9318942ADC460D0BC8056A25E78F916E496817C82388FEA73969D0E53095E9C70A0FE1EC85732A1A1E96FBD64F90F2950D95A66
Malicious:	false
Reputation:	unknown
Preview:	REG DELETE "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "cz.seznam.software.autoupdate" ..

C:\Users\user\AppData\Local\Temp\~006A8374.00000DD4.sznpkg\control.ini

Download File

Process:	C:\Users\user\AppData\Local\Temp\~006A2DE2.00000DD4.sznpkg\UNZIP.EXE
File Type:	Unicode text, UTF-8 text, with CRLF line terminators
Category:	dropped
Size (bytes):	260
Entropy (8bit):	4.833738966229456
Encrypted:	false
SSDEEP:	6:tup39kV5rR4LUw4kzyZ9KiMml8wVXKU9rZIlV/R:tZVKU1kkMmygak4VR
MD5:	34DDBA490BAF20CE87DA887262DFB101
SHA1:	56F81AB1E53D1074436F8609E7E95A3651C747F2
SHA-256:	FAE11ED16BFEB7C3C71DF0EAF7FC5520BBD3A7BFCC72F319A795D9CFE49C327D
SHA-512:	E4CB8C3BB1ACE9216BAA6BF96F3C5673D3D8175D9C54D4E243678FBE136F980724E190DDF3A9E61C0517182606CAFF654AFD03A17351CC11FBF92A23264CD288
Malicious:	false
Reputation:	unknown
Preview:	..[package]..name=szn-software-base..version=1.0.0..depends=cz.seznam.software.szninstall..install=install.bat..uninstall=uninstall.bat..platform=win32..islib=true ..appName=Seznam Software\|Z.kladna pro v.echny aplikace, bez toho nebudou aplikace fungovat

C:\Users\user\AppData\Local\Temp\~006A8374.00000DD4.sznpkg\install.bat

Download File

Process:	C:\Users\user\AppData\Local\Temp\~006A2DE2.00000DD4.sznpkg\UNZIP.EXE
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	129
Entropy (8bit):	4.606037069317163
Encrypted:	false
SSDEEP:	3:dAxUZr1THsp+VKHoUDXTHVDCpDHfbTHHSuCivA0Koyn:duOZLUYKDLVDCpDHfbLHSxivAIyn
MD5:	3D00B26AC691FA886F7A9E557B882842
SHA1:	9EC82A89E5F1B5720A13A54D178D553838FA6C6B
SHA-256:	34EFD0E3AC0515FB1FD025CE99C84B9A99E67BF2FE9D4889E4FD76664F941F42
SHA-512:	EE01469A4F5E1055A9559C25DF291F7C6A19E05CEAF6FBECB96D8ED50C8BA6C1F2E7BF563E82D383A4B65F13511F79074E51D741562128370D64C78F6D4279EC
Malicious:	false
Reputation:	unknown
Preview:	cd /D %1..if NOT EXIST "bin" mkdir "bin"..if NOT EXIST "conf" mkdir "conf"..if NOT EXIST "data" mkdir "data"..exit %ERRORLEVEL%..

C:\Users\user\AppData\Local\Temp\~006A8374.00000DD4.sznpkg\uninstall.bat

Download File

Process:	C:\Users\user\AppData\Local\Temp\~006A2DE2.00000DD4.sznpkg\UNZIP.EXE
File Type:	ASCII text, with CRLF line terminators
Category:	modified
Size (bytes):	32
Entropy (8bit):	3.9056390622295662
Encrypted:	false
SSDEEP:	3:HI4+MY:v+MY
MD5:	82CED4B51204137AFEC924B9A0A34C92
SHA1:	3E3DD1C485E7A421141CDF4ACA14950E2F3BDE77
SHA-256:	EA3FCD8551241061C5C4685D32DDA1970DE9CD6D509A20BD956D77B28A98ED97
SHA-512:	1890CB5281E76B48EDE926F9B72F9C1F02F0E1A620038A9CC8423831EE666CDB05B20184FF348A6EB7C171B934D1D0461F28119E95F49A3E1358FA5A9442FAE1
Malicious:	false
Reputation:	unknown
Preview:	rm bin..rm conf..rm data..exit 0

C:\Users\user\AppData\Local\Temp\~006A848E.00000DD4.sznpkg\control.ini

Download File

Process:	C:\Users\user\AppData\Local\Temp\~006A2DE2.00000DD4.sznpkg\UNZIP.EXE
File Type:	Unicode text, UTF-8 text, with CRLF line terminators
Category:	dropped
Size (bytes):	304
Entropy (8bit):	5.09326711674463
Encrypted:	false
SSDEEP:	6:tup39X91L93KFYi4kzyZ9KiMzQuPUORZ2ccvFSuIhgdVSuOE:tcl3KYkkMzQuPUUMccwuIA1OE
MD5:	EBDCEA21DBA5DD8D4C53740DEAA09264
SHA1:	9A0EAD48E31977EF2EEE7C458A5F0BFBB52F0163
SHA-256:	C038A306FF814C1633AFD5923595DF7F1B12EA826996F0C9502BF9ED4E051EFB
SHA-512:	A8785D14CF9FA48521CEE06E9F56791C2C4F605BB5ABF607189864E5A4BD0164BE42525192BF156AB566991C5D958C54D059B05CA78937FBC8151F0E5774CA7D
Malicious:	false
Reputation:	unknown
Preview:	..[package]..name=com.microsoft.msdn.msvcr110..version=11.0.51106.1..depends=szn-software-base ..install=install.bat..uninstall=uninstall.bat..platform=win32..islib=1..appName=Microsoft Visual C++ Runtime\|Sd.len. knihovny od firmy Microsoft ur.en. pro b.h program. napsan. v jazyce C++..

C:\Users\user\AppData\Local\Temp\~006A848E.00000DD4.sznpkg\install.bat

Download File

Process:	C:\Users\user\AppData\Local\Temp\~006A2DE2.00000DD4.sznpkg\UNZIP.EXE
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	56
Entropy (8bit):	4.33834309158456
Encrypted:	false
SSDEEP:	3:o9cIeXB9cIv:oKfKS
MD5:	07F8553EBC55FC91142A43993C01460B
SHA1:	2C4F175D5BD5DBDD7B351CF2001122AC72328D49
SHA-256:	E0D474ED9F004971CBC3367F687EDC99D3C26CFA63EC2E3EDC13B8FCB469ECDC
SHA-512:	94558AF820E4E738B095F4F19EDB55FFC70F52FCB78CFB04E66D196256B29631614EA0C9F642AB402E97B394968C747436113C1AEC44EB94A74B23B8F69FAF2A
Malicious:	false
Reputation:	unknown
Preview:	cpy msvcp110.dll "%~1\bin"..cpy msvcr110.dll "%~1\bin"..

C:\Users\user\AppData\Local\Temp\~006A848E.00000DD4.sznpkg\msvcp110.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\~006A2DE2.00000DD4.sznpkg\UNZIP.EXE
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	535008
Entropy (8bit):	6.072620448350034
Encrypted:	false
SSDEEP:	12288:FqULIc5nb9rywgfyhUgiW6QR7t5sA3Ooc8sHkC2eRxUH:PLHnhryLfBA3Ooc8sHkC2eRxUH
MD5:	3E29914113EC4B968BA5EB1F6D194A0A
SHA1:	557B67E372E85EB39989CB53CFFD3EF1ADABB9FE
SHA-256:	C8D5572CA8D7624871188F0ACABC3AE60D4C5A4F6782D952B9038DE3BC28B39A
SHA-512:	75078C9EAA5A7AE39408E5DB1CE7DBCE5A3180D1C644BCB5E481B0810B07CB7D001D68D1B4F462CD5355E98951716F041EF570FCC866D289A68EA19B3F500C43
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$....................7.>...........:.L....:.J....:.H.....:.I.....:.T....:.M....:.N....:.K....Rich...........PE..L......P.........."!.........................0...............................P......[.....@.........................`N..$.......<........................=.......D...................................K..@...............D............................text............................... ..`.data....`...0...2..................@....idata...............N..............@..@.rsrc................j..............@..@.reloc...}.......~...n..............@..B........................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\~006A848E.00000DD4.sznpkg\msvcr110.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\~006A2DE2.00000DD4.sznpkg\UNZIP.EXE
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	modified
Size (bytes):	875472
Entropy (8bit):	6.9224404430053434
Encrypted:	false
SSDEEP:	12288:TmCyHcMpK7QdgD+9Tr8r3FmJciMgLFWkA8qTWu+FVlofpJCjNdr12iqwZeq:TmCyHNIQdTryVmCipIkqTWu+Fr
MD5:	4BA25D2CBE1587A841DCFB8C8C4A6EA6
SHA1:	52693D4B5E0B55A929099B680348C3932F2C3C62
SHA-256:	B30160E759115E24425B9BCDF606EF6EBCE4657487525EDE7F1AC40B90FF7E49
SHA-512:	82E86EC67A5C6CDDF2230872F66560F4B0C3E4C1BB672507BBB8446A8D6F62512CBD0475FE23B619DB3A67BB870F4F742761CF1F87D50DB7F14076F54006F6C6
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......x._'<.1t<.1t<.1t<.0t..1t...t?.1t.+.t..1t.+.t].1t.+.t..1t.+.t..1t.+.t=.1t.+.t=.1t.+.t=.1tRich<.1t................PE..L......P.........."!.....`..........<........@...............................`......l9....@.........................`...........(........................=.......S..0n..8...........................0...@............................................text....^.......`.................. ..`.data....\...p...N...d..............@....idata..............................@....rsrc...............................@..@.reloc...S.......T..................@..B........................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\~006A848E.00000DD4.sznpkg\uninstall.bat

Download File

Process:	C:\Users\user\AppData\Local\Temp\~006A2DE2.00000DD4.sznpkg\UNZIP.EXE
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	42
Entropy (8bit):	4.088629625108202
Encrypted:	false
SSDEEP:	3:HNIWT6yosNIWT8Byn:tayoCYyn
MD5:	275B053DDF715BAAE046DA79CB5E8D68
SHA1:	76B078C6D16C4A5DB5F9E34CFD945176041F503E
SHA-256:	A8C6ADBEBFC5E4BAE1B237C4F400D832ED9FD0D64E588B7CB9A459D710EB3C93
SHA-512:	BFB7F388872C4B2F131E24385E53AD0186D94AA1DA10A47B933DA3FD51D98A72CF003906BE8417105DB9B72C6F6187205C30083180F66EECFAF23ABCE4688583
Malicious:	false
Reputation:	unknown
Preview:	rm bin\msvcp110.dll..rm bin\msvcr110.dll..

C:\Users\user\AppData\Local\Temp\~006A8960.00000DD4.sznpkg\control.ini

Download File

Process:	C:\Users\user\AppData\Local\Temp\~006A2DE2.00000DD4.sznpkg\UNZIP.EXE
File Type:	Unicode text, UTF-8 text, with CRLF line terminators
Category:	dropped
Size (bytes):	416
Entropy (8bit):	5.090173049529164
Encrypted:	false
SSDEEP:	6:tup39xLpf0KF9T91hVxufigLpT/4kzyZ9KiMz3BA/FXRStkwptFxligX+s:tYuK/T5uflBQkkMz32/FXUku/Xb
MD5:	9271C260DD5C0EEBE83D9363645CA4D9
SHA1:	94E8C17BCA4E49388F066FC0A1B96D8FCB52E3F6
SHA-256:	FE43FD58CFEBDCAA526826CA42381CCD635D91942427C6158DBB77F6DFE11FA8
SHA-512:	3E6AC8C669E20E14DA32B026F03504BE69371D46D01D9B9F024B86ED872132AA90D1DEC680C0A344931FA9DD520344B2A92E6F94F8248BA3704B604F09E564B1
Malicious:	false
Reputation:	unknown
Preview:	..[package]..name=cz.seznam.software.lightspeed-1210..version=12.10.18..depends=szn-software-base ..depends=com.microsoft.msdn.msvcr110..conflicts=cz.seznam.software.lightspeed-1208..install=install.bat..uninstall=uninstall.bat..platform=win32..islib=1..appName=Knihovna LightSpeed\|Sd.len. knihovna LightSpeed pro n.kter. komponenty. Sd.len. knihoven .et.. pam.. po..ta.e...installer=1.1.15..

C:\Users\user\AppData\Local\Temp\~006A8960.00000DD4.sznpkg\install.bat

Download File

Process:	C:\Users\user\AppData\Local\Temp\~006A2DE2.00000DD4.sznpkg\UNZIP.EXE
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	30
Entropy (8bit):	4.348394345536403
Encrypted:	false
SSDEEP:	3:FRWVAA1JKIv:rs1JKS
MD5:	628C0001F72480BACC5461C706E89F69
SHA1:	F161DAA6069BCF1F7E3C9D16F23B53A401F458AA
SHA-256:	5F716B3D423663BEDF60A38A47552916F6C277E058EAB3763AE9BAB6215006AC
SHA-512:	78265C706C2B9CDF649A069592DCDC8D6651FDAF38BD099252CFD48EA5AB31E6B9771A2881CD7206714E9D517548D11A9B4E723295DAFFB69FCEB1D55F7EC3D2
Malicious:	false
Reputation:	unknown
Preview:	cpy lightspeed.dll "%~1\bin"..

C:\Users\user\AppData\Local\Temp\~006A8960.00000DD4.sznpkg\lightspeed.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\~006A2DE2.00000DD4.sznpkg\UNZIP.EXE
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	869584
Entropy (8bit):	6.445649712952402
Encrypted:	false
SSDEEP:	12288:2+wY3QbHhn8bRpAkrUOmkYdIPSoC15s0XfhxGXDcNUc:23Y3QbHhnsVmkYdIPSoC15s0Xfhmc
MD5:	E6370ECDD6F343093F82E483F4D73799
SHA1:	E33138C62D6594A7FCD2D4901735EA5F5F1B0E20
SHA-256:	A924C4F999F222176A2D236BAE73AF72FACA23202D5EC3176D0841ED08CA05A0
SHA-512:	BD2ED19914C092A49F755F87DCEFF5EB7530A9ED6EB049AE96907DDEE87820A89788ECCEE1BD246E921276CB93BE78295B87DD772AF3F6CC6D13EC0F09323667
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......./.k...k...k...W..n...W..c...W..`...W..o...k......b.K.e...H~..).......j.......j.......j...Richk...........................PE..L....<.Z...........!.................H.......@...............................`............@.................................L........@...................0...P..T....C..8............................+..@............@..l............................text...w,.......................... ..`.rdata..Qc...@...d...2..............@..@.data............t..................@....rsrc........@......................@..@.reloc..P....P......................@..B........................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\~006A8960.00000DD4.sznpkg\uninstall.bat

Download File

Process:	C:\Users\user\AppData\Local\Temp\~006A2DE2.00000DD4.sznpkg\UNZIP.EXE
File Type:	ASCII text, with CRLF line terminators
Category:	modified
Size (bytes):	23
Entropy (8bit):	4.0559581516151235
Encrypted:	false
SSDEEP:	3:HNJDKVAA1Jy:tJDY1Jy
MD5:	6B5B33ACCAB99D9F69195776DDE81615
SHA1:	A05632A3A23BD422F5A687921A9FB154E0DCE0D7
SHA-256:	8C55EBBAD55537F6920F4C3D8882FF8F2143CA46129C2BBABB6DC8ABD4135DFF
SHA-512:	F01C9D35A8FF76E57825FFF232D32052D5918175F6776832F12D2E9A312449A25BFDE720832319B23CF342AD6C280817F905BB790987D3B59450785D5D47B128
Malicious:	false
Reputation:	unknown
Preview:	rm bin\lightspeed.dll..

C:\Users\user\AppData\Local\Temp\~006A8B64.00000DD4.sznpkg\control.ini

Download File

Process:	C:\Users\user\AppData\Local\Temp\~006A2DE2.00000DD4.sznpkg\UNZIP.EXE
File Type:	Unicode text, UTF-8 text
Category:	dropped
Size (bytes):	414
Entropy (8bit):	5.0368921356687535
Encrypted:	false
SSDEEP:	12:AI98H2vPBk353EoT/C++fH+voOPcvzVWV6Z1Xr:jPel5TiHQoOPcv59br
MD5:	2FC2ECBCA14110BE0DE113150075D8D1
SHA1:	43B6B7C1AC7B0B3A1685B346A9B42A673780280D
SHA-256:	B1B37EB3559A5E63A517734FBC24813D58B454E2A311F662540B4F3E79B770E1
SHA-512:	7344BA0F84CF21919E532AB23301459D29619C799E8ECEDE5BDF17B20D88DA44FB5145BC21ABB7AC9B8C5CBEEBD839FC3B0CE41DACF77FFBE262C1ED2199D616
Malicious:	false
Reputation:	unknown
Preview:	[package].name=cz.seznam.software.libszndesktop.version=2.1.35.install=install.bat.uninstall=uninstall.bat.reconfigure=reconfigure.bat.platform=win32.depends=szn-software-base.depends=com.microsoft.msdn.msvcr110.depends=cz.seznam.software.lightspeed-1210 (12.10.17).conflicts=szn-software-seznamdesktop.appName=Desktop HTTP Server (knihovna)\|Zaji..uje b.h HTML5 aplikac. na desktopu.islib=true.installer=1.2.0.

C:\Users\user\AppData\Local\Temp\~006A8B64.00000DD4.sznpkg\install.bat

Download File

Process:	C:\Users\user\AppData\Local\Temp\~006A2DE2.00000DD4.sznpkg\UNZIP.EXE
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	590
Entropy (8bit):	5.447813309811645
Encrypted:	false
SSDEEP:	12:zsLOvLOLs0bfuERBoFK28fYjE8BpTRTNOIiV2LUuCCV2LgJVjHQddV:z5DmG4Bhf8BpTRcIbrVzudV
MD5:	B61DF9A6B879BC61545ECDA4863ADB8B
SHA1:	12D9014E1F52E792A3DFA8219919D2557FE660DC
SHA-256:	D428E0882C3BF85915D39BDE4A91B862C02BF094939621DE6F53479ABEE47452
SHA-512:	83F402F734607CA33F9B2775CFEBE378E706532FDA5E3793176FF1666DCFD512C5D8CCB4CD651FA3536D6FCFB571A53DA84C767F47BF7D5F5493887B0C008990
Malicious:	false
Reputation:	unknown
Preview:	SET BINFILE=szndesktop.exe..SET CONFFILE=szndesktop.conf..SET DATAFILE=szndesktop.webpak..SET BINPATH=%~1\bin..SET CONFPATH=%~1\conf..SET DATAPATH=%~1\data......cpy "%BINFILE%" "%BINPATH%"..cpy "%CONFFILE%" "%CONFPATH%"..cpy "%DATAFILE%" "%DATAPATH%"..cpy "sznpp.exe" "%BINPATH%"....pushd %~dp0..for /F "usebackq delims== tokens=1,2*" %%i in (control.ini) do SET ini_%%i=%%j..popd....if NOT EXIST "%CONFPATH%\szndesktop.d" mkdir "%CONFPATH%\szndesktop.d"....reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall\SeznamInstall" /v DisplayVersion /t REG_SZ /d "%ini_version%" /f..

C:\Users\user\AppData\Local\Temp\~006A8B64.00000DD4.sznpkg\reconfigure.bat

Download File

Process:	C:\Users\user\AppData\Local\Temp\~006A2DE2.00000DD4.sznpkg\UNZIP.EXE
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	90
Entropy (8bit):	5.00869816904785
Encrypted:	false
SSDEEP:	3:I3IgbLIROL4AOshCGKyShkdomKtAlov:zGLBL4OK2CUov
MD5:	CFB7FE84F6F3C98AB9B32ABE82F4F2D0
SHA1:	E5B15A307E6F6E25945DD17A2BC85BA1C6C89863
SHA-256:	35B565956F3C521A3D5B3F5D4F4933D0DCA04202D5B3CC2BCFD55651F3030811
SHA-512:	BD31D6D5DC72AF48E2A0733B7943A58F0045F5ED48D75610153259EDCC9FFFA4BA8FE9B6E1B3AAD3517ED540100FF8A9D847FD2A706F0825B0EE14C45CF1B333
Malicious:	false
Reputation:	unknown
Preview:	SET BINFILE=szndesktop.exe..SET BINPATH=%~1\bin...."%BINPATH%\%BINFILE%" default restart..

C:\Users\user\AppData\Local\Temp\~006A8B64.00000DD4.sznpkg\szndesktop.conf

Download File

Process:	C:\Users\user\AppData\Local\Temp\~006A2DE2.00000DD4.sznpkg\UNZIP.EXE
File Type:	Generic INItialization configuration [controlweb]
Category:	dropped
Size (bytes):	334
Entropy (8bit):	4.824443527950377
Encrypted:	false
SSDEEP:	6:dCrLcQe2YV2J++rLXV9cu1Rk7l0iYa0iY7AK0YJADUvUsYVUEyFF:d6LhxoKlLF9cu1RM6B3AGUsiWF
MD5:	A1905B8002E0D317DCFBB47A80AD448B
SHA1:	B2C7C09016C2D0098D121706A57A8BFDCBE022BE
SHA-256:	E5D4EDDF1282C2D61F7D86281D7F7FA756CE6D2B77BE2BA96C89CDCF95EB6DD1
SHA-512:	2B4F215064FAB495FA778BD02F2387D08AAEACA8374ED82B445B0C34EB48D8E8B4861B3F0B69E0A087809591BBC4F997DBB0C8A055B1A734011C3BEC469CD08A
Malicious:	false
Reputation:	unknown
Preview:	[modules]..subdir=szndesktop.d..module=controlweb....[controlweb]..type=staticpak..path=..webfile=$data:\szndesktop.webpak..indexFile=welcome.html....[mimetypes]..html=text/html;charset=utf-8..htm=text/html;charset=utf-8..txt=text/plain;charset=utf-8..jpg=image/jpeg..gif=image/gif..png=image/png..css=text/css..js=text/javascript..

C:\Users\user\AppData\Local\Temp\~006A8B64.00000DD4.sznpkg\szndesktop.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\~006A2DE2.00000DD4.sznpkg\UNZIP.EXE
File Type:	PE32 executable (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	506064
Entropy (8bit):	6.375464739429351
Encrypted:	false
SSDEEP:	6144:FoGTca+RgvFMpKQDZU5bGrIABTK/oKygFW6/q8676K+QZ5qMRc0N87B+gVyGzWft:mZtrwg4mj5qMRSABfjZSDT2
MD5:	DAC25BB758D6C17C5A8D64CF63702B4E
SHA1:	2424AA5A11DC1C2AFDA0B769033E724F3BDEFDDA
SHA-256:	E96D79777D5D3BDF0993FFF70009621848D0524A0CBC5CFB698B6C35567F4969
SHA-512:	2F2F0A26CBFF99DDEC63BE60D8EECB0F497FA7F6E120D71F5D0C2900E8F4413A5964800FDCFADF69C5AB9410F1742A8AEC56CE01F911B8DE081D1E71DCD8897B
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......b...&...&...&....cV.#....cU.5....cT.#....cP."...@KP.$....JU.!.../...+...&........JH.3...@KR.'...@KW.'...Rich&...................PE..L.....Z.................@...L...............P....@.......................................@.................................4........ ...................0...0...`...U..8...............................@............P...............................text...:?.......@.................. ..`.rdata.......P.......D..............@..@.data...(@.......:..................@....rsrc........ ......................@..@.reloc..l....0......................@..B........................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\~006A8B64.00000DD4.sznpkg\szndesktop.webpak

Download File

Process:	C:\Users\user\AppData\Local\Temp\~006A2DE2.00000DD4.sznpkg\UNZIP.EXE
File Type:	data
Category:	dropped
Size (bytes):	40568
Entropy (8bit):	7.9817629224009
Encrypted:	false
SSDEEP:	768:1XGjof0xmmKg0FGRzqNFOaXKYezSgcZaIc3csECrhtJ37CY:1UosmjgubX2bRMsECrxCY
MD5:	8FC0633EF306E63FDF83CF00572AE094
SHA1:	6DD643D2995445443E01DDC620A29FF078239251
SHA-256:	42444C496F284ABE61E35007A88FC7100BE59AE04AF4224B5B6A0904BE74B326
SHA-512:	FA86B90FF73FBA7153176169A094146B78B9B0BAAA0AF0E7F5348E33D5B7C7978CD7499300E1825BDB66FBC4B69FCB40193A28A9A072C26BCA6EACBF572248CA
Malicious:	false
Reputation:	unknown
Preview:	............<html>..<head>.. <title>Shutdown Seznam Desktop?</title>..</head>..<body>.. <h1>.. Bye bye!</h1>.. <p>Server will be terminated in 2 seconds</p>.. <p style="display:none" id="msg">Done</p>.. <script type="text/javascript">.. setTimeout("document.getElementById('msg').style.display='block'", 2000);.. </script>.. <p><a href="/">Back</a></p>..</body>..</html>..GIF89a..........KMJ..................!.......,...........8...0.I..8...`(..0.h.VBP.......a..+..p...".......3...kTQ.AQ.}).K.S....VYU.O;..;...ks....+.k.wi.%aDr..a.I0.:....Y.....J...d..G...uy.;.Zsw../.&...>...:...Fr.%..x6?06..b0{Bh.A.c2...x..v.z...}..^..NK..r..F.............=.Q.e.t.Luo..X.U!.gj..?.8.!W..X.'.ty.....F....x.8f....6...a.d-dX.S4.c$>a...{.R>c.1f..F. ...........e.c....,.VpW\....a1......6.;\|t.V..J..N.......[.B.{.S.qk....a.P.z...(.I..E\.....2..B7..3..j).e.W....\....$F~v.\|'9tM..7.vC...#Ak..J.!/......pw.....3.\.G.=.HZ.0..g">N.\....8g..d.W....z.@vE`SX..(....{..._

C:\Users\user\AppData\Local\Temp\~006A8B64.00000DD4.sznpkg\sznpp.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\~006A2DE2.00000DD4.sznpkg\UNZIP.EXE
File Type:	PE32 executable (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1592048
Entropy (8bit):	6.4918795184818014
Encrypted:	false
SSDEEP:	24576:SRrMSewZ7TNb1oLfxBTk1kuEwnf4z/TWzXqoNb1oLfLv+eoXo2w:lSV1CLffk1c+fE/IZCLfLmeoXoV
MD5:	62DF7B2F443CBB0284CB7959AD2228C1
SHA1:	5A53641AB7184163843FA188F02EBD22AB17AFC3
SHA-256:	464546FEC35F4B178FA2D912504023C4489B879976FA52F8E71652F4B5B76E6C
SHA-512:	A94D892BBD15EFAD62E470F313A7DFD1FEEA8EE8A7739DA17908557B97882FAB447FE5BAFDB6FE2AC67408BFCB25DC0C7DD214F79C3C6A210166B5DA362FFF16
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........g..].._].._].._.$_P.._.&_..._.'_@.._fX.^E.._fX.^f.._fX.^z.._.X.^X.._~.._Z.._T~F_D.._].._..._.X.^_.._.X.^Z.._.X_\.._].B_\.._.X.^\.._Rich].._........PE..L......\.........."..........\|......Y.............@..........................p...........@..................................!..........p................0...0...:......T...................T...........@............................................text............................... ..`.rdata...w.......x..................@..@.data....;...@......(..............@....gfids...............R..............@..@.tls.................T..............@....rsrc...p............V..............@..@.reloc...:...0...<..................@..B................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\~006A8B64.00000DD4.sznpkg\uninstall.bat

Download File

Process:	C:\Users\user\AppData\Local\Temp\~006A2DE2.00000DD4.sznpkg\UNZIP.EXE
File Type:	ASCII text, with CRLF line terminators
Category:	modified
Size (bytes):	321
Entropy (8bit):	5.099866037700299
Encrypted:	false
SSDEEP:	6:zGLBL4j3RLBLgLBLTD20b3GCv1Y9aQwCVDQJw2JfowCV2LgPBSn:zsLOvLOLpbxkV8Jf+V2Lgo
MD5:	5E04518BB23AAB14529D29ED5BDE12A7
SHA1:	87A4E150BB716B96FE27431871BC479A63C444AC
SHA-256:	CFF88B9D1CCD44E13D35F66620BDB200622260DA35F5C671237CAC34F4C7A741
SHA-512:	6374D80C7C0D81CFDB5EE096BB734FFD06BED3730A27AC488E1DAAC5548AA61F5AF181B174A4AC300C897D63D2ED80E07147A035F5638B861767A9AE4B500D7E
Malicious:	false
Reputation:	unknown
Preview:	SET BINFILE=szndesktop.exe..SET CONFFILE=szndesktop.conf..SET DATAFILE=szndesktop.webpak..SET BINPATH=bin..SET CONFPATH=conf..SET DATAPATH=data...."%BINPATH%\%BINFILE%" default stop..rm "%BINPATH%\%BINFILE%"..rm "%CONFPATH%\%CONFFILE%"..rm "%DATAPATH%\%DATAFILE%"..rm "%CONFPATH%\szndesktop.d"..rm "%BINPATH%\sznpp.exe"..

C:\Users\user\AppData\Local\Temp\~006A9140.00000DD4.sznpkg\control.ini

Download File

Process:	C:\Users\user\AppData\Local\Temp\~006A2DE2.00000DD4.sznpkg\UNZIP.EXE
File Type:	Unicode text, UTF-8 text, with CRLF line terminators
Category:	dropped
Size (bytes):	334
Entropy (8bit):	5.051439725456318
Encrypted:	false
SSDEEP:	6:x39xRNfyMXBLhi4kzyZ9KiQLH2FlCqgLH2yEFORqtrWWblBVWxq0eWMEgX+s:dy4kkyH2HYH2yEFOPcnVWVeNBXb
MD5:	3800088727CE74072CC43008E16CE07D
SHA1:	F4559E53D3FC78439D93EC44FD1ADD759880124D
SHA-256:	13ACE6A8C4489F7E1410380D11C756363929180EB268706AF04A1455752BA8F5
SHA-512:	37E3342FF0230480E0C7F981D60A88C6E2ED2F5963710B04CC09E712E029F261F5FE91DF044CF629F14D352142EAD5BFCBC4B76BBB25734CC6E8CDB4510C7109
Malicious:	false
Reputation:	unknown
Preview:	[package]..name=cz.seznam.software.szndesktop..version=2.0.32..install=install.bat..uninstall=uninstall.bat..platform=win32..depends=cz.seznam.software.libszndesktop (2.1.30)..triggers=cz.seznam.software.libszndesktop..appName=Desktop HTTP Server (aplikace)\|Zaji..uje b.h HTML5 aplikac. na desktopu..islib=true..installer=1.1.15..

C:\Users\user\AppData\Local\Temp\~006A9140.00000DD4.sznpkg\install.bat

Download File

Process:	C:\Users\user\AppData\Local\Temp\~006A2DE2.00000DD4.sznpkg\UNZIP.EXE
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	290
Entropy (8bit):	5.318143737635718
Encrypted:	false
SSDEEP:	6:zxL4OKSVvieyoAB88yumoAB88y9CtuH1j0Kq9G9RNfHW+syxQ:zxLJIBsRBsJVj0KLxHW+lQ
MD5:	A4F113D2DDF779A13A65D3DF7D86E61B
SHA1:	952F6CCB508BF9C9E62C2886127BF4B89079A4C6
SHA-256:	7D27BC072CED3AC7D71446A77364429A04A12538DC4FFBA81894340728302285
SHA-512:	1A0C41330A63E6B1602647818D322E65E7E972DDE5B20CCF045FF007FCC4518FDF1055F819665DA3738B1E899BFC08A015F2AF361416442E01B790D3EF459F12
Malicious:	false
Reputation:	unknown
Preview:	SET BINFILE=wszndesktop.exe..SET BINPATH=%~1\bin....cpy "%BINFILE%" "%BINPATH%"..if ERRORLEVEL 1 exit %ERRORLEVEL%......if ERRORLEVEL 1 exit %ERRORLEVEL%....REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "cz.seznam.software.szndesktop" /d "\"%BINPATH%\%BINFILE%\" -q"..

C:\Users\user\AppData\Local\Temp\~006A9140.00000DD4.sznpkg\uninstall.bat

Download File

Process:	C:\Users\user\AppData\Local\Temp\~006A2DE2.00000DD4.sznpkg\UNZIP.EXE
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	178
Entropy (8bit):	5.307857484647402
Encrypted:	false
SSDEEP:	3:I3IgefL2JROL4AOshFMLyEqkdoL8FJAc2KD9so3KRfyM1K7eDoK0T9Gcx8SERLBJ:zxL4IDOQv4tuH1j0Kq9G9RNfHF
MD5:	6F73BC97F458228B8DC66C578AD0558D
SHA1:	E24552D8AB3F31E57A2B2320D4AFCFE8D29C394A
SHA-256:	06C375DA50AF41C663D982BBC244E2458AECE2DF7EC796F057C723D0C0334466
SHA-512:	1C377425590FF781DB6BCF411DAF9FCD6017E96C37151550163D27B1B83E23962F4E81614237C41640A17674EAE9AFB130944FB6E53788CB6165073370FD7B7D
Malicious:	false
Reputation:	unknown
Preview:	SET BINFILE=wszndesktop.exe..SET BINPATH=bin....rm "%BINPATH%\%BINFILE%"....REG DELETE "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "cz.seznam.software.szndesktop"

C:\Users\user\AppData\Local\Temp\~006A9140.00000DD4.sznpkg\wszndesktop.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\~006A2DE2.00000DD4.sznpkg\UNZIP.EXE
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	modified
Size (bytes):	109808
Entropy (8bit):	6.2768201722897174
Encrypted:	false
SSDEEP:	1536:HLe6c4VhQSZ5O0Ge/aeNS56OVRnh2vEWfrXIwGPqCRYMZ3ZqA3hCF:p9fQSZ4eieuvRheRfGqCRb3wBF
MD5:	F417B21647412D6FE712CA715351FFB1
SHA1:	5B8A678CB0F2E9A6E1F8DCFEFB37E5B5C2E5BFF1
SHA-256:	83CB19E6CB06A5DD29CC1757B64D7B9F740D19E688AE3088E3912265AE6C034D
SHA-512:	5A4174B53A9E4B76DC9B563FAD63843AD93D400C490E4B1EB7A86CF1C4DD742A5BF54775CB6C8DFEBF35F6564793A87F2B5317A2E949520EC59F3635F8557B63
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......;.V...8...8...8.%..}.8.%..l.8.%..{.8.%..x.8.....}.8.v...t.8...9..8.....{.8.....~.8....~.8.....~.8.Rich..8.................PE..L...A[dU..........................................@......................................@..................................D.......p...............\|...0..............8...............................@............................................text...$........................... ..`.rdata..._.......`..................@..@.data...`....P.......8..............@....rsrc........p.......F..............@..@.reloc..Z+.......,...P..............@..B........................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\~006A93FF.00000DD4.sznpkg\control.ini

Download File

Process:	C:\Users\user\AppData\Local\Temp\~006A2DE2.00000DD4.sznpkg\UNZIP.EXE
File Type:	Unicode text, UTF-8 text, with CRLF line terminators
Category:	dropped
Size (bytes):	489
Entropy (8bit):	5.046041168777111
Encrypted:	false
SSDEEP:	12:pHB1kkGU6KTtwvC4KH2HYH2yEFf+/BXOn:ePKTGWof+JOn
MD5:	8944C5B1FF10F616774AEDE76EAE6E21
SHA1:	8DACA10C92061ADA66E83024381321A640C74023
SHA-256:	F05AC648C802A7DADC99FBEABFDCD3B931E5DE69ACAE92222800E45DB81AF9FD
SHA-512:	5A543AC8FC4D0AEAD1DDC8284B15B1EAD2D6872F9B0FF4CA4CC68CD0D16BE275417690A7A0FACD4B9430514463F4206E4AC26B0E1CD22F069075219CD0D59078
Malicious:	false
Reputation:	unknown
Preview:	[package]..name=cz.seznam.software.libfoxcub..version=3.3.8..install=install.bat..uninstall=uninstall.bat..platform=win32..depends=cz.seznam.software.szndesktop (2.0.31)..depends=szn-software-base..depends=com.microsoft.msdn.msvcr110..depends=cz.seznam.software.lightspeed-1210 (12.10.18)..depends=cz.seznam.software.libszndesktop (2.1.30)..triggers=cz.seznam.software.libszndesktop..appName=Rychla volba\|Hlavn. sou..st Li.ti.ky 3 - Rychl. volba pro IE..islib=true..installer=1.2.0..

C:\Users\user\AppData\Local\Temp\~006A93FF.00000DD4.sznpkg\foxcub.conf

Download File

Process:	C:\Users\user\AppData\Local\Temp\~006A2DE2.00000DD4.sznpkg\UNZIP.EXE
File Type:	JSON data
Category:	dropped
Size (bytes):	251
Entropy (8bit):	4.291736196961814
Encrypted:	false
SSDEEP:	3:YGQXXpuEE+EngwE7sKHku4Esp3Ap76LCHfOtHJYLMvrE7G/HN3W6UhHAwEvu5EEe:YGQXdHEgwAsih4ToGp/AKt3fkHLuua1n
MD5:	8E57D24183014767EC68E92B133FD115
SHA1:	74107EDB98696D90820D3FFBFFB83054407D7DA0
SHA-256:	E494C7D20BF02BC63FD9AB43896CAE0FCF5A97B73266A3A5090F8D4674870CC4
SHA-512:	37B0EFFC7B2314A2DD8AC5D9F3B6CDB9DD9A4B2B87956D4CB1E6CA1656109ACB2C1B812EAAEB9BB0B79A62EEF21F3D83A3A242A29D7DD653591AF5E91BB0EF45
Malicious:	false
Reputation:	unknown
Preview:	{"currency":{"enable":true},"email":{"enable":true,"mailboxes":[]},"kos":{"enable":true},"slovnik":{"active":true,"curLang":"en_cz","enable":true},"speedDial":{"enable":true,"mode":"big","rss":true},"srank":{"enable":true},"synchro":{"enable":true}}..

C:\Users\user\AppData\Local\Temp\~006A93FF.00000DD4.sznpkg\install.bat

Download File

Process:	C:\Users\user\AppData\Local\Temp\~006A2DE2.00000DD4.sznpkg\UNZIP.EXE
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	2513
Entropy (8bit):	5.406931319732965
Encrypted:	false
SSDEEP:	48:jg7gDWxgDyg7gbg0lZa3UCvBRaA/4r/wnkEGs6HbDLugINpTR09pQzXRiN:jin3sAnWUkEA/4r/wL6bGfl09pJN
MD5:	BF471E6E8C4F554736825FA91840F9EB
SHA1:	D5789BF2D42C6286D0105C1AEE1590BD99F46EA8
SHA-256:	7EA60AFB73078A88A53212DD907C953F1508A851FE864C95B338466E8FC9C00E
SHA-512:	931B0BA8E163EE0896E951ED3CEDBE7D81D4BFF0490CC18E69AF0ACD2E9F64639E2634B5AC3A7E435FB94B268E8E78A5F3071F827AAA2711E759D43CD98FA02D
Malicious:	false
Reputation:	unknown
Preview:	REM ----------------------- Ielisticka ------------------------------....cpy libfoxcub.dll "%~1\bin"..cpy libfoxcub-x64.dll "%~1\bin"..if errorlevel 1 exit %ERRORLEVEL%..cpy libfoxcub.conf "%~1\conf\szndesktop.d"..if errorlevel 1 exit %ERRORLEVEL%..if not exist "%~1\conf\libfoxcub" mkdir "%~1\conf\libfoxcub"..if not exist "%~1\conf\libfoxcub\foxcub.conf" cpy foxcub.conf "%~1\conf\libfoxcub"..if not exist "%~1\conf\libfoxcub\remote.conf" cpy remote.conf "%~1\conf\libfoxcub"..if errorlevel 1 exit %ERRORLEVEL%..cpy listickaconfig.webpak "%~1\data"..if errorlevel 1 exit %ERRORLEVEL%..cpy listickanastaveni.webpak "%~1\data"..if errorlevel 1 exit %ERRORLEVEL%..cpy speeddial.webpak "%~1\data"..if errorlevel 1 exit %ERRORLEVEL%....if EXIST "%~1\conf\libfoxcub\regcfg.conf" goto skipPartner....SET partnerId=1..pushd "%~1"..for /F "delims== tokens=1,2*" %%a IN (partner.conf) DO IF "%%a" == "partnerId" SET partnerId=%%b..popd ....echo {"partnerId":%partnerId%} > "%~1\conf\libfoxcub\regcfg.conf"..

C:\Users\user\AppData\Local\Temp\~006A93FF.00000DD4.sznpkg\libfoxcub.conf

Download File

Process:	C:\Users\user\AppData\Local\Temp\~006A2DE2.00000DD4.sznpkg\UNZIP.EXE
File Type:	Generic INItialization configuration [staticweb]
Category:	dropped
Size (bytes):	1448
Entropy (8bit):	4.901047438742344
Encrypted:	false
SSDEEP:	24:dUh6Z6o7ZsR3cGoR4EGTXWMI2RdAWMIB/O1E9WMI5+RWMIvWMId0Qrpl5LLKWMIa:iRMG25Gg2RVmT5lcd08l59at
MD5:	7B2F5385705ABE063F856AB95862728C
SHA1:	FC13736A364F28889926D8D45AB60BEF73C225EB
SHA-256:	BE549B1221217D59B61BFA2E01A3BD4184F17B530B126E73EAC3641AD208C01F
SHA-512:	88252DF6FC20F4DC88D9BEC6543D5E8CF3AD9BE73E329FCECAA41AAE64E9E091C90F4DE238CDF37A72127E1E82204880B796E68B7E72AD4255D1785C827D1139
Malicious:	false
Reputation:	unknown
Preview:	[modules]..module=staticweb..module=proxy..module=confighandler..module=speedDial..module=config..module=trash..module=email..module=nastaveni..module=currency..module=synchro....[staticweb]..type=staticpak..path=/speedDial..webfile=$data:\speeddial.webpak..indexFile=speedDial.html....[config]..type=staticpak..path=/libfoxcub/config..webfile=$data:\listickaconfig.webpak..indexFile=jsoneditor.htm....[configd]..type=static..path=/libfoxcub/configd..documentRoot=C:\Users\ondrej.novak\Documents\Visual Studio 2008\Projects\software-trunk\ielisticka_new\libfoxcub\jsoneditor..indexFile=jsoneditor.htm......[proxy]..type=proxy..path=/speedDial/proxy..proxyurl= .. ....[speedDial] ..type=library ..path=/speedDial/listicka..libraryPath=$bin:\libfoxcub.dll..handlerName=speedDial ....[confighandler] ..type=library..path=/libfoxcub/config/service..libraryPath=$bin:\libfoxcub.dll..handlerName=config ......[trash] ..type=library ..path=/libfoxcub/trash..libraryPath=$bin:\libfoxcub.dll..handlerName=tr

C:\Users\user\AppData\Local\Temp\~006A93FF.00000DD4.sznpkg\libfoxcub.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\~006A2DE2.00000DD4.sznpkg\UNZIP.EXE
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1880272
Entropy (8bit):	6.500018529063439
Encrypted:	false
SSDEEP:	24576:hl7fX2zHchwxBv/2GXCJWdWoo7SzQEjhMcWOuqTYwiTrJGQnHJfjXYf092Zr3WIB:pKWhZHhrYrZr3W6wC48Yxe+waL/HS
MD5:	F5D82C32D38DEC985CFFC2B0001E7CE3
SHA1:	D378CB9DC9F5AE37C9D329866C7939F8196ADE16
SHA-256:	803CEDEC2FE0C589DED0DC8ABA250AB22B3932F33BD39C7F53C85C607F94139C
SHA-512:	C0B8D6B83C976CE41EB2603E642315ACECB58874995FFCC0507A1BA6E20DB8109738F51BFF6F2E4FA44B0CF74CABB0CA9024CCF98E380754699BA9F26FF8F442
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$........o................5.......6.......3.......7.......7......v{......vk.......3.........X.....+.......2.......1.......o.......4.....Rich............................PE..L...?:.Z...........!.....$...`......E........@......................................h%....@.........................P...>....c..........h................0.......[...J..8........................... ...@............@...............................text....".......$.................. ..`.rdata...W...@...X...(..............@..@.data...h...........................@....rsrc...h............b..............@..@.reloc..>............n..............@..B........................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\~006A93FF.00000DD4.sznpkg\listickaconfig.webpak

Download File

Process:	C:\Users\user\AppData\Local\Temp\~006A2DE2.00000DD4.sznpkg\UNZIP.EXE
File Type:	data
Category:	dropped
Size (bytes):	71016
Entropy (8bit):	5.785633253325673
Encrypted:	false
SSDEEP:	1536:bQZjTDOzKaKdpHqxRNPHIBXgeKLHQ4ZGAB:bQlbdpHqxRNPggj
MD5:	0088ADAA0D4E38DEAFF99DBB53056BCF
SHA1:	00F8CD59EADF6FEFE898E5B92970F64F08C25486
SHA-256:	4F06D3F8AF8D3D42F5A27D954BE0864894B850E3A807AC1BFB1A7DED149732A2
SHA-512:	E28210D2F0124E08A6F218988252B5A91CAA056AFAE50E720801FA8130AB2D108B720C0A85F744184D3BA53DA9DA556E69C0D943FEAD0E8A62C6CFDE1DC069F0
Malicious:	false
Reputation:	unknown
Preview:	........h...<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3c.org/TR/1999/REC-html401-19991224/loose.dtd">.. saved from url=(0032)http://www.jsoneditoronline.org/ -->..<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd"> ....@file index.html....@brief ..JsonEditor is an editor to display and edit JSON data in a treeview. ....Supported browsers: Chrome, Firefox, Safari, Opera, Internet Explorer 8+ ....@license..This json editor is open sourced with the intention to use the editor as ..a component in your own application. Not to just copy and monetize the editor..as it is.....Licensed under the Apache License, Version 2.0 (the "License"); you may not..use this file except in compliance with the License. You may obtain a copy ..of the License at....http://www.apache.org/licenses/LICENSE-2.0....Unless required by applicable law or agreed to in writing, software..distributed under the License is distribute

C:\Users\user\AppData\Local\Temp\~006A93FF.00000DD4.sznpkg\listickanastaveni.webpak

Download File

Process:	C:\Users\user\AppData\Local\Temp\~006A2DE2.00000DD4.sznpkg\UNZIP.EXE
File Type:	data
Category:	dropped
Size (bytes):	1075112
Entropy (8bit):	7.7428487407634945
Encrypted:	false
SSDEEP:	24576:/qQkNhE7ATNvwR2hxIJRMmg+Ed7jhyIchGssZaB5siU1uro7GBSSkvl8rDn5yjET:/bk/E8T2UIJRMv+Ed7jhyIchGssZaB5h
MD5:	D00533F1920AC71573B41B305E281009
SHA1:	CD970AD17A4963943483C238A8BB1A90654D66E1
SHA-256:	34BFC9049EE263DBCA2851DA67A841C4AA4C1FF59A6E6FE8C9ED1A281D10B682
SHA-512:	7DDDF1C65FBDB72D61853F0555E6A69D0E65F91FDB111012288893D78BD676778D2B37FDEA4CA6048CA1C78C674C4BCA9365BBF0F6EBC12F52473DA56DA47459
Malicious:	false
Reputation:	unknown
Preview:	....B...._..<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">..<html xmlns="http://www.w3.org/1999/xhtml">..<head>.. <meta http-equiv="content-type" content="text/html; charset=utf-8" />.. <title>Li.ti.ka nastaven.</title>.. <link rel="stylesheet" href="css/default.css" media="all" type="text/css" id="link" />.. <script type="text/javascript" src="js/jak.js"></script>.. <script type="text/javascript" src="js/listicka.js"></script>.. <script type="text/javascript" src="js/chrome/about.js"></script>.. <script type="text/javascript" src="js/chrome/advance.js"></script>.. <script type="text/javascript" src="js/slovnik.js"></script>.. <script type="text/javascript" src="js/email.js"></script>.. <script type="text/javascript" src="js/promo.js"></script>.. <script type="text/javascript" src="js/synchro.js"></script>.. <script type="text/javascript" src="js/speeddial.js"></script>....

C:\Users\user\AppData\Local\Temp\~006A93FF.00000DD4.sznpkg\remote.conf

Download File

Process:	C:\Users\user\AppData\Local\Temp\~006A2DE2.00000DD4.sznpkg\UNZIP.EXE
File Type:	JSON data
Category:	dropped
Size (bytes):	11515
Entropy (8bit):	5.478707149357688
Encrypted:	false
SSDEEP:	192:HxAJUUhAJLFamdn7jQyFiP6VvRtURYdRzRKRxR5RU+zvPzpVRDNv:QnmVAP6Vv/UadxQD71fr
MD5:	C55F08F888B2DC2D520921D2656238ED
SHA1:	22EBE442A76ADF786F098E0F64E944DD94A13933
SHA-256:	C13F64AA32CC4C81631B541218C96A25A2263CA4A47B95844FA663E36BD90070
SHA-512:	5791D75C8E2224510FB64373C5094DD92FCFAEE6C5A1B5504B707F7FABE5EEA5FA74FD3556CB013513B94FE9C316176B59348685B7E08FCEDAD7486944F07EC8
Malicious:	false
Reputation:	unknown
Preview:	{"core":{"configUrl":"http://download.seznam.cz/software/conf/","configUrlSecure":"https://download.seznam.cz/software/conf/","registerUrl":"http://reg.software.seznam.cz:80/RPC2","registerUrlSecure":"https://reg.software.seznam.cz:443/RPC2","updateUrl":"http://download.seznam.cz/software/conf/update-${product}.ini"},"currencies":{"updateUrl":"http://www.cnb.cz/cs/financni_trhy/devizovy_trh/kurzy_devizoveho_trhu/denni_kurz.txt"},"email":{"classes":{"atlas.cz":{"compose":"https://auser.centrum.cz/??ego_user=${jmeno}&ego_domain=${domain}&ego_secret=${heslo}&url=http%3A%2F%2Famail.centrum.cz%2F\\{onload}\\$${}?pg=newmsg","mailbox":"https://auser.centrum.cz/??ego_user=${jmeno}&ego_secret=${heslo}&ego_domain=atlas%2ecz&url=http%3a%2f%2famail%2ecentrum%2ecz%2f","mode":"pop3","server":"imap.atlas.cz:110"},"centrum.cz":{"compose":"https://user.centrum.cz/??ego_user=${jmeno}&ego_domain=${domain}&ego_secret=${heslo}&url=http%3A%2F%2Fmail.centrum.cz%2F\\{onload}\\$${}?pg=newmsg&to=${to}&subject=$

C:\Users\user\AppData\Local\Temp\~006A93FF.00000DD4.sznpkg\speeddial.webpak

Download File

Process:	C:\Users\user\AppData\Local\Temp\~006A2DE2.00000DD4.sznpkg\UNZIP.EXE
File Type:	data
Category:	dropped
Size (bytes):	989872
Entropy (8bit):	7.417276532154073
Encrypted:	false
SSDEEP:	24576:0NVC7oR2sMQIN9D9fB5sYUMWW4WK/Z34K2uxaXTfGjmK5UkJU4pzqJg1tK1zoHGe:IH6HD9fB5sYUMWW4WKJxaXTfGjmK5Ukf
MD5:	E27433CCC5181FC6BF27EF706B41FB84
SHA1:	26BCE9411553873948A52B0DFE98C5E0A85EB637
SHA-256:	F3FD949C5AF3BD17017CA5FEF6EF3DC5757B56DEFDF03F742610FC5C9FB4D964
SHA-512:	3D34F2DF7778BDF3DE911D731C4D1569447F91D9D2235438552C86D9BA43C14A95616B5C12EDE68F6B9CCD1491522A0060100CA4826C185B0CC01FBE71866150
Malicious:	false
Reputation:	unknown
Preview:	....a.......body {. background: url(../img/ie-back.jpg) #843395 top left repeat-x;.}..body #backgroundImage {. height: 100%;. width: 100%;. display: block;. margin: 0;. background: transparent url(../img/ie-logo.png) no-repeat left top;.}.html {. font-size: 106.5%.}..body {. margin: 0 0 8px 0;. text-align: center;. color: #000;. font-size: 76.5%;. font-family: Arial, sans-serif;. background: #fff.}..body#www-seznam-cz {.}..html:first-child body#www-seznam-cz[id="www-seznam-cz"] {. background-position: 50% 9.5em.}..td {. font-size: 100%;.}..h1, h2, h3, h4, h5, p, ul, ol, li, form {. padding: 0;. margin: 0.}..select {. font-size: 100%.}..img {. vertical-align: top;. border: none;. margin: 0;. padding: 0.}..li {. list-style-type: none.}..hr {. display: none.}..a:link {. color: #de0000.}..a:visited {. color: #900.}..a:hover {. color: #300.}../*body {-ms-filter: "progid:DXImageTransform.Microsoft.Blur(pixelRadi

C:\Users\user\AppData\Local\Temp\~006A93FF.00000DD4.sznpkg\uninstall.bat

Download File

Process:	C:\Users\user\AppData\Local\Temp\~006A2DE2.00000DD4.sznpkg\UNZIP.EXE
File Type:	ASCII text, with CRLF line terminators
Category:	modified
Size (bytes):	447
Entropy (8bit):	5.094173564825026
Encrypted:	false
SSDEEP:	6:1iWREo1HPrzb1LErZKkW6kK1enEhftxyEniECjAXrYKd1oct2LcEJcRz2CISR7Kj:11b1PHVQxJcoWaR2LcbKCIi7+IitFR
MD5:	7DA206C336BBE241FA88BB871711480E
SHA1:	47B0CA6C686DB6E1967BFAA9CE9BD70E1C7B786A
SHA-256:	637EF514B3A00D744B00D17C1E5F61B78C98BEDD08A1FD97E4CF542D5C8300B9
SHA-512:	51A693D9191323DFC76581C994521B3419E805704A31C0A6FB8D11AE4F6229F95262B28683643DA86E6DA977ED4B7A351CC8695F05B26629B7F7E0473CECB9C1
Malicious:	false
Reputation:	unknown
Preview:	REM ----------------------- Postak Uninstall------------------------------....if "%INSTALLMODE%" == "reinstall" goto skipUnreg....pushd "%~1\bin"..rundll32.exe libfoxcub.dll,UninstallFoxCub..echo Result: %ERRORLEVEL%..popd..rm "%~1\conf\libfoxcub"....:skipUnreg....rm "%~1\bin\libfoxcub.dll"..rm "%~1\conf\szndesktop.d\libfoxcub.conf"..rm "%~1\data\listickaconfig.webpak"..rm "%~1\data\listickanastaveni.webpak"..rm "%~1\data\speeddial.webpak"....

C:\Users\user\AppData\Local\Temp\~006AA61F.00000DD4.sznpkg\control.ini

Download File

Process:	C:\Users\user\AppData\Local\Temp\~006A2DE2.00000DD4.sznpkg\UNZIP.EXE
File Type:	Unicode text, UTF-8 text, with CRLF line terminators
Category:	dropped
Size (bytes):	442
Entropy (8bit):	5.01472571344773
Encrypted:	false
SSDEEP:	12:pHALZkkyH22HyKT9clH2yEFTzFj4KLCBXOn:6LGwKTGhoTz9HWOn
MD5:	7BF679DB31F3B8B6A27DBA5D5B36F99A
SHA1:	EF1D96574DC79A9D10F99406B50CCA6535DC572D
SHA-256:	900948B98AEE697C90C34442BC258BD975C9716F944A9A63AC2BEB1B0C2BA5E4
SHA-512:	A73138047146391A3E44CE6F89C002E5FD5BF8093B2C3E5D4B7C0D875C8F4DEE15722A0C09A78947FB3081A8094232A74D62569BF857EB60AD4453B4ABE67C09
Malicious:	false
Reputation:	unknown
Preview:	[package]..name=cz.seznam.software.libfoxloader..version=3.2.7..install=install.bat..uninstall=uninstall.bat..platform=win32..depends=cz.seznam.software.libszndesktop (2.1.29)..depends=cz.seznam.software.libfoxcub (3.3.4)..depends=szn-software-base..depends=com.microsoft.msdn.msvcr110..triggers=cz.seznam.software.libszndesktop..appName=Zavad.. Li.ti.ky pro IE\|Modul zavede Li.ti.ku do Internet Exploreru..islib=true..installer=1.2.0..

C:\Users\user\AppData\Local\Temp\~006AA61F.00000DD4.sznpkg\install.bat

Download File

Process:	C:\Users\user\AppData\Local\Temp\~006A2DE2.00000DD4.sznpkg\UNZIP.EXE
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	665
Entropy (8bit):	5.090531037132653
Encrypted:	false
SSDEEP:	12:dEMSlM7DC8g9Tb2LgxLXgoNH2zNoRzdoz5aLH2zRLN2NH2zcDzVaLJXgp:2MSC7DHgZh7goVgoiO8LNuytgp
MD5:	9BBCD62FE1CD94EBEB3E5E0D265B1FAC
SHA1:	DF5D01AB785BDBD8999D691055ABC89FB848A460
SHA-256:	70AF4838579108F54C6CAEC76951864981A4A45BBF5EEB88A9A867F95870FFE3
SHA-512:	537ACE03CAEE651837B479E3563AC020016A3406F9B68C634653A58359EEA572ED5807D58DDB2F453F83803F2A8C9A3CF7E7FA6C574BEA603DB57D7447E966E6
Malicious:	false
Reputation:	unknown
Preview:	SET PREFIX=%RANDOM%..SET TRGNAME=%PREFIX%libfoxloader.dll....pushd "%~1\bin"..for %%a in (*libfoxloader.dll) do %RM% %%a..popd..copy libfoxloader.dll "%~1\bin\%TRGNAME%"..if errorlevel 1 exit %ERRORLEVEL%..pushd "%~1\conf\szndesktop.d"..echo [modules]> libfoxloader.conf..if errorlevel 1 exit %ERRORLEVEL%..echo module=foxloader>> libfoxloader.conf..echo [foxloader]>> libfoxloader.conf..echo type=library>> libfoxloader.conf..echo path=/libfoxcub/loader>> libfoxloader.conf..echo handlerName=libfoxloader>> libfoxloader.conf..echo loadOnStart=true>> libfoxloader.conf..echo libraryPath=$bin:\%TRGNAME%>> libfoxloader.conf..if errorlevel 1 exit %ERRORLEVEL%..popd..

C:\Users\user\AppData\Local\Temp\~006AA61F.00000DD4.sznpkg\libfoxloader.conf

Download File

Process:	C:\Users\user\AppData\Local\Temp\~006A2DE2.00000DD4.sznpkg\UNZIP.EXE
File Type:	Generic INItialization configuration [foxloader]
Category:	dropped
Size (bytes):	165
Entropy (8bit):	4.545945161173906
Encrypted:	false
SSDEEP:	3:rJAguK72ub6ofqOsJMjgKEEK/AXQv26pShVovCuEErPvGW6lJJov:dIKdblVgKc/Au2jhCqutTexov
MD5:	6010386C369DD37FA35F0895697A55A0
SHA1:	C9CDE28259BFB467A716338662B5F9988435FD9D
SHA-256:	5ECB2D995A08B9A5AE1BCDFF200127FD1E874F1FA40B5BF58C953F1DD3FFC3A6
SHA-512:	736A849A74A49D75B099D93CB988DCF333C1EB7B77B7D68DD2D35F12D4A6EC7D6B05070B4A67A3592CB2DB14D2084F7E19D712201B2C502AE9AEC9E37647D6BD
Malicious:	false
Reputation:	unknown
Preview:	[modules]..module=foxloader......[foxloader]..type=library ..path=/libfoxcub/loader..handlerName=libfoxloader..loadOnStart=true..libraryPath=$bin:\libfoxloader.dll..

C:\Users\user\AppData\Local\Temp\~006AA61F.00000DD4.sznpkg\libfoxloader.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\~006A2DE2.00000DD4.sznpkg\UNZIP.EXE
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	85200
Entropy (8bit):	5.932380817410408
Encrypted:	false
SSDEEP:	1536:WrTyUCzoihenEBGcjsWjcdPLQZgbK5CUghz:WHyJornAY0ZYZ
MD5:	98AE6C257258FF994E7E9766DDAEC68E
SHA1:	EAF20399A1B51F8E3E65CFF4C9E59A3738867601
SHA-256:	B04D855959131D3864A953A64421166CB933DC9A4F3D21EC0841CC316F5CC2C2
SHA-512:	ECEBDAF83E5F4EF38EE68FC0C83134A029D059E0F8531106596A9C36CB050CE74041E14A3EA2B839FC4DDDC8BCE66DA12FE25ADDEE62AA482F18DAA455BFA560
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........']{.t]{.t]{.t..it@{.t..ktV{.t..ht.{.tT.5tX{.t]{.t.{.t~.ut^{.t;.lt\{.t;.ot\{.t;.jt\{.tRich]{.t........................PE..L......Z...........!.........................................................p......\|:....@.............................x.......<.... ...................0...0..........8...............................@...............<............................text....~.......................... ..`.rdata..xS.......T..................@..@.data...8-..........................@....rsrc........ ......................@..@.reloc..<0...0...2..................@..B................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\~006AA61F.00000DD4.sznpkg\uninstall.bat

Download File

Process:	C:\Users\user\AppData\Local\Temp\~006A2DE2.00000DD4.sznpkg\UNZIP.EXE
File Type:	ASCII text, with CRLF line terminators
Category:	modified
Size (bytes):	117
Entropy (8bit):	4.733719959588687
Encrypted:	false
SSDEEP:	3:EIFTLU2JROLcDviK3FiMqIbMFAAsMxLGlJJM7KZAF9KVw:THt2Lc2WFKwMFRL+MEgo+
MD5:	9F076A34053864B8E9A1B5FEE5C8A375
SHA1:	9C04BD85478C512D0C150913A2F9124E65E8FBE7
SHA-256:	A42B1531B57778A1DB29D0E00C2E572737C2658D6A8B4B9DAE9641B664A85187
SHA-512:	0C2CF9730C468FE1BAD8FED6A1FA7FF2196096564CAA418551E789A7EA59679F3E59C16996C9D2F53FCFC232BD9B6696F9F9C6C3DAC5F66BB0EBE73C72523E4A
Malicious:	false
Reputation:	unknown
Preview:	..rm "%~1\conf\szndesktop.d\libfoxloader.conf"....pushd "%~1\bin"..for %%a in (*libfoxloader.dll) do %RM% %%a..popd..

C:\Users\user\AppData\Local\Temp\~006AA7B6.00000DD4.sznpkg\control.ini

Download File

Process:	C:\Users\user\AppData\Local\Temp\~006A2DE2.00000DD4.sznpkg\UNZIP.EXE
File Type:	Unicode text, UTF-8 text, with CRLF line terminators
Category:	dropped
Size (bytes):	371
Entropy (8bit):	5.103634549690599
Encrypted:	false
SSDEEP:	6:x39xLHE8li4kzyZ9KiZ+JLHY/oCqgLH2yEFmao77LPtA4OUjZEgXOn:pHP1kkZKHYwYH2yEFmaQXyMNBXOn
MD5:	A95BB6B9B97ABE3837321C6E10F7D18C
SHA1:	FF47ABC686E475E7F11D7A9DE75719E920050FB7
SHA-256:	F89BD222E4BCCC250AE261290317FA5B6F1A0AAFF45CA3C76A3D6AFF3C0BA48D
SHA-512:	1B845A8438B89F7D298A490FADA6C714D0AE81D0A47751F2AA3EC245251D40BA4843CEB0735B90CBC213716E92846B5BB29105A53A8F63C3648133F6FC72846A
Malicious:	false
Reputation:	unknown
Preview:	[package]..name=cz.seznam.software.libfoxcub64..version=3.3.8..install=install.bat..uninstall=uninstall.bat..platform=win32..depends=szn-software-base..depends=cz.seznam.software.libfoxloader (3.2.7)..triggers=cz.seznam.software.libszndesktop..appName=Seznam Li.ti.ka 64bit\|Soubory pot.ebn. pro b.h Li.ti.ky v 64bitov. architektu.e..islib=true..installer=1.2.0..

C:\Users\user\AppData\Local\Temp\~006AA7B6.00000DD4.sznpkg\install.bat

Download File

Process:	C:\Users\user\AppData\Local\Temp\~006A2DE2.00000DD4.sznpkg\UNZIP.EXE
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	479
Entropy (8bit):	5.092757416486348
Encrypted:	false
SSDEEP:	6:1FtfQNO2LGaKwMFRLJgoBI0AXMJ2dI8ym0TAXMJ2dI8yx2C8XMJ2dI8yrwTHrYTe:1gEMFlMagmTgoC8grcHGLyqy
MD5:	7A522080BFF68371130F0741A612C4E0
SHA1:	9D3C3D2C406C821D71ED1E153401BB738C3726B6
SHA-256:	EB0BA985B99016851B9319C24F38B7D7C9AF75603323B93763FE5B79D66B196B
SHA-512:	01680337EFB8CD5F9BA80A5F2CBFA932731EBDDBA4AAFBF31D5D17302228B8DC99586764A925D50935AB98B73B7322F52DFFA2D7CBC5FB705E26FBE511B5FD98
Malicious:	false
Reputation:	unknown
Preview:	REM ----------------------- Ielisticka ------------------------------....SET PREFIX=%RANDOM%..SET TRGNAME=%PREFIX%libfoxloader-x64.dll....pushd "%~1\bin"..for %%a in (*libfoxloader-x64.dll) do %RM% %%a..popd....cpy libfoxcub-x64.dll "%~1\bin"..if errorlevel 1 exit %ERRORLEVEL%..cpy listicka-x64.exe "%~1\bin"..if errorlevel 1 exit %ERRORLEVEL%..copy libfoxloader-x64.dll "%~1\bin\%TRGNAME%"..if errorlevel 1 exit %ERRORLEVEL%....cd /D "%~1\bin"..szndesktop.exe default restart..

C:\Users\user\AppData\Local\Temp\~006AA7B6.00000DD4.sznpkg\libfoxcub-x64.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\~006A2DE2.00000DD4.sznpkg\UNZIP.EXE
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	2568400
Entropy (8bit):	6.126130023583928
Encrypted:	false
SSDEEP:	49152:1o4AvX3ICcnSJRucrQHk0xK5Rf9GjKj/vK6NY6dKSH7WW:saS6IMwpH7WW
MD5:	E42A7B81947AE11B69A1773C2246166F
SHA1:	0CBAC24F21C1F7DE8636DC118A1A4EAD469DD1D6
SHA-256:	057C982A5972B27BE039E76A8253016E83B5B91CD8E3BE9A32A224AD19D53900
SHA-512:	5888CA62149A72A0917C639CD823660F74BE6377659A4D1EA891537AEB8EAB544DDB20AB3D816BC3EDF6AFB52030AEA973A25EE0ABC43167DB1E7BC676F955F6
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......\.....@...@...@.......@.....J.@.......@.;#....@......@......@......@...A...@.;#....@.~"....@.~"....@......@.~"....@.Rich..@.........PE..d...'=.Z.........." .................#........................................'.......'...`.........................................PR".....4*".,.... %.@.....$.......'..0....&.8@.../..8...........................PN..p............ ...............................text............................... ..`.rdata...2... ...4..................@..@.data........`"..V...D".............@....pdata........$.......#.............@..@.rsrc...@.... %.......$.............@..@.reloc.......&......\|&.............@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\~006AA7B6.00000DD4.sznpkg\libfoxloader-x64.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\~006A2DE2.00000DD4.sznpkg\UNZIP.EXE
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	92368
Entropy (8bit):	5.825209255940427
Encrypted:	false
SSDEEP:	1536:VVM9oDGj2dQ8T4LPgNELt/dXheskGKwshql8ksWXd8kNg8BgLA9+kghm:49oa6T+YKt/dXsLmHTVNBBS2+k
MD5:	838737C4B75CCEC631951DAC86CE2F78
SHA1:	D7976EE1E596D81607484CBB11B79E8AAD3130BE
SHA-256:	734D8ADDF79703CAE9844BD8A92E29C7872851134CCDB17B04A2DB793463C04F
SHA-512:	8B2D325FC4D8CBB32A25622A139AA4273701677C37FAA9DAD2E7DC56BD5EA145E009F687F4C7F7A1E28F27E170D3AB6CE42E4BC1210E0FA6BF45F42097227935
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........za.............{.......{.......{.......c..........................................Rich............................PE..d..._..Z.........." ................<.....................................................`.............................................x.......<....p.......`.......8...0.............8...........................p...p...............h............................text.............................. ..`.rdata..Hs.......t..................@..@.data...h8... ......................@....pdata.......`......................@..@.rsrc........p.......&..............@..@.reloc...............(..............@..B........................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\~006AA7B6.00000DD4.sznpkg\listicka-x64.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\~006A2DE2.00000DD4.sznpkg\UNZIP.EXE
File Type:	PE32+ executable (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	80576
Entropy (8bit):	5.719036217075449
Encrypted:	false
SSDEEP:	1536:4yiJI2Te51f0yTd/kryK7ReiTA68DsW7iXdG8pm35/Ah:QI2TSfld/krl7N8UG8p2
MD5:	D893A7276D60FD252EAFFE6E91AAC434
SHA1:	CFC5619C24F1EB11BE5689CE4BF71DDE149B69DA
SHA-256:	62DF14CED9A313DD632C8161F9E6DBDF74CFAE6F2E5DDDD1F28B380173E0210E
SHA-512:	525C314C2D6BBA61A7DFC86E0AE9347F9C7184CFB9CCC1FF118446B9AE8E817E8F22A750E3799DDE0777991B0A3B6263F5A58F45A54D76EA1504519CDA9D9A4F
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......}.q.9...9...9....5.+....5.m....5.>...0...:...9...i......;..._..8..._..8...Rich9...........................PE..d...f..X.........."......v.......... ..........@.............................p.......x....`.....................................................(....P.......@...........0...`.. .......8...............................p............... ............................text...kt.......v.................. ..`.rdata...b.......d...z..............@..@.data....7..........................@....pdata.......@......................@..@.rsrc........P......................@..@.reloc..H....`......................@..B................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\~006AA7B6.00000DD4.sznpkg\uninstall.bat

Download File

Process:	C:\Users\user\AppData\Local\Temp\~006A2DE2.00000DD4.sznpkg\UNZIP.EXE
File Type:	ASCII text, with CRLF line terminators
Category:	modified
Size (bytes):	143
Entropy (8bit):	4.821271069043112
Encrypted:	false
SSDEEP:	3:VCHrYI8FrI3VxtFIjEdg7BiMqIbMFAAsMxLG4oKZAF9KVt:VCHrYzrIb3g0qBKwMFRLJgo/
MD5:	C206DCA6E849C4A7E9834ECBC272A07F
SHA1:	748ACE4319039EDE0A248B523847A0E1CAE9B015
SHA-256:	A5DEFAF6D54CB1EC27EF9837C1D1160FCC6C32E407769C20961DDC95F074619F
SHA-512:	1108628973E8A190D05536859B343B92EF3962CDDCA99793A74DA09393E3B329F640B6C4C3741C7B0558ADB7A86406AFBB26169D57A0B37420BDB2A3CE631275
Malicious:	false
Reputation:	unknown
Preview:	..cd /D "%~1\bin"..%RM% libfoxcub-x64.dll ..%RM% listicka-x64.exe ....pushd "%~1\bin"..for %%a in (*libfoxloader-x64.dll) do %RM% %%a..popd....

C:\Users\user\AppData\Local\Temp\~DF35775713FA993F91.TMP

Download File

Process:	C:\Program Files\Internet Explorer\iexplore.exe
File Type:	data
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.1447792184086376
Encrypted:	false
SSDEEP:	12:i9lm1qat20tNjN75qPauDGzdM67iAvckH879:i9lm168NjN75qbDKdMc05
MD5:	70B7C92CE553C6CE069D8C3307E041ED
SHA1:	A33EBBA713406D9F55256E37772304DF393D8A31
SHA-256:	6B6CFB3C2920D66077DE7BA798479A5FF8111B2188CE8B91BE9BA4783D2FC4BC
SHA-512:	74C36C879C98F2B08C7B89DBA33A535313F742B11F3AAC41C967CEBD5CFB8EF4CC70F1A5DFB88A6F04837E64D7EC6725D0512C27F90EBD9B8C7BCACFDF320598
Malicious:	false
Reputation:	unknown
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\~DF423FA2587ED1B6A7.TMP

Download File

Process:	C:\Program Files\Internet Explorer\iexplore.exe
File Type:	data
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.08128987671884447
Encrypted:	false
SSDEEP:	3:3FuOXjI/OwRJolclllv/nt+lybltll1lRsltFll2/lsllYxO17lxOfll:QSE//r4UFAl3+tswxI7/A
MD5:	7DD2782247FE82D0567D3FDC8E9C466E
SHA1:	CE81BC0E77342C403185B6FA50FBA287452CBBAA
SHA-256:	BDEB81F58D67A623B6BC4823BA1F0C542F6D97E5A6C4A17F909409FC11F5D861
SHA-512:	BA819132E3DEC8A44657C4119CDF7B9BE807CD8C5129BD49F326FC391D1080446B23857C3DB41DD57B4C4E6DDCAC5115979687A61659681D62B2B58EF30AC8A0
Malicious:	false
Reputation:	unknown
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\~DF6246FEEE8A098C52.TMP

Download File

Process:	C:\Program Files\Internet Explorer\iexplore.exe
File Type:	data
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.06969055509156002
Encrypted:	false
SSDEEP:	3:u3XQOXbfNrdlolclllv/nt+lybltll1lRsltFll2/lsllu19QO17lxOfll:unQSLl4UFAl3+tsm19QI7/A
MD5:	8A47D07E3D514AFF13F3B24158DB6507
SHA1:	30C235D7E110D7FA858847177ADDB6CEEDDCB6D3
SHA-256:	5EB0935582ED1CAF4E3E294B65AC62A90C59C245ADC631A088310268129C0C1E
SHA-512:	24FED8BBBBA93C98354C23293635C0F039DADDF23B932DD480D6FA1296608B3328AD05FCAD8AFC7BF0803B62EE0D83B173C838743DFE857CF6117F15AB83FE7A
Malicious:	false
Reputation:	unknown
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Picasa 3.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Archive, ctime=Fri Oct 9 16:37:40 2015, mtime=Wed Oct 2 09:16:08 2024, atime=Fri Oct 9 16:37:40 2015, length=10160456, window=hide
Category:	dropped
Size (bytes):	1207
Entropy (8bit):	4.559271585237806
Encrypted:	false
SSDEEP:	24:8m5iIEAdOEuWKxiouIPW34CcAAvqipEf88R0dRZTpidRZToUUFfqygm:8m58AdO+KxbrPW34CcXSipEf88R0d/Ti
MD5:	34E902E590540396F43221F204F8AB66
SHA1:	CB5C0B5332058DF60039023A466494D74277401B
SHA-256:	9E6B3C50E095D9AB23C2FFA22AFB44E692D0F63AB0897DB74B888F6799196DC4
SHA-512:	62AAFBC490AA9E5D82EC739420169376F04B5E14B932769771AEC5F41D984055166ACEC5FD7294C587A080811154378C663C50F3C10DA25EE260FD35828980F7
Malicious:	false
Reputation:	unknown
Preview:	L..................F.... ......1....F.^........1....H............................P.O. .:i.....+00.../C:\.....................1.....BY.Q..PROGRA~2.........O.IBY.Q....................V......N..P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.)...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.8.1.7.....T.1.....BY.R..Google..>......CW.VBY.R..............................G.o.o.g.l.e.....V.1.....BY.R..Picasa3.@......BY.RBY.R.............................P.i.c.a.s.a.3.....b.2.H...IG.. .Picasa3.exe.H......IG..BY.R..............................P.i.c.a.s.a.3...e.x.e.......`...............-......._.............{......C:\Program Files (x86)\Google\Picasa3\Picasa3.exe..C.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.).\.G.o.o.g.l.e.\.P.i.c.a.s.a.3.\.P.i.c.a.s.a.3...e.x.e.%.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.).\.G.o.o.g.l.e.\.P.i.c.a.s.a.3.........................@Z\|...K.J.........`.......X.......216554...........hT..CrF.f4... ..!............%..hT..CrF.f4... ..!............%........

C:\Users\user\AppData\Roaming\Seznam.cz\bin\24557libfoxloader-x64.dll

Download File

Process:	C:\Windows\SysWOW64\cmd.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	92368
Entropy (8bit):	5.825209255940427
Encrypted:	false
SSDEEP:	1536:VVM9oDGj2dQ8T4LPgNELt/dXheskGKwshql8ksWXd8kNg8BgLA9+kghm:49oa6T+YKt/dXsLmHTVNBBS2+k
MD5:	838737C4B75CCEC631951DAC86CE2F78
SHA1:	D7976EE1E596D81607484CBB11B79E8AAD3130BE
SHA-256:	734D8ADDF79703CAE9844BD8A92E29C7872851134CCDB17B04A2DB793463C04F
SHA-512:	8B2D325FC4D8CBB32A25622A139AA4273701677C37FAA9DAD2E7DC56BD5EA145E009F687F4C7F7A1E28F27E170D3AB6CE42E4BC1210E0FA6BF45F42097227935
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........za.............{.......{.......{.......c..........................................Rich............................PE..d..._..Z.........." ................<.....................................................`.............................................x.......<....p.......`.......8...0.............8...........................p...p...............h............................text.............................. ..`.rdata..Hs.......t..................@..@.data...h8... ......................@....pdata.......`......................@..@.rsrc........p.......&..............@..@.reloc...............(..............@..B........................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Seznam.cz\bin\24557libfoxloader.dll

Download File

Process:	C:\Windows\SysWOW64\cmd.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	85200
Entropy (8bit):	5.932380817410408
Encrypted:	false
SSDEEP:	1536:WrTyUCzoihenEBGcjsWjcdPLQZgbK5CUghz:WHyJornAY0ZYZ
MD5:	98AE6C257258FF994E7E9766DDAEC68E
SHA1:	EAF20399A1B51F8E3E65CFF4C9E59A3738867601
SHA-256:	B04D855959131D3864A953A64421166CB933DC9A4F3D21EC0841CC316F5CC2C2
SHA-512:	ECEBDAF83E5F4EF38EE68FC0C83134A029D059E0F8531106596A9C36CB050CE74041E14A3EA2B839FC4DDDC8BCE66DA12FE25ADDEE62AA482F18DAA455BFA560
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........']{.t]{.t]{.t..it@{.t..ktV{.t..ht.{.tT.5tX{.t]{.t.{.t~.ut^{.t;.lt\{.t;.ot\{.t;.jt\{.tRich]{.t........................PE..L......Z...........!.........................................................p......\|:....@.............................x.......<.... ...................0...0..........8...............................@...............<............................text....~.......................... ..`.rdata..xS.......T..................@..@.data...8-..........................@....rsrc........ ......................@..@.reloc..<0...0...2..................@..B................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Seznam.cz\bin\libfoxcub-x64.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\~006A2DE2.00000DD4.sznpkg\CPY.EXE
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	2568400
Entropy (8bit):	6.126130023583928
Encrypted:	false
SSDEEP:	49152:1o4AvX3ICcnSJRucrQHk0xK5Rf9GjKj/vK6NY6dKSH7WW:saS6IMwpH7WW
MD5:	E42A7B81947AE11B69A1773C2246166F
SHA1:	0CBAC24F21C1F7DE8636DC118A1A4EAD469DD1D6
SHA-256:	057C982A5972B27BE039E76A8253016E83B5B91CD8E3BE9A32A224AD19D53900
SHA-512:	5888CA62149A72A0917C639CD823660F74BE6377659A4D1EA891537AEB8EAB544DDB20AB3D816BC3EDF6AFB52030AEA973A25EE0ABC43167DB1E7BC676F955F6
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......\.....@...@...@.......@.....J.@.......@.;#....@......@......@......@...A...@.;#....@.~"....@.~"....@......@.~"....@.Rich..@.........PE..d...'=.Z.........." .................#........................................'.......'...`.........................................PR".....4*".,.... %.@.....$.......'..0....&.8@.../..8...........................PN..p............ ...............................text............................... ..`.rdata...2... ...4..................@..@.data........`"..V...D".............@....pdata........$.......#.............@..@.rsrc...@.... %.......$.............@..@.reloc.......&......\|&.............@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Seznam.cz\bin\libfoxcub.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\~006A2DE2.00000DD4.sznpkg\CPY.EXE
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1880272
Entropy (8bit):	6.500018529063439
Encrypted:	false
SSDEEP:	24576:hl7fX2zHchwxBv/2GXCJWdWoo7SzQEjhMcWOuqTYwiTrJGQnHJfjXYf092Zr3WIB:pKWhZHhrYrZr3W6wC48Yxe+waL/HS
MD5:	F5D82C32D38DEC985CFFC2B0001E7CE3
SHA1:	D378CB9DC9F5AE37C9D329866C7939F8196ADE16
SHA-256:	803CEDEC2FE0C589DED0DC8ABA250AB22B3932F33BD39C7F53C85C607F94139C
SHA-512:	C0B8D6B83C976CE41EB2603E642315ACECB58874995FFCC0507A1BA6E20DB8109738F51BFF6F2E4FA44B0CF74CABB0CA9024CCF98E380754699BA9F26FF8F442
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$........o................5.......6.......3.......7.......7......v{......vk.......3.........X.....+.......2.......1.......o.......4.....Rich............................PE..L...?:.Z...........!.....$...`......E........@......................................h%....@.........................P...>....c..........h................0.......[...J..8........................... ...@............@...............................text....".......$.................. ..`.rdata...W...@...X...(..............@..@.data...h...........................@....rsrc...h............b..............@..@.reloc..>............n..............@..B........................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Seznam.cz\bin\lightspeed.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\~006A2DE2.00000DD4.sznpkg\CPY.EXE
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	869584
Entropy (8bit):	6.445649712952402
Encrypted:	false
SSDEEP:	12288:2+wY3QbHhn8bRpAkrUOmkYdIPSoC15s0XfhxGXDcNUc:23Y3QbHhnsVmkYdIPSoC15s0Xfhmc
MD5:	E6370ECDD6F343093F82E483F4D73799
SHA1:	E33138C62D6594A7FCD2D4901735EA5F5F1B0E20
SHA-256:	A924C4F999F222176A2D236BAE73AF72FACA23202D5EC3176D0841ED08CA05A0
SHA-512:	BD2ED19914C092A49F755F87DCEFF5EB7530A9ED6EB049AE96907DDEE87820A89788ECCEE1BD246E921276CB93BE78295B87DD772AF3F6CC6D13EC0F09323667
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......./.k...k...k...W..n...W..c...W..`...W..o...k......b.K.e...H~..).......j.......j.......j...Richk...........................PE..L....<.Z...........!.................H.......@...............................`............@.................................L........@...................0...P..T....C..8............................+..@............@..l............................text...w,.......................... ..`.rdata..Qc...@...d...2..............@..@.data............t..................@....rsrc........@......................@..@.reloc..P....P......................@..B........................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Seznam.cz\bin\listicka-x64.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\~006A2DE2.00000DD4.sznpkg\CPY.EXE
File Type:	PE32+ executable (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	80576
Entropy (8bit):	5.719036217075449
Encrypted:	false
SSDEEP:	1536:4yiJI2Te51f0yTd/kryK7ReiTA68DsW7iXdG8pm35/Ah:QI2TSfld/krl7N8UG8p2
MD5:	D893A7276D60FD252EAFFE6E91AAC434
SHA1:	CFC5619C24F1EB11BE5689CE4BF71DDE149B69DA
SHA-256:	62DF14CED9A313DD632C8161F9E6DBDF74CFAE6F2E5DDDD1F28B380173E0210E
SHA-512:	525C314C2D6BBA61A7DFC86E0AE9347F9C7184CFB9CCC1FF118446B9AE8E817E8F22A750E3799DDE0777991B0A3B6263F5A58F45A54D76EA1504519CDA9D9A4F
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......}.q.9...9...9....5.+....5.m....5.>...0...:...9...i......;..._..8..._..8...Rich9...........................PE..d...f..X.........."......v.......... ..........@.............................p.......x....`.....................................................(....P.......@...........0...`.. .......8...............................p............... ............................text...kt.......v.................. ..`.rdata...b.......d...z..............@..@.data....7..........................@....pdata.......@......................@..@.rsrc........P......................@..@.reloc..H....`......................@..B................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Seznam.cz\bin\msvcp110.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\~006A2DE2.00000DD4.sznpkg\CPY.EXE
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	535008
Entropy (8bit):	6.072620448350034
Encrypted:	false
SSDEEP:	12288:FqULIc5nb9rywgfyhUgiW6QR7t5sA3Ooc8sHkC2eRxUH:PLHnhryLfBA3Ooc8sHkC2eRxUH
MD5:	3E29914113EC4B968BA5EB1F6D194A0A
SHA1:	557B67E372E85EB39989CB53CFFD3EF1ADABB9FE
SHA-256:	C8D5572CA8D7624871188F0ACABC3AE60D4C5A4F6782D952B9038DE3BC28B39A
SHA-512:	75078C9EAA5A7AE39408E5DB1CE7DBCE5A3180D1C644BCB5E481B0810B07CB7D001D68D1B4F462CD5355E98951716F041EF570FCC866D289A68EA19B3F500C43
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$....................7.>...........:.L....:.J....:.H.....:.I.....:.T....:.M....:.N....:.K....Rich...........PE..L......P.........."!.........................0...............................P......[.....@.........................`N..$.......<........................=.......D...................................K..@...............D............................text............................... ..`.data....`...0...2..................@....idata...............N..............@..@.rsrc................j..............@..@.reloc...}.......~...n..............@..B........................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Seznam.cz\bin\msvcr110.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\~006A2DE2.00000DD4.sznpkg\CPY.EXE
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	875472
Entropy (8bit):	6.9224404430053434
Encrypted:	false
SSDEEP:	12288:TmCyHcMpK7QdgD+9Tr8r3FmJciMgLFWkA8qTWu+FVlofpJCjNdr12iqwZeq:TmCyHNIQdTryVmCipIkqTWu+Fr
MD5:	4BA25D2CBE1587A841DCFB8C8C4A6EA6
SHA1:	52693D4B5E0B55A929099B680348C3932F2C3C62
SHA-256:	B30160E759115E24425B9BCDF606EF6EBCE4657487525EDE7F1AC40B90FF7E49
SHA-512:	82E86EC67A5C6CDDF2230872F66560F4B0C3E4C1BB672507BBB8446A8D6F62512CBD0475FE23B619DB3A67BB870F4F742761CF1F87D50DB7F14076F54006F6C6
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......x._'<.1t<.1t<.1t<.0t..1t...t?.1t.+.t..1t.+.t].1t.+.t..1t.+.t..1t.+.t=.1t.+.t=.1t.+.t=.1tRich<.1t................PE..L......P.........."!.....`..........<........@...............................`......l9....@.........................`...........(........................=.......S..0n..8...........................0...@............................................text....^.......`.................. ..`.data....\...p...N...d..............@....idata..............................@....rsrc...............................@..@.reloc...S.......T..................@..B........................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Seznam.cz\bin\szndesktop.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\~006A2DE2.00000DD4.sznpkg\CPY.EXE
File Type:	PE32 executable (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	506064
Entropy (8bit):	6.375464739429351
Encrypted:	false
SSDEEP:	6144:FoGTca+RgvFMpKQDZU5bGrIABTK/oKygFW6/q8676K+QZ5qMRc0N87B+gVyGzWft:mZtrwg4mj5qMRSABfjZSDT2
MD5:	DAC25BB758D6C17C5A8D64CF63702B4E
SHA1:	2424AA5A11DC1C2AFDA0B769033E724F3BDEFDDA
SHA-256:	E96D79777D5D3BDF0993FFF70009621848D0524A0CBC5CFB698B6C35567F4969
SHA-512:	2F2F0A26CBFF99DDEC63BE60D8EECB0F497FA7F6E120D71F5D0C2900E8F4413A5964800FDCFADF69C5AB9410F1742A8AEC56CE01F911B8DE081D1E71DCD8897B
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......b...&...&...&....cV.#....cU.5....cT.#....cP."...@KP.$....JU.!.../...+...&........JH.3...@KR.'...@KW.'...Rich&...................PE..L.....Z.................@...L...............P....@.......................................@.................................4........ ...................0...0...`...U..8...............................@............P...............................text...:?.......@.................. ..`.rdata.......P.......D..............@..@.data...(@.......:..................@....rsrc........ ......................@..@.reloc..l....0......................@..B........................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Seznam.cz\bin\sznpp.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\~006A2DE2.00000DD4.sznpkg\CPY.EXE
File Type:	PE32 executable (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1592048
Entropy (8bit):	6.4918795184818014
Encrypted:	false
SSDEEP:	24576:SRrMSewZ7TNb1oLfxBTk1kuEwnf4z/TWzXqoNb1oLfLv+eoXo2w:lSV1CLffk1c+fE/IZCLfLmeoXoV
MD5:	62DF7B2F443CBB0284CB7959AD2228C1
SHA1:	5A53641AB7184163843FA188F02EBD22AB17AFC3
SHA-256:	464546FEC35F4B178FA2D912504023C4489B879976FA52F8E71652F4B5B76E6C
SHA-512:	A94D892BBD15EFAD62E470F313A7DFD1FEEA8EE8A7739DA17908557B97882FAB447FE5BAFDB6FE2AC67408BFCB25DC0C7DD214F79C3C6A210166B5DA362FFF16
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........g..].._].._].._.$_P.._.&_..._.'_@.._fX.^E.._fX.^f.._fX.^z.._.X.^X.._~.._Z.._T~F_D.._].._..._.X.^_.._.X.^Z.._.X_\.._].B_\.._.X.^\.._Rich].._........PE..L......\.........."..........\|......Y.............@..........................p...........@..................................!..........p................0...0...:......T...................T...........@............................................text............................... ..`.rdata...w.......x..................@..@.data....;...@......(..............@....gfids...............R..............@..@.tls.................T..............@....rsrc...p............V..............@..@.reloc...:...0...<..................@..B................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Seznam.cz\bin\wszndesktop.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\~006A2DE2.00000DD4.sznpkg\CPY.EXE
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	109808
Entropy (8bit):	6.2768201722897174
Encrypted:	false
SSDEEP:	1536:HLe6c4VhQSZ5O0Ge/aeNS56OVRnh2vEWfrXIwGPqCRYMZ3ZqA3hCF:p9fQSZ4eieuvRheRfGqCRb3wBF
MD5:	F417B21647412D6FE712CA715351FFB1
SHA1:	5B8A678CB0F2E9A6E1F8DCFEFB37E5B5C2E5BFF1
SHA-256:	83CB19E6CB06A5DD29CC1757B64D7B9F740D19E688AE3088E3912265AE6C034D
SHA-512:	5A4174B53A9E4B76DC9B563FAD63843AD93D400C490E4B1EB7A86CF1C4DD742A5BF54775CB6C8DFEBF35F6564793A87F2B5317A2E949520EC59F3635F8557B63
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......;.V...8...8...8.%..}.8.%..l.8.%..{.8.%..x.8.....}.8.v...t.8...9..8.....{.8.....~.8....~.8.....~.8.Rich..8.................PE..L...A[dU..........................................@......................................@..................................D.......p...............\|...0..............8...............................@............................................text...$........................... ..`.rdata..._.......`..................@..@.data...`....P.......8..............@....rsrc........p.......F..............@..@.reloc..Z+.......,...P..............@..B........................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Seznam.cz\conf\libfoxcub\foxcub.conf

Download File

Process:	C:\Users\user\AppData\Local\Temp\~006A2DE2.00000DD4.sznpkg\CPY.EXE
File Type:	JSON data
Category:	dropped
Size (bytes):	251
Entropy (8bit):	4.291736196961814
Encrypted:	false
SSDEEP:	3:YGQXXpuEE+EngwE7sKHku4Esp3Ap76LCHfOtHJYLMvrE7G/HN3W6UhHAwEvu5EEe:YGQXdHEgwAsih4ToGp/AKt3fkHLuua1n
MD5:	8E57D24183014767EC68E92B133FD115
SHA1:	74107EDB98696D90820D3FFBFFB83054407D7DA0
SHA-256:	E494C7D20BF02BC63FD9AB43896CAE0FCF5A97B73266A3A5090F8D4674870CC4
SHA-512:	37B0EFFC7B2314A2DD8AC5D9F3B6CDB9DD9A4B2B87956D4CB1E6CA1656109ACB2C1B812EAAEB9BB0B79A62EEF21F3D83A3A242A29D7DD653591AF5E91BB0EF45
Malicious:	false
Reputation:	unknown
Preview:	{"currency":{"enable":true},"email":{"enable":true,"mailboxes":[]},"kos":{"enable":true},"slovnik":{"active":true,"curLang":"en_cz","enable":true},"speedDial":{"enable":true,"mode":"big","rss":true},"srank":{"enable":true},"synchro":{"enable":true}}..

C:\Users\user\AppData\Roaming\Seznam.cz\conf\libfoxcub\regcfg.conf

Download File

Process:	C:\Windows\SysWOW64\cmd.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	22
Entropy (8bit):	4.277613436819114
Encrypted:	false
SSDEEP:	3:YVE9Jfa:YaQ
MD5:	48F929CD18C33327454CFA1C6BDFE636
SHA1:	A31B450197CD641D687DC125BAF2134E0BA5C975
SHA-256:	DD5E8013D6FDA626940C26C4F58359A97B04110AD28732868636C60362E99F92
SHA-512:	61CFD16C14537549E0C353168A6FE6C27C15450122D10075B106519FBEFDC35973FED79E0F519405C8A029F7AB6CBA329A3E69A81B4EF4C66F93AB03840F1AAB
Malicious:	false
Reputation:	unknown
Preview:	{"partnerId":40139} ..

C:\Users\user\AppData\Roaming\Seznam.cz\conf\libfoxcub\remote.conf

Download File

Process:	C:\Users\user\AppData\Local\Temp\~006A2DE2.00000DD4.sznpkg\CPY.EXE
File Type:	JSON data
Category:	dropped
Size (bytes):	11515
Entropy (8bit):	5.478707149357688
Encrypted:	false
SSDEEP:	192:HxAJUUhAJLFamdn7jQyFiP6VvRtURYdRzRKRxR5RU+zvPzpVRDNv:QnmVAP6Vv/UadxQD71fr
MD5:	C55F08F888B2DC2D520921D2656238ED
SHA1:	22EBE442A76ADF786F098E0F64E944DD94A13933
SHA-256:	C13F64AA32CC4C81631B541218C96A25A2263CA4A47B95844FA663E36BD90070
SHA-512:	5791D75C8E2224510FB64373C5094DD92FCFAEE6C5A1B5504B707F7FABE5EEA5FA74FD3556CB013513B94FE9C316176B59348685B7E08FCEDAD7486944F07EC8
Malicious:	false
Reputation:	unknown
Preview:	{"core":{"configUrl":"http://download.seznam.cz/software/conf/","configUrlSecure":"https://download.seznam.cz/software/conf/","registerUrl":"http://reg.software.seznam.cz:80/RPC2","registerUrlSecure":"https://reg.software.seznam.cz:443/RPC2","updateUrl":"http://download.seznam.cz/software/conf/update-${product}.ini"},"currencies":{"updateUrl":"http://www.cnb.cz/cs/financni_trhy/devizovy_trh/kurzy_devizoveho_trhu/denni_kurz.txt"},"email":{"classes":{"atlas.cz":{"compose":"https://auser.centrum.cz/??ego_user=${jmeno}&ego_domain=${domain}&ego_secret=${heslo}&url=http%3A%2F%2Famail.centrum.cz%2F\\{onload}\\$${}?pg=newmsg","mailbox":"https://auser.centrum.cz/??ego_user=${jmeno}&ego_secret=${heslo}&ego_domain=atlas%2ecz&url=http%3a%2f%2famail%2ecentrum%2ecz%2f","mode":"pop3","server":"imap.atlas.cz:110"},"centrum.cz":{"compose":"https://user.centrum.cz/??ego_user=${jmeno}&ego_domain=${domain}&ego_secret=${heslo}&url=http%3A%2F%2Fmail.centrum.cz%2F\\{onload}\\$${}?pg=newmsg&to=${to}&subject=$

C:\Users\user\AppData\Roaming\Seznam.cz\conf\szndesktop.conf

Download File

Process:	C:\Users\user\AppData\Local\Temp\~006A2DE2.00000DD4.sznpkg\CPY.EXE
File Type:	Generic INItialization configuration [controlweb]
Category:	dropped
Size (bytes):	334
Entropy (8bit):	4.824443527950377
Encrypted:	false
SSDEEP:	6:dCrLcQe2YV2J++rLXV9cu1Rk7l0iYa0iY7AK0YJADUvUsYVUEyFF:d6LhxoKlLF9cu1RM6B3AGUsiWF
MD5:	A1905B8002E0D317DCFBB47A80AD448B
SHA1:	B2C7C09016C2D0098D121706A57A8BFDCBE022BE
SHA-256:	E5D4EDDF1282C2D61F7D86281D7F7FA756CE6D2B77BE2BA96C89CDCF95EB6DD1
SHA-512:	2B4F215064FAB495FA778BD02F2387D08AAEACA8374ED82B445B0C34EB48D8E8B4861B3F0B69E0A087809591BBC4F997DBB0C8A055B1A734011C3BEC469CD08A
Malicious:	false
Reputation:	unknown
Preview:	[modules]..subdir=szndesktop.d..module=controlweb....[controlweb]..type=staticpak..path=..webfile=$data:\szndesktop.webpak..indexFile=welcome.html....[mimetypes]..html=text/html;charset=utf-8..htm=text/html;charset=utf-8..txt=text/plain;charset=utf-8..jpg=image/jpeg..gif=image/gif..png=image/png..css=text/css..js=text/javascript..

C:\Users\user\AppData\Roaming\Seznam.cz\conf\szndesktop.d\libfoxcub.conf

Download File

Process:	C:\Users\user\AppData\Local\Temp\~006A2DE2.00000DD4.sznpkg\CPY.EXE
File Type:	Generic INItialization configuration [staticweb]
Category:	dropped
Size (bytes):	1448
Entropy (8bit):	4.901047438742344
Encrypted:	false
SSDEEP:	24:dUh6Z6o7ZsR3cGoR4EGTXWMI2RdAWMIB/O1E9WMI5+RWMIvWMId0Qrpl5LLKWMIa:iRMG25Gg2RVmT5lcd08l59at
MD5:	7B2F5385705ABE063F856AB95862728C
SHA1:	FC13736A364F28889926D8D45AB60BEF73C225EB
SHA-256:	BE549B1221217D59B61BFA2E01A3BD4184F17B530B126E73EAC3641AD208C01F
SHA-512:	88252DF6FC20F4DC88D9BEC6543D5E8CF3AD9BE73E329FCECAA41AAE64E9E091C90F4DE238CDF37A72127E1E82204880B796E68B7E72AD4255D1785C827D1139
Malicious:	false
Reputation:	unknown
Preview:	[modules]..module=staticweb..module=proxy..module=confighandler..module=speedDial..module=config..module=trash..module=email..module=nastaveni..module=currency..module=synchro....[staticweb]..type=staticpak..path=/speedDial..webfile=$data:\speeddial.webpak..indexFile=speedDial.html....[config]..type=staticpak..path=/libfoxcub/config..webfile=$data:\listickaconfig.webpak..indexFile=jsoneditor.htm....[configd]..type=static..path=/libfoxcub/configd..documentRoot=C:\Users\ondrej.novak\Documents\Visual Studio 2008\Projects\software-trunk\ielisticka_new\libfoxcub\jsoneditor..indexFile=jsoneditor.htm......[proxy]..type=proxy..path=/speedDial/proxy..proxyurl= .. ....[speedDial] ..type=library ..path=/speedDial/listicka..libraryPath=$bin:\libfoxcub.dll..handlerName=speedDial ....[confighandler] ..type=library..path=/libfoxcub/config/service..libraryPath=$bin:\libfoxcub.dll..handlerName=config ......[trash] ..type=library ..path=/libfoxcub/trash..libraryPath=$bin:\libfoxcub.dll..handlerName=tr

C:\Users\user\AppData\Roaming\Seznam.cz\conf\szndesktop.d\libfoxloader.conf

Download File

Process:	C:\Windows\SysWOW64\cmd.exe
File Type:	Generic INItialization configuration [foxloader]
Category:	modified
Size (bytes):	165
Entropy (8bit):	4.645572809039041
Encrypted:	false
SSDEEP:	3:rJAguK72MsofqOpvuLJMjgKEEK/AXQv26pShVovCuEErPx2HJRslJJov:dIKHnpvvgKc/Au2jhCqutTA7Iov
MD5:	0AD013CE72BF4FB0C2383F233C1CF0EF
SHA1:	B8B9F99CFC2986630A39FE4C93F09882F79C67EF
SHA-256:	7A2D502AC78DC14D0C201532CC95EC6A095EDFE6F9ECFABC818188E4A1570BBD
SHA-512:	5DE7C9C2594CFD8DB8D40ADB70DB3DF39E7C73DFC3AD56708D24F05A631046A2AFE3B0A06216687174F64F83CF64307DA34C273EEF4E522B5CDA4250DDE03A26
Malicious:	false
Reputation:	unknown
Preview:	[modules]..module=foxloader..[foxloader]..type=library..path=/libfoxcub/loader..handlerName=libfoxloader..loadOnStart=true..libraryPath=$bin:\24557libfoxloader.dll..

C:\Users\user\AppData\Roaming\Seznam.cz\data\listickaconfig.webpak

Download File

Process:	C:\Users\user\AppData\Local\Temp\~006A2DE2.00000DD4.sznpkg\CPY.EXE
File Type:	data
Category:	dropped
Size (bytes):	71016
Entropy (8bit):	5.785633253325673
Encrypted:	false
SSDEEP:	1536:bQZjTDOzKaKdpHqxRNPHIBXgeKLHQ4ZGAB:bQlbdpHqxRNPggj
MD5:	0088ADAA0D4E38DEAFF99DBB53056BCF
SHA1:	00F8CD59EADF6FEFE898E5B92970F64F08C25486
SHA-256:	4F06D3F8AF8D3D42F5A27D954BE0864894B850E3A807AC1BFB1A7DED149732A2
SHA-512:	E28210D2F0124E08A6F218988252B5A91CAA056AFAE50E720801FA8130AB2D108B720C0A85F744184D3BA53DA9DA556E69C0D943FEAD0E8A62C6CFDE1DC069F0
Malicious:	false
Reputation:	unknown
Preview:	........h...<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3c.org/TR/1999/REC-html401-19991224/loose.dtd">.. saved from url=(0032)http://www.jsoneditoronline.org/ -->..<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd"> ....@file index.html....@brief ..JsonEditor is an editor to display and edit JSON data in a treeview. ....Supported browsers: Chrome, Firefox, Safari, Opera, Internet Explorer 8+ ....@license..This json editor is open sourced with the intention to use the editor as ..a component in your own application. Not to just copy and monetize the editor..as it is.....Licensed under the Apache License, Version 2.0 (the "License"); you may not..use this file except in compliance with the License. You may obtain a copy ..of the License at....http://www.apache.org/licenses/LICENSE-2.0....Unless required by applicable law or agreed to in writing, software..distributed under the License is distribute

C:\Users\user\AppData\Roaming\Seznam.cz\data\listickanastaveni.webpak

Download File

Process:	C:\Users\user\AppData\Local\Temp\~006A2DE2.00000DD4.sznpkg\CPY.EXE
File Type:	data
Category:	dropped
Size (bytes):	1075112
Entropy (8bit):	7.7428487407634945
Encrypted:	false
SSDEEP:	24576:/qQkNhE7ATNvwR2hxIJRMmg+Ed7jhyIchGssZaB5siU1uro7GBSSkvl8rDn5yjET:/bk/E8T2UIJRMv+Ed7jhyIchGssZaB5h
MD5:	D00533F1920AC71573B41B305E281009
SHA1:	CD970AD17A4963943483C238A8BB1A90654D66E1
SHA-256:	34BFC9049EE263DBCA2851DA67A841C4AA4C1FF59A6E6FE8C9ED1A281D10B682
SHA-512:	7DDDF1C65FBDB72D61853F0555E6A69D0E65F91FDB111012288893D78BD676778D2B37FDEA4CA6048CA1C78C674C4BCA9365BBF0F6EBC12F52473DA56DA47459
Malicious:	false
Reputation:	unknown
Preview:	....B...._..<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">..<html xmlns="http://www.w3.org/1999/xhtml">..<head>.. <meta http-equiv="content-type" content="text/html; charset=utf-8" />.. <title>Li.ti.ka nastaven.</title>.. <link rel="stylesheet" href="css/default.css" media="all" type="text/css" id="link" />.. <script type="text/javascript" src="js/jak.js"></script>.. <script type="text/javascript" src="js/listicka.js"></script>.. <script type="text/javascript" src="js/chrome/about.js"></script>.. <script type="text/javascript" src="js/chrome/advance.js"></script>.. <script type="text/javascript" src="js/slovnik.js"></script>.. <script type="text/javascript" src="js/email.js"></script>.. <script type="text/javascript" src="js/promo.js"></script>.. <script type="text/javascript" src="js/synchro.js"></script>.. <script type="text/javascript" src="js/speeddial.js"></script>....

C:\Users\user\AppData\Roaming\Seznam.cz\data\speeddial.webpak

Download File

Process:	C:\Users\user\AppData\Local\Temp\~006A2DE2.00000DD4.sznpkg\CPY.EXE
File Type:	data
Category:	dropped
Size (bytes):	989872
Entropy (8bit):	7.417276532154073
Encrypted:	false
SSDEEP:	24576:0NVC7oR2sMQIN9D9fB5sYUMWW4WK/Z34K2uxaXTfGjmK5UkJU4pzqJg1tK1zoHGe:IH6HD9fB5sYUMWW4WKJxaXTfGjmK5Ukf
MD5:	E27433CCC5181FC6BF27EF706B41FB84
SHA1:	26BCE9411553873948A52B0DFE98C5E0A85EB637
SHA-256:	F3FD949C5AF3BD17017CA5FEF6EF3DC5757B56DEFDF03F742610FC5C9FB4D964
SHA-512:	3D34F2DF7778BDF3DE911D731C4D1569447F91D9D2235438552C86D9BA43C14A95616B5C12EDE68F6B9CCD1491522A0060100CA4826C185B0CC01FBE71866150
Malicious:	false
Reputation:	unknown
Preview:	....a.......body {. background: url(../img/ie-back.jpg) #843395 top left repeat-x;.}..body #backgroundImage {. height: 100%;. width: 100%;. display: block;. margin: 0;. background: transparent url(../img/ie-logo.png) no-repeat left top;.}.html {. font-size: 106.5%.}..body {. margin: 0 0 8px 0;. text-align: center;. color: #000;. font-size: 76.5%;. font-family: Arial, sans-serif;. background: #fff.}..body#www-seznam-cz {.}..html:first-child body#www-seznam-cz[id="www-seznam-cz"] {. background-position: 50% 9.5em.}..td {. font-size: 100%;.}..h1, h2, h3, h4, h5, p, ul, ol, li, form {. padding: 0;. margin: 0.}..select {. font-size: 100%.}..img {. vertical-align: top;. border: none;. margin: 0;. padding: 0.}..li {. list-style-type: none.}..hr {. display: none.}..a:link {. color: #de0000.}..a:visited {. color: #900.}..a:hover {. color: #300.}../*body {-ms-filter: "progid:DXImageTransform.Microsoft.Blur(pixelRadi

C:\Users\user\AppData\Roaming\Seznam.cz\data\szndesktop.webpak

Download File

Process:	C:\Users\user\AppData\Local\Temp\~006A2DE2.00000DD4.sznpkg\CPY.EXE
File Type:	data
Category:	dropped
Size (bytes):	40568
Entropy (8bit):	7.9817629224009
Encrypted:	false
SSDEEP:	768:1XGjof0xmmKg0FGRzqNFOaXKYezSgcZaIc3csECrhtJ37CY:1UosmjgubX2bRMsECrxCY
MD5:	8FC0633EF306E63FDF83CF00572AE094
SHA1:	6DD643D2995445443E01DDC620A29FF078239251
SHA-256:	42444C496F284ABE61E35007A88FC7100BE59AE04AF4224B5B6A0904BE74B326
SHA-512:	FA86B90FF73FBA7153176169A094146B78B9B0BAAA0AF0E7F5348E33D5B7C7978CD7499300E1825BDB66FBC4B69FCB40193A28A9A072C26BCA6EACBF572248CA
Malicious:	false
Reputation:	unknown
Preview:	............<html>..<head>.. <title>Shutdown Seznam Desktop?</title>..</head>..<body>.. <h1>.. Bye bye!</h1>.. <p>Server will be terminated in 2 seconds</p>.. <p style="display:none" id="msg">Done</p>.. <script type="text/javascript">.. setTimeout("document.getElementById('msg').style.display='block'", 2000);.. </script>.. <p><a href="/">Back</a></p>..</body>..</html>..GIF89a..........KMJ..................!.......,...........8...0.I..8...`(..0.h.VBP.......a..+..p...".......3...kTQ.AQ.}).K.S....VYU.O;..;...ks....+.k.wi.%aDr..a.I0.:....Y.....J...d..G...uy.;.Zsw../.&...>...:...Fr.%..x6?06..b0{Bh.A.c2...x..v.z...}..^..NK..r..F.............=.Q.e.t.Luo..X.U!.gj..?.8.!W..X.'.ty.....F....x.8f....6...a.d-dX.S4.c$>a...{.R>c.1f..F. ...........e.c....,.VpW\....a1......6.;\|t.V..J..N.......[.B.{.S.qk....a.P.z...(.I..E\.....2..B7..3..j).e.W....\....$F~v.\|'9tM..7.vC...#Ak..J.!/......pw.....3.\.G.=.HZ.0..g">N.\....8g..d.W....z.@vE`SX..(....{..._

C:\Users\user\AppData\Roaming\Seznam.cz\install.log (copy)

Download File

Process:	C:\Users\user\AppData\Roaming\Seznam.cz\szninstall.exe
File Type:	Non-ISO extended-ASCII text, with very long lines (404), with CRLF line terminators
Category:	dropped
Size (bytes):	50793
Entropy (8bit):	5.446189669428245
Encrypted:	false
SSDEEP:	384:mAlgwB2PFsr9WcDi5GyZLQpjXJZlZlJgfmv5ywdyw/yw6+JYNFLigrFu+bb2G1Dv:P1NAmv5ywdyw/ywc1DGbvcNT3t
MD5:	24271499A6ACA6D6FE19B963D25EAFFF
SHA1:	B4218263B214A4E3401CC40C7BABCFC781596B25
SHA-256:	DA156E9076EBF15D49C16411AB474B280515ECE11BE1B90CAE6980A82B8395C7
SHA-512:	AAF911C0627C792B1926AA24B4CC5927E2B2CD5BB672E73CC174946B9B5AC9560845C322776647B916D0229700A5902FE4167A2806E463F7D8C03915959AD460
Malicious:	false
Reputation:	unknown
Preview:	..=================== SznSetup starting (2.10.2024 06:16:33)====================..2024/10/02 06:16:33 I001: [main] Versopm: 1.2.6 (SznSetup::SznSetup_t::start:45)..2024/10/02 06:16:33 I001: [main] CommandLine: C:\Users\user\AppData\Roaming\Seznam.cz\sznsetup.exe -T C:\Users\user\AppData\Roaming\Seznam.cz -i -u cz.seznam.software.autoupdate szn-software-listicka -p (SznSetup::SznSetup_t::start:45)..2024/10/02 06:16:33 N002: [main] Can't open ARP job object - probably not WinXP or ARP is not in effect (SznSetup::Installer_t::fixWinXPARP:1174)..2024/10/02 06:16:35 D002: [main] Loading package: cz.seznam.software.autoupdate 1.0.8 (score: 1.000000E+0) (SznSetup::Solver_t::extendDomainPkg:132)..2024/10/02 06:16:35 D002: [main] Loading package: cz.seznam.software.szninstall 1.1.14 (score: 5.000000E-1) (SznSetup::Solver_t::extendDomainPkg:132)..2024/10/02 06:16:35 D002: [main] Loading package: cz.seznam.software.sznsetup 1.2.6 (score: 5.000000E-1) (SznSetup::Solver_t::extendDomainPkg:132)..202

C:\Users\user\AppData\Roaming\Seznam.cz\install.log.$$$

Download File

Process:	C:\Users\user\AppData\Roaming\Seznam.cz\szninstall.exe
File Type:	Non-ISO extended-ASCII text, with very long lines (404), with CRLF line terminators
Category:	dropped
Size (bytes):	50793
Entropy (8bit):	5.446189669428245
Encrypted:	false
SSDEEP:	384:mAlgwB2PFsr9WcDi5GyZLQpjXJZlZlJgfmv5ywdyw/yw6+JYNFLigrFu+bb2G1Dv:P1NAmv5ywdyw/ywc1DGbvcNT3t
MD5:	24271499A6ACA6D6FE19B963D25EAFFF
SHA1:	B4218263B214A4E3401CC40C7BABCFC781596B25
SHA-256:	DA156E9076EBF15D49C16411AB474B280515ECE11BE1B90CAE6980A82B8395C7
SHA-512:	AAF911C0627C792B1926AA24B4CC5927E2B2CD5BB672E73CC174946B9B5AC9560845C322776647B916D0229700A5902FE4167A2806E463F7D8C03915959AD460
Malicious:	false
Reputation:	unknown
Preview:	..=================== SznSetup starting (2.10.2024 06:16:33)====================..2024/10/02 06:16:33 I001: [main] Versopm: 1.2.6 (SznSetup::SznSetup_t::start:45)..2024/10/02 06:16:33 I001: [main] CommandLine: C:\Users\user\AppData\Roaming\Seznam.cz\sznsetup.exe -T C:\Users\user\AppData\Roaming\Seznam.cz -i -u cz.seznam.software.autoupdate szn-software-listicka -p (SznSetup::SznSetup_t::start:45)..2024/10/02 06:16:33 N002: [main] Can't open ARP job object - probably not WinXP or ARP is not in effect (SznSetup::Installer_t::fixWinXPARP:1174)..2024/10/02 06:16:35 D002: [main] Loading package: cz.seznam.software.autoupdate 1.0.8 (score: 1.000000E+0) (SznSetup::Solver_t::extendDomainPkg:132)..2024/10/02 06:16:35 D002: [main] Loading package: cz.seznam.software.szninstall 1.1.14 (score: 5.000000E-1) (SznSetup::Solver_t::extendDomainPkg:132)..2024/10/02 06:16:35 D002: [main] Loading package: cz.seznam.software.sznsetup 1.2.6 (score: 5.000000E-1) (SznSetup::Solver_t::extendDomainPkg:132)..202

C:\Users\user\AppData\Roaming\Seznam.cz\install.log.5868.log

Download File

Process:	C:\Users\user\AppData\Roaming\Seznam.cz\szninstall.exe
File Type:	Non-ISO extended-ASCII text, with very long lines (404), with CRLF line terminators
Category:	modified
Size (bytes):	50629
Entropy (8bit):	5.442314706642521
Encrypted:	false
SSDEEP:	384:6AlgwB2PFsr9WcDi5GyZLQpjXJZlZlJgfmv5ywdyw/yw6+JYNFLigrFu+bb2G1DB:D1NAmv5ywdyw/ywc1DGbvcNT3f
MD5:	94873F913BEBFF5EA77950E0DB935CE7
SHA1:	1F66E1409A11FF6B182A6F2EDAB4DF1818667BC7
SHA-256:	4302C1D89624929CEF44851EC73C5362E0899319BD7D3A8463E80C1E515A2566
SHA-512:	811A0DF7311E850A3394674DDD39939ECDE884FC174D04F0248BA44B5581EBD87607FEA730605758122C310379659DD0D17D02412FC28519676073B06B972B0A
Malicious:	false
Reputation:	unknown
Preview:	2024/10/02 06:16:33 I001: [main] Versopm: 1.2.6 (SznSetup::SznSetup_t::start:45)..2024/10/02 06:16:33 I001: [main] CommandLine: C:\Users\user\AppData\Roaming\Seznam.cz\sznsetup.exe -T C:\Users\user\AppData\Roaming\Seznam.cz -i -u cz.seznam.software.autoupdate szn-software-listicka -p (SznSetup::SznSetup_t::start:45)..2024/10/02 06:16:33 N002: [main] Can't open ARP job object - probably not WinXP or ARP is not in effect (SznSetup::Installer_t::fixWinXPARP:1174)..2024/10/02 06:16:35 D002: [main] Loading package: cz.seznam.software.autoupdate 1.0.8 (score: 1.000000E+0) (SznSetup::Solver_t::extendDomainPkg:132)..2024/10/02 06:16:35 D002: [main] Loading package: cz.seznam.software.szninstall 1.1.14 (score: 5.000000E-1) (SznSetup::Solver_t::extendDomainPkg:132)..2024/10/02 06:16:35 D002: [main] Loading package: cz.seznam.software.sznsetup 1.2.6 (score: 5.000000E-1) (SznSetup::Solver_t::extendDomainPkg:132)..2024/10/02 06:16:35 I002: [main] Generating install plan for cz.seznam.software.autou

C:\Users\user\AppData\Roaming\Seznam.cz\install\com.microsoft.msdn.msvcr100-10.0.40219.325-win32.zip

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsm983C.tmp\listicka.exe
File Type:	Zip archive data, at least v2.0 to extract, compression method=deflate
Category:	dropped
Size (bytes):	529195
Entropy (8bit):	7.999020139670802
Encrypted:	true
SSDEEP:	12288:mojIJS0Zb4KTELAxUwFzmg4KX8tGqtKJQu0BIq:m450ZNTK0N4KXaGqtu0R
MD5:	CF3B1B6E8062E277C361F5EB155078B2
SHA1:	FDDE4556BA0CC46E42738922C8D5494F5F491FF1
SHA-256:	65AD3A9F67BC66E232A97CD72261EB7068E22EA34518FF571636C279EA59D280
SHA-512:	7F0ADE02FB7B95D38C82A3325AF9E006B499F8AF409DF773C2F7D1ACF75212F36136A70DB433BC7C3C7FB8F57706EB2D9C9676869EB5A755B60CB37248780C0F
Malicious:	true
Reputation:	unknown
Preview:	PK........P..Ap.sY....2.......control.iniE.1N.1.E{K...Q...........Q....=.l.F.q.N..(..H..q.h....?o.9{..mq..8#tZv..g...pI..]....Q.d<.......N..[...T.iO...0.e.I.\..J....)Z..t]..l.......Us..5..9...K.kJx1i@....<........c5..aKf.G..+.Mt........=..M......C........?g.PK........E..A.~s(#...8.......install.batK..T.-.K.040.K..QPR.3.I..S....a...PK.........].@..7.....Pm......msvcp100.dll.{\.U...av6..7..Z`.f.hJ........taW...mY.=.'Q.1.A.E.e..2.2..$..2#K.4..4#...}gv.L-.T.u>~..9..{....k...PEQ....EY..f..3k...;.v..V.X........".....;.m.......l.b...cK.p....t.....1.....opF.6..{U..t...~j..k........U.....m.>X........e..a......o@.#X.pEI..SRkwe4...S{D..+.{.....5%.ZQz#1E..o...(d.j.,.......l'H".Z....o..Q.6.I.f.(..J.e[..nh_..v...:)Jw..6.?].(j..9.O.%..x.j..s.;8.(S.8...~L.9....h+c.>."..>s0.b....<{.....`Lpn.X..zp.P...O.r...1.......ux.fC%.L..0.l..M.....C5T..&@...n..@...:Cw......0......`&T.C..,.Z...`.\|..A.........`..C......5..^.u.%.6[..b .2......1.z]..W..(...X.Mp.V...P...-.\|M.p...Q

C:\Users\user\AppData\Roaming\Seznam.cz\install\com.microsoft.msdn.msvcr110-11.0.51106.1-win32.zip

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsm983C.tmp\listicka.exe
File Type:	Zip archive data, at least v2.0 to extract, compression method=deflate
Category:	dropped
Size (bytes):	631911
Entropy (8bit):	7.998038935008375
Encrypted:	true
SSDEEP:	12288:IENxq2CfNEvj5Qqu5yQOB/r8I1h1OIyCgqY4t7FogY15FYwsL8ZCxMj9Z2W:BMXKr1u55OZPzXowWGnLa0Mj9t
MD5:	C368CCEE0406E5B4D43CF5013DFC08A6
SHA1:	F5C82443E149709F2DE9B9D627655B947D115133
SHA-256:	C55562895ED2E6C4DF5CFB4C0E5A2B4E5D3DD43C8D10941305FBD2E2B1146F9E
SHA-512:	224A04B84F7298930592BA6DC959C6875F5DC665501214D4F87E8A61F8B212FCF5DF7344CD8D56FD5327B3DD4F3E7926190E6B795E88F64EBFB0DF2AED0C5BEA
Malicious:	true
Reputation:	unknown
Preview:	PK........,P.F.0` ....0.......control.iniEN1N.1..-...G.r .\QC.....}....l.E...^..(..H.W.Q..bw4..;..ET[\.w....x.J!....5MmP.iV..&e.H6.X......g.DC:..eu.0.e...\.Y.....)Z,..t..h.............rz.1>....js.....x.Xo>_....:....&.4B....G..}:~..b....7.....? ...6...Ge.}.NPK........,P.F.S.#...8.......install.batK..T.-.K.044.K..QPR.3.I..S....a...PK........,P.F...............uninstall.bat+.UH...-.K.044.K....B.,....PK..........fABk.Bj...)......msvcp110.dll.Z{\|.E...A@..FE7H..<.. ..L..5.(O..tf:I.L......5 "...z.....x.r..[...g...z..U...\teo..~.U=3=1(x.^.>......U.......5,......1...'..9..........=P....:.Q..Ukk.5.....j.L.0.)3g..+........O.>.....1.?&.}I.W.=.<...{._..y.....\|.....^._p......J.W..:....rc......L.....v.tg._g.....W...@..!.e..1.R`W.y.}.....e...ftb..G...l.%6wfG...<..N..tfON!......o.2w......OT..bWop.+..,...v.-.....j.....~.8.sN9.m.6d..s.h.0v...m....l..yCG...../...>`?...7..-...>.\|..;._...n;..#......I.?.~.........`9..x..=... ?.~...p.........s.O..}.....o./...X.$..

C:\Users\user\AppData\Roaming\Seznam.cz\install\cz.seznam.software.autoupdate-1.0.8-win32.zip

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsm983C.tmp\listicka.exe
File Type:	Zip archive data, at least v2.0 to extract, compression method=deflate
Category:	dropped
Size (bytes):	849
Entropy (8bit):	6.725585672714635
Encrypted:	false
SSDEEP:	12:5jmcAZbECULvwE+334bK4crAvtsXCxXMuTXpFEKh3zGpcuEZr0vBWe5bXzG7sbvT:9mcAZbEXLoSo+tsSpfp16pcuXs9a
MD5:	F4BEBE89A8E1AC362FE3A79C97BE1DDE
SHA1:	77E567394D7AC07A76CE5814DE02D5867E33255F
SHA-256:	ECC1A7118616BB0481129D8ABAA60DF7F3E60A6EBC6E995D803E89736C45181E
SHA-512:	C5099BBBEA5896BA984BA34AC9840C3C4FBA086E5EAEE458E521E171AE2EBABC43394332550C11924B56B2CCA06D2B4DA8BA5E9FAC6BB342CC5B56C80F6E8B6A
Malicious:	false
Reputation:	unknown
Preview:	PK........L\|-A...(...........control.iniu.1n.1.E{K......".H...A.......=.i.e((8..^..R...../....u.%.p...N4..._...42...0I....w...z".u..u...,Ev....GC.\..e.a...JWz..E....{....._;7.s.@..W...m...-gtv@M....y.>.5).0).[.....+.F.G3..j.o).PK..........D@.{.(\|...........install.bat-...0....w8..M.....q...-!.B.^$.X......k..p..0......q.ML..R.....E./)..;'.Qh,..M..]5.U.....[r,/o3...$.\|w.U.h..l...u.6?PK........J.D@....c...h.......uninstall.bat.ruWpq.q.qUP..v....O+)O,J...L../..b.3.R..c.K..R.J.R..3..b.J............S...s......KK.K.R.KR..x..PK..?.......L\|-A...(.........$....... .......control.ini.. ..........)`\|..................PK..?.........D@.{.(\|.........$....... .......install.bat.. ...............................PK..?.......J.D@....c...h.....$....... .......uninstall.bat.. ...............................PK..............".....

C:\Users\user\AppData\Roaming\Seznam.cz\install\cz.seznam.software.chromelisticka-2.0.4-win32.zip

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsm983C.tmp\listicka.exe
File Type:	Zip archive data, at least v2.0 to extract, compression method=deflate
Category:	dropped
Size (bytes):	1045
Entropy (8bit):	7.292089732889401
Encrypted:	false
SSDEEP:	24:9wRr6xIT9OhM01f3OunuyITEGnYEO8gRsOl:92mSk2u6FY
MD5:	E6973300F7AD15C8C5F26B324128C9DB
SHA1:	15238797C7AB9DE40303B2C7F95CF63ABECDE99A
SHA-256:	DF6A3D97A5E11DA56BEC69C5321091FC705869E84AD9172EACECCED28D9EAA4D
SHA-512:	D974EBB994A247AC9B30255E1B91D5AA1DF7BB879F1BE81C78599685254D6A382F6145D25145A7DFA8F03BC14C94F5E8D3A030A6979FA8131BB5FCFBB42D56CA
Malicious:	false
Reputation:	unknown
Preview:	PK.........n_K.1.f....<.......control.inim.=N.0..{K.. ....&...JD1.'...2NV.q..@........TT...y.>bY.#=h.....J#.J;l..64.N.[Q.zj...g..\j.$d...)0i.._.O}.."y+...+d.N!.Qf.Mvu.UdLUh.\|..E.....y.,...x.....6n...x..b...0..v_ny~........@..:.N.....[F.....%b.....T..E^.y.~..Wp..V.PK..........'K.1..)...........install.bat...j.0........7....%](..%.(.U..".$,.6=...5.].......f....\...^.O...)...z...-.T.-..8.Q..e."..t6.....I..... .EeK...UcP.E..n.@.Y>........._.j........x..\..ht.].....r...>_.=v..k.. ..u...1o.i..}........ahI.LG..X.Nl....Sw8.......P..K....l./....4..Rje.b..Y..(c...A..:....u..[.+.\|...z...#.}..PK.........'K.}..............uninstall.bat.....0.@w..p).... ...v.X...>h..&.8../.N.f.!9.."Q...9&y.a....;.Q\F.J.Df.3.sA.u..?..Y .."U..A+..Q!+...n\|..Y......z.m.t.1.:..O.#.<..5AYQ.d,.:9m.uW...W -..:.R.k..4...hK&...,^M.?...PK...........n_K.1.f....<............. .......control.iniPK............'K.1..)................. .......install.batPK...........'K.}..................

C:\Users\user\AppData\Roaming\Seznam.cz\install\cz.seznam.software.ielisticka3-3.3.1-win32.zip

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsm983C.tmp\listicka.exe
File Type:	Zip archive data, at least v2.0 to extract, compression method=deflate
Category:	dropped
Size (bytes):	724
Entropy (8bit):	6.408287557760436
Encrypted:	false
SSDEEP:	12:5jvg1MijbDWNJBcOlpn07sq2pS4bueQKs5qEft5zSaq16Wjjzg1MiKtSu5dMb3dO:9vg1reoknlq2pHbuis5NMaqTPzg13CCc
MD5:	E4320B4B2CB3F74CA56DBA6DE0EF0163
SHA1:	4F63EEDB103F45226514C5368CA0376637388543
SHA-256:	E357942A177954451DD945952B71D9A26F8E1E0DB3064D62A9E514EADFA48A8C
SHA-512:	FA4E02BBCCB9F94C9C0200138E5F1CD03DBF57A404F2B8FF1195FDB43C54152F9C1F92ACCCC3F7F9B1989E7DC940BF7CA3D9308096F321FA079324D4ED5A6DE6
Malicious:	false
Reputation:	unknown
Preview:	PK..........vKEs.q....).......control.ini...N.0...Hy..04...S.$.$.......&Q..A.+...<..^..R..."%v...e.x.Z..[J..@..#.........1....P;+J^...lc..(p..,...%......eA....1bzy%#%[;..Y...<....+U..........2..wZ.7.y..MW.B...Y...&.........w...;...:.6N..FA.O....'.....j........S...d}.\|p.....br!...._......I{..^4.C.v.A.<.cJ..PK........GA.H...7............install.batrem IE listicka installs..PK........GA.H?GZ.............uninstall.batrem IE listicka uninstallsPK............vKEs.q....)............. .......control.iniPK..?.......GA.H...7..........$....... ...A...install.bat.. ................"%/yE..."%/yE..PK..?.......GA.H?GZ...........$....... .......uninstall.bat.. ................"%/yE..."%/yE..PK....................

C:\Users\user\AppData\Roaming\Seznam.cz\install\cz.seznam.software.libfoxcub-3.3.4-win32.zip

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsm983C.tmp\listicka.exe
File Type:	Zip archive data, at least v2.0 to extract, compression method=deflate
Category:	dropped
Size (bytes):	2203997
Entropy (8bit):	7.999375044744081
Encrypted:	true
SSDEEP:	49152:ZAj7VZosMIMpohqb6cqrAETIBR+v2yoqjazMQbhXpkMv:CdZosMIRh3ccM48qjGOc
MD5:	B5E04582FCC602E919C376A6BBD5C972
SHA1:	2B66CD590776782D27557062BE88F1723BB22F18
SHA-256:	F67F157CF3BF60B159B7F2D56BAF9251DBAF6419F914D053EC9B67145CCBF756
SHA-512:	1639B85C1933740F87BD8DE2079BA1BA3A3FA46FD5AB0FE48606C6040456C2F71814C512211CB60FAF1DA997F70FBEFB9ADEE6BE4BD2D7DADFA37ECEBE22FEF8
Malicious:	true
Reputation:	unknown
Preview:	PK..........vK..V.............control.ini.QKN.0..G...l.....b.%.H..[..I&...<NJ#..C.....^...!....{o..VT.h.%...& .B.d....A.1..P.....E.9\...R..R.8..1}...U.7...R.<...-..jI...:o,.e.B..?..&GfR.._.L.......S...+.y.o?%.'.X'<.)...x..z~AV.O.!....d.S]....q...U.P..F...N.Qo...a..n.....r..V,g..bo7.:...........<..].f...'PK........GA.H..............foxcub.confm.1..0.....Kx..23r....Z%Jp..V..w'.P.6..~.^..".~...1.D`..i5@/.i......R..{9.Y.XS.8......u...-..`..M.]...sG....&......bf..\|h....PK.........vK................install.bat.Vko.H.......4R..Ix.n[.(..U...v#Y..g......@H...w..qX.$...&.{.s...!...pi.f.\|.x.z-Jn f..E.y..1X.{3.3n.\.?:..l.TJ!c..14....}..{....!@$."....u..U+-..yZ8c.No....,X...G....iZ..~<.g.t-4...x8.....9.g..5.'..IB.>?......._...J.aa..cdF./w2}...h.,...Z.Z.."..S.zO....O.8.z-./$.e.X..'...Y..r..bE.r..Z.Y.P...^....K..5.....a..-........@......Z.~..3..g.h}..8.......7K.n5....W.d)CB.b........q3.XlC...$.......>.................d<.~..8..H.%.:..8...m..\..R1....3.S!.S.k

C:\Users\user\AppData\Roaming\Seznam.cz\install\cz.seznam.software.libfoxcub64-3.3.4-win32.zip

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsm983C.tmp\listicka.exe
File Type:	Zip archive data, at least v2.0 to extract, compression method=deflate
Category:	dropped
Size (bytes):	1053805
Entropy (8bit):	7.993440369898343
Encrypted:	true
SSDEEP:	24576:PshJO8c4oe/KqyFISsEa2pBV5UVNEwJlLi2zbrWtMqVtVhGcvU:PYO8gqynsQBV+NEz2zutMq/Gp
MD5:	2206D760A7C726AD292B42F2EF50C2BC
SHA1:	560FB65F3743FB7D053524589CF03E52D76174A9
SHA-256:	F861C709D7677198CABD8076AC3A54C78D980CE5682A8646DAAF05E203243F13
SHA-512:	A84FE90DF84426B58C343490402EFAB092FF3218A4591129906414A3E9068246A2ED639440DDCFFA485F621A915271C78ED925A8A39A28D9948E56A80A2E7B4C
Malicious:	true
Reputation:	unknown
Preview:	PK........T.vK_(.u....s.......control.iniuP1n.0.......!B.....]2..(.v.;. .Nc..}@.c..._U.&.2..;.\.([h.Y..[4.....D5. .....b..19.........X....t"B.\S....L.....4...nb!...#.0..B.....]..p76.E..e.R@.O....dj...o-...:~]Qo).U >...._DR....j8.i.<.r..[..F~K..c...a4...A..PK........IA.H.}.4............install.bat.....0...{..0.....EX..A0..V.(..K.L1....R=...VEPD....3.......V.t- z8a..S6...~.....x0..=..q?f=loQ.$3.6B.....O.u...[I..LT....X@..rx........1.#`.YCi..6...9{....Zc5mHC..R..q>.#6g#l.....*z.0.q[..,..\|N<.....=.......MCI.(..K......PK.........}mK..6.......'.....libfoxcub-x64.dll..\|...0>....f.B.EX h(..h......2.EnQD.h.......%.&..8.+V.....V[M.r.!H.@..%H..j...Q.b....9....f..}....~_..v..<...s.EW.s...Y./........?...{q....7..Ho._Tvc..\|...^s.s.5.W..;...6..y.j.g.B.-k..~jZ.,....0.....;...A....s..o;.....v....?..l.}v.H.}i......7..;...;'....9.C.....~.1.^~..2l.....q..=.{..W......I.9.)...q.3.H.e.U.....8..p._..\......b\|d...g.....i\.I.....$....'r.g....pm9.....2.

C:\Users\user\AppData\Roaming\Seznam.cz\install\cz.seznam.software.libfoxloader-3.2.7-win32.zip

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsm983C.tmp\listicka.exe
File Type:	Zip archive data, at least v2.0 to extract, compression method=deflate
Category:	dropped
Size (bytes):	42615
Entropy (8bit):	7.9894642823384725
Encrypted:	false
SSDEEP:	768:go0miBJRD4or9TkOSJ/qbhcFsXiVtBO/SPFhCTTkOhIp+NtlR3Gxk/VyNBHBondD:F0mmKohTk36hcFsSByS6jaQTlRvrDZB
MD5:	791596A8FC72684C08552120F793DDA9
SHA1:	2BA6BFA256777ADF57E0643E123326525FC603E3
SHA-256:	6F2536409EF39BCE630BFBE7B948632B1503C09CC2B8820C877FDBE3A61BC91C
SHA-512:	9589D65DDBB75E7C6375AE4D07ED582BABA232B0A08497D5699208665F3B129CE386E46A628B20A21AC6F180F62DA0BF10D5164248A678AC85ED9444CD671CA7
Malicious:	false
Reputation:	unknown
Preview:	PK..........vK6.Lf............control.ini.P.N.0..G.?.8..h..8...... .n.MQ.$r.nT.....R..L.............pC.R8.n'.4..._.-2.5...GM,.H..wu.%.Ja\Lhm....$....S....i...U....9....'.)v...(......J....ZTP...t.Z...F:#.=..e......0.\..R$6.M...B)0.....8..?.z0_.....M...~....`.#i....3.....V.`=....o..:.M\g# K..PK........'z&F................install.bat..Qk.0..............scP..e.f...(K...{.o.Nq..W.z.9.9.f..`C........Ct.n.#...<.(.4WG.(.f.p...uU0...2IK9s.\.@.PJ..=w..S.$.N..f..)...rD&8...^...QF.w.`..XZ.......`.'.2%....WoV.9k.<+.........ing. d...o.....q..P.Fs.].j........6......Lp...7....$.[K......t(..Z]..........>..PK........&z&F..N2q...........libfoxloader.conf...O).I-...l..+r..SR.x.@0...).,H...LJ,.T..*H,....j.K..a.2..RrR...s...L...y.%.E%.%E..@..i. .T.2.b.u....r..PK........;~mK.`H......L......libfoxloader.dll..\|...>.;.L.&.H.A.....mt..K0A6.....]RH...v..0....8Y.0N.>im..".G_...........Xh..z.........;.....}......s...{..s...v..0..?]g....W....1.eN}9.y1.i.,..1....6..p..7...

C:\Users\user\AppData\Roaming\Seznam.cz\install\cz.seznam.software.libszndesktop-2.1.29-win32.zip

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsm983C.tmp\listicka.exe
File Type:	Zip archive data, at least v2.0 to extract, compression method=deflate
Category:	dropped
Size (bytes):	1033669
Entropy (8bit):	7.997552881095073
Encrypted:	true
SSDEEP:	24576:/GpGxiTemBHz2aomEeqCTirAm32vyYGuebFYGwVE:epWqHSaPqYiUmGvyY/ebsu
MD5:	4E50416F5ECEA5EE27C40BFFCD96932B
SHA1:	47D0230DA97898E7124064052EFE8EF1B4725FA4
SHA-256:	0FCBEAA11F8C10E7A272BF8395625610AEF1B8725F8C695A2CBCBA0FA8B9E03D
SHA-512:	5EAFC96BB9ADB06F3AA6F0447491E4F41A7EC0269423ACA9FCA85B5A803BEF62430320EA69EC2DAF889ABB6C659CC085D30195ABE5B3EB5AE97B4BD1EC956366
Malicious:	true
Reputation:	unknown
Preview:	PK........e\|mK$...............control.inimP.N.0......!V....7..@Ht.1\.k..-.I..?ab`.+....6.!..w.Nw....B...@.B.,.. .v....iU..T..h....e.(.g.%Q&D.Z.3+!.......=Jk..=._x.9.qm}'....B..."...G.....i;.)..D..T&.Az.....M....x.s..IH...L.i%....\|p.n...P....>.O..EkTc...G..... -.^.4w{sN.i......qeOTH...{..D/..,'.PK........"..J}.GG...N.......install.batu.QO.0...I...%M......0dQ....4!e.n..- <..m.DFb.....].D)\..a\|..f+(3...}.v..d<<...yE...wL.l.H.xe~...x..r.m..iJ,i......T...w..(..^X.:hb/.p.4..\...P..ji.)..U..V.5t..,.......J.0a.V.L..{~u..B...............t...!B.N...Mx..I..K........,.....4{.B).....'2.k.....E.......Z3a..6\.<.\.K..'l+."...:+.p.J..K.c.1..%..q}._hU!...?~.PK.........z&F...jL...Z.......reconfigure.bat.v.Qp..s..q.-..KI-.../.K.H....8.x....$e..r.r).B.UcT.ZU..RR..KsJ..R.K..Jx..PK.........z&F........N.......szndesktop.confu..n.0.Dw....]..E......#.6...L.q.......d....c.qJ$..d:E.......#...P..K.......~W....U..3.E."*.~...Y..&...s..J.}.9..d.d...W.......(.~...e........{.

C:\Users\user\AppData\Roaming\Seznam.cz\install\cz.seznam.software.lightspeed-1210-12.10.12-win32.zip

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsm983C.tmp\listicka.exe
File Type:	Zip archive data, at least v2.0 to extract, compression method=deflate
Category:	dropped
Size (bytes):	313182
Entropy (8bit):	7.995274191932154
Encrypted:	true
SSDEEP:	6144:UFg/9LIhVLCq2K2nfygPMx9L+kjM20+yow5kwq+P9AS8C37slrr:Ua9QLCRfyg0b1jm2iAS8C3Y
MD5:	1D728224B44F40104BDB6EC746318304
SHA1:	54B5151EF4FCA53B07F5D0E01D1A016FD1CB0BA1
SHA-256:	4DC52FBEE798A3AC56AEC9286019BDC5BAE13DD9651BAB163747AADEDFFC04DD
SHA-512:	EDAE13E725BC5E089E865979ADC988A4EF18A2C0B449286D56B7D7AB6FEBF0010E52158C189308D198FFA7372178675D70733A2DBA73DCBC4864115A8F04E6DC
Malicious:	true
Reputation:	unknown
Preview:	PK.........TvB..hc............control.ini.O1n.0......@..E..zA.......$.%J.T.5..<...C.....j.v3t(......(y.J......r u...S.....9.s...F.......G)J...JJ..U......T.v....;...W.K.N..Q..q.qo....W..J.....K.;.)y..T. X..>:y2xWN.d.N.JT...G4G.bO3.v&..V}g..+..NY...p.3.............-8@6^!..S'(7\./..p..3._1.....S..PK........Q..A................install.batcpy lightspeed.dll "%~1\bin"..PK.........\|yB...k............lightspeed.dll.]{`S...in.K.4@.Q..[.......iy...)...!c.).).........m.{..^.9.-.....S...m......3.}...4....u....\|.;.\|...nW...../.R.nE.U+c.....=Y......v,z....?..X.~....p..W\}.5......w^.....%M.._....&M*..u..tc....:..>q......ot\|V.............ul.e/...~..........ow\|F..!~.?...T.p.....Q...h.zvP)8c..XQ..)..xv.7.....x.+q].(.....W~<I .wN..j......g.n.(w.D........;2...$e..B.[...E..g...e.v..8{...2....K\.!....@..jv...\~^..+.W(...N...~..e.C...Q1.c3.)w..~.....9......F_..............,....J1~..X.....c.[.c.u.............XT..GR.q...o..O..5.........0..].NU.....~.y..o.in.

C:\Users\user\AppData\Roaming\Seznam.cz\install\cz.seznam.software.lightspeed-1210-12.10.17-win32.zip

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsm983C.tmp\listicka.exe
File Type:	Zip archive data, at least v2.0 to extract, compression method=deflate
Category:	dropped
Size (bytes):	288347
Entropy (8bit):	7.995271482247388
Encrypted:	true
SSDEEP:	6144:nq3sfOVsqadpVQ4cahdP5hkgH3Rks1LN/31w:q3sfBqAhrRks1Lhlw
MD5:	4C2D06174847D9B2BE76015C4F666C98
SHA1:	9188C967210432254301CE7758587C7C2B5F6D9E
SHA-256:	0F42B30040121AE3A0D40E857184339901B47B93A66FACD831C3CB215BEBD711
SHA-512:	E0B1CB09C1102EB4133BB93ADB0473B61AF28970173318CE7DEF786D9E6C54A748EFA46F355B4ECD16B9D3C09EF32E0B4878016520DE5AAFAF13A4F66D09EBF1
Malicious:	true
Reputation:	unknown
Preview:	PK........,P.F...C............control.ini.O1n.0......@.(E..zA......L'.%J.T.5..<...C.....j.v3t.......(y.JWj.o..r u..4c./.QE....9..b%6bMI.1..Rl.Xs.@I...H25.Zp..J..v...qgt..w..1.:...XZ.s.......)+k..NeJ.qi..2.V..G'...6#:Y..............D...>.E.Z....S..g.....a.w.#`..l..3................6....O.D)......PK........&z&F................install.batcpy lightspeed.dll "%~1\bin"..PK.........l.F(.Y..b.........lightspeed.dll.].xT......\`a.Xt.UW]k.D.I...m.y.......[.FJ-&Y...].,.....o.....Z......j......[......g.........J..9s..9g...{....I.....I.%.+.F.I...2A.._\..6....o.....C.o}...7....>....-...m.[o.W.k...CKo.b...............wO..V...w7....?..k.y..}..u'g......]...V..D....[on.r.5!T%Isl..EK..q.......I...$.....&. .o.=G.r.....n./.Y6...t....x...8.....qR/G.S:lK..3^z.,..).~ I.3..t...W06.....{..W........$.'..5W..}o.{%i..v...xN.3....e#.?.?..wT...R.u^...z3..&.L8..:..k.e..1.q.H...\|.....o;..N....mwV..=..^.~Mz{@a.C..l~....x."Y..._.l.]c..<Y..mM.x.A..c..).t...%...;e....Z...

C:\Users\user\AppData\Roaming\Seznam.cz\install\cz.seznam.software.pp-1.0.2-win32.zip

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsm983C.tmp\listicka.exe
File Type:	Zip archive data, at least v2.0 to extract, compression method=deflate
Category:	dropped
Size (bytes):	96329
Entropy (8bit):	7.996117613458463
Encrypted:	true
SSDEEP:	1536:rw0DlhFT8v9Ey7BHP5mjocqOGSg5u1JXdURVd+EDtHHKw00NVgfy7Cn9y:rw0h4v/VUjo/LSCmJXuRV4ERnKy2fyoI
MD5:	F65744CDA67E821CFBE074C8C2050D36
SHA1:	FFBF1306352439E86D912413BB7926F408118E9C
SHA-256:	50F4226F6776905A8F3AC724C9B69789EB4CB3D04410DFE6FA08FE8738A4EF2C
SHA-512:	F2271A24A06462214BED50A688F4C34CCA169A0088749810EBFE6F286A8824A5B2A95D1AFA54C47CD309518F062DAC3B5D6B113CE3DD6A4BEB555C6DE5975BCB
Malicious:	true
Reputation:	unknown
Preview:	PK..........XA...T....?.......control.ini.OKj.1...\|..@.xJ..B.t......$$'..Q...~.(T..!.=.{..WX..;..i...a0>.+(.....V.R.c...(H.....rj&..!Nq.~..5.2+.X.Z.^...q.G.`;e...xW..l[.....3}.;._....Z.......R..D.o._8.+...........(...;..C.'.>.PK.........uWA.@..~...........install.batK..T(...O...+.I.KN.K..QPR.3.I..S..."9?/....)..KI-.../.K.iHQ.w.J...LSH-./.I-K.Q0TH..,QPu.....q.s.Q..B2!."U!%5-.4.D.(.haQ./..PK..........VA?.5.<...j.......uninstall.batS..UUH..)...O...+.I.KN.K.....K&....W..g....+.)@R.]....PK.........VA.9..e...........unlockInstance.conf...O).I-...lK.r.]rrx.x...X.^...T....J . .$.V...3..$1/9......TI...AU...2:#1/%'../17..U^.h2.PK........C.XA.2.w.s..8.......unlockInstance.dll.\.\|.G....c.Gri.6-..z.hh....5.\Hi.{.r...U.1..!.TK...,.VT...h.].Z.T...`c..m.TQQ..kP..".......JR..aZ.vg.y.....[..].M.$;.E...%..Ji.1...;y...?...R..k.7.mc..{..z.;..r.;.yo[......Y..w.W-./~.k..0}z...a]...j.`0..'Kj.U.m...."...`..}wp....V.w....o.m..Gy.{PN.w....:..x.[..o.O.j-9..K.Wbe'%..,....

C:\Users\user\AppData\Roaming\Seznam.cz\install\cz.seznam.software.szndesktop-2.0.31-win32.zip

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsm983C.tmp\listicka.exe
File Type:	Zip archive data, at least v2.0 to extract, compression method=deflate
Category:	dropped
Size (bytes):	42736
Entropy (8bit):	7.99148015785193
Encrypted:	true
SSDEEP:	768:LqnjR9ldV3zQMrPOPHY3UL8tS2voA5EkI2quTb3PyXWHFJMJW3:LqdJfho2gooiT7ymoJW3
MD5:	6CFB4F9B75BADFDE9124DDCD294ED760
SHA1:	0ED0E3A8CE6A03883E20FC5C9B23A71DB189CD30
SHA-256:	0DE708CB9BD1CE4831343A83EE1399B04FF91C7867AB6B1BE672E62C049101DD
SHA-512:	C108E3A587F49A9D4CFEDE1A7F5340F32232850F7C8CFA2C56AA9F8D70F060E7AFB2960059FFFCB8701205F1F70FA038C400CD3A9AB12E5F7E0FBB018FA580F7
Malicious:	true
Reputation:	unknown
Preview:	PK........Qd.Fy.qx....N.......control.ini..=..0...H.CFX"~......L ..5%4.Q..Tq.&.FN.....H.-..=}..q.).).E...a.F...E.J...\|n(.u2..[..Dj.A)Qu......k..F._.v+.Rw;.$hP'.W..Q....&%..4E....0f.D.W&..l.h..k.Q2....9l..t?..d.........4.......o....m..G..PK........%z&F..8y....".......install.bat.....0..w...IG1>...D.. .gA(Icl..A..]L..n.....E,.ep..!.7.S...J..h....."...=.T..:Y..B..%.<@...,.q~.!KX.3.....'.m...l......[.1.E.F.^fF.~.T.n,.jc...a...y..L..>.d.gE..g..7j.T..G..i!..<z..PK........%z&F...d............uninstall.batE....@.E............,B.6.1}....y...W0....S..6.i..:.y...1...7.Q..u.%wKq.G~.!.'....?V.=lu.k.";..S.~....h[.....R.f6..=.xE..)'...a.....q.fP.\|.....PK.........l.F.Z.s............wszndesktop.exe.].\|.G..K6...............K5..K.$\.$h....O....P@j..2nE.Z..jU.~..6.....(.Z.Q7&jh#....7.{..].._..0m.....73.y..R...R.$I2~MS..%.S)M..#I..}.@.....Y...nkyk[..w.e...V..7...w..tG........Uk..v..;n.={f..E....{.o....}........;..i.........~.....F..)7>..G.G...N^.U<)?.........)D..

C:\Users\user\AppData\Roaming\Seznam.cz\install\cz.seznam.software.szninstall-1.1.14-win32.zip

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsm983C.tmp\listicka.exe
File Type:	Zip archive data, at least v2.0 to extract, compression method=deflate
Category:	dropped
Size (bytes):	413937
Entropy (8bit):	7.997346385247254
Encrypted:	true
SSDEEP:	12288:Q1rqA4uA1eUvYHWvC4e1nHJ5NzMw/4LWn98B:2rZpUgnHPCcKW9O
MD5:	BCD1142EB88F3CCFDF1C50EA60CFBC23
SHA1:	8F5B28DBA299B667098761CA12A9CDEDCAC045CC
SHA-256:	13A128092FC1F1A080EE7C3409D072AC04251028E771301CEB66008D86EE18AF
SHA-512:	A82B94D3297E429335570D61221DEDF92D4226952B87CCE5FF7E1A6B3A8E9A3D0127F81B1748C5E3F58C032555A7CE9513C8EBEB247CED7352AC760B69C04C96
Malicious:	true
Reputation:	unknown
Preview:	PK........{z.B..............control.iniuO1..0..#...a..... !.F..n..&Q.R...<....._..tC.......%.83P..:I..T.-B..%uF..PU.]..F-e_k.FA.(S..5..l.rthr..B..'f.u..s.....j.Y%}..t..op.E./.p....._c.....{.^8oK...!..._7c)h.7d...$9..PK.........e-At...............install.bat}.]O.0....?.,.2.5.E....?.&..3..M[T...Y@..d.8=......f..A....^s.f){......6.X......qmh.8M.....R....C...0.j.'.I1...M.<..oFsR..\|R..Jh..G...S..R)....f....J.\s.].9...}0.`....W.!....d...,;.C.A. ...f!...EI..).da.;.L..&.._M.Z...I.tX...<..Z....s^.q.{.O...X.juOM}...t.\|m..Q..+.....Wb...kc.e...2z...562g...........~;^m.....En.C=h,k..*..NK.-E.%..0....F...)J....G..>.M.........a..PK........"{.B.....K..H6......szninstall.exe.].`T....$KX....!J...A.H..7...I..v..A..i...a...b7.<...V..S.W.\.V{.D......5R.Q.R....T."{...{.v...l...(o......w....;...(6..F..U..%.....7~...'.<.a......4\|m].......w.....y_.1om.y_.f..5y....??n\V.^..k..~uv....;B....9......_....^&.....7><W..{............k74PyCa.y....\..~#.f.

C:\Users\user\AppData\Roaming\Seznam.cz\install\cz.seznam.software.sznsetup-1.2.6-win32.zip

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsm983C.tmp\listicka.exe
File Type:	Zip archive data, at least v2.0 to extract, compression method=deflate
Category:	dropped
Size (bytes):	1121056
Entropy (8bit):	7.9980844161334
Encrypted:	true
SSDEEP:	24576:GEsHd/6e673WBuIc1m+QeCHL9Ii4oPW4zyaU+a:qHd/67MuIFh4GW6GF
MD5:	457F45D1DD530D03DEFD57CE13EA6568
SHA1:	6BDAFF63863E54C18980E6D2BF406ABB7279D70A
SHA-256:	A5DA40F3B5A597D6DEC28632A262EFEE7D5754FF40176C8FD964B72E7FEBE42B
SHA-512:	4ADCFFFD87D6FBEDA4A6740A61FCCA89E457EF002E9D0BE73F4BA702061697831E87E02A5BB7BC6D58E63A0C774F67BAA14FF80FDFDA614A4E9BD961F1C20565
Malicious:	true
Reputation:	unknown
Preview:	PK.........z.B..X.............control.iniE.K..0.....!'.X.]n n.S\L.T..$$.....(..}(..g..w.Pwp.....:.y.:..G..c........:2;]..."C.......~.U....7..f../.v<..pH(.x.Z..V.{....kz.....U...#$V.\|...PK.........T-AbEm.5...Z.......install.bat.LSH..,.QPR.3.)..+N-)-.K.HUR@.)....bQ..._P..T......PK........L{.B..E....H.'.....sznsetup.exe.].\|T....$C....F..5k.P...(L.B`&!?.....,U...J.L..x..[..B..[.e....4h..L..S.%...z1.DE..d.....L.I@....c.y...s.=..s.97...S.4..zz4.N....3......v...y..:.../...;...^r.\|.w}.{.-M....%e..~..)3.R.{..W......x...g^.6.m.........}....?.w3...{2...>N..........5....].......i.tG...[..V.a-.1..i?.hZ.y..R..4/n.<.....X...../g.M+N...W"..~..oC.W.D7.#.....Xt..;......ZQ.^..2.......#n.$..........w>...q_]..j.....f.75...9e.7....^.....2.6e...P`5~s.}.5\..%w..}.>k?......-...^d.~..a.....Y.\|7k...._...g.._...{..GA.SUw...?.M.y....C..S..m...0].....7.....Iww:.=o.>....n...S.Q.....@......w...c.9k.7.oLu...>o.w......=....'^c).2.\v...o.O.F#..<}.5.;o7.6gO....._.L..

C:\Users\user\AppData\Roaming\Seznam.cz\install\packages.inf

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsm983C.tmp\listicka.exe
File Type:	Unicode text, UTF-8 text, with very long lines (11895), with no line terminators
Category:	dropped
Size (bytes):	12019
Entropy (8bit):	5.138509902305094
Encrypted:	false
SSDEEP:	192:yZVOTb1ZVTbJZm2bzZexbNnGyZObiYZXb/ZVxb7ZBy3b/2Z05xtb6Z0bUZKbqjZ5:y6TZfdE2vwoyorFbjxPnSCsxtGy4wegw
MD5:	F697B45DFBC054244DBD7C0B84A6978D
SHA1:	3A8DD4A006489F666283CE878BFCB9D1D6429E97
SHA-256:	93566BC8CD8AAA71DA3D8E7DE5C27B79566231E37AE9DE6BA1BE47CEDCFE24E5
SHA-512:	93322C3C7B56B064B2364C55C8400FDA2F25A356788235271A7DEF4EDE827417B4A9EFCDB2A1AB59F4398F2C074D81FC7FE90B48694378CE65E1800AD28A63BA
Malicious:	false
Reputation:	unknown
Preview:	"packages"={[ "com.microsoft.msdn.msvcr100" "10.0.40219.325" "instver"={ ""} "depends"={[ "szn-software-base"]} "conflicts"={[]} "replaces"={[]} "implements"={[]} "triggers"={[]} "install"={ "install.bat"} "uninstall"={ "uninstall.bat"} "postInstall"={ ""} "preUninstall"={ ""} "reconfigure"={ ""} "appname"={ "Microsoft Visual C++ Runtime\|Sd.len. knihovny od firmy Microsoft ur.en. pro b.h program. napsan. v jazyce C++"} "md5"={ "cf3b1b6e8062e277c361f5eb155078b2"} "source"={ ""} "size"={529195} "islib"={true} "location"={ "com.microsoft.msdn.msvcr100-10.0.40219.325-win32.zip"} "downloads"={[]} "isgroup"={false} "updateMode"={0}, "com.microsoft.msdn.msvcr110" "11.0.51106.1" "instver"={ ""} "depends"={[ "szn-software-base"]} "conflicts"={[]} "replaces"={[]} "implements"={[]} "triggers"={[]} "install"={ "install.bat"} "uninstall"={ "uninstall.bat"} "postInstall"={ ""} "preUninstall"={ ""} "reconfigure"={ ""} "appname"={ "Microsoft Visual C++ Runtime\|Sd.len. knihovny od firmy Micro

C:\Users\user\AppData\Roaming\Seznam.cz\install\szn-software-base-1.0.0-win32.zip

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsm983C.tmp\listicka.exe
File Type:	Zip archive data, at least v2.0 to extract, compression method=deflate
Category:	dropped
Size (bytes):	719
Entropy (8bit):	6.349415100701118
Encrypted:	false
SSDEEP:	12:5jwSNlmjFxowaViqg54+10RlfaQz/B2USNlX2isyw8P:9dnsxToij4dlffz/wZnX1vzP
MD5:	074A93E1689EA64403D500B6C7A83AB4
SHA1:	91717B519EAE49DAB6F62550862BBBBE67B14CF4
SHA-256:	95CEB6D4F123EDD7043964BDDBAFA0E18C247762CD42581ACBE621327B09BAE0
SHA-512:	5E44E6E7027AA7477D0BD73C3D304022E33D15D43BF21C1E5B08F24D912C4A7597570E71CE2A7A02D5CD317DF98B7A27B7B35C7DD18F1AAFA249E76478779FDD
Malicious:	false
Reputation:	unknown
Preview:	PK.........h?@..(............control.ini=.K..0.D..r...">.\..;...u!jp.\|ZQq...q/.j..#..f.8..Z..E..;.4.:.&..im0....d=....5..:.jP...R..`.).sR.B.[..R.^.Z..07>.uoy.....9..i.....z._".....5..kF..C......08.bE+04@.7.L...-h._}...PK.........p%@....N...........install.batKNQ.wQP5...LS...Qp....QPJ..SR..N.,........ ...).%.P...PEjEf...kP....k...*/..PK........Q~:@.o[\.... .......uninstall.bat+.UH........yi`FJbI"/WjEf....PK..?........h?@..(..........$....... .......control.ini.. ....................?.......?....PK..?........p%@....N.........$....... .......install.bat.. ..........$.......?......?....PK..?.......Q~:@.o[\.... .....$....... ...X...uninstall.bat.. ..........a.9......?.......?....PK....................

C:\Users\user\AppData\Roaming\Seznam.cz\install\szn-software-fflisticka-4.0.4-win32.zip

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsm983C.tmp\listicka.exe
File Type:	Zip archive data, at least v2.0 to extract, compression method=deflate
Category:	dropped
Size (bytes):	5209329
Entropy (8bit):	7.995007947124359
Encrypted:	true
SSDEEP:	49152:Hs1BcPiuJ69o8NZmPCDng2DVSVSGftCpg45crWoNTq1ehPWihbqDLPdLVyhS9VCS:HswK66Fm6Dg2ISG0uQcxqMhei0drV7
MD5:	644B1DB74D32B4748747402D32807B2E
SHA1:	D03AC037136667802AEA894095E62859C565DFA4
SHA-256:	6CFCE917D8784F6F8D8D29C955CF9068C97223FD3F10D5002EC1B09F844A65C7
SHA-512:	BAE6C262A87B1530431387BC19F17C30424784CEB6FFA5CA7722A1D2ACB4E726488B5FA4CF332C4F68E114A4215C01F750EA7213FED65AD652D1C8865B38EE71
Malicious:	true
Reputation:	unknown
Preview:	PK.........n_K./.B3...........control.ini.SKj.@.]K.;....c.q.....$&...Y..5vO.......+..Y..>B...R=.m.G.u.....U..%9...F.:U.._>.....E....>....k..o..U..........zp.3.."[.l.. +Hthe(....A...Q..>...N+.G......h&j...5.S....<.(.a...E.....f.#r.V...dW.jx.ql.....~......>..=.....qI.+..e...Dl>?.v?J..........(.I'.L>H....58.r.U...w.....G.....:....R..H3..uUY..G......q..xI. ....$u.+.G.j....p,q)../O.VeU~r....?We^.E..I.e...O..!K....hq^...U9..c\|#...9#2.........XsT..\........0^b.8....2.......-........]..4or...}...Q...E.3.R.....;...........b.5.tB.4c.%....Y..O..XF.....N..)..vs...c _.../.......PK........'.[K....8...........install.bat...k.0......Bv..txm.l:...=.J.$.l..dX=.o_...`....{..}./.;.N..j.>...8.....rS.\......#2 #L.h.^...4F...BY...i....Z=yLE.K.c/./_..}.3...e..Z..[R.M..a...&.$.\|/:.!...G...nOk..(.u.#...z..'..:]........x..L0.h.3".vL.kaPhs..C[ff...QtS.E.....[...n....~O.7.2..1.7<...q...%........k....VU.0.K...MH%.....PK..........6K...2............uninstall.bat

C:\Users\user\AppData\Roaming\Seznam.cz\install\szn-software-listicka-3.0.0-win32.zip

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsm983C.tmp\listicka.exe
File Type:	Zip archive data, at least v1.0 to extract, compression method=store
Category:	dropped
Size (bytes):	1688
Entropy (8bit):	7.31141552358749
Encrypted:	false
SSDEEP:	48:eZ0gM6JildusNaNNROdmmXkYVQZJoyLgfJM0FZgraoIQc/:eZy6sX1NmNROMQKZJtgfGcOr/I3/
MD5:	9AE25DCC2D25C8408A413C70DFF1B41A
SHA1:	048DD9E455EB99EA8AAEC1946C3411F8ADE0671E
SHA-256:	C23C5FD2153E7229335BBFA20C1BAA697DF761E7144605EB9D45B8724728BF04
SHA-512:	D229C2A19DE9652C9FD81EE54883AED9C24DC0D080D4DC473D70B3CFF5E185B1FA0E610AB2E550768BB7FCBDFEC0BBD121626D544222FBBFAC65184A795493FB
Malicious:	false
Reputation:	unknown
Preview:	PK........<.o@k...........)....stamps/szn-software-listicka-win32.stamp1 ..PK.........tWA................control.ini..1j.@.E.....`a.zo.."eH1^.....avW."W.!\.....Wd.a.!d........+.m..7..z4a.U.U..s!.Y.j@..).u..DF*..c.p...........V.B..d..=..e..z.sm.............V.B..3?;.@......DI.U..Jt.q.......A+`~.\|...=.........&.6m.vK.....}.d/~.:}\..;}N_x>...u..PK.........x.@P.`.............install.bat.TQk.@.~/.?..y)$..M.!....m.",H..E......~.m.s....J^...f..\|3<.Y8....".....t<{...F......{?.qq.W\|`.B.`...8..\.u%r..H.D.Qhf....]qr.M..^w.\%L{\d..}..`.Kd.V.-.=..)..T..._akgCWf..v..NU.H.({.D.YA..:.V...=..L.].........^.'......`4.a.....'.Ny.....K.R... W.....RP.....:?.iv....Z.<..nj.....fCR@..=.....P...6.-j~.......x..s#.}..f.U....a..^KO..C0......W%.U...-..........-.l$'.s..AQ...\n...o.6....H..`....LV_....l.....~...^k.4m.`.S9..!.Yyd.H....="h..x....B.&}{]..B.l.^D.4.j....5.b...2$A..........?PK........w.o@..TB;...b.......uninstall.bat..Mk.@....aX...(...XC.a7Q....,&.......kHi.B/.....

C:\Users\user\AppData\Roaming\Seznam.cz\install_packages.log

Download File

Process:	C:\Windows\SysWOW64\cmd.exe
File Type:	ASCII text, with very long lines (426), with CRLF line terminators
Category:	modified
Size (bytes):	1644
Entropy (8bit):	5.351438470703697
Encrypted:	false
SSDEEP:	48:PQCqogmGO2P/aoGINMJswnTtFmE9+YDng9DH7:PqoglJPifywT7mE9rnmDH7
MD5:	ADCA357ED073FAAE44273CD22CCB7BCF
SHA1:	746EE5066EAA659A6476BCD3D60EB53B5829F8E1
SHA-256:	FB93A14DB2EAEDA8BAE3BC081D87B76455F8D0747853313E080FE19356F2281E
SHA-512:	54526D3C24C9898A2DF5621BF7FF0B0A2D3D4000AE52C85E026B6583B0F3DC853C41EDFA1AB40F9DEFD28E5E4B32586F32F77B852EE7067340EF525D4277A9FB
Malicious:	false
Reputation:	unknown
Preview:	========== cz.seznam.software.libfoxcub install 02/10/2024 6:17:01.99 ..07296 006987796 === Starting sznpp. ver= 2.1.35..07296 006989046 Reported. ret= 1 url= https://h.imedia.cz/hit/?a=event&d=%7B%22application%22%3A%22szndesktop%22%2C%22signedhash%22%3A%220%22%2C%22action%22%3A%22install_ie%22%2C%22status%22%3A0%2C%22osbuild%22%3A19045%2C%22osarch%22%3A9%2C%22iever%22%3A%2211.00.19041.1%20%28WinBuild.160101.0800%29%22%7D&s=partprog&v=2.1.35&r=1218851696&u=http://www.seznam.cz&h=B0B7C794-8699-4634-B6F9-24DA47BBD8EF&lsid=1727870994840&lses=0..07296 006989046 === Exiting sznpp.. ..========== szn-software-fflisticka install 02/10/2024 6:17:07.78 ..C:\Users\user\AppData\Local\Temp\~006AB2D1.00000DD4.sznpkg\control.ini..C:\Users\user\AppData\Local\Temp\~006AB2D1.00000DD4.sznpkg\install.bat..C:\Users\user\AppData\Local\Temp\~006AB2D1.00000DD4.sznpkg\seznam_doplnek_email-4.4.1-fx.xpi..C:\Users\user\AppData\Local\Temp\~006AB2D1.00000DD4.sznpkg\sko-extension@firma.seznam.cz.xpi..C:\Users\cal

C:\Users\user\AppData\Roaming\Seznam.cz\packages.inf (copy)

Download File

Process:	C:\Users\user\AppData\Roaming\Seznam.cz\sznsetup-lt.exe
File Type:	Unicode text, UTF-8 text, with very long lines (12717), with no line terminators
Category:	dropped
Size (bytes):	12827
Entropy (8bit):	5.180540644941676
Encrypted:	false
SSDEEP:	384:gcTZpdQNn2vQkWcyQGb8MY6qXM2RPM5IStQJpAoCzQz3eQ0opmMloCnmQW6yQKUh:gcVjQNnaQkvyQGQMYxM21M5nQJpA/Qzh
MD5:	2B30B0F36476D2B69181AC52F3E6D0B7
SHA1:	326D309F3937F116BF93FC1EAA8B4A2376CE67F4
SHA-256:	28195C17A65889A95509E4F636E0C23BFF89898163272BAAA71C5A5E033D7015
SHA-512:	0E1481C9F651F9D1F916A6CCF6573CE576B875E987DF88063841347FBACCD22D5FE92EED8F2583E534763EC5A3E43FF6930BBAEC6273ED819957CFA7B0BC9FB8
Malicious:	false
Reputation:	unknown
Preview:	"repository"={ "packages"={[ "com.microsoft.msdn.msvcr100" "10.0.40219.325" "instver"={ ""} "depends"={[ "szn-software-base"]} "conflicts"={[]} "replaces"={[]} "implements"={[]} "triggers"={[]} "install"={ "com_microsoft_msdn_msvcr100_10_0_40219_325.install.bat"} "uninstall"={ "com_microsoft_msdn_msvcr100_10_0_40219_325.uninstall.bat"} "postInstall"={ ""} "preUninstall"={ ""} "reconfigure"={ ""} "appname"={ "Microsoft Visual C++ Runtime\|Sd.len. knihovny od firmy Microsoft ur.en. pro b.h program. napsan. v jazyce C++"} "md5"={ "cf3b1b6e8062e277c361f5eb155078b2"} "source"={ ""} "size"={529195} "islib"={true} "location"={ "com.microsoft.msdn.msvcr100-10.0.40219.325-win32.zip"} "downloads"={[]} "isgroup"={false} "updateMode"={0}, "com.microsoft.msdn.msvcr110" "11.0.51106.1" "instver"={ ""} "depends"={[ "szn-software-base"]} "conflicts"={[]} "replaces"={[]} "implements"={[]} "triggers"={[]} "install"={ "com_microsoft_msdn_msvcr110_11_0_51106_1.install.bat"} "uninstall"={ "com_micros

C:\Users\user\AppData\Roaming\Seznam.cz\packages.inf.$$$

Download File

Process:	C:\Users\user\AppData\Roaming\Seznam.cz\sznsetup-lt.exe
File Type:	Unicode text, UTF-8 text, with very long lines (12717), with no line terminators
Category:	modified
Size (bytes):	12827
Entropy (8bit):	5.180540644941676
Encrypted:	false
SSDEEP:	384:gcTZpdQNn2vQkWcyQGb8MY6qXM2RPM5IStQJpAoCzQz3eQ0opmMloCnmQW6yQKUh:gcVjQNnaQkvyQGQMYxM21M5nQJpA/Qzh
MD5:	2B30B0F36476D2B69181AC52F3E6D0B7
SHA1:	326D309F3937F116BF93FC1EAA8B4A2376CE67F4
SHA-256:	28195C17A65889A95509E4F636E0C23BFF89898163272BAAA71C5A5E033D7015
SHA-512:	0E1481C9F651F9D1F916A6CCF6573CE576B875E987DF88063841347FBACCD22D5FE92EED8F2583E534763EC5A3E43FF6930BBAEC6273ED819957CFA7B0BC9FB8
Malicious:	false
Reputation:	unknown
Preview:	"repository"={ "packages"={[ "com.microsoft.msdn.msvcr100" "10.0.40219.325" "instver"={ ""} "depends"={[ "szn-software-base"]} "conflicts"={[]} "replaces"={[]} "implements"={[]} "triggers"={[]} "install"={ "com_microsoft_msdn_msvcr100_10_0_40219_325.install.bat"} "uninstall"={ "com_microsoft_msdn_msvcr100_10_0_40219_325.uninstall.bat"} "postInstall"={ ""} "preUninstall"={ ""} "reconfigure"={ ""} "appname"={ "Microsoft Visual C++ Runtime\|Sd.len. knihovny od firmy Microsoft ur.en. pro b.h program. napsan. v jazyce C++"} "md5"={ "cf3b1b6e8062e277c361f5eb155078b2"} "source"={ ""} "size"={529195} "islib"={true} "location"={ "com.microsoft.msdn.msvcr100-10.0.40219.325-win32.zip"} "downloads"={[]} "isgroup"={false} "updateMode"={0}, "com.microsoft.msdn.msvcr110" "11.0.51106.1" "instver"={ ""} "depends"={[ "szn-software-base"]} "conflicts"={[]} "replaces"={[]} "implements"={[]} "triggers"={[]} "install"={ "com_microsoft_msdn_msvcr110_11_0_51106_1.install.bat"} "uninstall"={ "com_micros

C:\Users\user\AppData\Roaming\Seznam.cz\partner.conf

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsm983C.tmp\listicka.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	28
Entropy (8bit):	4.093069207771889
Encrypted:	false
SSDEEP:	3:2WXR64u:2E64u
MD5:	37A778A115FF09FE80C7C2466A51D96D
SHA1:	31D153C9F1A2AD499CD2B354C46E2D5CA8C1C38C
SHA-256:	8AFC5D9EDE736D2AF74897F2D73BF6CD491C2A5016E9CF5937E1C3D3993AADED
SHA-512:	69414F23D21D2614E8FDD1E51E0538F36F14A8100CD4E2ADCE49AA86D24234DCD5CA0FEE46E04816D44885F3AEA36C8EDB581368429AF2E78CCCFC3CA82E03BD
Malicious:	false
Reputation:	unknown
Preview:	[Partner]..partnerId=40139..

C:\Users\user\AppData\Roaming\Seznam.cz\sources.inf

Download File

Process:	C:\Users\user\AppData\Roaming\Seznam.cz\sznsetup-lt.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	45
Entropy (8bit):	4.358085318359589
Encrypted:	false
SSDEEP:	3:cm7zKaKEl/oiQQmovn:cm7ma5fvn
MD5:	8EFB99DC1764C24A3AFD26525CB801AE
SHA1:	EF3001D662DC98EF5DCF2B971E6715BFBC4FFE50
SHA-256:	EA7AF9470621FFDD4B4AFB4380C0E0EC1FDD5F6D2D1B371304290474AC1C9B4A
SHA-512:	CF1A8B52D569DBD580473D95F213499B66F2E925134530ECF821A4B36A5701DEE1A33B521859E3C1AA57A834AC7FBC8A830BCB51629755DD193895027B537B96
Malicious:	false
Reputation:	unknown
Preview:	$\install..http://download.seznam.cz/update..

C:\Users\user\AppData\Roaming\Seznam.cz\szninstall.exe

Download File

Process:	C:\Windows\SysWOW64\cmd.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1069296
Entropy (8bit):	6.42377685493426
Encrypted:	false
SSDEEP:	24576:FCZGGSEniyqZsG0YyPXDKGeN/jBeaj2TZ/UN:fGeIYx1yTZ/UN
MD5:	C73E94B86ED9B6BDFF199BB7E8BF9D77
SHA1:	81187638DF3B943E9A990A8DFAA5AE70D4AE360B
SHA-256:	ABCBBDCC62338959F0F74B257E34AC86ABA9132675F34A389756F624909C0115
SHA-512:	56347635037935771708E803278678520E6CF6F16AC532D53EF571FD25BB86FF16677CB5832A16DCA8D6921D5A9BF7672540BF29A92063627BFAC8E6B6D79FF0
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........p..Y..Y..Y..B.u.G..B.A.$..B.@.m..Pih.[..Y..t..Pix.B..B.D.g..B.q.X..B.v.X..RichY..................PE..L...&.Q.....................".......J............@..........................p......lR....@.................................l........................ ...0.......................................... ...@...............\|............................text............................... ..`.rdata..............................@..@.data........0...\|..................@....rsrc...............................@..@.reloc..8............6..............@..B........................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Seznam.cz\sznsetup-lt.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsm983C.tmp\listicka.exe
File Type:	PE32 executable (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1266688
Entropy (8bit):	6.644795121487715
Encrypted:	false
SSDEEP:	24576:a7sp3PWWBbM5IrRn9LVt9cExxYJvpwLiAaZrcp:Xp3PWWbTVglpwLisp
MD5:	9033DBEE427815F396F63928C3273862
SHA1:	999A21163538790C49640969648818410AC3EF5C
SHA-256:	D73B8AEB672800608AD5DF8351CBF38F7B7A6E56781C75827E7D10025ECDDC6A
SHA-512:	EFD48A08883CB19E704BA5B867F41EDF25237F7EF55B3E408CA993FADFAFC569B1BBFCE3F2E1981444887866686835DEFE06C3A58C19D05792E2A5C53627394E
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........* ..KN.KN.KN....KN....3KN....KN.KO.lKN.3..KN....KN....KN....KN.Rich.KN.................PE..L....8vQ..........................................@..................................[....@.................................D<..........lr...........................................................y..@...............0............................text............................... ..`.rdata..............................@..@.data...D....P.......@..............@....rsrc...lr.......t..................@..@.reloc..B............D..............@..B................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Seznam.cz\sznsetup.exe

Download File

Process:	C:\Windows\SysWOW64\cmd.exe
File Type:	PE32 executable (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2596080
Entropy (8bit):	6.581958589749376
Encrypted:	false
SSDEEP:	49152:yUPwoS+FWk6IIv4pN4erBKXFia3JdpoTG/1hd5VBsoKJqZij:IiFWbIPKXIGvcoKA6
MD5:	D0F5D99C74D568EB9909C7582A775DC7
SHA1:	4D7D588C789B26E0A6AFD6C2E3685A01DA7B1351
SHA-256:	30CAEDF510C447A3DC0F8A068B6ED8C55409818C77FAEB7E01E86DF1C3949B2D
SHA-512:	5424989B78E418AF100C10D8F6D12B13B78643CE2F5F7A9E0462A9571827DC8C1EEF60324D64BB4CA7651262523434ADA0B564A757A1B15D338DDAF47DCFCF01
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........* ..KN..KN..KN......KN.....EKN......KN..KO..KN..3...KN......KN......KN......KN.Rich.KN.........................PE..L...w.Q.........................................@...........................'......S(...@..................................M....... ...y...........l'..0....&.$.......................................@...............<............................text..._........................... ..`.rdata..............................@..@.data...D....`.......F..............@....rsrc....y... ...z..................@..@.reloc........&......P&.............@..B........................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Seznam.cz\uninstall\com_microsoft_msdn_msvcr100_10_0_40219_325.install.bat

Download File

Process:	C:\Users\user\AppData\Roaming\Seznam.cz\sznsetup.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	56
Entropy (8bit):	4.36530335951897
Encrypted:	false
SSDEEP:	3:JLzHcIeqHcIv:m3S
MD5:	4271A7FA5E233E43048DE68E2945F523
SHA1:	52F2F7333535F77DFA1834BCCD752944B3957685
SHA-256:	F2BF2FC9F09D668D79DF8FCA8FF827F1997AFBAE7D99A3AC50584B73E336204D
SHA-512:	C06A210C19982CBCECFE6606CF7E4B534D18D077E673F548FD3B42CE953B7A33DBC70E9F227584DDD3C609EAE51FF6B43FE814E89ABA15BB434B3144F7071DD6
Malicious:	false
Reputation:	unknown
Preview:	cpy msvcp100.dll "%~1\bin"..cpy msvcr100.dll "%~1\bin"..

C:\Users\user\AppData\Roaming\Seznam.cz\uninstall\com_microsoft_msdn_msvcr100_10_0_40219_325.uninstall.bat

Download File

Process:	C:\Users\user\AppData\Roaming\Seznam.cz\sznsetup.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	42
Entropy (8bit):	4.088629625108202
Encrypted:	false
SSDEEP:	3:HNIWTvLevosNIWT8vn:t6voCcvn
MD5:	438645DAC0A08E21DAFCC6EE75284EC1
SHA1:	8D99CE0F6A450271B1F226B68F698236FEA216E5
SHA-256:	9B977BFD65F844CD708B3E6649810EE6F2130AEB2674966511581DCABE9D0B87
SHA-512:	6B0218D27F71F112561311FB7A116AA570A60C19B4094D51BEAE2CC8A44AC42AABFDF5D8BD9EA4B1952EE0293425A856A5EF0D68FC4B2BB9AE9ADA24F8FC1939
Malicious:	false
Reputation:	unknown
Preview:	rm bin\msvcp100.dll..rm bin\msvcr100.dll..

C:\Users\user\AppData\Roaming\Seznam.cz\uninstall\com_microsoft_msdn_msvcr110_11_0_51106_1.install.bat

Download File

Process:	C:\Users\user\AppData\Roaming\Seznam.cz\sznsetup.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	56
Entropy (8bit):	4.33834309158456
Encrypted:	false
SSDEEP:	3:o9cIeXB9cIv:oKfKS
MD5:	07F8553EBC55FC91142A43993C01460B
SHA1:	2C4F175D5BD5DBDD7B351CF2001122AC72328D49
SHA-256:	E0D474ED9F004971CBC3367F687EDC99D3C26CFA63EC2E3EDC13B8FCB469ECDC
SHA-512:	94558AF820E4E738B095F4F19EDB55FFC70F52FCB78CFB04E66D196256B29631614EA0C9F642AB402E97B394968C747436113C1AEC44EB94A74B23B8F69FAF2A
Malicious:	false
Reputation:	unknown
Preview:	cpy msvcp110.dll "%~1\bin"..cpy msvcr110.dll "%~1\bin"..

C:\Users\user\AppData\Roaming\Seznam.cz\uninstall\com_microsoft_msdn_msvcr110_11_0_51106_1.uninstall.bat

Download File

Process:	C:\Users\user\AppData\Roaming\Seznam.cz\sznsetup.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	42
Entropy (8bit):	4.088629625108202
Encrypted:	false
SSDEEP:	3:HNIWT6yosNIWT8Byn:tayoCYyn
MD5:	275B053DDF715BAAE046DA79CB5E8D68
SHA1:	76B078C6D16C4A5DB5F9E34CFD945176041F503E
SHA-256:	A8C6ADBEBFC5E4BAE1B237C4F400D832ED9FD0D64E588B7CB9A459D710EB3C93
SHA-512:	BFB7F388872C4B2F131E24385E53AD0186D94AA1DA10A47B933DA3FD51D98A72CF003906BE8417105DB9B72C6F6187205C30083180F66EECFAF23ABCE4688583
Malicious:	false
Reputation:	unknown
Preview:	rm bin\msvcp110.dll..rm bin\msvcr110.dll..

C:\Users\user\AppData\Roaming\Seznam.cz\uninstall\cz_seznam_software_autoupdate_1_0_8.install.bat

Download File

Process:	C:\Users\user\AppData\Roaming\Seznam.cz\sznsetup.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	133
Entropy (8bit):	4.999643899132137
Encrypted:	false
SSDEEP:	3:kgJtm2KD9so3KRfyM1K7eDoK0T9Gcx8SE0nwi4iYrE:9CtuH1j0Kq9G90wi4E
MD5:	F45C071FD1ABA066C0A5877DCCC37F07
SHA1:	73C90D2A48ADC0BC7CA8A5232C0B15C4D3304853
SHA-256:	24BC6E07585B3D7CF3812E5B1B377AC0E39A154D8C14B8B7B3AE03DDA9C85803
SHA-512:	0027B487FCD0A9F51AED2D76551273F60FA2945B78EA68FF1E9F2F79C7B52944DA40F063E29A815557B79504812402A151FEC817B9A30BD8D6F5CE9EDDB274EB
Malicious:	false
Reputation:	unknown
Preview:	..REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "cz.seznam.software.autoupdate" /d "\"%~1\szninstall.exe\" -c"..

C:\Users\user\AppData\Roaming\Seznam.cz\uninstall\cz_seznam_software_autoupdate_1_0_8.uninstall.bat

Download File

Process:	C:\Users\user\AppData\Roaming\Seznam.cz\sznsetup.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	104
Entropy (8bit):	4.908191555872355
Encrypted:	false
SSDEEP:	3:7Ac2KD9so3KRfyM1K7eDoK0T9Gcx8SE0a:M4tuH1j0Kq9G9r
MD5:	5D379CB847043D49E99717CBE5CFD1B1
SHA1:	F9E82F6CC4EAE5B60366D71A3446E439887F5491
SHA-256:	F9774B7B55CA1144C478108B561C1DEAB3BB1DECBA3212D07F136F7A00EDF952
SHA-512:	E0FD611D55EE78F1978D3AACE9318942ADC460D0BC8056A25E78F916E496817C82388FEA73969D0E53095E9C70A0FE1EC85732A1A1E96FBD64F90F2950D95A66
Malicious:	false
Reputation:	unknown
Preview:	REG DELETE "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "cz.seznam.software.autoupdate" ..

C:\Users\user\AppData\Roaming\Seznam.cz\uninstall\cz_seznam_software_chromelisticka_2_0_4.install.bat

Download File

Process:	C:\Users\user\AppData\Roaming\Seznam.cz\sznsetup.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	698
Entropy (8bit):	5.170584919475078
Encrypted:	false
SSDEEP:	12:zLYEw+I23WRLefYeqw2Lyra7qQLIOX/Q4ZEsibgBRLmLw7vfEw7UI2eQ:zLjV93Qd5qLQs4IMhBRLmY859b
MD5:	8331107CAE62639FE04594C8B8BFB197
SHA1:	9BE2D95AAF8089C4A25EBC53D2688A9F040C8ED2
SHA-256:	7DF405A1774F369E9820BE806902F85ACF22A208C80AA61B4CA97764E8DB1CFB
SHA-512:	DEAA43B287E129C42B537829DCD7EA3CABEE065ADD29689C08BE3F601D0C381A9A2A5FC8FC7E20FE24BFCD97DDBFC8D80B45386DC4674F1B8F6CD51FA5F4735A
Malicious:	false
Reputation:	unknown
Preview:	setlocal..set LOG="%~1\install_packages.log"....echo. >> %LOG%..echo ========== szn-software-chromelisticka install %DATE% %TIME% >> %LOG%..pushd "%~1".."%~1\bin\sznpp.exe" install-chrome all >> %LOG% 2>&1.."%~1\bin\sznpp.exe" install-chrome-nm >> %LOG% 2>&1....set CONF="%~1\conf\szndesktop.d\installChrome.conf"..echo [modules]> %CONF%..echo module=installChrome>> %CONF%..echo.>> %CONF%..echo [installChrome]>> %CONF%..echo type=installer>> %CONF%..echo path=/installChrome>> %CONF%....set sznpp_name=%~s1\bin\sznpp.exe..echo cmdline="\"%sznpp_name:\=\\%\" install-chrome retry">> %CONF%..popd..echo ========== szn-software-chromelisticka install finished %DATE% %TIME% >> %LOG% 2>&1..endlocal..

C:\Users\user\AppData\Roaming\Seznam.cz\uninstall\cz_seznam_software_chromelisticka_2_0_4.uninstall.bat

Download File

Process:	C:\Users\user\AppData\Roaming\Seznam.cz\sznsetup.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	397
Entropy (8bit):	5.1985547220807895
Encrypted:	false
SSDEEP:	12:GLYEwjWUI2eXw2LyNnqWRLeyYekEwjWUI2ep:GLjtU9UqNnXKItU9e
MD5:	0F3B2B6B03FA376926AEA017902DAA7D
SHA1:	2BB38BB2AB30A1A4392F7E012C2E3D203D07A4F0
SHA-256:	932CA8BA7AABF2CCBF9652D17AF0A1C9F57AFEAB06C7FB3E2F99C5E725E0665E
SHA-512:	3DE62CFA220FCEEE9B9AC7AABD7EEB2A2C562BBCA2B72B947547664B5F9BF2EF7486F5573706695FF81FA02C3EF3F106A883943B341983DC987016418293DDBA
Malicious:	false
Reputation:	unknown
Preview:	set LOG="%~1\install_packages.log"..echo. >> %LOG%..echo ========== szn-software-chromelisticka uninstall %DATE% %TIME% >> %LOG% 2>&1..set CONF="%~1\conf\szndesktop.d\installChrome.conf"..del /q %CONF%.."%~1\bin\sznpp.exe" uninstall-chrome all >> %LOG% 2>&1.."%~1\bin\sznpp.exe" uninstall-chrome-nm >> %LOG% 2>&1..echo ========== szn-software-chromelisticka uninstall %DATE% %TIME% >> %LOG% 2>&1..

C:\Users\user\AppData\Roaming\Seznam.cz\uninstall\cz_seznam_software_ielisticka3_3_3_5.install.bat

Download File

Process:	C:\Users\user\AppData\Roaming\Seznam.cz\sznsetup.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	26
Entropy (8bit):	3.815072410115943
Encrypted:	false
SSDEEP:	3:MggWfNqYy:hTsYy
MD5:	ABCBAAF46341277F8951FB5BF133C383
SHA1:	F87F5B04F9B86C21B335E82AA1AD8DFE686E9745
SHA-256:	B38FC392B3E5E6A3A378E6FF6910CDB925F6FBA084B42F12183044C3AABCD41D
SHA-512:	D67A6C0A1F937B1946655EDE9C2F77DA3F8586C4D08B045B847C772BC4D91C678132CF5FCEBD661402715D78929A3AB662AFF71F4264E7125D266493D0E8A59B
Malicious:	false
Reputation:	unknown
Preview:	rem IE listicka installs..

C:\Users\user\AppData\Roaming\Seznam.cz\uninstall\cz_seznam_software_ielisticka3_3_3_5.uninstall.bat

Download File

Process:	C:\Users\user\AppData\Roaming\Seznam.cz\sznsetup.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	26
Entropy (8bit):	3.738149333192866
Encrypted:	false
SSDEEP:	3:MggWfTLWFn:hTvWFn
MD5:	239F13333B848ECD8348E41C0A62046A
SHA1:	68E57E511BAA8EA7355F44D15FBE6A426149A500
SHA-256:	3B889C45AEE317109919705D75CCC13C7AFFBDDAEF2546E22CDA2A6F295FC244
SHA-512:	06136D8FBEABC2CDCD4E0B4E6357896A5E0BCF739800CE68D281EFEEE52A86CF9E5A4126B1272C3FF8BEF58B719FA74B95CA154A21A85A23979A9E3B0D48F939
Malicious:	false
Reputation:	unknown
Preview:	rem IE listicka uninstalls

C:\Users\user\AppData\Roaming\Seznam.cz\uninstall\cz_seznam_software_libfoxcub64_3_3_8.install.bat

Download File

Process:	C:\Users\user\AppData\Roaming\Seznam.cz\sznsetup.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	479
Entropy (8bit):	5.092757416486348
Encrypted:	false
SSDEEP:	6:1FtfQNO2LGaKwMFRLJgoBI0AXMJ2dI8ym0TAXMJ2dI8yx2C8XMJ2dI8yrwTHrYTe:1gEMFlMagmTgoC8grcHGLyqy
MD5:	7A522080BFF68371130F0741A612C4E0
SHA1:	9D3C3D2C406C821D71ED1E153401BB738C3726B6
SHA-256:	EB0BA985B99016851B9319C24F38B7D7C9AF75603323B93763FE5B79D66B196B
SHA-512:	01680337EFB8CD5F9BA80A5F2CBFA932731EBDDBA4AAFBF31D5D17302228B8DC99586764A925D50935AB98B73B7322F52DFFA2D7CBC5FB705E26FBE511B5FD98
Malicious:	false
Reputation:	unknown
Preview:	REM ----------------------- Ielisticka ------------------------------....SET PREFIX=%RANDOM%..SET TRGNAME=%PREFIX%libfoxloader-x64.dll....pushd "%~1\bin"..for %%a in (*libfoxloader-x64.dll) do %RM% %%a..popd....cpy libfoxcub-x64.dll "%~1\bin"..if errorlevel 1 exit %ERRORLEVEL%..cpy listicka-x64.exe "%~1\bin"..if errorlevel 1 exit %ERRORLEVEL%..copy libfoxloader-x64.dll "%~1\bin\%TRGNAME%"..if errorlevel 1 exit %ERRORLEVEL%....cd /D "%~1\bin"..szndesktop.exe default restart..

C:\Users\user\AppData\Roaming\Seznam.cz\uninstall\cz_seznam_software_libfoxcub64_3_3_8.uninstall.bat

Download File

Process:	C:\Users\user\AppData\Roaming\Seznam.cz\sznsetup.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	143
Entropy (8bit):	4.821271069043112
Encrypted:	false
SSDEEP:	3:VCHrYI8FrI3VxtFIjEdg7BiMqIbMFAAsMxLG4oKZAF9KVt:VCHrYzrIb3g0qBKwMFRLJgo/
MD5:	C206DCA6E849C4A7E9834ECBC272A07F
SHA1:	748ACE4319039EDE0A248B523847A0E1CAE9B015
SHA-256:	A5DEFAF6D54CB1EC27EF9837C1D1160FCC6C32E407769C20961DDC95F074619F
SHA-512:	1108628973E8A190D05536859B343B92EF3962CDDCA99793A74DA09393E3B329F640B6C4C3741C7B0558ADB7A86406AFBB26169D57A0B37420BDB2A3CE631275
Malicious:	false
Reputation:	unknown
Preview:	..cd /D "%~1\bin"..%RM% libfoxcub-x64.dll ..%RM% listicka-x64.exe ....pushd "%~1\bin"..for %%a in (*libfoxloader-x64.dll) do %RM% %%a..popd....

C:\Users\user\AppData\Roaming\Seznam.cz\uninstall\cz_seznam_software_libfoxcub_3_3_8.install.bat

Download File

Process:	C:\Users\user\AppData\Roaming\Seznam.cz\sznsetup.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	2513
Entropy (8bit):	5.406931319732965
Encrypted:	false
SSDEEP:	48:jg7gDWxgDyg7gbg0lZa3UCvBRaA/4r/wnkEGs6HbDLugINpTR09pQzXRiN:jin3sAnWUkEA/4r/wL6bGfl09pJN
MD5:	BF471E6E8C4F554736825FA91840F9EB
SHA1:	D5789BF2D42C6286D0105C1AEE1590BD99F46EA8
SHA-256:	7EA60AFB73078A88A53212DD907C953F1508A851FE864C95B338466E8FC9C00E
SHA-512:	931B0BA8E163EE0896E951ED3CEDBE7D81D4BFF0490CC18E69AF0ACD2E9F64639E2634B5AC3A7E435FB94B268E8E78A5F3071F827AAA2711E759D43CD98FA02D
Malicious:	false
Reputation:	unknown
Preview:	REM ----------------------- Ielisticka ------------------------------....cpy libfoxcub.dll "%~1\bin"..cpy libfoxcub-x64.dll "%~1\bin"..if errorlevel 1 exit %ERRORLEVEL%..cpy libfoxcub.conf "%~1\conf\szndesktop.d"..if errorlevel 1 exit %ERRORLEVEL%..if not exist "%~1\conf\libfoxcub" mkdir "%~1\conf\libfoxcub"..if not exist "%~1\conf\libfoxcub\foxcub.conf" cpy foxcub.conf "%~1\conf\libfoxcub"..if not exist "%~1\conf\libfoxcub\remote.conf" cpy remote.conf "%~1\conf\libfoxcub"..if errorlevel 1 exit %ERRORLEVEL%..cpy listickaconfig.webpak "%~1\data"..if errorlevel 1 exit %ERRORLEVEL%..cpy listickanastaveni.webpak "%~1\data"..if errorlevel 1 exit %ERRORLEVEL%..cpy speeddial.webpak "%~1\data"..if errorlevel 1 exit %ERRORLEVEL%....if EXIST "%~1\conf\libfoxcub\regcfg.conf" goto skipPartner....SET partnerId=1..pushd "%~1"..for /F "delims== tokens=1,2*" %%a IN (partner.conf) DO IF "%%a" == "partnerId" SET partnerId=%%b..popd ....echo {"partnerId":%partnerId%} > "%~1\conf\libfoxcub\regcfg.conf"..

C:\Users\user\AppData\Roaming\Seznam.cz\uninstall\cz_seznam_software_libfoxcub_3_3_8.uninstall.bat

Download File

Process:	C:\Users\user\AppData\Roaming\Seznam.cz\sznsetup.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	447
Entropy (8bit):	5.094173564825026
Encrypted:	false
SSDEEP:	6:1iWREo1HPrzb1LErZKkW6kK1enEhftxyEniECjAXrYKd1oct2LcEJcRz2CISR7Kj:11b1PHVQxJcoWaR2LcbKCIi7+IitFR
MD5:	7DA206C336BBE241FA88BB871711480E
SHA1:	47B0CA6C686DB6E1967BFAA9CE9BD70E1C7B786A
SHA-256:	637EF514B3A00D744B00D17C1E5F61B78C98BEDD08A1FD97E4CF542D5C8300B9
SHA-512:	51A693D9191323DFC76581C994521B3419E805704A31C0A6FB8D11AE4F6229F95262B28683643DA86E6DA977ED4B7A351CC8695F05B26629B7F7E0473CECB9C1
Malicious:	false
Reputation:	unknown
Preview:	REM ----------------------- Postak Uninstall------------------------------....if "%INSTALLMODE%" == "reinstall" goto skipUnreg....pushd "%~1\bin"..rundll32.exe libfoxcub.dll,UninstallFoxCub..echo Result: %ERRORLEVEL%..popd..rm "%~1\conf\libfoxcub"....:skipUnreg....rm "%~1\bin\libfoxcub.dll"..rm "%~1\conf\szndesktop.d\libfoxcub.conf"..rm "%~1\data\listickaconfig.webpak"..rm "%~1\data\listickanastaveni.webpak"..rm "%~1\data\speeddial.webpak"....

C:\Users\user\AppData\Roaming\Seznam.cz\uninstall\cz_seznam_software_libfoxloader_3_2_7.install.bat

Download File

Process:	C:\Users\user\AppData\Roaming\Seznam.cz\sznsetup.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	665
Entropy (8bit):	5.090531037132653
Encrypted:	false
SSDEEP:	12:dEMSlM7DC8g9Tb2LgxLXgoNH2zNoRzdoz5aLH2zRLN2NH2zcDzVaLJXgp:2MSC7DHgZh7goVgoiO8LNuytgp
MD5:	9BBCD62FE1CD94EBEB3E5E0D265B1FAC
SHA1:	DF5D01AB785BDBD8999D691055ABC89FB848A460
SHA-256:	70AF4838579108F54C6CAEC76951864981A4A45BBF5EEB88A9A867F95870FFE3
SHA-512:	537ACE03CAEE651837B479E3563AC020016A3406F9B68C634653A58359EEA572ED5807D58DDB2F453F83803F2A8C9A3CF7E7FA6C574BEA603DB57D7447E966E6
Malicious:	false
Reputation:	unknown
Preview:	SET PREFIX=%RANDOM%..SET TRGNAME=%PREFIX%libfoxloader.dll....pushd "%~1\bin"..for %%a in (*libfoxloader.dll) do %RM% %%a..popd..copy libfoxloader.dll "%~1\bin\%TRGNAME%"..if errorlevel 1 exit %ERRORLEVEL%..pushd "%~1\conf\szndesktop.d"..echo [modules]> libfoxloader.conf..if errorlevel 1 exit %ERRORLEVEL%..echo module=foxloader>> libfoxloader.conf..echo [foxloader]>> libfoxloader.conf..echo type=library>> libfoxloader.conf..echo path=/libfoxcub/loader>> libfoxloader.conf..echo handlerName=libfoxloader>> libfoxloader.conf..echo loadOnStart=true>> libfoxloader.conf..echo libraryPath=$bin:\%TRGNAME%>> libfoxloader.conf..if errorlevel 1 exit %ERRORLEVEL%..popd..

C:\Users\user\AppData\Roaming\Seznam.cz\uninstall\cz_seznam_software_libfoxloader_3_2_7.uninstall.bat

Download File

Process:	C:\Users\user\AppData\Roaming\Seznam.cz\sznsetup.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	117
Entropy (8bit):	4.733719959588687
Encrypted:	false
SSDEEP:	3:EIFTLU2JROLcDviK3FiMqIbMFAAsMxLGlJJM7KZAF9KVw:THt2Lc2WFKwMFRL+MEgo+
MD5:	9F076A34053864B8E9A1B5FEE5C8A375
SHA1:	9C04BD85478C512D0C150913A2F9124E65E8FBE7
SHA-256:	A42B1531B57778A1DB29D0E00C2E572737C2658D6A8B4B9DAE9641B664A85187
SHA-512:	0C2CF9730C468FE1BAD8FED6A1FA7FF2196096564CAA418551E789A7EA59679F3E59C16996C9D2F53FCFC232BD9B6696F9F9C6C3DAC5F66BB0EBE73C72523E4A
Malicious:	false
Reputation:	unknown
Preview:	..rm "%~1\conf\szndesktop.d\libfoxloader.conf"....pushd "%~1\bin"..for %%a in (*libfoxloader.dll) do %RM% %%a..popd..

C:\Users\user\AppData\Roaming\Seznam.cz\uninstall\cz_seznam_software_libszndesktop_2_1_35.install.bat

Download File

Process:	C:\Users\user\AppData\Roaming\Seznam.cz\sznsetup.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	590
Entropy (8bit):	5.447813309811645
Encrypted:	false
SSDEEP:	12:zsLOvLOLs0bfuERBoFK28fYjE8BpTRTNOIiV2LUuCCV2LgJVjHQddV:z5DmG4Bhf8BpTRcIbrVzudV
MD5:	B61DF9A6B879BC61545ECDA4863ADB8B
SHA1:	12D9014E1F52E792A3DFA8219919D2557FE660DC
SHA-256:	D428E0882C3BF85915D39BDE4A91B862C02BF094939621DE6F53479ABEE47452
SHA-512:	83F402F734607CA33F9B2775CFEBE378E706532FDA5E3793176FF1666DCFD512C5D8CCB4CD651FA3536D6FCFB571A53DA84C767F47BF7D5F5493887B0C008990
Malicious:	false
Reputation:	unknown
Preview:	SET BINFILE=szndesktop.exe..SET CONFFILE=szndesktop.conf..SET DATAFILE=szndesktop.webpak..SET BINPATH=%~1\bin..SET CONFPATH=%~1\conf..SET DATAPATH=%~1\data......cpy "%BINFILE%" "%BINPATH%"..cpy "%CONFFILE%" "%CONFPATH%"..cpy "%DATAFILE%" "%DATAPATH%"..cpy "sznpp.exe" "%BINPATH%"....pushd %~dp0..for /F "usebackq delims== tokens=1,2*" %%i in (control.ini) do SET ini_%%i=%%j..popd....if NOT EXIST "%CONFPATH%\szndesktop.d" mkdir "%CONFPATH%\szndesktop.d"....reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall\SeznamInstall" /v DisplayVersion /t REG_SZ /d "%ini_version%" /f..

C:\Users\user\AppData\Roaming\Seznam.cz\uninstall\cz_seznam_software_libszndesktop_2_1_35.reconfigure.bat

Download File

Process:	C:\Users\user\AppData\Roaming\Seznam.cz\sznsetup.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	90
Entropy (8bit):	5.00869816904785
Encrypted:	false
SSDEEP:	3:I3IgbLIROL4AOshCGKyShkdomKtAlov:zGLBL4OK2CUov
MD5:	CFB7FE84F6F3C98AB9B32ABE82F4F2D0
SHA1:	E5B15A307E6F6E25945DD17A2BC85BA1C6C89863
SHA-256:	35B565956F3C521A3D5B3F5D4F4933D0DCA04202D5B3CC2BCFD55651F3030811
SHA-512:	BD31D6D5DC72AF48E2A0733B7943A58F0045F5ED48D75610153259EDCC9FFFA4BA8FE9B6E1B3AAD3517ED540100FF8A9D847FD2A706F0825B0EE14C45CF1B333
Malicious:	false
Reputation:	unknown
Preview:	SET BINFILE=szndesktop.exe..SET BINPATH=%~1\bin...."%BINPATH%\%BINFILE%" default restart..

C:\Users\user\AppData\Roaming\Seznam.cz\uninstall\cz_seznam_software_libszndesktop_2_1_35.uninstall.bat

Download File

Process:	C:\Users\user\AppData\Roaming\Seznam.cz\sznsetup.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	321
Entropy (8bit):	5.099866037700299
Encrypted:	false
SSDEEP:	6:zGLBL4j3RLBLgLBLTD20b3GCv1Y9aQwCVDQJw2JfowCV2LgPBSn:zsLOvLOLpbxkV8Jf+V2Lgo
MD5:	5E04518BB23AAB14529D29ED5BDE12A7
SHA1:	87A4E150BB716B96FE27431871BC479A63C444AC
SHA-256:	CFF88B9D1CCD44E13D35F66620BDB200622260DA35F5C671237CAC34F4C7A741
SHA-512:	6374D80C7C0D81CFDB5EE096BB734FFD06BED3730A27AC488E1DAAC5548AA61F5AF181B174A4AC300C897D63D2ED80E07147A035F5638B861767A9AE4B500D7E
Malicious:	false
Reputation:	unknown
Preview:	SET BINFILE=szndesktop.exe..SET CONFFILE=szndesktop.conf..SET DATAFILE=szndesktop.webpak..SET BINPATH=bin..SET CONFPATH=conf..SET DATAPATH=data...."%BINPATH%\%BINFILE%" default stop..rm "%BINPATH%\%BINFILE%"..rm "%CONFPATH%\%CONFFILE%"..rm "%DATAPATH%\%DATAFILE%"..rm "%CONFPATH%\szndesktop.d"..rm "%BINPATH%\sznpp.exe"..

C:\Users\user\AppData\Roaming\Seznam.cz\uninstall\cz_seznam_software_lightspeed_1210_12_10_18.install.bat

Download File

Process:	C:\Users\user\AppData\Roaming\Seznam.cz\sznsetup.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	30
Entropy (8bit):	4.348394345536403
Encrypted:	false
SSDEEP:	3:FRWVAA1JKIv:rs1JKS
MD5:	628C0001F72480BACC5461C706E89F69
SHA1:	F161DAA6069BCF1F7E3C9D16F23B53A401F458AA
SHA-256:	5F716B3D423663BEDF60A38A47552916F6C277E058EAB3763AE9BAB6215006AC
SHA-512:	78265C706C2B9CDF649A069592DCDC8D6651FDAF38BD099252CFD48EA5AB31E6B9771A2881CD7206714E9D517548D11A9B4E723295DAFFB69FCEB1D55F7EC3D2
Malicious:	false
Reputation:	unknown
Preview:	cpy lightspeed.dll "%~1\bin"..

C:\Users\user\AppData\Roaming\Seznam.cz\uninstall\cz_seznam_software_lightspeed_1210_12_10_18.uninstall.bat

Download File

Process:	C:\Users\user\AppData\Roaming\Seznam.cz\sznsetup.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	23
Entropy (8bit):	4.0559581516151235
Encrypted:	false
SSDEEP:	3:HNJDKVAA1Jy:tJDY1Jy
MD5:	6B5B33ACCAB99D9F69195776DDE81615
SHA1:	A05632A3A23BD422F5A687921A9FB154E0DCE0D7
SHA-256:	8C55EBBAD55537F6920F4C3D8882FF8F2143CA46129C2BBABB6DC8ABD4135DFF
SHA-512:	F01C9D35A8FF76E57825FFF232D32052D5918175F6776832F12D2E9A312449A25BFDE720832319B23CF342AD6C280817F905BB790987D3B59450785D5D47B128
Malicious:	false
Reputation:	unknown
Preview:	rm bin\lightspeed.dll..

C:\Users\user\AppData\Roaming\Seznam.cz\uninstall\cz_seznam_software_pp_1_0_2.install.bat

Download File

Process:	C:\Users\user\AppData\Roaming\Seznam.cz\sznsetup.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	166
Entropy (8bit):	4.903562305955095
Encrypted:	false
SSDEEP:	3:GLrzHcIerLrNiMdLU2JROLgWFKTH/HcoUD8XMJATkU2QAgKoyWOROL4AYftAlov:G3z8Z3Xt2LgJTH/HcgXMJ2dI8yWfL43j
MD5:	E7883526279757875FB8188805601ED1
SHA1:	C2C9FAA62B4833A0AF71C66986B2F0533551E529
SHA-256:	400242B3026CEB1C0FEAF4D82D4C74A0C5A62230CAA00DD37591A99280A2AED3
SHA-512:	51C962AF22F9A16B0C5B587298069C7F8CBF15A04CA23CEEEDB690ACF7ABE4DD85E17425B932832F56198D3047531CB85764827F2D727B2AE280964E4C03D413
Malicious:	false
Reputation:	unknown
Preview:	cpy unlockInstance.dll "%~1\bin"..cpy unlockInstance.conf "%~1\conf\szndesktop.d"..cd /D "%1\bin"..if errorlevel 1 exit %ERRORLEVEL%..szndesktop.exe default restart..

C:\Users\user\AppData\Roaming\Seznam.cz\uninstall\cz_seznam_software_pp_1_0_2.uninstall.bat

Download File

Process:	C:\Users\user\AppData\Roaming\Seznam.cz\sznsetup.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	106
Entropy (8bit):	4.352109998418424
Encrypted:	false
SSDEEP:	3:bPLOLJKSLrevbgJU2JROLWJtLrNTJQJtLrNr:bgJt3wbg72LWr3l43Z
MD5:	EC8D719E6F25D33D9F16817F6BCF1621
SHA1:	537A245B464E45A6E7F4856D9EE1E24BD6443E96
SHA-256:	62C19855908F69E4A71DE3DBF26B108CBE90B5C84DBE65B37415176733C072C3
SHA-512:	113D640BCC08026484E69F538B1D7151D9832297400E6D4B26F689695A877113F4AA12988AFB376A4854486552FB11AA1A3C1669568DD0E1E6B516ED82758C5D
Malicious:	false
Reputation:	unknown
Preview:	%RM% bin\unlockInstance.dll..%RM% conf\szndesktop.d\unlockInstance.conf..%RM% conf\unlockInstance.conf....

C:\Users\user\AppData\Roaming\Seznam.cz\uninstall\cz_seznam_software_szndesktop_2_0_32.install.bat

Download File

Process:	C:\Users\user\AppData\Roaming\Seznam.cz\sznsetup.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	290
Entropy (8bit):	5.318143737635718
Encrypted:	false
SSDEEP:	6:zxL4OKSVvieyoAB88yumoAB88y9CtuH1j0Kq9G9RNfHW+syxQ:zxLJIBsRBsJVj0KLxHW+lQ
MD5:	A4F113D2DDF779A13A65D3DF7D86E61B
SHA1:	952F6CCB508BF9C9E62C2886127BF4B89079A4C6
SHA-256:	7D27BC072CED3AC7D71446A77364429A04A12538DC4FFBA81894340728302285
SHA-512:	1A0C41330A63E6B1602647818D322E65E7E972DDE5B20CCF045FF007FCC4518FDF1055F819665DA3738B1E899BFC08A015F2AF361416442E01B790D3EF459F12
Malicious:	false
Reputation:	unknown
Preview:	SET BINFILE=wszndesktop.exe..SET BINPATH=%~1\bin....cpy "%BINFILE%" "%BINPATH%"..if ERRORLEVEL 1 exit %ERRORLEVEL%......if ERRORLEVEL 1 exit %ERRORLEVEL%....REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "cz.seznam.software.szndesktop" /d "\"%BINPATH%\%BINFILE%\" -q"..

C:\Users\user\AppData\Roaming\Seznam.cz\uninstall\cz_seznam_software_szndesktop_2_0_32.uninstall.bat

Download File

Process:	C:\Users\user\AppData\Roaming\Seznam.cz\sznsetup.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	178
Entropy (8bit):	5.307857484647402
Encrypted:	false
SSDEEP:	3:I3IgefL2JROL4AOshFMLyEqkdoL8FJAc2KD9so3KRfyM1K7eDoK0T9Gcx8SERLBJ:zxL4IDOQv4tuH1j0Kq9G9RNfHF
MD5:	6F73BC97F458228B8DC66C578AD0558D
SHA1:	E24552D8AB3F31E57A2B2320D4AFCFE8D29C394A
SHA-256:	06C375DA50AF41C663D982BBC244E2458AECE2DF7EC796F057C723D0C0334466
SHA-512:	1C377425590FF781DB6BCF411DAF9FCD6017E96C37151550163D27B1B83E23962F4E81614237C41640A17674EAE9AFB130944FB6E53788CB6165073370FD7B7D
Malicious:	false
Reputation:	unknown
Preview:	SET BINFILE=wszndesktop.exe..SET BINPATH=bin....rm "%BINPATH%\%BINFILE%"....REG DELETE "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "cz.seznam.software.szndesktop"

C:\Users\user\AppData\Roaming\Seznam.cz\uninstall\cz_seznam_software_szninstall_1_1_15.install.bat

Download File

Process:	C:\Users\user\AppData\Roaming\Seznam.cz\sznsetup-lt.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	908
Entropy (8bit):	5.305590837067523
Encrypted:	false
SSDEEP:	24:cizQsyV/yXA7Mp7vKLyPJFkJbxbp9MayHp:QkXAoxvfkJN35yHp
MD5:	93C3AFFD6E3E86AD9FC944356E55712A
SHA1:	8B2ABEA2446AEE93D17CDD58D95B6494AEE4783E
SHA-256:	5E3AEBCF7AB3579B7EC48A0589130A961D4A2B7035F99FC9F196B260B62C156A
SHA-512:	83767A58B605E764A8CF199FB98691B371CB6DA2FD7A6CC392632F0188F2D0251A9E6F73381F3212BF41ADD10B32F187E31C615FA799E4BA5D6CAC7C36A2DE66
Malicious:	false
Reputation:	unknown
Preview:	SET rm="%~1\sznsetup.exe" --rm..if exist "%~1\szninstall.exe" %rm% "%~1\szninstall.exe" ..copy szninstall.exe %1....SET UNINSTALLKEY="HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall\SeznamInstall"..SET SETUNINST=REG ADD %UNINSTALLKEY% /f....REG DELETE %UNINSTALLKEY% /f /va..%SETUNINST%..%SETUNINST% /v "InstallLocation" /d %1..%SETUNINST% /v "DisplayName" /d "Seznam Software"..%SETUNINST% /v "DisplayIcon" /d "%~1\szninstall.exe,0"..%SETUNINST% /v "UninstallString" /d "\"%~1\szninstall.exe\" -X"..%SETUNINST% /v "ModifyPath" /d "%~1\szninstall.exe"..%SETUNINST% /v "Publisher" /d "Seznam.cz"..%SETUNINST% /v "URLInfoAbout" /d "http://software.seznam.cz"..%SETUNINST% /v "HelpLink" /d "http://napoveda.seznam.cz/cz/software.html"..%SETUNINST% /v "Comments" /d "Vsechny aplikace spolecnosti Seznam.cz a.s."..%SETUNINST% /v "NoRepair" /t REG_DWORD /d 1..%SETUNINST% /v "NoModify" /t REG_DWORD /d 0..

C:\Users\user\AppData\Roaming\Seznam.cz\uninstall\cz_seznam_software_szninstall_1_1_15.uninstall.bat

Download File

Process:	C:\Users\user\AppData\Roaming\Seznam.cz\sznsetup-lt.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	181
Entropy (8bit):	5.159345752239915
Encrypted:	false
SSDEEP:	3:ynWpY6Cbjp/g52KD9so3KRfyM1K7eELNREZ4tWUEJABK2xkpVoIueABK2xkpVoyy:ynWfUpYRtuH1jEBRE0BDkpSIaBDkpSyy
MD5:	1FEFF19973A4F9158C152836AA645DA9
SHA1:	5235DA552796A62FB9A88394A049829BB43B3E22
SHA-256:	2DE87146ED0503AADACC414FE9DF49635D9722AFFEFDFEC0D485BFBAF2173B43
SHA-512:	E275593A178C32434A1C748908BFC70856E71EC49D9EF7CAC71F03DC1602A8891FB891A8C09C4F94FDF88701BFF2AC27742D92CC4F71D965D98B6A5FA093F155
Malicious:	false
Reputation:	unknown
Preview:	%rm% szninstall.exe....SET UNINSTALLKEY="HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall\SeznamInstall"..REG DELETE %UNINSTALLKEY% /f /va..REG DELETE %UNINSTALLKEY% /f ....

C:\Users\user\AppData\Roaming\Seznam.cz\uninstall\cz_seznam_software_sznsetup_1_2_7.install.bat

Download File

Process:	C:\Users\user\AppData\Roaming\Seznam.cz\sznsetup-lt.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	90
Entropy (8bit):	4.290353127049867
Encrypted:	false
SSDEEP:	3:C6dUPipVkisfj2Vkg1YFgbTipVkiyGk2Vkgxyy:C2SiQhfL5ibTiQbG0vy
MD5:	7BE26BBB7D13C3C854F880E2D7C77F47
SHA1:	E2C44ACBC3E683FE54E4C24CC52BD5C64714C8CC
SHA-256:	0C58CA6AFAB9755BD17C25D4AC3C602BC12C78B2064FD36E781D7BFD3D55F200
SHA-512:	8E9CFDC1679A49E5053373E4583BF77D9C9DC4C18BCC4A01AD025D6DE644EC0CBE72DADB4F3BFBF1E6873EE588B334B6A91310543C959766C48EC5095B0537D6
Malicious:	false
Reputation:	unknown
Preview:	if exist "%~1\sznsetup.exe" sznsetup.exe --rm "%~1\sznsetup.exe"..copy sznsetup.exe %1....

C:\Users\user\AppData\Roaming\Seznam.cz\uninstall\cz_seznam_software_sznsetup_1_2_7.uninstall.bat

Download File

Process:	C:\Users\user\AppData\Roaming\Seznam.cz\sznsetup-lt.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	21
Entropy (8bit):	3.7849418274376423
Encrypted:	false
SSDEEP:	3:ynW72Vk0:ynWD0
MD5:	0F2A9391C79202E47E212C8D2C4D6D43
SHA1:	79B8DF7D9AA3841AC189129472BB1A5020E9B4BF
SHA-256:	448E9C54E2079DCF42F4211C2B5A6415A0B9F7E80C351CCC32EE3236D6E5520A
SHA-512:	A649ACEA21DB5FE3DE14D4800939280204D1A69F6394EAC68C211302F3AC240F21DF10D4E4F0C4F07E6A2086E371E894360973A43DC0AF87A8A08DC594B03D9D
Malicious:	false
Reputation:	unknown
Preview:	%rm% sznsetup.exe....

C:\Users\user\AppData\Roaming\Seznam.cz\uninstall\szn_software_base_1_0_0.install.bat

Download File

Process:	C:\Users\user\AppData\Roaming\Seznam.cz\sznsetup.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	129
Entropy (8bit):	4.606037069317163
Encrypted:	false
SSDEEP:	3:dAxUZr1THsp+VKHoUDXTHVDCpDHfbTHHSuCivA0Koyn:duOZLUYKDLVDCpDHfbLHSxivAIyn
MD5:	3D00B26AC691FA886F7A9E557B882842
SHA1:	9EC82A89E5F1B5720A13A54D178D553838FA6C6B
SHA-256:	34EFD0E3AC0515FB1FD025CE99C84B9A99E67BF2FE9D4889E4FD76664F941F42
SHA-512:	EE01469A4F5E1055A9559C25DF291F7C6A19E05CEAF6FBECB96D8ED50C8BA6C1F2E7BF563E82D383A4B65F13511F79074E51D741562128370D64C78F6D4279EC
Malicious:	false
Reputation:	unknown
Preview:	cd /D %1..if NOT EXIST "bin" mkdir "bin"..if NOT EXIST "conf" mkdir "conf"..if NOT EXIST "data" mkdir "data"..exit %ERRORLEVEL%..

C:\Users\user\AppData\Roaming\Seznam.cz\uninstall\szn_software_base_1_0_0.uninstall.bat

Download File

Process:	C:\Users\user\AppData\Roaming\Seznam.cz\sznsetup.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	32
Entropy (8bit):	3.9056390622295662
Encrypted:	false
SSDEEP:	3:HI4+MY:v+MY
MD5:	82CED4B51204137AFEC924B9A0A34C92
SHA1:	3E3DD1C485E7A421141CDF4ACA14950E2F3BDE77
SHA-256:	EA3FCD8551241061C5C4685D32DDA1970DE9CD6D509A20BD956D77B28A98ED97
SHA-512:	1890CB5281E76B48EDE926F9B72F9C1F02F0E1A620038A9CC8423831EE666CDB05B20184FF348A6EB7C171B934D1D0461F28119E95F49A3E1358FA5A9442FAE1
Malicious:	false
Reputation:	unknown
Preview:	rm bin..rm conf..rm data..exit 0

C:\Users\user\AppData\Roaming\Seznam.cz\uninstall\szn_software_fflisticka_4_0_8.install.bat

Download File

Process:	C:\Users\user\AppData\Roaming\Seznam.cz\sznsetup.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	687
Entropy (8bit):	5.322812677736683
Encrypted:	false
SSDEEP:	12:/bkJswTmsibBLYWI2PidsooCTe9aYsgsH/D3iHjUI2ep:4JswYBL79a66TxYsgsziw9e
MD5:	6773193894447A6084F1908ABC14F403
SHA1:	250CFCE2C5796ABE5C0AE05E309652910A1FE9D1
SHA-256:	0074FDFBE74480A40956A6DC9ECBCA75E0C57232B3E742F16EC2A697B004FF52
SHA-512:	C63E438E0FAC0DA0B74160DFFC39E216965FCC0A1C142C9DC06872B15A7B6765EE91440924D0FC1D246512D305C0553FF7D21201DD36D03E46E99D2CCAC64AF5
Malicious:	false
Reputation:	unknown
Preview:	set FFLISTICKAEMAIL=seznam_doplnek_email-4.4.1-fx.xpi..set FFLISTICKASKO=sko-extension@firma.seznam.cz.xpi..set LOG="%~1\install_packages.log"....echo. >> %LOG%..echo ========== szn-software-fflisticka install %DATE% %TIME% >> %LOG%....if not exist "%~1\data\fflisticka" mkdir "%~1\data\fflisticka"..copy /y "%~dp0%FFLISTICKA%" "%~1\data\fflisticka\" >> %LOG% 2>&1....pushd "%~1"..call "%~1\bin\sznpp.exe" install_ff "%~1\data\fflisticka\%FFLISTICKAEMAIL%" 2>&1..call "%~1\bin\sznpp.exe" install_ff "%~1\data\fflisticka\%FFLISTICKASKO%" 2>&1..call "%~1\bin\sznpp.exe" install-firefox-nm 2>&1..popd....echo ========== szn-software-fflisticka install finished %DATE% %TIME% >> %LOG% 2>&1..

C:\Users\user\AppData\Roaming\Seznam.cz\uninstall\szn_software_fflisticka_4_0_8.uninstall.bat

Download File

Process:	C:\Users\user\AppData\Roaming\Seznam.cz\sznsetup.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	448
Entropy (8bit):	5.189247818819657
Encrypted:	false
SSDEEP:	12:zLYbWUI2e8/Me8goie8FeyD3DmbWUI2ep:zL/U9l0lgblFhDFU9e
MD5:	054B05BC8BC79BDA4D251E806DCA7000
SHA1:	952ECC5584D21FABE3FA4525B316AE7A2A563209
SHA-256:	A8E2256D67AF00B8660A08D45CDDE983ABC87EB200D9FA887EAA5AB6C0797467
SHA-512:	E4EB2AC8194FE48BDF3E464A3C69AC748CBDB964013F8ED9A64F94220D7AC8E91399B62017309AF3A4259DDBAEAEC3C339BCDFA208BE85DBF90C6E1BD10AF13A
Malicious:	false
Reputation:	unknown
Preview:	set LOG="%~1\install_packages.log"....echo. >> %LOG%..echo ========== szn-software-fflisticka uninstall %DATE% %TIME% >> %LOG% 2>&1.."%~1\bin\sznpp.exe" uninstall_ff >> %LOG% 2>&1.."%~1\bin\sznpp.exe" uninstall_ff EMAIL >> %LOG% 2>&1.."%~1\bin\sznpp.exe" uninstall_ff SKO >> %LOG% 2>&1.."%~1\bin\sznpp.exe" uninstall-firefox-nm 2>&1..rmdir /S /Q "%~1\data\fflisticka"..echo ========== szn-software-fflisticka uninstall %DATE% %TIME% >> %LOG% 2>&1..

C:\Users\user\AppData\Roaming\Seznam.cz\uninstall\szn_software_listicka_3_0_0.install.bat

Download File

Process:	C:\Users\user\AppData\Roaming\Seznam.cz\sznsetup.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1326
Entropy (8bit):	5.33309352066757
Encrypted:	false
SSDEEP:	24:89Du5wOxyKCOdQWSTZFIVzKvavfzBhdzB3dzBUzPzo9mIVh5zNzzQwoPmmQ9v:89A6WiIVTXzBhdzB3dzBUzPzoMIv5zNF
MD5:	D158ACC89C1DA1F81A2D5399A4263C0E
SHA1:	D71C2AB956F409C7B201C1AB6D5FAFE522853BE8
SHA-256:	51E661DB108A754083E1873FADF341A4C6EE4F26C5C54DF215703370C1E97911
SHA-512:	4C4933788C38292E6F12C486744D09D400D638E325693653440839D3508D56D47E0B56E6EE248B3E357DBAFE776D0D3962EB43B0D57F87C2B7F8AB71E09F33EC
Malicious:	false
Reputation:	unknown
Preview:	if NOT "%~1" == "ADMINPHASE" goto skipAdmin...... if not exist %3 mkdir %3.. copy "%~2\sznsetup.exe" %3.. copy "%~2\szninstall.exe" %3.. copy "%~2\sources.inf" %3.. copy "%~2\partner.conf" %3.. "%~2\sznsetup.exe" -T "%~3" -R "%~3\install".. if not exist "%~2\install" goto skipoffline.. if not exist "%~3\install" mkdir "%~3\install".. xcopy /S /Y /G /I "%~2\install\." "%~3\install".. :skipoffline.. REG ADD "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /f /v "seznam-listicka-distribuce" /d "\"%~3\szninstall.exe\" -s -d listicka 1 szn-software-listicka cz.seznam.software.autoupdate".. goto :EOF....:skipAdmin....SET DISTDIR=%ProgramFiles%\Seznam.cz\distribution..if not exist "%DISTDIR%" goto installAdmin..if not exist "%DISTDIR%\sznsetup.exe" goto installAdmin..if not exist "%DISTDIR%\szninstall.exe" goto installAdmin..if not exist "%DISTDIR%\sources.inf" goto installAdmin..if not exist "%DISTDIR%\partner.conf" goto installAdmin..REG QUERY "HKEY_LOCAL_MACHINE\SOFTWAR

C:\Users\user\AppData\Roaming\Seznam.cz\uninstall\szn_software_listicka_3_0_0.uninstall.bat

Download File

Process:	C:\Users\user\AppData\Roaming\Seznam.cz\sznsetup.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	610
Entropy (8bit):	5.416846342511522
Encrypted:	false
SSDEEP:	12:89i3ngGLMVj0KbLchWizHBNm/4R93zoFHcNLMVj0KUcfR3zuzMhIjxi:89i3nrIVzKTzfJxzo9mIVh1zuzMhIdi
MD5:	45DD3CC582D0DDC41CFB2C691DC67B7A
SHA1:	22F768620636A0C8152DADF46B8A0BBDCF5960E5
SHA-256:	A54AB646956E1C3C0E8B9369D58B77794E9737C87964478E596F65EC348639EA
SHA-512:	1413E700F0FBFD55AC0632BB11AE6FF1BD0CC23266739E31006551538FF563ED9B192C862C8B5F52C907DFE4A95FB82746C6694DBBC2F085A53BD54D4E0F5CE0
Malicious:	false
Reputation:	unknown
Preview:	if NOT "%~1" == "ADMINPHASE" goto skipAdmin....if exist %2 rm %2..if ERRORLEVEL 0 REG DELETE "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /f /v "seznam-listicka-distribuce" ....goto :EOF....:skipAdmin....if "%INSTALLMODE%"=="reinstall" goto skipUnreg......SET DISTDIR=%ProgramFiles%\Seznam.cz\distribution..if exist "%DISTDIR%" goto uninstallAdmin..REG QUERY "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "seznam-listicka-distribuce"..if ERRORLEVEL 0 goto uninstallAdmin..goto skipUnreg....:uninstallAdmin....%RUNADMIN% %~f0 ADMINPHASE "%DISTDIR%"....:skipUnreg..

C:\Windows\SysWOW64\GPhotos.scr

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	4587520
Entropy (8bit):	6.856228264363554
Encrypted:	false
SSDEEP:	98304:zZm/RKAjTcGEPdnHbLXt/34smaZmaRME9i5:zZmJEL9PJmaZma
MD5:	404C6C3C3A59784456DA52660F86C52B
SHA1:	B3917505F1374E002E480B0F9684945C57B73A98
SHA-256:	7479D71A52D7A638FE6CD6D0E494B8A6CACD8A5CB04A3EBE8D95DD30023901DC
SHA-512:	9B997A67B91B16D365C94F102E4D12FB313593CF4C444FBAA7F2D2D1E882659B03B8199DE6EFF9EA65C2A3FA9D646BB2ECEC4C952E99DA6F96FCEF3AF11CA256
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........n..=..=..=C .=..=.".=..=.".=a.=.".=..=..=..=...=..=...=..=..=..=...=..=.".=F.=.".=..=.".=..=.".=..=Rich..=........................PE..L......V.................. ...&...............!...@...........................G.....3.F..............................'......l'.h......@...........................p.!...............................................!..............................text..... ....... ................. ..`.rdata........!.......!.............@..@.data....K....'..p....'.............@....rsrc...@............).............@..@........................................................................................................................................................................................................................................................................................................................

Static File Info

General

File type:	Zip archive data, at least v2.0 to extract, compression method=deflate
Entropy (8bit):	7.9999932207284585
TrID:	ZIP compressed archive (8000/1) 99.91% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.09%
File name:	563299efce875400a8d9b44b96597c8e-sample (1).zip
File size:	25'085'622 bytes
MD5:	8625e1f9e8548342a4f9f1641a1ae4eb
SHA1:	3b602c272347d14cc91e07bf0dae686d768d7965
SHA256:	11fe7a13ad470ff3c39423f1ebb5b7abff8cf8a656d2ac97c0183d680d07687c
SHA512:	6c9c07b70e8c53ef10df4cf839ee47a28acdda815dc1a5f337967a4cbe2f9b26b8075ecbc4e5295f755cfddcc2459aef1b21f9f46a7b11a89e554347261fc520
SSDEEP:	393216:xUYMp10LmoSzKCcMhttMWlPXxLBzQdDMOf8GInTd7EoOUwY6zcqtXWZ6:mYMsmoexcMhTlBz0f8GOTd7EY6zccWk
TLSH:	1247337B987F859DB007FEB6D2002024BE59B50F671C43A3A163177D3CAEA7862D291D
File Content Preview:	PK.........PBY............ ...1a4e5ccd35a56d84281a143f831563bee.............2.n...yRx...<.7J....._>...."..X\|tE..%<.Bz4f....$.....7.."..P.Th:..<F.....SM7....D....iP...e4........e^./....D....xo.G.........N...y(.Lg.."OG...V.H.?..c.p.Y....ohEd/.G...;`.j......

File Icon


Icon Hash:	1c1c1e4e4ececedc

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-10-02T12:16:22.113361+0200	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.16	49707	77.75.76.70	80	TCP
2024-10-02T12:16:23.980004+0200	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.16	49707	77.75.76.70	80	TCP
2024-10-02T12:16:26.673684+0200	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.16	49707	77.75.76.70	80	TCP
2024-10-02T12:16:35.593694+0200	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.16	49765	77.75.76.70	80	TCP
2024-10-02T12:16:36.357307+0200	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.16	49775	172.217.23.110	443	TCP
2024-10-02T12:16:37.099132+0200	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.16	49765	77.75.76.70	80	TCP
2024-10-02T12:16:38.974886+0200	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.16	49765	77.75.76.70	80	TCP
2024-10-02T12:16:41.372917+0200	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.16	49765	77.75.76.70	80	TCP
2024-10-02T12:16:43.050976+0200	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.16	49765	77.75.76.70	80	TCP
2024-10-02T12:16:46.292462+0200	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.16	49765	77.75.76.70	80	TCP
2024-10-02T12:16:48.599342+0200	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.16	49765	77.75.76.70	80	TCP
2024-10-02T12:16:49.917865+0200	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.16	49765	77.75.76.70	80	TCP
2024-10-02T12:17:04.630823+0200	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.16	49960	77.75.78.30	443	TCP
2024-10-02T12:17:08.501285+0200	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.16	49966	77.75.78.30	443	TCP
2024-10-02T12:17:10.907798+0200	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.16	49969	77.75.78.30	443	TCP
2024-10-02T12:17:12.823071+0200	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.16	49972	77.75.78.30	443	TCP
2024-10-02T12:17:21.078549+0200	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.16	49981	77.75.78.30	443	TCP
2024-10-02T12:17:27.273153+0200	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.16	49996	77.75.78.30	443	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 2, 2024 12:15:26.210700989 CEST	49673	443	192.168.2.16	204.79.197.203
Oct 2, 2024 12:15:26.513369083 CEST	49673	443	192.168.2.16	204.79.197.203
Oct 2, 2024 12:15:27.117325068 CEST	49673	443	192.168.2.16	204.79.197.203
Oct 2, 2024 12:15:28.326339006 CEST	49673	443	192.168.2.16	204.79.197.203
Oct 2, 2024 12:15:29.146348000 CEST	49689	80	192.168.2.16	192.229.211.108
Oct 2, 2024 12:15:30.735529900 CEST	49673	443	192.168.2.16	204.79.197.203
Oct 2, 2024 12:15:32.565810919 CEST	49702	443	192.168.2.16	184.28.90.27
Oct 2, 2024 12:15:32.565860987 CEST	443	49702	184.28.90.27	192.168.2.16
Oct 2, 2024 12:15:32.565944910 CEST	49702	443	192.168.2.16	184.28.90.27
Oct 2, 2024 12:15:32.567750931 CEST	49702	443	192.168.2.16	184.28.90.27
Oct 2, 2024 12:15:32.567769051 CEST	443	49702	184.28.90.27	192.168.2.16
Oct 2, 2024 12:15:33.231296062 CEST	443	49702	184.28.90.27	192.168.2.16
Oct 2, 2024 12:15:33.231404066 CEST	49702	443	192.168.2.16	184.28.90.27
Oct 2, 2024 12:15:33.235661030 CEST	49702	443	192.168.2.16	184.28.90.27
Oct 2, 2024 12:15:33.235707998 CEST	443	49702	184.28.90.27	192.168.2.16
Oct 2, 2024 12:15:33.235924006 CEST	443	49702	184.28.90.27	192.168.2.16
Oct 2, 2024 12:15:33.286524057 CEST	49702	443	192.168.2.16	184.28.90.27
Oct 2, 2024 12:15:33.327406883 CEST	443	49702	184.28.90.27	192.168.2.16
Oct 2, 2024 12:15:33.504484892 CEST	443	49702	184.28.90.27	192.168.2.16
Oct 2, 2024 12:15:33.504626989 CEST	443	49702	184.28.90.27	192.168.2.16
Oct 2, 2024 12:15:33.504715919 CEST	49702	443	192.168.2.16	184.28.90.27
Oct 2, 2024 12:15:33.504715919 CEST	49702	443	192.168.2.16	184.28.90.27
Oct 2, 2024 12:15:33.504717112 CEST	49702	443	192.168.2.16	184.28.90.27
Oct 2, 2024 12:15:33.535079002 CEST	49704	443	192.168.2.16	184.28.90.27
Oct 2, 2024 12:15:33.535171032 CEST	443	49704	184.28.90.27	192.168.2.16
Oct 2, 2024 12:15:33.535279989 CEST	49704	443	192.168.2.16	184.28.90.27
Oct 2, 2024 12:15:33.535502911 CEST	49704	443	192.168.2.16	184.28.90.27
Oct 2, 2024 12:15:33.535542965 CEST	443	49704	184.28.90.27	192.168.2.16
Oct 2, 2024 12:15:33.817279100 CEST	49702	443	192.168.2.16	184.28.90.27
Oct 2, 2024 12:15:33.817328930 CEST	443	49702	184.28.90.27	192.168.2.16
Oct 2, 2024 12:15:34.174818039 CEST	443	49704	184.28.90.27	192.168.2.16
Oct 2, 2024 12:15:34.174967051 CEST	49704	443	192.168.2.16	184.28.90.27
Oct 2, 2024 12:15:34.176132917 CEST	49704	443	192.168.2.16	184.28.90.27
Oct 2, 2024 12:15:34.176165104 CEST	443	49704	184.28.90.27	192.168.2.16
Oct 2, 2024 12:15:34.176383018 CEST	443	49704	184.28.90.27	192.168.2.16
Oct 2, 2024 12:15:34.177407980 CEST	49704	443	192.168.2.16	184.28.90.27
Oct 2, 2024 12:15:34.219400883 CEST	443	49704	184.28.90.27	192.168.2.16
Oct 2, 2024 12:15:34.373735905 CEST	49678	443	192.168.2.16	20.189.173.10
Oct 2, 2024 12:15:34.455807924 CEST	443	49704	184.28.90.27	192.168.2.16
Oct 2, 2024 12:15:34.455939054 CEST	443	49704	184.28.90.27	192.168.2.16
Oct 2, 2024 12:15:34.456279039 CEST	49704	443	192.168.2.16	184.28.90.27
Oct 2, 2024 12:15:34.457041979 CEST	49704	443	192.168.2.16	184.28.90.27
Oct 2, 2024 12:15:34.457062006 CEST	443	49704	184.28.90.27	192.168.2.16
Oct 2, 2024 12:15:34.457072020 CEST	49704	443	192.168.2.16	184.28.90.27
Oct 2, 2024 12:15:34.457077980 CEST	443	49704	184.28.90.27	192.168.2.16
Oct 2, 2024 12:15:34.675281048 CEST	49678	443	192.168.2.16	20.189.173.10
Oct 2, 2024 12:15:35.279311895 CEST	49678	443	192.168.2.16	20.189.173.10
Oct 2, 2024 12:15:35.546267986 CEST	49673	443	192.168.2.16	204.79.197.203
Oct 2, 2024 12:15:36.487274885 CEST	49678	443	192.168.2.16	20.189.173.10
Oct 2, 2024 12:15:38.841670036 CEST	49680	80	192.168.2.16	192.229.211.108
Oct 2, 2024 12:15:38.889318943 CEST	49678	443	192.168.2.16	20.189.173.10
Oct 2, 2024 12:15:39.145333052 CEST	49680	80	192.168.2.16	192.229.211.108
Oct 2, 2024 12:15:39.751306057 CEST	49680	80	192.168.2.16	192.229.211.108
Oct 2, 2024 12:15:40.965408087 CEST	49680	80	192.168.2.16	192.229.211.108
Oct 2, 2024 12:15:43.368398905 CEST	49680	80	192.168.2.16	192.229.211.108
Oct 2, 2024 12:15:43.703403950 CEST	49678	443	192.168.2.16	20.189.173.10
Oct 2, 2024 12:15:45.155549049 CEST	49673	443	192.168.2.16	204.79.197.203
Oct 2, 2024 12:15:48.183459044 CEST	49680	80	192.168.2.16	192.229.211.108
Oct 2, 2024 12:15:53.317369938 CEST	49678	443	192.168.2.16	20.189.173.10
Oct 2, 2024 12:15:57.788395882 CEST	49680	80	192.168.2.16	192.229.211.108
Oct 2, 2024 12:16:02.328838110 CEST	49705	80	192.168.2.16	142.250.185.228
Oct 2, 2024 12:16:02.333921909 CEST	80	49705	142.250.185.228	192.168.2.16
Oct 2, 2024 12:16:02.334007025 CEST	49705	80	192.168.2.16	142.250.185.228
Oct 2, 2024 12:16:02.334244967 CEST	49705	80	192.168.2.16	142.250.185.228
Oct 2, 2024 12:16:02.339098930 CEST	80	49705	142.250.185.228	192.168.2.16
Oct 2, 2024 12:16:03.048310041 CEST	80	49705	142.250.185.228	192.168.2.16
Oct 2, 2024 12:16:03.048327923 CEST	80	49705	142.250.185.228	192.168.2.16
Oct 2, 2024 12:16:03.048403978 CEST	49705	80	192.168.2.16	142.250.185.228
Oct 2, 2024 12:16:03.048453093 CEST	49705	80	192.168.2.16	142.250.185.228
Oct 2, 2024 12:16:03.049995899 CEST	49705	80	192.168.2.16	142.250.185.228
Oct 2, 2024 12:16:03.050030947 CEST	49705	80	192.168.2.16	142.250.185.228
Oct 2, 2024 12:16:21.453318119 CEST	49707	80	192.168.2.16	77.75.76.70
Oct 2, 2024 12:16:21.458261967 CEST	80	49707	77.75.76.70	192.168.2.16
Oct 2, 2024 12:16:21.458333969 CEST	49707	80	192.168.2.16	77.75.76.70
Oct 2, 2024 12:16:21.458539009 CEST	49707	80	192.168.2.16	77.75.76.70
Oct 2, 2024 12:16:21.463378906 CEST	80	49707	77.75.76.70	192.168.2.16
Oct 2, 2024 12:16:22.113296986 CEST	80	49707	77.75.76.70	192.168.2.16
Oct 2, 2024 12:16:22.113360882 CEST	49707	80	192.168.2.16	77.75.76.70
Oct 2, 2024 12:16:22.122649908 CEST	49708	443	192.168.2.16	77.75.76.70
Oct 2, 2024 12:16:22.122678995 CEST	443	49708	77.75.76.70	192.168.2.16
Oct 2, 2024 12:16:22.122742891 CEST	49708	443	192.168.2.16	77.75.76.70
Oct 2, 2024 12:16:22.137401104 CEST	49708	443	192.168.2.16	77.75.76.70
Oct 2, 2024 12:16:22.137413025 CEST	443	49708	77.75.76.70	192.168.2.16
Oct 2, 2024 12:16:22.825047016 CEST	443	49708	77.75.76.70	192.168.2.16
Oct 2, 2024 12:16:22.825126886 CEST	49708	443	192.168.2.16	77.75.76.70
Oct 2, 2024 12:16:22.870379925 CEST	49708	443	192.168.2.16	77.75.76.70
Oct 2, 2024 12:16:22.870404005 CEST	443	49708	77.75.76.70	192.168.2.16
Oct 2, 2024 12:16:22.870767117 CEST	443	49708	77.75.76.70	192.168.2.16
Oct 2, 2024 12:16:22.870831013 CEST	49708	443	192.168.2.16	77.75.76.70
Oct 2, 2024 12:16:22.873316050 CEST	49708	443	192.168.2.16	77.75.76.70
Oct 2, 2024 12:16:22.919401884 CEST	443	49708	77.75.76.70	192.168.2.16
Oct 2, 2024 12:16:23.451534986 CEST	443	49708	77.75.76.70	192.168.2.16
Oct 2, 2024 12:16:23.451560974 CEST	443	49708	77.75.76.70	192.168.2.16
Oct 2, 2024 12:16:23.451601982 CEST	443	49708	77.75.76.70	192.168.2.16
Oct 2, 2024 12:16:23.451617956 CEST	49708	443	192.168.2.16	77.75.76.70
Oct 2, 2024 12:16:23.451617956 CEST	49708	443	192.168.2.16	77.75.76.70
Oct 2, 2024 12:16:23.451652050 CEST	443	49708	77.75.76.70	192.168.2.16
Oct 2, 2024 12:16:23.451666117 CEST	49708	443	192.168.2.16	77.75.76.70
Oct 2, 2024 12:16:23.451697111 CEST	49708	443	192.168.2.16	77.75.76.70
Oct 2, 2024 12:16:23.451703072 CEST	443	49708	77.75.76.70	192.168.2.16
Oct 2, 2024 12:16:23.451742887 CEST	443	49708	77.75.76.70	192.168.2.16
Oct 2, 2024 12:16:23.451750040 CEST	49708	443	192.168.2.16	77.75.76.70
Oct 2, 2024 12:16:23.451788902 CEST	49708	443	192.168.2.16	77.75.76.70
Oct 2, 2024 12:16:23.455677986 CEST	49708	443	192.168.2.16	77.75.76.70
Oct 2, 2024 12:16:23.455697060 CEST	443	49708	77.75.76.70	192.168.2.16
Oct 2, 2024 12:16:23.519866943 CEST	49707	80	192.168.2.16	77.75.76.70
Oct 2, 2024 12:16:23.760160923 CEST	80	49707	77.75.76.70	192.168.2.16
Oct 2, 2024 12:16:23.979949951 CEST	80	49707	77.75.76.70	192.168.2.16
Oct 2, 2024 12:16:23.980004072 CEST	49707	80	192.168.2.16	77.75.76.70
Oct 2, 2024 12:16:23.984478951 CEST	49709	443	192.168.2.16	77.75.76.70
Oct 2, 2024 12:16:23.984519005 CEST	443	49709	77.75.76.70	192.168.2.16
Oct 2, 2024 12:16:23.984584093 CEST	49709	443	192.168.2.16	77.75.76.70
Oct 2, 2024 12:16:23.985007048 CEST	49709	443	192.168.2.16	77.75.76.70
Oct 2, 2024 12:16:23.985022068 CEST	443	49709	77.75.76.70	192.168.2.16
Oct 2, 2024 12:16:24.775125027 CEST	443	49709	77.75.76.70	192.168.2.16
Oct 2, 2024 12:16:24.775232077 CEST	49709	443	192.168.2.16	77.75.76.70
Oct 2, 2024 12:16:24.775652885 CEST	49709	443	192.168.2.16	77.75.76.70
Oct 2, 2024 12:16:24.775659084 CEST	443	49709	77.75.76.70	192.168.2.16
Oct 2, 2024 12:16:24.775815010 CEST	49709	443	192.168.2.16	77.75.76.70
Oct 2, 2024 12:16:24.775820017 CEST	443	49709	77.75.76.70	192.168.2.16
Oct 2, 2024 12:16:25.282018900 CEST	443	49709	77.75.76.70	192.168.2.16
Oct 2, 2024 12:16:25.282080889 CEST	443	49709	77.75.76.70	192.168.2.16
Oct 2, 2024 12:16:25.282121897 CEST	49709	443	192.168.2.16	77.75.76.70
Oct 2, 2024 12:16:25.282140017 CEST	443	49709	77.75.76.70	192.168.2.16
Oct 2, 2024 12:16:25.282187939 CEST	49709	443	192.168.2.16	77.75.76.70
Oct 2, 2024 12:16:25.282227039 CEST	49709	443	192.168.2.16	77.75.76.70
Oct 2, 2024 12:16:25.293220043 CEST	443	49709	77.75.76.70	192.168.2.16
Oct 2, 2024 12:16:25.293263912 CEST	443	49709	77.75.76.70	192.168.2.16
Oct 2, 2024 12:16:25.293349981 CEST	49709	443	192.168.2.16	77.75.76.70
Oct 2, 2024 12:16:25.293360949 CEST	443	49709	77.75.76.70	192.168.2.16
Oct 2, 2024 12:16:25.293407917 CEST	49709	443	192.168.2.16	77.75.76.70
Oct 2, 2024 12:16:25.403511047 CEST	443	49709	77.75.76.70	192.168.2.16
Oct 2, 2024 12:16:25.403563976 CEST	443	49709	77.75.76.70	192.168.2.16
Oct 2, 2024 12:16:25.403600931 CEST	49709	443	192.168.2.16	77.75.76.70
Oct 2, 2024 12:16:25.403616905 CEST	443	49709	77.75.76.70	192.168.2.16
Oct 2, 2024 12:16:25.403630972 CEST	49709	443	192.168.2.16	77.75.76.70
Oct 2, 2024 12:16:25.403650045 CEST	49709	443	192.168.2.16	77.75.76.70
Oct 2, 2024 12:16:25.413168907 CEST	443	49709	77.75.76.70	192.168.2.16
Oct 2, 2024 12:16:25.413213015 CEST	443	49709	77.75.76.70	192.168.2.16
Oct 2, 2024 12:16:25.413247108 CEST	49709	443	192.168.2.16	77.75.76.70
Oct 2, 2024 12:16:25.413259983 CEST	443	49709	77.75.76.70	192.168.2.16
Oct 2, 2024 12:16:25.413285017 CEST	49709	443	192.168.2.16	77.75.76.70
Oct 2, 2024 12:16:25.413302898 CEST	49709	443	192.168.2.16	77.75.76.70
Oct 2, 2024 12:16:25.414577961 CEST	443	49709	77.75.76.70	192.168.2.16
Oct 2, 2024 12:16:25.414644003 CEST	49709	443	192.168.2.16	77.75.76.70
Oct 2, 2024 12:16:25.415776014 CEST	443	49709	77.75.76.70	192.168.2.16
Oct 2, 2024 12:16:25.415843010 CEST	49709	443	192.168.2.16	77.75.76.70
Oct 2, 2024 12:16:25.421967030 CEST	443	49709	77.75.76.70	192.168.2.16
Oct 2, 2024 12:16:25.422013044 CEST	443	49709	77.75.76.70	192.168.2.16
Oct 2, 2024 12:16:25.422051907 CEST	49709	443	192.168.2.16	77.75.76.70
Oct 2, 2024 12:16:25.422065973 CEST	443	49709	77.75.76.70	192.168.2.16
Oct 2, 2024 12:16:25.422082901 CEST	49709	443	192.168.2.16	77.75.76.70
Oct 2, 2024 12:16:25.422106028 CEST	49709	443	192.168.2.16	77.75.76.70
Oct 2, 2024 12:16:25.524274111 CEST	443	49709	77.75.76.70	192.168.2.16
Oct 2, 2024 12:16:25.524339914 CEST	443	49709	77.75.76.70	192.168.2.16
Oct 2, 2024 12:16:25.524370909 CEST	49709	443	192.168.2.16	77.75.76.70
Oct 2, 2024 12:16:25.524391890 CEST	443	49709	77.75.76.70	192.168.2.16
Oct 2, 2024 12:16:25.524414062 CEST	49709	443	192.168.2.16	77.75.76.70
Oct 2, 2024 12:16:25.524429083 CEST	49709	443	192.168.2.16	77.75.76.70
Oct 2, 2024 12:16:25.524490118 CEST	443	49709	77.75.76.70	192.168.2.16
Oct 2, 2024 12:16:25.524553061 CEST	49709	443	192.168.2.16	77.75.76.70
Oct 2, 2024 12:16:25.526535034 CEST	443	49709	77.75.76.70	192.168.2.16
Oct 2, 2024 12:16:25.526602030 CEST	49709	443	192.168.2.16	77.75.76.70
Oct 2, 2024 12:16:25.531923056 CEST	443	49709	77.75.76.70	192.168.2.16
Oct 2, 2024 12:16:25.531972885 CEST	443	49709	77.75.76.70	192.168.2.16
Oct 2, 2024 12:16:25.532001972 CEST	49709	443	192.168.2.16	77.75.76.70
Oct 2, 2024 12:16:25.532018900 CEST	443	49709	77.75.76.70	192.168.2.16
Oct 2, 2024 12:16:25.532031059 CEST	49709	443	192.168.2.16	77.75.76.70
Oct 2, 2024 12:16:25.532053947 CEST	49709	443	192.168.2.16	77.75.76.70
Oct 2, 2024 12:16:25.536734104 CEST	443	49709	77.75.76.70	192.168.2.16
Oct 2, 2024 12:16:25.536780119 CEST	443	49709	77.75.76.70	192.168.2.16
Oct 2, 2024 12:16:25.536814928 CEST	49709	443	192.168.2.16	77.75.76.70
Oct 2, 2024 12:16:25.536830902 CEST	443	49709	77.75.76.70	192.168.2.16
Oct 2, 2024 12:16:25.536854029 CEST	49709	443	192.168.2.16	77.75.76.70
Oct 2, 2024 12:16:25.536870956 CEST	49709	443	192.168.2.16	77.75.76.70
Oct 2, 2024 12:16:25.541352987 CEST	443	49709	77.75.76.70	192.168.2.16
Oct 2, 2024 12:16:25.541399956 CEST	443	49709	77.75.76.70	192.168.2.16
Oct 2, 2024 12:16:25.541428089 CEST	49709	443	192.168.2.16	77.75.76.70
Oct 2, 2024 12:16:25.541443110 CEST	443	49709	77.75.76.70	192.168.2.16
Oct 2, 2024 12:16:25.541457891 CEST	49709	443	192.168.2.16	77.75.76.70
Oct 2, 2024 12:16:25.541491985 CEST	49709	443	192.168.2.16	77.75.76.70
Oct 2, 2024 12:16:25.545455933 CEST	443	49709	77.75.76.70	192.168.2.16
Oct 2, 2024 12:16:25.545512915 CEST	443	49709	77.75.76.70	192.168.2.16
Oct 2, 2024 12:16:25.545526028 CEST	49709	443	192.168.2.16	77.75.76.70
Oct 2, 2024 12:16:25.545541048 CEST	443	49709	77.75.76.70	192.168.2.16
Oct 2, 2024 12:16:25.545573950 CEST	49709	443	192.168.2.16	77.75.76.70
Oct 2, 2024 12:16:25.545598030 CEST	49709	443	192.168.2.16	77.75.76.70
Oct 2, 2024 12:16:25.615680933 CEST	443	49709	77.75.76.70	192.168.2.16
Oct 2, 2024 12:16:25.615731955 CEST	443	49709	77.75.76.70	192.168.2.16
Oct 2, 2024 12:16:25.615768909 CEST	49709	443	192.168.2.16	77.75.76.70
Oct 2, 2024 12:16:25.615786076 CEST	443	49709	77.75.76.70	192.168.2.16
Oct 2, 2024 12:16:25.615813971 CEST	49709	443	192.168.2.16	77.75.76.70
Oct 2, 2024 12:16:25.615833998 CEST	49709	443	192.168.2.16	77.75.76.70
Oct 2, 2024 12:16:25.644495964 CEST	443	49709	77.75.76.70	192.168.2.16
Oct 2, 2024 12:16:25.644524097 CEST	443	49709	77.75.76.70	192.168.2.16
Oct 2, 2024 12:16:25.644572020 CEST	49709	443	192.168.2.16	77.75.76.70
Oct 2, 2024 12:16:25.644589901 CEST	443	49709	77.75.76.70	192.168.2.16
Oct 2, 2024 12:16:25.644603014 CEST	49709	443	192.168.2.16	77.75.76.70
Oct 2, 2024 12:16:25.644632101 CEST	49709	443	192.168.2.16	77.75.76.70
Oct 2, 2024 12:16:25.648401976 CEST	443	49709	77.75.76.70	192.168.2.16
Oct 2, 2024 12:16:25.648431063 CEST	443	49709	77.75.76.70	192.168.2.16
Oct 2, 2024 12:16:25.648509026 CEST	49709	443	192.168.2.16	77.75.76.70
Oct 2, 2024 12:16:25.648524046 CEST	443	49709	77.75.76.70	192.168.2.16
Oct 2, 2024 12:16:25.648561954 CEST	49709	443	192.168.2.16	77.75.76.70
Oct 2, 2024 12:16:25.648581982 CEST	49709	443	192.168.2.16	77.75.76.70
Oct 2, 2024 12:16:25.651556969 CEST	443	49709	77.75.76.70	192.168.2.16
Oct 2, 2024 12:16:25.651585102 CEST	443	49709	77.75.76.70	192.168.2.16
Oct 2, 2024 12:16:25.651663065 CEST	49709	443	192.168.2.16	77.75.76.70
Oct 2, 2024 12:16:25.651663065 CEST	49709	443	192.168.2.16	77.75.76.70
Oct 2, 2024 12:16:25.651676893 CEST	443	49709	77.75.76.70	192.168.2.16
Oct 2, 2024 12:16:25.651716948 CEST	49709	443	192.168.2.16	77.75.76.70
Oct 2, 2024 12:16:25.654710054 CEST	443	49709	77.75.76.70	192.168.2.16
Oct 2, 2024 12:16:25.654747009 CEST	443	49709	77.75.76.70	192.168.2.16
Oct 2, 2024 12:16:25.654779911 CEST	49709	443	192.168.2.16	77.75.76.70
Oct 2, 2024 12:16:25.654795885 CEST	443	49709	77.75.76.70	192.168.2.16
Oct 2, 2024 12:16:25.654809952 CEST	49709	443	192.168.2.16	77.75.76.70
Oct 2, 2024 12:16:25.654825926 CEST	49709	443	192.168.2.16	77.75.76.70
Oct 2, 2024 12:16:25.657378912 CEST	443	49709	77.75.76.70	192.168.2.16
Oct 2, 2024 12:16:25.657409906 CEST	443	49709	77.75.76.70	192.168.2.16
Oct 2, 2024 12:16:25.657452106 CEST	49709	443	192.168.2.16	77.75.76.70
Oct 2, 2024 12:16:25.657465935 CEST	443	49709	77.75.76.70	192.168.2.16
Oct 2, 2024 12:16:25.657493114 CEST	49709	443	192.168.2.16	77.75.76.70
Oct 2, 2024 12:16:25.657507896 CEST	49709	443	192.168.2.16	77.75.76.70
Oct 2, 2024 12:16:25.660269976 CEST	443	49709	77.75.76.70	192.168.2.16
Oct 2, 2024 12:16:25.660307884 CEST	443	49709	77.75.76.70	192.168.2.16
Oct 2, 2024 12:16:25.660341024 CEST	49709	443	192.168.2.16	77.75.76.70
Oct 2, 2024 12:16:25.660352945 CEST	443	49709	77.75.76.70	192.168.2.16
Oct 2, 2024 12:16:25.660391092 CEST	49709	443	192.168.2.16	77.75.76.70
Oct 2, 2024 12:16:25.660406113 CEST	49709	443	192.168.2.16	77.75.76.70
Oct 2, 2024 12:16:25.662844896 CEST	443	49709	77.75.76.70	192.168.2.16
Oct 2, 2024 12:16:25.662874937 CEST	443	49709	77.75.76.70	192.168.2.16
Oct 2, 2024 12:16:25.662911892 CEST	49709	443	192.168.2.16	77.75.76.70
Oct 2, 2024 12:16:25.662921906 CEST	443	49709	77.75.76.70	192.168.2.16
Oct 2, 2024 12:16:25.662951946 CEST	49709	443	192.168.2.16	77.75.76.70
Oct 2, 2024 12:16:25.662966013 CEST	49709	443	192.168.2.16	77.75.76.70
Oct 2, 2024 12:16:25.708039999 CEST	443	49709	77.75.76.70	192.168.2.16
Oct 2, 2024 12:16:25.708091974 CEST	443	49709	77.75.76.70	192.168.2.16
Oct 2, 2024 12:16:25.708136082 CEST	49709	443	192.168.2.16	77.75.76.70
Oct 2, 2024 12:16:25.708157063 CEST	443	49709	77.75.76.70	192.168.2.16
Oct 2, 2024 12:16:25.708168983 CEST	49709	443	192.168.2.16	77.75.76.70
Oct 2, 2024 12:16:25.708201885 CEST	49709	443	192.168.2.16	77.75.76.70
Oct 2, 2024 12:16:25.735691071 CEST	443	49709	77.75.76.70	192.168.2.16
Oct 2, 2024 12:16:25.735711098 CEST	443	49709	77.75.76.70	192.168.2.16
Oct 2, 2024 12:16:25.735742092 CEST	443	49709	77.75.76.70	192.168.2.16
Oct 2, 2024 12:16:25.735780954 CEST	49709	443	192.168.2.16	77.75.76.70
Oct 2, 2024 12:16:25.735809088 CEST	443	49709	77.75.76.70	192.168.2.16
Oct 2, 2024 12:16:25.735821962 CEST	49709	443	192.168.2.16	77.75.76.70
Oct 2, 2024 12:16:25.735852957 CEST	49709	443	192.168.2.16	77.75.76.70
Oct 2, 2024 12:16:25.738195896 CEST	443	49709	77.75.76.70	192.168.2.16
Oct 2, 2024 12:16:25.738219023 CEST	443	49709	77.75.76.70	192.168.2.16
Oct 2, 2024 12:16:25.738300085 CEST	49709	443	192.168.2.16	77.75.76.70
Oct 2, 2024 12:16:25.738312006 CEST	443	49709	77.75.76.70	192.168.2.16
Oct 2, 2024 12:16:25.738353968 CEST	49709	443	192.168.2.16	77.75.76.70
Oct 2, 2024 12:16:25.741724968 CEST	443	49709	77.75.76.70	192.168.2.16
Oct 2, 2024 12:16:25.741748095 CEST	443	49709	77.75.76.70	192.168.2.16
Oct 2, 2024 12:16:25.741810083 CEST	49709	443	192.168.2.16	77.75.76.70
Oct 2, 2024 12:16:25.741822958 CEST	443	49709	77.75.76.70	192.168.2.16
Oct 2, 2024 12:16:25.741864920 CEST	49709	443	192.168.2.16	77.75.76.70
Oct 2, 2024 12:16:25.743520021 CEST	443	49709	77.75.76.70	192.168.2.16
Oct 2, 2024 12:16:25.743541002 CEST	443	49709	77.75.76.70	192.168.2.16
Oct 2, 2024 12:16:25.743583918 CEST	49709	443	192.168.2.16	77.75.76.70
Oct 2, 2024 12:16:25.743594885 CEST	443	49709	77.75.76.70	192.168.2.16
Oct 2, 2024 12:16:25.743617058 CEST	49709	443	192.168.2.16	77.75.76.70
Oct 2, 2024 12:16:25.743637085 CEST	49709	443	192.168.2.16	77.75.76.70
Oct 2, 2024 12:16:25.772136927 CEST	443	49709	77.75.76.70	192.168.2.16
Oct 2, 2024 12:16:25.772159100 CEST	443	49709	77.75.76.70	192.168.2.16
Oct 2, 2024 12:16:25.772202969 CEST	49709	443	192.168.2.16	77.75.76.70
Oct 2, 2024 12:16:25.772218943 CEST	443	49709	77.75.76.70	192.168.2.16
Oct 2, 2024 12:16:25.772233009 CEST	49709	443	192.168.2.16	77.75.76.70
Oct 2, 2024 12:16:25.772252083 CEST	49709	443	192.168.2.16	77.75.76.70
Oct 2, 2024 12:16:25.774615049 CEST	443	49709	77.75.76.70	192.168.2.16
Oct 2, 2024 12:16:25.774636030 CEST	443	49709	77.75.76.70	192.168.2.16
Oct 2, 2024 12:16:25.774678946 CEST	49709	443	192.168.2.16	77.75.76.70
Oct 2, 2024 12:16:25.774692059 CEST	443	49709	77.75.76.70	192.168.2.16
Oct 2, 2024 12:16:25.774718046 CEST	49709	443	192.168.2.16	77.75.76.70
Oct 2, 2024 12:16:25.774732113 CEST	49709	443	192.168.2.16	77.75.76.70
Oct 2, 2024 12:16:25.777086973 CEST	443	49709	77.75.76.70	192.168.2.16
Oct 2, 2024 12:16:25.777107000 CEST	443	49709	77.75.76.70	192.168.2.16
Oct 2, 2024 12:16:25.777143002 CEST	49709	443	192.168.2.16	77.75.76.70
Oct 2, 2024 12:16:25.777154922 CEST	443	49709	77.75.76.70	192.168.2.16
Oct 2, 2024 12:16:25.777174950 CEST	49709	443	192.168.2.16	77.75.76.70
Oct 2, 2024 12:16:25.777188063 CEST	49709	443	192.168.2.16	77.75.76.70
Oct 2, 2024 12:16:25.800034046 CEST	443	49709	77.75.76.70	192.168.2.16
Oct 2, 2024 12:16:25.800055981 CEST	443	49709	77.75.76.70	192.168.2.16
Oct 2, 2024 12:16:25.800118923 CEST	49709	443	192.168.2.16	77.75.76.70
Oct 2, 2024 12:16:25.800134897 CEST	443	49709	77.75.76.70	192.168.2.16
Oct 2, 2024 12:16:25.800164938 CEST	49709	443	192.168.2.16	77.75.76.70
Oct 2, 2024 12:16:25.800179005 CEST	49709	443	192.168.2.16	77.75.76.70
Oct 2, 2024 12:16:25.828413963 CEST	443	49709	77.75.76.70	192.168.2.16
Oct 2, 2024 12:16:25.828450918 CEST	443	49709	77.75.76.70	192.168.2.16
Oct 2, 2024 12:16:25.828541040 CEST	49709	443	192.168.2.16	77.75.76.70
Oct 2, 2024 12:16:25.828557014 CEST	443	49709	77.75.76.70	192.168.2.16
Oct 2, 2024 12:16:25.828597069 CEST	49709	443	192.168.2.16	77.75.76.70
Oct 2, 2024 12:16:25.830723047 CEST	443	49709	77.75.76.70	192.168.2.16
Oct 2, 2024 12:16:25.830751896 CEST	443	49709	77.75.76.70	192.168.2.16
Oct 2, 2024 12:16:25.830802917 CEST	49709	443	192.168.2.16	77.75.76.70
Oct 2, 2024 12:16:25.830813885 CEST	443	49709	77.75.76.70	192.168.2.16
Oct 2, 2024 12:16:25.830837011 CEST	49709	443	192.168.2.16	77.75.76.70
Oct 2, 2024 12:16:25.830852032 CEST	49709	443	192.168.2.16	77.75.76.70
Oct 2, 2024 12:16:25.833188057 CEST	443	49709	77.75.76.70	192.168.2.16
Oct 2, 2024 12:16:25.833219051 CEST	443	49709	77.75.76.70	192.168.2.16
Oct 2, 2024 12:16:25.833266973 CEST	49709	443	192.168.2.16	77.75.76.70
Oct 2, 2024 12:16:25.833276987 CEST	443	49709	77.75.76.70	192.168.2.16
Oct 2, 2024 12:16:25.833287954 CEST	49709	443	192.168.2.16	77.75.76.70
Oct 2, 2024 12:16:25.833329916 CEST	49709	443	192.168.2.16	77.75.76.70
Oct 2, 2024 12:16:25.834873915 CEST	443	49709	77.75.76.70	192.168.2.16
Oct 2, 2024 12:16:25.834894896 CEST	443	49709	77.75.76.70	192.168.2.16
Oct 2, 2024 12:16:25.834939957 CEST	49709	443	192.168.2.16	77.75.76.70
Oct 2, 2024 12:16:25.834949970 CEST	443	49709	77.75.76.70	192.168.2.16
Oct 2, 2024 12:16:25.834989071 CEST	49709	443	192.168.2.16	77.75.76.70
Oct 2, 2024 12:16:25.835016012 CEST	49709	443	192.168.2.16	77.75.76.70
Oct 2, 2024 12:16:25.855222940 CEST	443	49709	77.75.76.70	192.168.2.16
Oct 2, 2024 12:16:25.855253935 CEST	443	49709	77.75.76.70	192.168.2.16
Oct 2, 2024 12:16:25.855315924 CEST	49709	443	192.168.2.16	77.75.76.70
Oct 2, 2024 12:16:25.855331898 CEST	443	49709	77.75.76.70	192.168.2.16
Oct 2, 2024 12:16:25.855355978 CEST	49709	443	192.168.2.16	77.75.76.70
Oct 2, 2024 12:16:25.855374098 CEST	49709	443	192.168.2.16	77.75.76.70
Oct 2, 2024 12:16:25.857508898 CEST	443	49709	77.75.76.70	192.168.2.16
Oct 2, 2024 12:16:25.857532978 CEST	443	49709	77.75.76.70	192.168.2.16
Oct 2, 2024 12:16:25.857578993 CEST	49709	443	192.168.2.16	77.75.76.70
Oct 2, 2024 12:16:25.857594013 CEST	443	49709	77.75.76.70	192.168.2.16
Oct 2, 2024 12:16:25.857619047 CEST	49709	443	192.168.2.16	77.75.76.70
Oct 2, 2024 12:16:25.857635975 CEST	49709	443	192.168.2.16	77.75.76.70
Oct 2, 2024 12:16:25.859376907 CEST	443	49709	77.75.76.70	192.168.2.16
Oct 2, 2024 12:16:25.859415054 CEST	443	49709	77.75.76.70	192.168.2.16
Oct 2, 2024 12:16:25.859494925 CEST	49709	443	192.168.2.16	77.75.76.70
Oct 2, 2024 12:16:25.859503031 CEST	443	49709	77.75.76.70	192.168.2.16
Oct 2, 2024 12:16:25.859724998 CEST	49709	443	192.168.2.16	77.75.76.70
Oct 2, 2024 12:16:25.893007040 CEST	443	49709	77.75.76.70	192.168.2.16
Oct 2, 2024 12:16:25.893037081 CEST	443	49709	77.75.76.70	192.168.2.16
Oct 2, 2024 12:16:25.893106937 CEST	49709	443	192.168.2.16	77.75.76.70
Oct 2, 2024 12:16:25.893127918 CEST	443	49709	77.75.76.70	192.168.2.16
Oct 2, 2024 12:16:25.893151999 CEST	49709	443	192.168.2.16	77.75.76.70
Oct 2, 2024 12:16:25.893162966 CEST	49709	443	192.168.2.16	77.75.76.70
Oct 2, 2024 12:16:25.920523882 CEST	443	49709	77.75.76.70	192.168.2.16
Oct 2, 2024 12:16:25.920550108 CEST	443	49709	77.75.76.70	192.168.2.16
Oct 2, 2024 12:16:25.920718908 CEST	49709	443	192.168.2.16	77.75.76.70
Oct 2, 2024 12:16:25.920732975 CEST	443	49709	77.75.76.70	192.168.2.16
Oct 2, 2024 12:16:25.920835972 CEST	49709	443	192.168.2.16	77.75.76.70
Oct 2, 2024 12:16:25.922346115 CEST	443	49709	77.75.76.70	192.168.2.16
Oct 2, 2024 12:16:25.922370911 CEST	443	49709	77.75.76.70	192.168.2.16
Oct 2, 2024 12:16:25.922430992 CEST	49709	443	192.168.2.16	77.75.76.70
Oct 2, 2024 12:16:25.922439098 CEST	443	49709	77.75.76.70	192.168.2.16
Oct 2, 2024 12:16:25.922673941 CEST	49709	443	192.168.2.16	77.75.76.70
Oct 2, 2024 12:16:25.925007105 CEST	443	49709	77.75.76.70	192.168.2.16
Oct 2, 2024 12:16:25.925035954 CEST	443	49709	77.75.76.70	192.168.2.16
Oct 2, 2024 12:16:25.925331116 CEST	49709	443	192.168.2.16	77.75.76.70
Oct 2, 2024 12:16:25.925339937 CEST	443	49709	77.75.76.70	192.168.2.16
Oct 2, 2024 12:16:25.925379038 CEST	49709	443	192.168.2.16	77.75.76.70
Oct 2, 2024 12:16:25.946950912 CEST	443	49709	77.75.76.70	192.168.2.16
Oct 2, 2024 12:16:25.946984053 CEST	443	49709	77.75.76.70	192.168.2.16
Oct 2, 2024 12:16:25.947051048 CEST	49709	443	192.168.2.16	77.75.76.70
Oct 2, 2024 12:16:25.947066069 CEST	443	49709	77.75.76.70	192.168.2.16
Oct 2, 2024 12:16:25.947094917 CEST	49709	443	192.168.2.16	77.75.76.70
Oct 2, 2024 12:16:25.947118998 CEST	49709	443	192.168.2.16	77.75.76.70
Oct 2, 2024 12:16:25.948477030 CEST	443	49709	77.75.76.70	192.168.2.16
Oct 2, 2024 12:16:25.948506117 CEST	443	49709	77.75.76.70	192.168.2.16
Oct 2, 2024 12:16:25.948561907 CEST	49709	443	192.168.2.16	77.75.76.70
Oct 2, 2024 12:16:25.948570013 CEST	443	49709	77.75.76.70	192.168.2.16
Oct 2, 2024 12:16:25.948594093 CEST	49709	443	192.168.2.16	77.75.76.70
Oct 2, 2024 12:16:25.948609114 CEST	49709	443	192.168.2.16	77.75.76.70
Oct 2, 2024 12:16:25.951000929 CEST	443	49709	77.75.76.70	192.168.2.16
Oct 2, 2024 12:16:25.951021910 CEST	443	49709	77.75.76.70	192.168.2.16
Oct 2, 2024 12:16:25.951117992 CEST	49709	443	192.168.2.16	77.75.76.70
Oct 2, 2024 12:16:25.951129913 CEST	443	49709	77.75.76.70	192.168.2.16
Oct 2, 2024 12:16:25.951246023 CEST	49709	443	192.168.2.16	77.75.76.70
Oct 2, 2024 12:16:25.952676058 CEST	443	49709	77.75.76.70	192.168.2.16
Oct 2, 2024 12:16:25.952708006 CEST	443	49709	77.75.76.70	192.168.2.16
Oct 2, 2024 12:16:25.952796936 CEST	49709	443	192.168.2.16	77.75.76.70
Oct 2, 2024 12:16:25.952807903 CEST	443	49709	77.75.76.70	192.168.2.16
Oct 2, 2024 12:16:25.952931881 CEST	49709	443	192.168.2.16	77.75.76.70
Oct 2, 2024 12:16:25.985383987 CEST	443	49709	77.75.76.70	192.168.2.16
Oct 2, 2024 12:16:25.985415936 CEST	443	49709	77.75.76.70	192.168.2.16
Oct 2, 2024 12:16:25.985480070 CEST	49709	443	192.168.2.16	77.75.76.70
Oct 2, 2024 12:16:25.985493898 CEST	443	49709	77.75.76.70	192.168.2.16
Oct 2, 2024 12:16:25.985544920 CEST	49709	443	192.168.2.16	77.75.76.70
Oct 2, 2024 12:16:26.012963057 CEST	443	49709	77.75.76.70	192.168.2.16
Oct 2, 2024 12:16:26.012994051 CEST	443	49709	77.75.76.70	192.168.2.16
Oct 2, 2024 12:16:26.013057947 CEST	49709	443	192.168.2.16	77.75.76.70
Oct 2, 2024 12:16:26.013071060 CEST	443	49709	77.75.76.70	192.168.2.16
Oct 2, 2024 12:16:26.013082027 CEST	49709	443	192.168.2.16	77.75.76.70
Oct 2, 2024 12:16:26.014902115 CEST	443	49709	77.75.76.70	192.168.2.16
Oct 2, 2024 12:16:26.014930010 CEST	443	49709	77.75.76.70	192.168.2.16
Oct 2, 2024 12:16:26.014977932 CEST	49709	443	192.168.2.16	77.75.76.70
Oct 2, 2024 12:16:26.014985085 CEST	443	49709	77.75.76.70	192.168.2.16
Oct 2, 2024 12:16:26.015007973 CEST	49709	443	192.168.2.16	77.75.76.70
Oct 2, 2024 12:16:26.015039921 CEST	49709	443	192.168.2.16	77.75.76.70
Oct 2, 2024 12:16:26.017785072 CEST	443	49709	77.75.76.70	192.168.2.16
Oct 2, 2024 12:16:26.017807007 CEST	443	49709	77.75.76.70	192.168.2.16
Oct 2, 2024 12:16:26.017872095 CEST	49709	443	192.168.2.16	77.75.76.70
Oct 2, 2024 12:16:26.017879009 CEST	443	49709	77.75.76.70	192.168.2.16
Oct 2, 2024 12:16:26.018774986 CEST	49709	443	192.168.2.16	77.75.76.70
Oct 2, 2024 12:16:26.039704084 CEST	443	49709	77.75.76.70	192.168.2.16
Oct 2, 2024 12:16:26.039743900 CEST	443	49709	77.75.76.70	192.168.2.16
Oct 2, 2024 12:16:26.039792061 CEST	49709	443	192.168.2.16	77.75.76.70
Oct 2, 2024 12:16:26.039802074 CEST	443	49709	77.75.76.70	192.168.2.16
Oct 2, 2024 12:16:26.039828062 CEST	49709	443	192.168.2.16	77.75.76.70
Oct 2, 2024 12:16:26.039849043 CEST	49709	443	192.168.2.16	77.75.76.70
Oct 2, 2024 12:16:26.041507959 CEST	443	49709	77.75.76.70	192.168.2.16
Oct 2, 2024 12:16:26.041538000 CEST	443	49709	77.75.76.70	192.168.2.16
Oct 2, 2024 12:16:26.041584015 CEST	49709	443	192.168.2.16	77.75.76.70
Oct 2, 2024 12:16:26.041589975 CEST	443	49709	77.75.76.70	192.168.2.16
Oct 2, 2024 12:16:26.041624069 CEST	49709	443	192.168.2.16	77.75.76.70
Oct 2, 2024 12:16:26.041630983 CEST	49709	443	192.168.2.16	77.75.76.70
Oct 2, 2024 12:16:26.043011904 CEST	443	49709	77.75.76.70	192.168.2.16
Oct 2, 2024 12:16:26.043045044 CEST	443	49709	77.75.76.70	192.168.2.16
Oct 2, 2024 12:16:26.043097973 CEST	49709	443	192.168.2.16	77.75.76.70
Oct 2, 2024 12:16:26.043103933 CEST	443	49709	77.75.76.70	192.168.2.16
Oct 2, 2024 12:16:26.043138981 CEST	49709	443	192.168.2.16	77.75.76.70
Oct 2, 2024 12:16:26.043154955 CEST	49709	443	192.168.2.16	77.75.76.70
Oct 2, 2024 12:16:26.044871092 CEST	443	49709	77.75.76.70	192.168.2.16
Oct 2, 2024 12:16:26.044893026 CEST	443	49709	77.75.76.70	192.168.2.16
Oct 2, 2024 12:16:26.044938087 CEST	49709	443	192.168.2.16	77.75.76.70
Oct 2, 2024 12:16:26.044944048 CEST	443	49709	77.75.76.70	192.168.2.16
Oct 2, 2024 12:16:26.044971943 CEST	49709	443	192.168.2.16	77.75.76.70
Oct 2, 2024 12:16:26.044992924 CEST	49709	443	192.168.2.16	77.75.76.70
Oct 2, 2024 12:16:26.077851057 CEST	443	49709	77.75.76.70	192.168.2.16
Oct 2, 2024 12:16:26.077882051 CEST	443	49709	77.75.76.70	192.168.2.16
Oct 2, 2024 12:16:26.077931881 CEST	49709	443	192.168.2.16	77.75.76.70
Oct 2, 2024 12:16:26.077940941 CEST	443	49709	77.75.76.70	192.168.2.16
Oct 2, 2024 12:16:26.077975988 CEST	49709	443	192.168.2.16	77.75.76.70
Oct 2, 2024 12:16:26.077996969 CEST	49709	443	192.168.2.16	77.75.76.70
Oct 2, 2024 12:16:26.105343103 CEST	443	49709	77.75.76.70	192.168.2.16
Oct 2, 2024 12:16:26.105375051 CEST	443	49709	77.75.76.70	192.168.2.16
Oct 2, 2024 12:16:26.105597973 CEST	49709	443	192.168.2.16	77.75.76.70
Oct 2, 2024 12:16:26.105597973 CEST	49709	443	192.168.2.16	77.75.76.70
Oct 2, 2024 12:16:26.105612993 CEST	443	49709	77.75.76.70	192.168.2.16
Oct 2, 2024 12:16:26.107067108 CEST	443	49709	77.75.76.70	192.168.2.16
Oct 2, 2024 12:16:26.107096910 CEST	443	49709	77.75.76.70	192.168.2.16
Oct 2, 2024 12:16:26.107140064 CEST	49709	443	192.168.2.16	77.75.76.70
Oct 2, 2024 12:16:26.107147932 CEST	443	49709	77.75.76.70	192.168.2.16
Oct 2, 2024 12:16:26.107173920 CEST	49709	443	192.168.2.16	77.75.76.70
Oct 2, 2024 12:16:26.107207060 CEST	49709	443	192.168.2.16	77.75.76.70
Oct 2, 2024 12:16:26.108800888 CEST	443	49709	77.75.76.70	192.168.2.16
Oct 2, 2024 12:16:26.108824968 CEST	443	49709	77.75.76.70	192.168.2.16
Oct 2, 2024 12:16:26.108892918 CEST	49709	443	192.168.2.16	77.75.76.70
Oct 2, 2024 12:16:26.108899117 CEST	443	49709	77.75.76.70	192.168.2.16
Oct 2, 2024 12:16:26.108937979 CEST	49709	443	192.168.2.16	77.75.76.70
Oct 2, 2024 12:16:26.108952045 CEST	49709	443	192.168.2.16	77.75.76.70
Oct 2, 2024 12:16:26.132128000 CEST	443	49709	77.75.76.70	192.168.2.16
Oct 2, 2024 12:16:26.132153034 CEST	443	49709	77.75.76.70	192.168.2.16
Oct 2, 2024 12:16:26.132203102 CEST	49709	443	192.168.2.16	77.75.76.70
Oct 2, 2024 12:16:26.132215977 CEST	443	49709	77.75.76.70	192.168.2.16
Oct 2, 2024 12:16:26.132237911 CEST	49709	443	192.168.2.16	77.75.76.70
Oct 2, 2024 12:16:26.132256031 CEST	49709	443	192.168.2.16	77.75.76.70
Oct 2, 2024 12:16:26.133419037 CEST	443	49709	77.75.76.70	192.168.2.16
Oct 2, 2024 12:16:26.133443117 CEST	443	49709	77.75.76.70	192.168.2.16
Oct 2, 2024 12:16:26.133521080 CEST	49709	443	192.168.2.16	77.75.76.70
Oct 2, 2024 12:16:26.133528948 CEST	443	49709	77.75.76.70	192.168.2.16
Oct 2, 2024 12:16:26.133661985 CEST	49709	443	192.168.2.16	77.75.76.70
Oct 2, 2024 12:16:26.135241985 CEST	443	49709	77.75.76.70	192.168.2.16
Oct 2, 2024 12:16:26.135265112 CEST	443	49709	77.75.76.70	192.168.2.16
Oct 2, 2024 12:16:26.135315895 CEST	49709	443	192.168.2.16	77.75.76.70
Oct 2, 2024 12:16:26.135324001 CEST	443	49709	77.75.76.70	192.168.2.16
Oct 2, 2024 12:16:26.135348082 CEST	49709	443	192.168.2.16	77.75.76.70
Oct 2, 2024 12:16:26.135366917 CEST	49709	443	192.168.2.16	77.75.76.70
Oct 2, 2024 12:16:26.137043953 CEST	443	49709	77.75.76.70	192.168.2.16
Oct 2, 2024 12:16:26.137068033 CEST	443	49709	77.75.76.70	192.168.2.16
Oct 2, 2024 12:16:26.137124062 CEST	49709	443	192.168.2.16	77.75.76.70
Oct 2, 2024 12:16:26.137131929 CEST	443	49709	77.75.76.70	192.168.2.16
Oct 2, 2024 12:16:26.137156010 CEST	49709	443	192.168.2.16	77.75.76.70
Oct 2, 2024 12:16:26.137172937 CEST	49709	443	192.168.2.16	77.75.76.70
Oct 2, 2024 12:16:26.170192957 CEST	443	49709	77.75.76.70	192.168.2.16
Oct 2, 2024 12:16:26.170213938 CEST	443	49709	77.75.76.70	192.168.2.16
Oct 2, 2024 12:16:26.170285940 CEST	49709	443	192.168.2.16	77.75.76.70
Oct 2, 2024 12:16:26.170306921 CEST	443	49709	77.75.76.70	192.168.2.16
Oct 2, 2024 12:16:26.170558929 CEST	49709	443	192.168.2.16	77.75.76.70
Oct 2, 2024 12:16:26.197830915 CEST	443	49709	77.75.76.70	192.168.2.16
Oct 2, 2024 12:16:26.197869062 CEST	443	49709	77.75.76.70	192.168.2.16
Oct 2, 2024 12:16:26.197927952 CEST	49709	443	192.168.2.16	77.75.76.70
Oct 2, 2024 12:16:26.197945118 CEST	443	49709	77.75.76.70	192.168.2.16
Oct 2, 2024 12:16:26.197982073 CEST	49709	443	192.168.2.16	77.75.76.70
Oct 2, 2024 12:16:26.197989941 CEST	49709	443	192.168.2.16	77.75.76.70
Oct 2, 2024 12:16:26.199738026 CEST	443	49709	77.75.76.70	192.168.2.16
Oct 2, 2024 12:16:26.199767113 CEST	443	49709	77.75.76.70	192.168.2.16
Oct 2, 2024 12:16:26.199815989 CEST	49709	443	192.168.2.16	77.75.76.70
Oct 2, 2024 12:16:26.199827909 CEST	443	49709	77.75.76.70	192.168.2.16
Oct 2, 2024 12:16:26.199856043 CEST	49709	443	192.168.2.16	77.75.76.70
Oct 2, 2024 12:16:26.199872017 CEST	49709	443	192.168.2.16	77.75.76.70
Oct 2, 2024 12:16:26.201611996 CEST	443	49709	77.75.76.70	192.168.2.16
Oct 2, 2024 12:16:26.201639891 CEST	443	49709	77.75.76.70	192.168.2.16
Oct 2, 2024 12:16:26.201688051 CEST	49709	443	192.168.2.16	77.75.76.70
Oct 2, 2024 12:16:26.201698065 CEST	443	49709	77.75.76.70	192.168.2.16
Oct 2, 2024 12:16:26.201730013 CEST	49709	443	192.168.2.16	77.75.76.70
Oct 2, 2024 12:16:26.201750040 CEST	49709	443	192.168.2.16	77.75.76.70
Oct 2, 2024 12:16:26.224929094 CEST	443	49709	77.75.76.70	192.168.2.16
Oct 2, 2024 12:16:26.224967957 CEST	443	49709	77.75.76.70	192.168.2.16
Oct 2, 2024 12:16:26.225028038 CEST	49709	443	192.168.2.16	77.75.76.70
Oct 2, 2024 12:16:26.225050926 CEST	443	49709	77.75.76.70	192.168.2.16
Oct 2, 2024 12:16:26.225063086 CEST	49709	443	192.168.2.16	77.75.76.70
Oct 2, 2024 12:16:26.225092888 CEST	49709	443	192.168.2.16	77.75.76.70
Oct 2, 2024 12:16:26.226278067 CEST	443	49709	77.75.76.70	192.168.2.16
Oct 2, 2024 12:16:26.226311922 CEST	443	49709	77.75.76.70	192.168.2.16
Oct 2, 2024 12:16:26.226371050 CEST	49709	443	192.168.2.16	77.75.76.70
Oct 2, 2024 12:16:26.226377964 CEST	443	49709	77.75.76.70	192.168.2.16
Oct 2, 2024 12:16:26.226423025 CEST	49709	443	192.168.2.16	77.75.76.70
Oct 2, 2024 12:16:26.228183031 CEST	443	49709	77.75.76.70	192.168.2.16
Oct 2, 2024 12:16:26.228213072 CEST	443	49709	77.75.76.70	192.168.2.16
Oct 2, 2024 12:16:26.228262901 CEST	49709	443	192.168.2.16	77.75.76.70
Oct 2, 2024 12:16:26.228270054 CEST	443	49709	77.75.76.70	192.168.2.16
Oct 2, 2024 12:16:26.228280067 CEST	49709	443	192.168.2.16	77.75.76.70
Oct 2, 2024 12:16:26.228310108 CEST	49709	443	192.168.2.16	77.75.76.70
Oct 2, 2024 12:16:26.262094021 CEST	443	49709	77.75.76.70	192.168.2.16
Oct 2, 2024 12:16:26.262125015 CEST	443	49709	77.75.76.70	192.168.2.16
Oct 2, 2024 12:16:26.262217999 CEST	49709	443	192.168.2.16	77.75.76.70
Oct 2, 2024 12:16:26.262217999 CEST	49709	443	192.168.2.16	77.75.76.70
Oct 2, 2024 12:16:26.262238026 CEST	443	49709	77.75.76.70	192.168.2.16
Oct 2, 2024 12:16:26.262726068 CEST	49709	443	192.168.2.16	77.75.76.70
Oct 2, 2024 12:16:26.291620970 CEST	443	49709	77.75.76.70	192.168.2.16
Oct 2, 2024 12:16:26.291645050 CEST	443	49709	77.75.76.70	192.168.2.16
Oct 2, 2024 12:16:26.291706085 CEST	49709	443	192.168.2.16	77.75.76.70
Oct 2, 2024 12:16:26.291723013 CEST	443	49709	77.75.76.70	192.168.2.16
Oct 2, 2024 12:16:26.291755915 CEST	49709	443	192.168.2.16	77.75.76.70
Oct 2, 2024 12:16:26.291826963 CEST	49709	443	192.168.2.16	77.75.76.70
Oct 2, 2024 12:16:26.292984962 CEST	443	49709	77.75.76.70	192.168.2.16
Oct 2, 2024 12:16:26.293013096 CEST	443	49709	77.75.76.70	192.168.2.16
Oct 2, 2024 12:16:26.293062925 CEST	49709	443	192.168.2.16	77.75.76.70
Oct 2, 2024 12:16:26.293071032 CEST	443	49709	77.75.76.70	192.168.2.16
Oct 2, 2024 12:16:26.293086052 CEST	49709	443	192.168.2.16	77.75.76.70
Oct 2, 2024 12:16:26.293111086 CEST	49709	443	192.168.2.16	77.75.76.70
Oct 2, 2024 12:16:26.294780016 CEST	443	49709	77.75.76.70	192.168.2.16
Oct 2, 2024 12:16:26.294804096 CEST	443	49709	77.75.76.70	192.168.2.16
Oct 2, 2024 12:16:26.294841051 CEST	49709	443	192.168.2.16	77.75.76.70
Oct 2, 2024 12:16:26.294848919 CEST	443	49709	77.75.76.70	192.168.2.16
Oct 2, 2024 12:16:26.294872999 CEST	49709	443	192.168.2.16	77.75.76.70
Oct 2, 2024 12:16:26.294888973 CEST	49709	443	192.168.2.16	77.75.76.70
Oct 2, 2024 12:16:26.296675920 CEST	443	49709	77.75.76.70	192.168.2.16
Oct 2, 2024 12:16:26.296696901 CEST	443	49709	77.75.76.70	192.168.2.16
Oct 2, 2024 12:16:26.296741962 CEST	49709	443	192.168.2.16	77.75.76.70
Oct 2, 2024 12:16:26.296751022 CEST	443	49709	77.75.76.70	192.168.2.16
Oct 2, 2024 12:16:26.296775103 CEST	49709	443	192.168.2.16	77.75.76.70
Oct 2, 2024 12:16:26.296791077 CEST	49709	443	192.168.2.16	77.75.76.70
Oct 2, 2024 12:16:26.317708015 CEST	443	49709	77.75.76.70	192.168.2.16
Oct 2, 2024 12:16:26.317759991 CEST	443	49709	77.75.76.70	192.168.2.16
Oct 2, 2024 12:16:26.317796946 CEST	49709	443	192.168.2.16	77.75.76.70
Oct 2, 2024 12:16:26.317809105 CEST	443	49709	77.75.76.70	192.168.2.16
Oct 2, 2024 12:16:26.317835093 CEST	49709	443	192.168.2.16	77.75.76.70
Oct 2, 2024 12:16:26.317852974 CEST	49709	443	192.168.2.16	77.75.76.70
Oct 2, 2024 12:16:26.318034887 CEST	49709	443	192.168.2.16	77.75.76.70
Oct 2, 2024 12:16:26.318049908 CEST	443	49709	77.75.76.70	192.168.2.16
Oct 2, 2024 12:16:26.475071907 CEST	49707	80	192.168.2.16	77.75.76.70
Oct 2, 2024 12:16:26.479999065 CEST	80	49707	77.75.76.70	192.168.2.16
Oct 2, 2024 12:16:26.483000040 CEST	49711	80	192.168.2.16	142.250.185.161
Oct 2, 2024 12:16:26.487837076 CEST	80	49711	142.250.185.161	192.168.2.16
Oct 2, 2024 12:16:26.490130901 CEST	49711	80	192.168.2.16	142.250.185.161
Oct 2, 2024 12:16:26.490330935 CEST	49711	80	192.168.2.16	142.250.185.161
Oct 2, 2024 12:16:26.495445013 CEST	80	49711	142.250.185.161	192.168.2.16
Oct 2, 2024 12:16:26.523407936 CEST	49713	80	192.168.2.16	172.217.23.100
Oct 2, 2024 12:16:26.523566008 CEST	49712	80	192.168.2.16	172.217.23.100
Oct 2, 2024 12:16:26.528954029 CEST	80	49713	172.217.23.100	192.168.2.16
Oct 2, 2024 12:16:26.528975010 CEST	80	49712	172.217.23.100	192.168.2.16
Oct 2, 2024 12:16:26.529052973 CEST	49713	80	192.168.2.16	172.217.23.100
Oct 2, 2024 12:16:26.529066086 CEST	49712	80	192.168.2.16	172.217.23.100
Oct 2, 2024 12:16:26.529124975 CEST	49713	80	192.168.2.16	172.217.23.100
Oct 2, 2024 12:16:26.534420967 CEST	80	49713	172.217.23.100	192.168.2.16
Oct 2, 2024 12:16:26.672422886 CEST	80	49707	77.75.76.70	192.168.2.16
Oct 2, 2024 12:16:26.673683882 CEST	49707	80	192.168.2.16	77.75.76.70
Oct 2, 2024 12:16:26.673683882 CEST	49714	443	192.168.2.16	77.75.76.70
Oct 2, 2024 12:16:26.673738003 CEST	443	49714	77.75.76.70	192.168.2.16
Oct 2, 2024 12:16:26.673933029 CEST	49714	443	192.168.2.16	77.75.76.70
Oct 2, 2024 12:16:26.675406933 CEST	49714	443	192.168.2.16	77.75.76.70
Oct 2, 2024 12:16:26.675425053 CEST	443	49714	77.75.76.70	192.168.2.16
Oct 2, 2024 12:16:27.165036917 CEST	80	49713	172.217.23.100	192.168.2.16
Oct 2, 2024 12:16:27.166229010 CEST	49713	80	192.168.2.16	172.217.23.100
Oct 2, 2024 12:16:27.188349009 CEST	49715	443	192.168.2.16	172.217.23.110
Oct 2, 2024 12:16:27.188383102 CEST	443	49715	172.217.23.110	192.168.2.16
Oct 2, 2024 12:16:27.188688993 CEST	49716	443	192.168.2.16	172.217.23.110
Oct 2, 2024 12:16:27.188716888 CEST	443	49716	172.217.23.110	192.168.2.16
Oct 2, 2024 12:16:27.188721895 CEST	49715	443	192.168.2.16	172.217.23.110
Oct 2, 2024 12:16:27.188772917 CEST	49716	443	192.168.2.16	172.217.23.110
Oct 2, 2024 12:16:27.191685915 CEST	49716	443	192.168.2.16	172.217.23.110
Oct 2, 2024 12:16:27.191703081 CEST	443	49716	172.217.23.110	192.168.2.16
Oct 2, 2024 12:16:27.192254066 CEST	49715	443	192.168.2.16	172.217.23.110
Oct 2, 2024 12:16:27.192270994 CEST	443	49715	172.217.23.110	192.168.2.16
Oct 2, 2024 12:16:27.294347048 CEST	80	49711	142.250.185.161	192.168.2.16
Oct 2, 2024 12:16:27.294408083 CEST	80	49711	142.250.185.161	192.168.2.16
Oct 2, 2024 12:16:27.294440985 CEST	80	49711	142.250.185.161	192.168.2.16
Oct 2, 2024 12:16:27.294521093 CEST	49711	80	192.168.2.16	142.250.185.161
Oct 2, 2024 12:16:27.294521093 CEST	49711	80	192.168.2.16	142.250.185.161
Oct 2, 2024 12:16:27.294661045 CEST	80	49711	142.250.185.161	192.168.2.16
Oct 2, 2024 12:16:27.294692993 CEST	80	49711	142.250.185.161	192.168.2.16
Oct 2, 2024 12:16:27.294724941 CEST	80	49711	142.250.185.161	192.168.2.16
Oct 2, 2024 12:16:27.294758081 CEST	80	49711	142.250.185.161	192.168.2.16
Oct 2, 2024 12:16:27.294770002 CEST	49711	80	192.168.2.16	142.250.185.161
Oct 2, 2024 12:16:27.294770002 CEST	49711	80	192.168.2.16	142.250.185.161
Oct 2, 2024 12:16:27.294884920 CEST	49711	80	192.168.2.16	142.250.185.161
Oct 2, 2024 12:16:27.295093060 CEST	80	49711	142.250.185.161	192.168.2.16
Oct 2, 2024 12:16:27.295151949 CEST	49711	80	192.168.2.16	142.250.185.161
Oct 2, 2024 12:16:27.295209885 CEST	80	49711	142.250.185.161	192.168.2.16
Oct 2, 2024 12:16:27.295274973 CEST	49711	80	192.168.2.16	142.250.185.161
Oct 2, 2024 12:16:27.341664076 CEST	443	49714	77.75.76.70	192.168.2.16
Oct 2, 2024 12:16:27.341803074 CEST	49714	443	192.168.2.16	77.75.76.70
Oct 2, 2024 12:16:27.343465090 CEST	49714	443	192.168.2.16	77.75.76.70
Oct 2, 2024 12:16:27.343475103 CEST	443	49714	77.75.76.70	192.168.2.16
Oct 2, 2024 12:16:27.343657017 CEST	49714	443	192.168.2.16	77.75.76.70
Oct 2, 2024 12:16:27.343663931 CEST	443	49714	77.75.76.70	192.168.2.16
Oct 2, 2024 12:16:27.810302973 CEST	443	49714	77.75.76.70	192.168.2.16
Oct 2, 2024 12:16:27.810364008 CEST	443	49714	77.75.76.70	192.168.2.16
Oct 2, 2024 12:16:27.810456991 CEST	49714	443	192.168.2.16	77.75.76.70
Oct 2, 2024 12:16:27.810483932 CEST	443	49714	77.75.76.70	192.168.2.16
Oct 2, 2024 12:16:27.810586929 CEST	49714	443	192.168.2.16	77.75.76.70
Oct 2, 2024 12:16:27.810596943 CEST	443	49714	77.75.76.70	192.168.2.16
Oct 2, 2024 12:16:27.810678005 CEST	49714	443	192.168.2.16	77.75.76.70
Oct 2, 2024 12:16:27.814656973 CEST	443	49714	77.75.76.70	192.168.2.16
Oct 2, 2024 12:16:27.814702988 CEST	443	49714	77.75.76.70	192.168.2.16
Oct 2, 2024 12:16:27.814743042 CEST	49714	443	192.168.2.16	77.75.76.70
Oct 2, 2024 12:16:27.814762115 CEST	443	49714	77.75.76.70	192.168.2.16
Oct 2, 2024 12:16:27.814811945 CEST	49714	443	192.168.2.16	77.75.76.70
Oct 2, 2024 12:16:27.814811945 CEST	49714	443	192.168.2.16	77.75.76.70
Oct 2, 2024 12:16:27.834052086 CEST	443	49716	172.217.23.110	192.168.2.16
Oct 2, 2024 12:16:27.834126949 CEST	49716	443	192.168.2.16	172.217.23.110
Oct 2, 2024 12:16:27.834779024 CEST	443	49716	172.217.23.110	192.168.2.16
Oct 2, 2024 12:16:27.834845066 CEST	49716	443	192.168.2.16	172.217.23.110
Oct 2, 2024 12:16:27.895005941 CEST	443	49714	77.75.76.70	192.168.2.16
Oct 2, 2024 12:16:27.895087004 CEST	443	49714	77.75.76.70	192.168.2.16
Oct 2, 2024 12:16:27.895139933 CEST	49714	443	192.168.2.16	77.75.76.70
Oct 2, 2024 12:16:27.895139933 CEST	49714	443	192.168.2.16	77.75.76.70
Oct 2, 2024 12:16:27.895155907 CEST	443	49714	77.75.76.70	192.168.2.16
Oct 2, 2024 12:16:27.895198107 CEST	49714	443	192.168.2.16	77.75.76.70
Oct 2, 2024 12:16:27.898041010 CEST	443	49714	77.75.76.70	192.168.2.16
Oct 2, 2024 12:16:27.898063898 CEST	443	49714	77.75.76.70	192.168.2.16
Oct 2, 2024 12:16:27.898168087 CEST	49714	443	192.168.2.16	77.75.76.70
Oct 2, 2024 12:16:27.898168087 CEST	49714	443	192.168.2.16	77.75.76.70
Oct 2, 2024 12:16:27.898175955 CEST	443	49714	77.75.76.70	192.168.2.16
Oct 2, 2024 12:16:27.898263931 CEST	49714	443	192.168.2.16	77.75.76.70
Oct 2, 2024 12:16:27.900994062 CEST	443	49714	77.75.76.70	192.168.2.16
Oct 2, 2024 12:16:27.901025057 CEST	443	49714	77.75.76.70	192.168.2.16
Oct 2, 2024 12:16:27.901097059 CEST	49714	443	192.168.2.16	77.75.76.70
Oct 2, 2024 12:16:27.901103973 CEST	443	49714	77.75.76.70	192.168.2.16
Oct 2, 2024 12:16:27.901118040 CEST	443	49714	77.75.76.70	192.168.2.16
Oct 2, 2024 12:16:27.901133060 CEST	49714	443	192.168.2.16	77.75.76.70
Oct 2, 2024 12:16:27.901187897 CEST	49714	443	192.168.2.16	77.75.76.70
Oct 2, 2024 12:16:27.913424015 CEST	443	49715	172.217.23.110	192.168.2.16
Oct 2, 2024 12:16:27.913522959 CEST	49715	443	192.168.2.16	172.217.23.110
Oct 2, 2024 12:16:27.914411068 CEST	443	49715	172.217.23.110	192.168.2.16
Oct 2, 2024 12:16:27.914522886 CEST	49715	443	192.168.2.16	172.217.23.110
Oct 2, 2024 12:16:28.021795988 CEST	443	49714	77.75.76.70	192.168.2.16
Oct 2, 2024 12:16:28.021822929 CEST	443	49714	77.75.76.70	192.168.2.16
Oct 2, 2024 12:16:28.021902084 CEST	49714	443	192.168.2.16	77.75.76.70
Oct 2, 2024 12:16:28.021909952 CEST	443	49714	77.75.76.70	192.168.2.16
Oct 2, 2024 12:16:28.021972895 CEST	49714	443	192.168.2.16	77.75.76.70
Oct 2, 2024 12:16:28.021972895 CEST	49714	443	192.168.2.16	77.75.76.70
Oct 2, 2024 12:16:28.022819996 CEST	443	49714	77.75.76.70	192.168.2.16
Oct 2, 2024 12:16:28.022882938 CEST	49714	443	192.168.2.16	77.75.76.70
Oct 2, 2024 12:16:28.024262905 CEST	443	49714	77.75.76.70	192.168.2.16
Oct 2, 2024 12:16:28.024315119 CEST	443	49714	77.75.76.70	192.168.2.16
Oct 2, 2024 12:16:28.024324894 CEST	49714	443	192.168.2.16	77.75.76.70
Oct 2, 2024 12:16:28.024336100 CEST	443	49714	77.75.76.70	192.168.2.16
Oct 2, 2024 12:16:28.024421930 CEST	49714	443	192.168.2.16	77.75.76.70
Oct 2, 2024 12:16:28.024518967 CEST	49714	443	192.168.2.16	77.75.76.70
Oct 2, 2024 12:16:28.026051998 CEST	443	49714	77.75.76.70	192.168.2.16
Oct 2, 2024 12:16:28.026077032 CEST	443	49714	77.75.76.70	192.168.2.16
Oct 2, 2024 12:16:28.026129961 CEST	49714	443	192.168.2.16	77.75.76.70
Oct 2, 2024 12:16:28.026135921 CEST	443	49714	77.75.76.70	192.168.2.16
Oct 2, 2024 12:16:28.026148081 CEST	49714	443	192.168.2.16	77.75.76.70
Oct 2, 2024 12:16:28.026284933 CEST	49714	443	192.168.2.16	77.75.76.70
Oct 2, 2024 12:16:28.027611971 CEST	443	49714	77.75.76.70	192.168.2.16
Oct 2, 2024 12:16:28.027673006 CEST	49714	443	192.168.2.16	77.75.76.70
Oct 2, 2024 12:16:28.027679920 CEST	443	49714	77.75.76.70	192.168.2.16
Oct 2, 2024 12:16:28.027822971 CEST	49714	443	192.168.2.16	77.75.76.70
Oct 2, 2024 12:16:28.039129972 CEST	443	49714	77.75.76.70	192.168.2.16
Oct 2, 2024 12:16:28.039151907 CEST	443	49714	77.75.76.70	192.168.2.16
Oct 2, 2024 12:16:28.039246082 CEST	49714	443	192.168.2.16	77.75.76.70
Oct 2, 2024 12:16:28.039246082 CEST	49714	443	192.168.2.16	77.75.76.70
Oct 2, 2024 12:16:28.039253950 CEST	443	49714	77.75.76.70	192.168.2.16
Oct 2, 2024 12:16:28.039410114 CEST	49714	443	192.168.2.16	77.75.76.70
Oct 2, 2024 12:16:28.096944094 CEST	443	49714	77.75.76.70	192.168.2.16
Oct 2, 2024 12:16:28.097028017 CEST	443	49714	77.75.76.70	192.168.2.16
Oct 2, 2024 12:16:28.097039938 CEST	49714	443	192.168.2.16	77.75.76.70
Oct 2, 2024 12:16:28.097048998 CEST	443	49714	77.75.76.70	192.168.2.16
Oct 2, 2024 12:16:28.097132921 CEST	49714	443	192.168.2.16	77.75.76.70
Oct 2, 2024 12:16:28.108869076 CEST	443	49714	77.75.76.70	192.168.2.16
Oct 2, 2024 12:16:28.108895063 CEST	443	49714	77.75.76.70	192.168.2.16
Oct 2, 2024 12:16:28.108994961 CEST	49714	443	192.168.2.16	77.75.76.70
Oct 2, 2024 12:16:28.108994961 CEST	49714	443	192.168.2.16	77.75.76.70
Oct 2, 2024 12:16:28.109002113 CEST	443	49714	77.75.76.70	192.168.2.16
Oct 2, 2024 12:16:28.109138012 CEST	49714	443	192.168.2.16	77.75.76.70
Oct 2, 2024 12:16:28.110529900 CEST	443	49714	77.75.76.70	192.168.2.16
Oct 2, 2024 12:16:28.110551119 CEST	443	49714	77.75.76.70	192.168.2.16
Oct 2, 2024 12:16:28.110594034 CEST	49714	443	192.168.2.16	77.75.76.70
Oct 2, 2024 12:16:28.110600948 CEST	443	49714	77.75.76.70	192.168.2.16
Oct 2, 2024 12:16:28.110636950 CEST	49714	443	192.168.2.16	77.75.76.70
Oct 2, 2024 12:16:28.110789061 CEST	49714	443	192.168.2.16	77.75.76.70
Oct 2, 2024 12:16:28.112292051 CEST	443	49714	77.75.76.70	192.168.2.16
Oct 2, 2024 12:16:28.112313986 CEST	443	49714	77.75.76.70	192.168.2.16
Oct 2, 2024 12:16:28.112359047 CEST	49714	443	192.168.2.16	77.75.76.70
Oct 2, 2024 12:16:28.112365007 CEST	443	49714	77.75.76.70	192.168.2.16
Oct 2, 2024 12:16:28.112413883 CEST	49714	443	192.168.2.16	77.75.76.70
Oct 2, 2024 12:16:28.112413883 CEST	49714	443	192.168.2.16	77.75.76.70
Oct 2, 2024 12:16:28.113296032 CEST	443	49714	77.75.76.70	192.168.2.16
Oct 2, 2024 12:16:28.113358021 CEST	443	49714	77.75.76.70	192.168.2.16
Oct 2, 2024 12:16:28.113379002 CEST	49714	443	192.168.2.16	77.75.76.70
Oct 2, 2024 12:16:28.113385916 CEST	443	49714	77.75.76.70	192.168.2.16
Oct 2, 2024 12:16:28.113423109 CEST	49714	443	192.168.2.16	77.75.76.70
Oct 2, 2024 12:16:28.113423109 CEST	49714	443	192.168.2.16	77.75.76.70
Oct 2, 2024 12:16:28.114940882 CEST	443	49714	77.75.76.70	192.168.2.16
Oct 2, 2024 12:16:28.114962101 CEST	443	49714	77.75.76.70	192.168.2.16
Oct 2, 2024 12:16:28.115035057 CEST	49714	443	192.168.2.16	77.75.76.70
Oct 2, 2024 12:16:28.115041018 CEST	443	49714	77.75.76.70	192.168.2.16
Oct 2, 2024 12:16:28.115331888 CEST	49714	443	192.168.2.16	77.75.76.70
Oct 2, 2024 12:16:28.115922928 CEST	443	49714	77.75.76.70	192.168.2.16
Oct 2, 2024 12:16:28.115967989 CEST	443	49714	77.75.76.70	192.168.2.16
Oct 2, 2024 12:16:28.115997076 CEST	49714	443	192.168.2.16	77.75.76.70
Oct 2, 2024 12:16:28.116003036 CEST	443	49714	77.75.76.70	192.168.2.16
Oct 2, 2024 12:16:28.116039991 CEST	49714	443	192.168.2.16	77.75.76.70
Oct 2, 2024 12:16:28.116053104 CEST	49714	443	192.168.2.16	77.75.76.70
Oct 2, 2024 12:16:28.117769957 CEST	443	49714	77.75.76.70	192.168.2.16
Oct 2, 2024 12:16:28.117789984 CEST	443	49714	77.75.76.70	192.168.2.16
Oct 2, 2024 12:16:28.117942095 CEST	49714	443	192.168.2.16	77.75.76.70
Oct 2, 2024 12:16:28.117949009 CEST	443	49714	77.75.76.70	192.168.2.16
Oct 2, 2024 12:16:28.118014097 CEST	49714	443	192.168.2.16	77.75.76.70
Oct 2, 2024 12:16:28.187297106 CEST	443	49714	77.75.76.70	192.168.2.16
Oct 2, 2024 12:16:28.187352896 CEST	443	49714	77.75.76.70	192.168.2.16
Oct 2, 2024 12:16:28.187417984 CEST	49714	443	192.168.2.16	77.75.76.70
Oct 2, 2024 12:16:28.187417984 CEST	49714	443	192.168.2.16	77.75.76.70
Oct 2, 2024 12:16:28.187427044 CEST	443	49714	77.75.76.70	192.168.2.16
Oct 2, 2024 12:16:28.187571049 CEST	49714	443	192.168.2.16	77.75.76.70
Oct 2, 2024 12:16:28.229557991 CEST	49716	443	192.168.2.16	172.217.23.110
Oct 2, 2024 12:16:28.229589939 CEST	443	49716	172.217.23.110	192.168.2.16
Oct 2, 2024 12:16:28.229733944 CEST	49716	443	192.168.2.16	172.217.23.110
Oct 2, 2024 12:16:28.229743958 CEST	443	49716	172.217.23.110	192.168.2.16
Oct 2, 2024 12:16:28.229877949 CEST	49715	443	192.168.2.16	172.217.23.110
Oct 2, 2024 12:16:28.229912043 CEST	443	49715	172.217.23.110	192.168.2.16
Oct 2, 2024 12:16:28.229927063 CEST	443	49716	172.217.23.110	192.168.2.16
Oct 2, 2024 12:16:28.230040073 CEST	49716	443	192.168.2.16	172.217.23.110
Oct 2, 2024 12:16:28.230259895 CEST	443	49715	172.217.23.110	192.168.2.16
Oct 2, 2024 12:16:28.230325937 CEST	49715	443	192.168.2.16	172.217.23.110
Oct 2, 2024 12:16:28.504492044 CEST	443	49714	77.75.76.70	192.168.2.16
Oct 2, 2024 12:16:28.504518032 CEST	443	49714	77.75.76.70	192.168.2.16
Oct 2, 2024 12:16:28.504602909 CEST	49714	443	192.168.2.16	77.75.76.70
Oct 2, 2024 12:16:28.504602909 CEST	49714	443	192.168.2.16	77.75.76.70
Oct 2, 2024 12:16:28.504623890 CEST	443	49714	77.75.76.70	192.168.2.16
Oct 2, 2024 12:16:28.505017042 CEST	49714	443	192.168.2.16	77.75.76.70
Oct 2, 2024 12:16:28.505693913 CEST	443	49714	77.75.76.70	192.168.2.16
Oct 2, 2024 12:16:28.505745888 CEST	443	49714	77.75.76.70	192.168.2.16
Oct 2, 2024 12:16:28.505770922 CEST	49714	443	192.168.2.16	77.75.76.70
Oct 2, 2024 12:16:28.505779028 CEST	443	49714	77.75.76.70	192.168.2.16
Oct 2, 2024 12:16:28.505815983 CEST	49714	443	192.168.2.16	77.75.76.70
Oct 2, 2024 12:16:28.505939007 CEST	49714	443	192.168.2.16	77.75.76.70
Oct 2, 2024 12:16:28.507154942 CEST	443	49714	77.75.76.70	192.168.2.16
Oct 2, 2024 12:16:28.507178068 CEST	443	49714	77.75.76.70	192.168.2.16
Oct 2, 2024 12:16:28.507288933 CEST	49714	443	192.168.2.16	77.75.76.70
Oct 2, 2024 12:16:28.507288933 CEST	49714	443	192.168.2.16	77.75.76.70
Oct 2, 2024 12:16:28.507302999 CEST	443	49714	77.75.76.70	192.168.2.16
Oct 2, 2024 12:16:28.507463932 CEST	49714	443	192.168.2.16	77.75.76.70
Oct 2, 2024 12:16:28.508654118 CEST	443	49714	77.75.76.70	192.168.2.16
Oct 2, 2024 12:16:28.508676052 CEST	443	49714	77.75.76.70	192.168.2.16
Oct 2, 2024 12:16:28.508862019 CEST	49714	443	192.168.2.16	77.75.76.70
Oct 2, 2024 12:16:28.508872986 CEST	443	49714	77.75.76.70	192.168.2.16
Oct 2, 2024 12:16:28.509241104 CEST	49714	443	192.168.2.16	77.75.76.70
Oct 2, 2024 12:16:28.509612083 CEST	443	49714	77.75.76.70	192.168.2.16
Oct 2, 2024 12:16:28.509638071 CEST	443	49714	77.75.76.70	192.168.2.16
Oct 2, 2024 12:16:28.509716988 CEST	49714	443	192.168.2.16	77.75.76.70
Oct 2, 2024 12:16:28.509716988 CEST	49714	443	192.168.2.16	77.75.76.70
Oct 2, 2024 12:16:28.509726048 CEST	443	49714	77.75.76.70	192.168.2.16
Oct 2, 2024 12:16:28.509768963 CEST	49714	443	192.168.2.16	77.75.76.70
Oct 2, 2024 12:16:28.511224031 CEST	443	49714	77.75.76.70	192.168.2.16
Oct 2, 2024 12:16:28.511245966 CEST	443	49714	77.75.76.70	192.168.2.16
Oct 2, 2024 12:16:28.511315107 CEST	49714	443	192.168.2.16	77.75.76.70
Oct 2, 2024 12:16:28.511322975 CEST	443	49714	77.75.76.70	192.168.2.16
Oct 2, 2024 12:16:28.511341095 CEST	49714	443	192.168.2.16	77.75.76.70
Oct 2, 2024 12:16:28.511360884 CEST	49714	443	192.168.2.16	77.75.76.70
Oct 2, 2024 12:16:28.511759996 CEST	443	49714	77.75.76.70	192.168.2.16
Oct 2, 2024 12:16:28.511780024 CEST	443	49714	77.75.76.70	192.168.2.16
Oct 2, 2024 12:16:28.511826992 CEST	49714	443	192.168.2.16	77.75.76.70
Oct 2, 2024 12:16:28.511832952 CEST	443	49714	77.75.76.70	192.168.2.16
Oct 2, 2024 12:16:28.511877060 CEST	49714	443	192.168.2.16	77.75.76.70
Oct 2, 2024 12:16:28.511877060 CEST	49714	443	192.168.2.16	77.75.76.70
Oct 2, 2024 12:16:28.512682915 CEST	443	49714	77.75.76.70	192.168.2.16
Oct 2, 2024 12:16:28.512733936 CEST	443	49714	77.75.76.70	192.168.2.16
Oct 2, 2024 12:16:28.512754917 CEST	49714	443	192.168.2.16	77.75.76.70
Oct 2, 2024 12:16:28.512761116 CEST	443	49714	77.75.76.70	192.168.2.16
Oct 2, 2024 12:16:28.512773037 CEST	443	49714	77.75.76.70	192.168.2.16
Oct 2, 2024 12:16:28.512806892 CEST	49714	443	192.168.2.16	77.75.76.70
Oct 2, 2024 12:16:28.512806892 CEST	49714	443	192.168.2.16	77.75.76.70
Oct 2, 2024 12:16:28.517025948 CEST	49714	443	192.168.2.16	77.75.76.70
Oct 2, 2024 12:16:28.517047882 CEST	443	49714	77.75.76.70	192.168.2.16
Oct 2, 2024 12:16:28.724328041 CEST	443	49716	172.217.23.110	192.168.2.16
Oct 2, 2024 12:16:28.724401951 CEST	443	49716	172.217.23.110	192.168.2.16
Oct 2, 2024 12:16:28.724489927 CEST	49716	443	192.168.2.16	172.217.23.110
Oct 2, 2024 12:16:28.738569975 CEST	49716	443	192.168.2.16	172.217.23.110
Oct 2, 2024 12:16:28.738589048 CEST	443	49716	172.217.23.110	192.168.2.16
Oct 2, 2024 12:16:28.743408918 CEST	49715	443	192.168.2.16	172.217.23.110
Oct 2, 2024 12:16:28.787420988 CEST	443	49715	172.217.23.110	192.168.2.16
Oct 2, 2024 12:16:28.970798969 CEST	443	49715	172.217.23.110	192.168.2.16
Oct 2, 2024 12:16:28.970962048 CEST	49715	443	192.168.2.16	172.217.23.110
Oct 2, 2024 12:16:28.970976114 CEST	443	49715	172.217.23.110	192.168.2.16
Oct 2, 2024 12:16:28.971118927 CEST	49715	443	192.168.2.16	172.217.23.110
Oct 2, 2024 12:16:28.973375082 CEST	443	49715	172.217.23.110	192.168.2.16
Oct 2, 2024 12:16:28.973486900 CEST	443	49715	172.217.23.110	192.168.2.16
Oct 2, 2024 12:16:28.973582029 CEST	49715	443	192.168.2.16	172.217.23.110
Oct 2, 2024 12:16:28.978924990 CEST	49715	443	192.168.2.16	172.217.23.110
Oct 2, 2024 12:16:28.978924990 CEST	49715	443	192.168.2.16	172.217.23.110
Oct 2, 2024 12:16:28.978940964 CEST	443	49715	172.217.23.110	192.168.2.16
Oct 2, 2024 12:16:28.979074001 CEST	49715	443	192.168.2.16	172.217.23.110
Oct 2, 2024 12:16:28.985423088 CEST	49720	443	192.168.2.16	172.217.23.110
Oct 2, 2024 12:16:28.985475063 CEST	443	49720	172.217.23.110	192.168.2.16
Oct 2, 2024 12:16:28.985538960 CEST	49720	443	192.168.2.16	172.217.23.110
Oct 2, 2024 12:16:28.985594034 CEST	49721	443	192.168.2.16	172.217.23.110
Oct 2, 2024 12:16:28.985627890 CEST	443	49721	172.217.23.110	192.168.2.16
Oct 2, 2024 12:16:28.985696077 CEST	49721	443	192.168.2.16	172.217.23.110
Oct 2, 2024 12:16:28.985815048 CEST	49720	443	192.168.2.16	172.217.23.110
Oct 2, 2024 12:16:28.985832930 CEST	443	49720	172.217.23.110	192.168.2.16
Oct 2, 2024 12:16:28.985945940 CEST	49721	443	192.168.2.16	172.217.23.110
Oct 2, 2024 12:16:28.985961914 CEST	443	49721	172.217.23.110	192.168.2.16
Oct 2, 2024 12:16:29.607983112 CEST	49723	443	192.168.2.16	172.217.23.97
Oct 2, 2024 12:16:29.608019114 CEST	443	49723	172.217.23.97	192.168.2.16
Oct 2, 2024 12:16:29.608089924 CEST	49723	443	192.168.2.16	172.217.23.97
Oct 2, 2024 12:16:29.608309031 CEST	49723	443	192.168.2.16	172.217.23.97
Oct 2, 2024 12:16:29.608324051 CEST	443	49723	172.217.23.97	192.168.2.16
Oct 2, 2024 12:16:29.676769972 CEST	443	49720	172.217.23.110	192.168.2.16
Oct 2, 2024 12:16:29.676856041 CEST	49720	443	192.168.2.16	172.217.23.110
Oct 2, 2024 12:16:29.677228928 CEST	49720	443	192.168.2.16	172.217.23.110
Oct 2, 2024 12:16:29.677238941 CEST	443	49720	172.217.23.110	192.168.2.16
Oct 2, 2024 12:16:29.677428961 CEST	49720	443	192.168.2.16	172.217.23.110
Oct 2, 2024 12:16:29.677433968 CEST	443	49720	172.217.23.110	192.168.2.16
Oct 2, 2024 12:16:29.687725067 CEST	443	49721	172.217.23.110	192.168.2.16
Oct 2, 2024 12:16:29.687804937 CEST	49721	443	192.168.2.16	172.217.23.110
Oct 2, 2024 12:16:29.688175917 CEST	49721	443	192.168.2.16	172.217.23.110
Oct 2, 2024 12:16:29.688185930 CEST	443	49721	172.217.23.110	192.168.2.16
Oct 2, 2024 12:16:30.033360958 CEST	443	49720	172.217.23.110	192.168.2.16
Oct 2, 2024 12:16:30.033437967 CEST	49720	443	192.168.2.16	172.217.23.110
Oct 2, 2024 12:16:30.033464909 CEST	443	49720	172.217.23.110	192.168.2.16
Oct 2, 2024 12:16:30.033520937 CEST	49720	443	192.168.2.16	172.217.23.110
Oct 2, 2024 12:16:30.033528090 CEST	443	49720	172.217.23.110	192.168.2.16
Oct 2, 2024 12:16:30.033539057 CEST	443	49720	172.217.23.110	192.168.2.16
Oct 2, 2024 12:16:30.033581972 CEST	49720	443	192.168.2.16	172.217.23.110
Oct 2, 2024 12:16:30.040088892 CEST	49720	443	192.168.2.16	172.217.23.110
Oct 2, 2024 12:16:30.040121078 CEST	443	49720	172.217.23.110	192.168.2.16
Oct 2, 2024 12:16:30.040134907 CEST	49720	443	192.168.2.16	172.217.23.110
Oct 2, 2024 12:16:30.040170908 CEST	49720	443	192.168.2.16	172.217.23.110
Oct 2, 2024 12:16:30.043508053 CEST	49721	443	192.168.2.16	172.217.23.110
Oct 2, 2024 12:16:30.043533087 CEST	443	49721	172.217.23.110	192.168.2.16
Oct 2, 2024 12:16:30.284475088 CEST	443	49723	172.217.23.97	192.168.2.16
Oct 2, 2024 12:16:30.284976959 CEST	49723	443	192.168.2.16	172.217.23.97
Oct 2, 2024 12:16:30.285000086 CEST	443	49723	172.217.23.97	192.168.2.16
Oct 2, 2024 12:16:30.285516024 CEST	443	49723	172.217.23.97	192.168.2.16
Oct 2, 2024 12:16:30.285531998 CEST	443	49723	172.217.23.97	192.168.2.16
Oct 2, 2024 12:16:30.285583973 CEST	49723	443	192.168.2.16	172.217.23.97
Oct 2, 2024 12:16:30.285593033 CEST	443	49723	172.217.23.97	192.168.2.16
Oct 2, 2024 12:16:30.285623074 CEST	49723	443	192.168.2.16	172.217.23.97
Oct 2, 2024 12:16:30.285633087 CEST	49723	443	192.168.2.16	172.217.23.97
Oct 2, 2024 12:16:30.286524057 CEST	443	49723	172.217.23.97	192.168.2.16
Oct 2, 2024 12:16:30.288616896 CEST	49723	443	192.168.2.16	172.217.23.97
Oct 2, 2024 12:16:30.288700104 CEST	443	49723	172.217.23.97	192.168.2.16
Oct 2, 2024 12:16:30.288779974 CEST	49723	443	192.168.2.16	172.217.23.97
Oct 2, 2024 12:16:30.288786888 CEST	443	49723	172.217.23.97	192.168.2.16
Oct 2, 2024 12:16:30.331552982 CEST	49723	443	192.168.2.16	172.217.23.97
Oct 2, 2024 12:16:30.385545015 CEST	443	49721	172.217.23.110	192.168.2.16
Oct 2, 2024 12:16:30.385633945 CEST	49721	443	192.168.2.16	172.217.23.110
Oct 2, 2024 12:16:30.388180017 CEST	443	49721	172.217.23.110	192.168.2.16
Oct 2, 2024 12:16:30.388240099 CEST	49721	443	192.168.2.16	172.217.23.110

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Oct 2, 2024 12:16:02.314733982 CEST	192.168.2.16	1.1.1.1	0xf773	Standard query (0)	pack.google.com	A (IP address)	IN (0x0001)	false
Oct 2, 2024 12:16:21.385323048 CEST	192.168.2.16	1.1.1.1	0x4d3b	Standard query (0)	download.seznam.cz	A (IP address)	IN (0x0001)	false
Oct 2, 2024 12:16:26.181840897 CEST	192.168.2.16	1.1.1.1	0xfa59	Standard query (0)	picasa.google.com	A (IP address)	IN (0x0001)	false
Oct 2, 2024 12:16:26.448601961 CEST	192.168.2.16	1.1.1.1	0xf58b	Standard query (0)	picasa-readme.blogspot.com	A (IP address)	IN (0x0001)	false
Oct 2, 2024 12:16:27.180741072 CEST	192.168.2.16	1.1.1.1	0x2ba9	Standard query (0)	support.google.com	A (IP address)	IN (0x0001)	false
Oct 2, 2024 12:16:29.598407984 CEST	192.168.2.16	1.1.1.1	0xae61	Standard query (0)	clients2.googleusercontent.com	A (IP address)	IN (0x0001)	false
Oct 2, 2024 12:16:29.598625898 CEST	192.168.2.16	1.1.1.1	0xf269	Standard query (0)	clients2.googleusercontent.com	65	IN (0x0001)	false
Oct 2, 2024 12:16:30.993328094 CEST	192.168.2.16	1.1.1.1	0x12fb	Standard query (0)	lh3.googleusercontent.com	A (IP address)	IN (0x0001)	false
Oct 2, 2024 12:16:32.557159901 CEST	192.168.2.16	1.1.1.1	0xd8f6	Standard query (0)	chrome.cloudflare-dns.com	A (IP address)	IN (0x0001)	false
Oct 2, 2024 12:16:32.557391882 CEST	192.168.2.16	1.1.1.1	0x502a	Standard query (0)	chrome.cloudflare-dns.com	65	IN (0x0001)	false
Oct 2, 2024 12:16:32.557588100 CEST	192.168.2.16	1.1.1.1	0x63	Standard query (0)	chrome.cloudflare-dns.com	A (IP address)	IN (0x0001)	false
Oct 2, 2024 12:16:32.557749033 CEST	192.168.2.16	1.1.1.1	0x3525	Standard query (0)	chrome.cloudflare-dns.com	65	IN (0x0001)	false
Oct 2, 2024 12:16:32.649852037 CEST	192.168.2.16	1.1.1.1	0x553e	Standard query (0)	chrome.cloudflare-dns.com	A (IP address)	IN (0x0001)	false
Oct 2, 2024 12:16:32.650036097 CEST	192.168.2.16	1.1.1.1	0xf384	Standard query (0)	chrome.cloudflare-dns.com	65	IN (0x0001)	false
Oct 2, 2024 12:16:32.659455061 CEST	192.168.2.16	1.1.1.1	0x8ce2	Standard query (0)	apis.google.com	A (IP address)	IN (0x0001)	false
Oct 2, 2024 12:16:45.821433067 CEST	192.168.2.16	1.1.1.1	0xed46	Standard query (0)	apis.google.com	A (IP address)	IN (0x0001)	false
Oct 2, 2024 12:17:03.465837002 CEST	192.168.2.16	1.1.1.1	0x4963	Standard query (0)	h.imedia.cz	A (IP address)	IN (0x0001)	false
Oct 2, 2024 12:17:16.197205067 CEST	192.168.2.16	1.1.1.1	0x62ae	Standard query (0)	sentry.sklik.cz	A (IP address)	IN (0x0001)	false
Oct 2, 2024 12:17:25.577631950 CEST	192.168.2.16	1.1.1.1	0x5c9e	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false
Oct 2, 2024 12:17:25.577771902 CEST	192.168.2.16	1.1.1.1	0xa4e9	Standard query (0)	www.google.com	65	IN (0x0001)	false
Oct 2, 2024 12:17:37.062351942 CEST	192.168.2.16	1.1.1.1	0x981	Standard query (0)	sentry.sklik.cz	A (IP address)	IN (0x0001)	false
Oct 2, 2024 12:17:38.204901934 CEST	192.168.2.16	1.1.1.1	0x8c74	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false
Oct 2, 2024 12:17:38.204996109 CEST	192.168.2.16	1.1.1.1	0x1972	Standard query (0)	www.google.com	65	IN (0x0001)	false
Oct 2, 2024 12:17:49.614650011 CEST	192.168.2.16	1.1.1.1	0x73bd	Standard query (0)	clients2.googleusercontent.com	A (IP address)	IN (0x0001)	false
Oct 2, 2024 12:17:49.614774942 CEST	192.168.2.16	1.1.1.1	0xbaa4	Standard query (0)	clients2.googleusercontent.com	65	IN (0x0001)	false
Oct 2, 2024 12:17:49.615194082 CEST	192.168.2.16	1.1.1.1	0x5c	Standard query (0)	sentry.sklik.cz	A (IP address)	IN (0x0001)	false
Oct 2, 2024 12:17:51.349709988 CEST	192.168.2.16	1.1.1.1	0x4997	Standard query (0)	chrome.google.com	A (IP address)	IN (0x0001)	false
Oct 2, 2024 12:17:51.349802017 CEST	192.168.2.16	1.1.1.1	0xc55d	Standard query (0)	chrome.google.com	65	IN (0x0001)	false
Oct 2, 2024 12:17:52.469170094 CEST	192.168.2.16	1.1.1.1	0x794e	Standard query (0)	software.seznam.cz	A (IP address)	IN (0x0001)	false
Oct 2, 2024 12:17:52.469271898 CEST	192.168.2.16	1.1.1.1	0x502d	Standard query (0)	software.seznam.cz	65	IN (0x0001)	false
Oct 2, 2024 12:17:52.470803022 CEST	192.168.2.16	1.1.1.1	0xb753	Standard query (0)	h.seznam.cz	A (IP address)	IN (0x0001)	false
Oct 2, 2024 12:17:52.470901966 CEST	192.168.2.16	1.1.1.1	0xa62e	Standard query (0)	h.seznam.cz	65	IN (0x0001)	false
Oct 2, 2024 12:17:59.836375952 CEST	192.168.2.16	1.1.1.1	0xe1a8	Standard query (0)	software.seznam.cz	A (IP address)	IN (0x0001)	false
Oct 2, 2024 12:17:59.836616993 CEST	192.168.2.16	1.1.1.1	0xc62c	Standard query (0)	software.seznam.cz	65	IN (0x0001)	false
Oct 2, 2024 12:17:59.837037086 CEST	192.168.2.16	1.1.1.1	0x1044	Standard query (0)	h.seznam.cz	A (IP address)	IN (0x0001)	false
Oct 2, 2024 12:17:59.837186098 CEST	192.168.2.16	1.1.1.1	0x8768	Standard query (0)	h.seznam.cz	65	IN (0x0001)	false
Oct 2, 2024 12:18:00.674310923 CEST	192.168.2.16	1.1.1.1	0x4315	Standard query (0)	clients2.googleusercontent.com	A (IP address)	IN (0x0001)	false
Oct 2, 2024 12:18:00.674391031 CEST	192.168.2.16	1.1.1.1	0x9a89	Standard query (0)	clients2.googleusercontent.com	65	IN (0x0001)	false
Oct 2, 2024 12:18:02.479906082 CEST	192.168.2.16	1.1.1.1	0x5aad	Standard query (0)	chrome.google.com	A (IP address)	IN (0x0001)	false
Oct 2, 2024 12:18:02.479919910 CEST	192.168.2.16	1.1.1.1	0x3a06	Standard query (0)	chrome.google.com	65	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Oct 2, 2024 12:16:02.322657108 CEST	1.1.1.1	192.168.2.16	0xf773	No error (0)	pack.google.com	www2.l.google.com		CNAME (Canonical name)	IN (0x0001)	false
Oct 2, 2024 12:16:02.322657108 CEST	1.1.1.1	192.168.2.16	0xf773	No error (0)	www2.l.google.com		142.250.185.228	A (IP address)	IN (0x0001)	false
Oct 2, 2024 12:16:21.448381901 CEST	1.1.1.1	192.168.2.16	0x4d3b	No error (0)	download.seznam.cz		77.75.76.70	A (IP address)	IN (0x0001)	false
Oct 2, 2024 12:16:21.448381901 CEST	1.1.1.1	192.168.2.16	0x4d3b	No error (0)	download.seznam.cz		77.75.78.70	A (IP address)	IN (0x0001)	false
Oct 2, 2024 12:16:26.192095995 CEST	1.1.1.1	192.168.2.16	0xfa59	No error (0)	picasa.google.com	www2.l.google.com		CNAME (Canonical name)	IN (0x0001)	false
Oct 2, 2024 12:16:26.192095995 CEST	1.1.1.1	192.168.2.16	0xfa59	No error (0)	www2.l.google.com		172.217.23.100	A (IP address)	IN (0x0001)	false
Oct 2, 2024 12:16:26.482245922 CEST	1.1.1.1	192.168.2.16	0xf58b	No error (0)	picasa-readme.blogspot.com	blogspot.l.googleusercontent.com		CNAME (Canonical name)	IN (0x0001)	false
Oct 2, 2024 12:16:26.482245922 CEST	1.1.1.1	192.168.2.16	0xf58b	No error (0)	blogspot.l.googleusercontent.com		142.250.185.161	A (IP address)	IN (0x0001)	false
Oct 2, 2024 12:16:27.187695980 CEST	1.1.1.1	192.168.2.16	0x2ba9	No error (0)	support.google.com		172.217.23.110	A (IP address)	IN (0x0001)	false
Oct 2, 2024 12:16:29.606112003 CEST	1.1.1.1	192.168.2.16	0xae61	No error (0)	clients2.googleusercontent.com	googlehosted.l.googleusercontent.com		CNAME (Canonical name)	IN (0x0001)	false
Oct 2, 2024 12:16:29.606112003 CEST	1.1.1.1	192.168.2.16	0xae61	No error (0)	googlehosted.l.googleusercontent.com		172.217.23.97	A (IP address)	IN (0x0001)	false
Oct 2, 2024 12:16:29.607366085 CEST	1.1.1.1	192.168.2.16	0xf269	No error (0)	clients2.googleusercontent.com	googlehosted.l.googleusercontent.com		CNAME (Canonical name)	IN (0x0001)	false
Oct 2, 2024 12:16:30.984013081 CEST	1.1.1.1	192.168.2.16	0xbc	No error (0)	scdn1f005.wpc.ad629.nucdn.net	sni1gl.wpc.nucdn.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 2, 2024 12:16:30.984965086 CEST	1.1.1.1	192.168.2.16	0x3e01	No error (0)	scdn1f005.wpc.ad629.nucdn.net	sni1gl.wpc.nucdn.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 2, 2024 12:16:30.984965086 CEST	1.1.1.1	192.168.2.16	0x3e01	No error (0)	sni1gl.wpc.nucdn.net		152.199.21.175	A (IP address)	IN (0x0001)	false
Oct 2, 2024 12:16:31.047714949 CEST	1.1.1.1	192.168.2.16	0x12fb	No error (0)	lh3.googleusercontent.com	googlehosted.l.googleusercontent.com		CNAME (Canonical name)	IN (0x0001)	false
Oct 2, 2024 12:16:31.047714949 CEST	1.1.1.1	192.168.2.16	0x12fb	No error (0)	googlehosted.l.googleusercontent.com		142.250.186.65	A (IP address)	IN (0x0001)	false
Oct 2, 2024 12:16:32.028748035 CEST	1.1.1.1	192.168.2.16	0xe35b	No error (0)	scdn1f005.wpc.ad629.nucdn.net	sni1gl.wpc.nucdn.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 2, 2024 12:16:32.028748035 CEST	1.1.1.1	192.168.2.16	0xe35b	No error (0)	sni1gl.wpc.nucdn.net		152.199.21.175	A (IP address)	IN (0x0001)	false
Oct 2, 2024 12:16:32.030133963 CEST	1.1.1.1	192.168.2.16	0xcdee	No error (0)	scdn1f005.wpc.ad629.nucdn.net	sni1gl.wpc.nucdn.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 2, 2024 12:16:32.564697027 CEST	1.1.1.1	192.168.2.16	0xd8f6	No error (0)	chrome.cloudflare-dns.com		172.64.41.3	A (IP address)	IN (0x0001)	false
Oct 2, 2024 12:16:32.564697027 CEST	1.1.1.1	192.168.2.16	0xd8f6	No error (0)	chrome.cloudflare-dns.com		162.159.61.3	A (IP address)	IN (0x0001)	false
Oct 2, 2024 12:16:32.564711094 CEST	1.1.1.1	192.168.2.16	0x502a	No error (0)	chrome.cloudflare-dns.com			65	IN (0x0001)	false
Oct 2, 2024 12:16:32.565217018 CEST	1.1.1.1	192.168.2.16	0x3525	No error (0)	chrome.cloudflare-dns.com			65	IN (0x0001)	false
Oct 2, 2024 12:16:32.565746069 CEST	1.1.1.1	192.168.2.16	0x63	No error (0)	chrome.cloudflare-dns.com		172.64.41.3	A (IP address)	IN (0x0001)	false
Oct 2, 2024 12:16:32.565746069 CEST	1.1.1.1	192.168.2.16	0x63	No error (0)	chrome.cloudflare-dns.com		162.159.61.3	A (IP address)	IN (0x0001)	false
Oct 2, 2024 12:16:32.677613020 CEST	1.1.1.1	192.168.2.16	0xf384	No error (0)	chrome.cloudflare-dns.com			65	IN (0x0001)	false
Oct 2, 2024 12:16:32.677627087 CEST	1.1.1.1	192.168.2.16	0x553e	No error (0)	chrome.cloudflare-dns.com		162.159.61.3	A (IP address)	IN (0x0001)	false
Oct 2, 2024 12:16:32.677627087 CEST	1.1.1.1	192.168.2.16	0x553e	No error (0)	chrome.cloudflare-dns.com		172.64.41.3	A (IP address)	IN (0x0001)	false
Oct 2, 2024 12:16:32.686394930 CEST	1.1.1.1	192.168.2.16	0x8ce2	No error (0)	apis.google.com	plus.l.google.com		CNAME (Canonical name)	IN (0x0001)	false
Oct 2, 2024 12:16:32.686394930 CEST	1.1.1.1	192.168.2.16	0x8ce2	No error (0)	plus.l.google.com		142.250.185.174	A (IP address)	IN (0x0001)	false
Oct 2, 2024 12:16:34.838638067 CEST	1.1.1.1	192.168.2.16	0xb763	No error (0)	scdn1f005.wpc.ad629.nucdn.net	sni1gl.wpc.nucdn.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 2, 2024 12:16:34.838638067 CEST	1.1.1.1	192.168.2.16	0xb763	No error (0)	sni1gl.wpc.nucdn.net		152.199.21.175	A (IP address)	IN (0x0001)	false
Oct 2, 2024 12:16:35.059930086 CEST	1.1.1.1	192.168.2.16	0xb763	No error (0)	scdn1f005.wpc.ad629.nucdn.net	sni1gl.wpc.nucdn.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 2, 2024 12:16:35.059930086 CEST	1.1.1.1	192.168.2.16	0xb763	No error (0)	sni1gl.wpc.nucdn.net		152.199.21.175	A (IP address)	IN (0x0001)	false
Oct 2, 2024 12:16:36.070111036 CEST	1.1.1.1	192.168.2.16	0xb763	No error (0)	scdn1f005.wpc.ad629.nucdn.net	sni1gl.wpc.nucdn.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 2, 2024 12:16:36.070111036 CEST	1.1.1.1	192.168.2.16	0xb763	No error (0)	sni1gl.wpc.nucdn.net		152.199.21.175	A (IP address)	IN (0x0001)	false
Oct 2, 2024 12:16:38.084070921 CEST	1.1.1.1	192.168.2.16	0xb763	No error (0)	scdn1f005.wpc.ad629.nucdn.net	sni1gl.wpc.nucdn.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 2, 2024 12:16:38.084070921 CEST	1.1.1.1	192.168.2.16	0xb763	No error (0)	sni1gl.wpc.nucdn.net		152.199.21.175	A (IP address)	IN (0x0001)	false
Oct 2, 2024 12:16:42.089453936 CEST	1.1.1.1	192.168.2.16	0xb763	No error (0)	scdn1f005.wpc.ad629.nucdn.net	sni1gl.wpc.nucdn.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 2, 2024 12:16:42.089453936 CEST	1.1.1.1	192.168.2.16	0xb763	No error (0)	sni1gl.wpc.nucdn.net		152.199.21.175	A (IP address)	IN (0x0001)	false
Oct 2, 2024 12:16:45.829086065 CEST	1.1.1.1	192.168.2.16	0xed46	No error (0)	apis.google.com	plus.l.google.com		CNAME (Canonical name)	IN (0x0001)	false
Oct 2, 2024 12:16:45.829086065 CEST	1.1.1.1	192.168.2.16	0xed46	No error (0)	plus.l.google.com		142.250.186.46	A (IP address)	IN (0x0001)	false
Oct 2, 2024 12:17:03.474505901 CEST	1.1.1.1	192.168.2.16	0x4963	No error (0)	h.imedia.cz		77.75.78.30	A (IP address)	IN (0x0001)	false
Oct 2, 2024 12:17:03.474505901 CEST	1.1.1.1	192.168.2.16	0x4963	No error (0)	h.imedia.cz		77.75.76.30	A (IP address)	IN (0x0001)	false
Oct 2, 2024 12:17:25.584803104 CEST	1.1.1.1	192.168.2.16	0x5c9e	No error (0)	www.google.com		216.58.206.36	A (IP address)	IN (0x0001)	false
Oct 2, 2024 12:17:25.585078001 CEST	1.1.1.1	192.168.2.16	0xa4e9	No error (0)	www.google.com			65	IN (0x0001)	false
Oct 2, 2024 12:17:38.219139099 CEST	1.1.1.1	192.168.2.16	0x8c74	No error (0)	www.google.com		216.58.206.68	A (IP address)	IN (0x0001)	false
Oct 2, 2024 12:17:38.219166994 CEST	1.1.1.1	192.168.2.16	0x1972	No error (0)	www.google.com			65	IN (0x0001)	false
Oct 2, 2024 12:17:49.629709005 CEST	1.1.1.1	192.168.2.16	0x73bd	No error (0)	clients2.googleusercontent.com	googlehosted.l.googleusercontent.com		CNAME (Canonical name)	IN (0x0001)	false
Oct 2, 2024 12:17:49.629709005 CEST	1.1.1.1	192.168.2.16	0x73bd	No error (0)	googlehosted.l.googleusercontent.com		142.250.184.225	A (IP address)	IN (0x0001)	false
Oct 2, 2024 12:17:49.630462885 CEST	1.1.1.1	192.168.2.16	0xbaa4	No error (0)	clients2.googleusercontent.com	googlehosted.l.googleusercontent.com		CNAME (Canonical name)	IN (0x0001)	false
Oct 2, 2024 12:17:51.357132912 CEST	1.1.1.1	192.168.2.16	0x4997	No error (0)	chrome.google.com	www3.l.google.com		CNAME (Canonical name)	IN (0x0001)	false
Oct 2, 2024 12:17:51.357132912 CEST	1.1.1.1	192.168.2.16	0x4997	No error (0)	www3.l.google.com		142.250.186.174	A (IP address)	IN (0x0001)	false
Oct 2, 2024 12:17:51.359018087 CEST	1.1.1.1	192.168.2.16	0xc55d	No error (0)	chrome.google.com	www3.l.google.com		CNAME (Canonical name)	IN (0x0001)	false
Oct 2, 2024 12:17:52.479468107 CEST	1.1.1.1	192.168.2.16	0xb753	No error (0)	h.seznam.cz		77.75.78.30	A (IP address)	IN (0x0001)	false
Oct 2, 2024 12:17:52.479468107 CEST	1.1.1.1	192.168.2.16	0xb753	No error (0)	h.seznam.cz		77.75.76.30	A (IP address)	IN (0x0001)	false
Oct 2, 2024 12:17:52.493208885 CEST	1.1.1.1	192.168.2.16	0x794e	No error (0)	software.seznam.cz	api.software.seznam.cz		CNAME (Canonical name)	IN (0x0001)	false
Oct 2, 2024 12:17:52.493208885 CEST	1.1.1.1	192.168.2.16	0x794e	No error (0)	api.software.seznam.cz		77.75.77.161	A (IP address)	IN (0x0001)	false
Oct 2, 2024 12:17:52.493208885 CEST	1.1.1.1	192.168.2.16	0x794e	No error (0)	api.software.seznam.cz		77.75.79.161	A (IP address)	IN (0x0001)	false
Oct 2, 2024 12:17:52.493863106 CEST	1.1.1.1	192.168.2.16	0x502d	No error (0)	software.seznam.cz	api.software.seznam.cz		CNAME (Canonical name)	IN (0x0001)	false
Oct 2, 2024 12:17:59.845935106 CEST	1.1.1.1	192.168.2.16	0x1044	No error (0)	h.seznam.cz		77.75.76.30	A (IP address)	IN (0x0001)	false
Oct 2, 2024 12:17:59.845935106 CEST	1.1.1.1	192.168.2.16	0x1044	No error (0)	h.seznam.cz		77.75.78.30	A (IP address)	IN (0x0001)	false
Oct 2, 2024 12:17:59.863442898 CEST	1.1.1.1	192.168.2.16	0xe1a8	No error (0)	software.seznam.cz	api.software.seznam.cz		CNAME (Canonical name)	IN (0x0001)	false
Oct 2, 2024 12:17:59.863442898 CEST	1.1.1.1	192.168.2.16	0xe1a8	No error (0)	api.software.seznam.cz		77.75.77.161	A (IP address)	IN (0x0001)	false
Oct 2, 2024 12:17:59.863442898 CEST	1.1.1.1	192.168.2.16	0xe1a8	No error (0)	api.software.seznam.cz		77.75.79.161	A (IP address)	IN (0x0001)	false
Oct 2, 2024 12:17:59.881932974 CEST	1.1.1.1	192.168.2.16	0xc62c	No error (0)	software.seznam.cz	api.software.seznam.cz		CNAME (Canonical name)	IN (0x0001)	false
Oct 2, 2024 12:18:00.681726933 CEST	1.1.1.1	192.168.2.16	0x9a89	No error (0)	clients2.googleusercontent.com	googlehosted.l.googleusercontent.com		CNAME (Canonical name)	IN (0x0001)	false
Oct 2, 2024 12:18:00.699428082 CEST	1.1.1.1	192.168.2.16	0x4315	No error (0)	clients2.googleusercontent.com	googlehosted.l.googleusercontent.com		CNAME (Canonical name)	IN (0x0001)	false
Oct 2, 2024 12:18:00.699428082 CEST	1.1.1.1	192.168.2.16	0x4315	No error (0)	googlehosted.l.googleusercontent.com		142.250.184.225	A (IP address)	IN (0x0001)	false
Oct 2, 2024 12:18:02.486397982 CEST	1.1.1.1	192.168.2.16	0x5aad	No error (0)	chrome.google.com	www3.l.google.com		CNAME (Canonical name)	IN (0x0001)	false
Oct 2, 2024 12:18:02.486397982 CEST	1.1.1.1	192.168.2.16	0x5aad	No error (0)	www3.l.google.com		216.58.212.142	A (IP address)	IN (0x0001)	false
Oct 2, 2024 12:18:02.487445116 CEST	1.1.1.1	192.168.2.16	0x3a06	No error (0)	chrome.google.com	www3.l.google.com		CNAME (Canonical name)	IN (0x0001)	false

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.16	49705	142.250.185.228	80	5508	C:\Windows\SysWOW64\GPhotos.scr

Timestamp	Bytes transferred	Direction	Data
Oct 2, 2024 12:16:02.334244967 CEST	248	OUT	GET /gphotos?action=install&hl=en&gl=ch&brand=GGLA&scrid=AD0E3D47-9B39-483F-83C6-9B8C783457F6&v=(null) HTTP/1.1 Accept: / Accept-Encoding: gzip User-Agent: Google Photos Screensaver 2.0 (gzip) Host: pack.google.com Connection: Keep-Alive
Oct 2, 2024 12:16:03.048310041 CEST	1236	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=UTF-8 Referrer-Policy: no-referrer Content-Length: 1568 Date: Wed, 02 Oct 2024 10:16:02 GMT Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 65 6e 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 0a 20 20 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 73 74 79 6c 65 3e 0a 20 20 20 20 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 [TRUNCATED] Data Ascii: <!DOCTYPE html><html lang=en> <meta charset=utf-8> <meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"> <title>Error 404 (Not Found)!!1</title> <style> {margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x54dp.png) no-repeat 0% 0%/100% 100%;-moz-border-image:url(//www.google.com/i [TRUNCATED]
Oct 2, 2024 12:16:03.048327923 CEST	487	IN	Data Raw: 20 6f 6e 6c 79 20 73 63 72 65 65 6e 20 61 6e 64 20 28 2d 77 65 62 6b 69 74 2d 6d 69 6e 2d 64 65 76 69 63 65 2d 70 69 78 65 6c 2d 72 61 74 69 6f 3a 32 29 7b 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f Data Ascii: only screen and (-webkit-min-device-pixel-ratio:2){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x54dp.png) no-repeat;-webkit-background-size:100% 100%}}#logo{display:inline-block;height:54px;width:15

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.16	49707	77.75.76.70	80	7028	C:\Users\user\AppData\Roaming\Seznam.cz\sznsetup-lt.exe

Timestamp	Bytes transferred	Direction	Data
Oct 2, 2024 12:16:21.458539009 CEST	63	OUT	GET /update/packages.inf HTTP/1.1 Host: download.seznam.cz
Oct 2, 2024 12:16:22.113296986 CEST	163	IN	HTTP/1.1 301 Moved Permanently location: https://download.seznam.cz/update/packages.inf date: Wed, 02 Oct 2024 10:16:21 GMT server: envoy content-length: 0
Oct 2, 2024 12:16:23.519866943 CEST	94	OUT	GET /update/cz.seznam.software.sznsetup-1.2.7-win32.zip HTTP/1.1 Host: download.seznam.cz
Oct 2, 2024 12:16:23.979949951 CEST	194	IN	HTTP/1.1 301 Moved Permanently location: https://download.seznam.cz/update/cz.seznam.software.sznsetup-1.2.7-win32.zip date: Wed, 02 Oct 2024 10:16:23 GMT server: envoy content-length: 0
Oct 2, 2024 12:16:26.475071907 CEST	97	OUT	GET /update/cz.seznam.software.szninstall-1.1.15-win32.zip HTTP/1.1 Host: download.seznam.cz
Oct 2, 2024 12:16:26.672422886 CEST	197	IN	HTTP/1.1 301 Moved Permanently location: https://download.seznam.cz/update/cz.seznam.software.szninstall-1.1.15-win32.zip date: Wed, 02 Oct 2024 10:16:26 GMT server: envoy content-length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.16	49711	142.250.185.161	80	6516	C:\Program Files (x86)\Google\Picasa3\Picasa3.exe

Timestamp	Bytes transferred	Direction	Data
Oct 2, 2024 12:16:26.490330935 CEST	170	OUT	GET /feeds/posts/default HTTP/1.1 Accept: / Accept-Encoding: gzip User-Agent: Picasa/3.9.141.255 (gzip) Host: picasa-readme.blogspot.com Connection: Keep-Alive
Oct 2, 2024 12:16:27.294347048 CEST	1236	IN	HTTP/1.1 200 OK Cross-Origin-Resource-Policy: cross-origin Content-Encoding: gzip ETag: W/"c0cf1b4023295e310be6a0c4867471a65178b3c614f7cf80069684d27704e64f" Date: Wed, 02 Oct 2024 10:16:27 GMT Content-Type: application/atom+xml; charset=UTF-8 Server: blogger-renderd Cache-Control: public, must-revalidate, proxy-revalidate, max-age=1 Vary: Accept-Encoding Expires: Wed, 02 Oct 2024 10:16:28 GMT X-Content-Type-Options: nosniff X-XSS-Protection: 0 Last-Modified: Wed, 28 Aug 2024 14:47:25 GMT Content-Length: 9776 X-Frame-Options: SAMEORIGIN Data Raw: 1f 8b 08 00 00 00 00 00 00 03 ed 7d d9 72 db c8 d2 e6 7d 3f 05 da 27 e2 d8 1d 16 48 2c 04 37 cb 3e 23 c9 4b ab 6d d9 b2 2d b7 ed be e9 00 81 22 09 13 04 60 2c a2 e8 ab 7e 88 b9 99 88 7f 22 fe 98 47 f9 1f a5 9f 64 32 b3 0a 1b 09 6e 12 25 ca 6e 75 d8 6d 89 04 0a 59 59 55 99 5f ae d8 ff cf c5 d8 95 ce 59 18 39 be f7 f8 be 5a 53 ee 4b cc b3 7c db f1 06 8f ef 7f 38 7b 2e b7 ef ff e7 c9 3e 5e 25 47 f1 d4 65 d1 90 b1 58 1a 86 ac ff f8 de 30 8e 83 6e bd 3e 99 4c 6a 3d d7 1f 0c 58 58 b3 fc 71 9d 5f 57 37 63 7f 5c b3 a2 e8 9e 14 4f 03 f6 f8 5e cc 2e e2 3a fe 0e e3 f5 19 b3 25 18 d3 8b 1e df 2f 8c 32 d1 6b 7e 38 a8 6b 8a 62 d4 0f e0 f6 fb fc 9a ae 1f 30 ef 3d 33 43 6b 98 5d 6e 76 e8 59 72 3d 0a 98 55 c7 0b 22 ba 20 8c a2 3a cc a2 9e de 2a 08 cb ee 8b ac 21 1b 9b 51 6d e0 fb 03 97 d1 18 e2 12 7c 6c 3b bd 6d c0 7c 18 a9 44 1c ff 88 08 e4 3f 66 d7 da 19 2b 2a 46 e7 d3 b9 27 ae 8d 87 39 29 41 12 ba 34 5c 34 f5 6c c7 32 63 58 82 3a 5c c0 4c 1b a7 70 ff c9 be 63 3f 89 cd 41 b7 c0 dc 3d b5 d3 e9 d0 07 b2 da 30 9a 46 [TRUNCATED] Data Ascii: }r}?'H,7>#Km-"`,~"Gd2n%numYYU_Y9ZSK\|8{.>^%GeX0n>Lj=XXq_W7c\O^.:%/2k~8kb0=3Ck]nvYr=U" :!Qm\|l;m\|D?f+F'9)A4\4l2cX:\Lpc?A=0F4V6I`1hVjFilS)f=3}]W>'gC&); 'Q+0.L~du2wzp}1n!W.I$1~LHQ=8o&n\|^%bnGnx>~z,{=w'VqfoMzzj0C?\|cD,3ud?'&~qYZhJSacCUy]gl!&w&$P0]19->N
Oct 2, 2024 12:16:27.294408083 CEST	1236	IN	Data Raw: 39 e3 81 4a 34 e3 5f 1a 07 3e a9 f7 d4 a6 1c fa 89 67 33 bb 36 70 fa c8 86 7a ca 87 01 f3 58 08 2b 1e e6 e2 b0 55 53 40 1e c2 7c 16 2d fd fd 27 87 fc 97 fd 7a 76 fb 93 fd 5c 5c 75 63 3f 36 dd 77 2c 82 e5 8f 9e a8 c0 9c 45 df 15 6f 8a 62 33 8c 8f Data Ascii: 9J4_>g36pzX+US@\|-'zv\\uc?6w,Eob3'jS7hFwrXMtp[\6sP(rT]V9SAh hj*rBjF(sBj^;P}_(S&,a%qo7~&~Hv<:<H[n~nj
Oct 2, 2024 12:16:27.294440985 CEST	1236	IN	Data Raw: a2 bf f4 f9 63 bd 63 28 4a f6 61 ec c3 9d 8f 55 c0 e7 1d 4d d9 50 9c 5d 7e 79 51 bd d7 36 11 51 57 f0 61 cc 3f c6 75 b2 e3 5b 2f 1c e5 db 25 63 40 6f cf bb 48 c4 33 2c 86 40 ba 30 d4 4f 33 ee cf 85 40 bb d9 52 1b 0d 1d ac 50 b5 69 b4 3a 7a e7 52 Data Ascii: cc(JaUMP]~yQ6QWa?u[/%c@oH3,@0O3@RPi:zRO0Rh"+*;!jPkc?4'^Fo:>7?fP_}u_=\|y7e"XA4w~~B\k>}m8TrQQseTPsd
Oct 2, 2024 12:16:27.294661045 CEST	1236	IN	Data Raw: 3f b0 4f aa 91 f4 de 7e 0e 3e 7d f8 b5 77 72 fc d5 ef 1c 47 1f 47 07 f2 e9 ab f3 af 6f e5 61 78 fe 9b f1 b6 f7 5c 7d d7 ac 47 6a 53 51 ea ef 2d 8c cb 3d 8c 60 4d 1e 6a 8a aa ca 98 2d d5 7e 68 c6 0f d5 9a d1 aa 19 fa c3 d3 93 5a e0 a5 ae 7e 4a 21 Data Ascii: ?O~>}wrGGoax\}GjSQ-=`Mj-~hZ~J!3=k>63'g?{~ht4}dkz\|%eZ}^gNo`=M1DUx7*[O;9i[--UV<VgCi{?^
Oct 2, 2024 12:16:27.294692993 CEST	1236	IN	Data Raw: a7 48 4a fe 91 00 12 80 38 8f 78 5d 80 b9 c0 ce 8e fc 7e 3c 41 e7 a8 53 d8 5f dc ee 8e 99 eb 8a 92 59 2c 40 e0 e4 f2 e6 17 a5 7c 31 ba db 83 59 59 98 8d 48 cd c9 38 f0 22 b2 76 89 a0 2a c4 f6 4e 10 d4 4a 3a b6 84 a0 94 3a fc 49 11 54 5b 06 21 2c Data Ascii: HJ8x]~<AS_Y,@\|1YYH8"vNJ::IT[!,gk9kFVi7ZF[ha(mYmPDjZ#U]Cw%56K!R}@,XQ,y`QTK-IOY<IE"G*d&+&Ct@Q
Oct 2, 2024 12:16:27.294724941 CEST	1236	IN	Data Raw: 12 87 85 8b 49 aa f0 f4 21 e0 13 1d ad 44 54 95 96 43 b8 68 48 6b a4 ee 9f 3c fc 05 d8 cb f1 ce 9d 12 80 f2 c3 28 73 e6 60 17 2e b1 aa 69 37 ab 14 66 e6 51 61 01 aa 80 d8 34 f3 83 f6 86 e8 ae 55 2b 78 29 66 27 ca 9d 4c 79 f3 57 ba 0f 73 91 82 48 Data Ascii: I!DTChHk<(s`.i7fQa4U+x)f'LyWsHiv &#l$NJx)\|HyKAEScnS]nni7[;-&#R@h:@]d30TcL!.\[J"_s)7axo/x{-
Oct 2, 2024 12:16:27.294758081 CEST	1236	IN	Data Raw: 53 f8 20 b4 39 3a 4c 13 14 85 f3 28 4b 39 ab f0 a4 a5 59 64 51 cc 82 cb b3 e3 12 22 ae 80 36 71 23 9a 20 8d 29 03 11 b0 10 ad 5a 90 79 51 97 ee 7a 3a d0 6f 13 94 1d 67 e6 80 7e c3 b2 1e 8b 07 d0 d1 9d 58 e6 a6 c8 0a 24 0e a2 b4 9c ed 48 43 e7 5a Data Ascii: S 9:L(K9YdQ"6q# )ZyQz:og~X$HCZTJjx>qt2tq]HUm)Ust>t'>tl%5=}VZSYhs\Wj)lk:R;\|\|6@J\dYI{V]><(Rj/
Oct 2, 2024 12:16:27.295093060 CEST	1236	IN	Data Raw: a7 2f 9f 7f b1 f4 3f 27 e1 68 59 18 f2 47 88 b8 6e 32 d5 dd 87 55 d7 dd 02 4b c3 aa 9b 82 98 45 97 64 e3 ec 34 d9 70 1e 7d ef 26 d9 70 15 1d db 33 10 d5 f4 12 10 8e f2 d8 b4 64 94 e1 b2 2a cc 43 5d 51 00 db 57 1a 88 6b d8 04 77 56 e2 35 59 89 86 Data Ascii: /?'hYGn2UKEd4p}&p3d*C]QWkwV5Y_KW;ZG1Vb+toc%fw4D<tJ.1CUjZ\|:yYf#z~8pJD_}1atNcN{g/BX5y}hQ;y^,T
Oct 2, 2024 12:16:27.295209885 CEST	447	IN	Data Raw: c5 9e 88 60 ad c7 d2 41 4b 03 cd f7 da 19 c1 35 4f 5b 8a c2 a5 ff 1b 77 3a 0e 00 07 3c 93 0d 4d 59 dd a1 2e 6f e7 23 8c 59 de 3a a7 b2 a3 4f da bc 67 c1 80 a2 bb cc ef 2b 4b 6b 17 25 47 04 33 c9 11 22 9d e4 05 7e 49 0f e0 c5 b4 48 ca 00 9b 5f 26 Data Ascii: `AK5O[w:<MY.o#Y:Og+Kk%G3"~IH_&QVn;DY"RThtlM(:1FKkuLAbMkjD&jD45:NS#Q(t/DQu_zR{R>MY5+\#H0O5\{u9

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.16	49713	172.217.23.100	80	3184	C:\Program Files (x86)\Internet Explorer\iexplore.exe

Timestamp	Bytes transferred	Direction	Data
Oct 2, 2024 12:16:26.529124975 CEST	304	OUT	GET /support/bin/answer.py?hl=en&answer=93773 HTTP/1.1 Accept: text/html, application/xhtml+xml, image/jxr, / Accept-Language: en-CH User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko Accept-Encoding: gzip, deflate Host: picasa.google.com Connection: Keep-Alive
Oct 2, 2024 12:16:27.165036917 CEST	631	IN	HTTP/1.1 301 Moved Permanently Location: https://support.google.com/picasa/answer/93773?hl=en Date: Wed, 02 Oct 2024 10:16:27 GMT Expires: Wed, 02 Oct 2024 10:16:27 GMT Cache-Control: private, max-age=0 Content-Type: text/html; charset=UTF-8 X-Content-Type-Options: nosniff Server: support-content-ui Content-Length: 249 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Data Raw: 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 63 6f 6e 74 65 6e 74 2d 74 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 3e 0a 3c 54 49 54 4c 45 3e 33 30 31 20 4d 6f 76 65 64 3c 2f 54 49 54 4c 45 3e 3c 2f 48 45 41 44 3e 3c 42 4f 44 59 3e 0a 3c 48 31 3e 33 30 31 20 4d 6f 76 65 64 3c 2f 48 31 3e 0a 54 68 65 20 64 6f 63 75 6d 65 6e 74 20 68 61 73 20 6d 6f 76 65 64 0a 3c 41 20 48 52 45 46 3d 22 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 70 69 63 61 73 61 2f 61 6e 73 77 65 72 2f 39 33 37 37 33 3f 68 6c 3d 65 6e 22 3e 68 65 72 65 3c 2f 41 3e 2e 0d 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0d 0a Data Ascii: <HTML><HEAD><meta http-equiv="content-type" content="text/html;charset=utf-8"><TITLE>301 Moved</TITLE></HEAD><BODY><H1>301 Moved</H1>The document has moved<A HREF="https://support.google.com/picasa/answer/93773?hl=en">here</A>.</BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.16	49765	77.75.76.70	80	3540	C:\Users\user\AppData\Roaming\Seznam.cz\sznsetup.exe

Timestamp	Bytes transferred	Direction	Data
Oct 2, 2024 12:16:34.835464001 CEST	63	OUT	GET /update/packages.inf HTTP/1.1 Host: download.seznam.cz
Oct 2, 2024 12:16:35.593621969 CEST	163	IN	HTTP/1.1 301 Moved Permanently location: https://download.seznam.cz/update/packages.inf date: Wed, 02 Oct 2024 10:16:35 GMT server: envoy content-length: 0
Oct 2, 2024 12:16:36.891760111 CEST	104	OUT	GET /update/cz.seznam.software.lightspeed-1210-12.10.18-win32.zip HTTP/1.1 Host: download.seznam.cz
Oct 2, 2024 12:16:37.099065065 CEST	204	IN	HTTP/1.1 301 Moved Permanently location: https://download.seznam.cz/update/cz.seznam.software.lightspeed-1210-12.10.18-win32.zip date: Wed, 02 Oct 2024 10:16:36 GMT server: envoy content-length: 0
Oct 2, 2024 12:16:38.771804094 CEST	100	OUT	GET /update/cz.seznam.software.libszndesktop-2.1.35-win32.zip HTTP/1.1 Host: download.seznam.cz
Oct 2, 2024 12:16:38.974817991 CEST	200	IN	HTTP/1.1 301 Moved Permanently location: https://download.seznam.cz/update/cz.seznam.software.libszndesktop-2.1.35-win32.zip date: Wed, 02 Oct 2024 10:16:38 GMT server: envoy content-length: 0
Oct 2, 2024 12:16:41.150942087 CEST	97	OUT	GET /update/cz.seznam.software.szndesktop-2.0.32-win32.zip HTTP/1.1 Host: download.seznam.cz
Oct 2, 2024 12:16:41.372847080 CEST	197	IN	HTTP/1.1 301 Moved Permanently location: https://download.seznam.cz/update/cz.seznam.software.szndesktop-2.0.32-win32.zip date: Wed, 02 Oct 2024 10:16:41 GMT server: envoy content-length: 0
Oct 2, 2024 12:16:42.852914095 CEST	95	OUT	GET /update/cz.seznam.software.libfoxcub-3.3.8-win32.zip HTTP/1.1 Host: download.seznam.cz
Oct 2, 2024 12:16:43.050888062 CEST	195	IN	HTTP/1.1 301 Moved Permanently location: https://download.seznam.cz/update/cz.seznam.software.libfoxcub-3.3.8-win32.zip date: Wed, 02 Oct 2024 10:16:42 GMT server: envoy content-length: 0
Oct 2, 2024 12:16:46.094790936 CEST	97	OUT	GET /update/cz.seznam.software.libfoxcub64-3.3.8-win32.zip HTTP/1.1 Host: download.seznam.cz
Oct 2, 2024 12:16:46.292402983 CEST	197	IN	HTTP/1.1 301 Moved Permanently location: https://download.seznam.cz/update/cz.seznam.software.libfoxcub64-3.3.8-win32.zip date: Wed, 02 Oct 2024 10:16:45 GMT server: envoy content-length: 0
Oct 2, 2024 12:16:48.401732922 CEST	97	OUT	GET /update/cz.seznam.software.ielisticka3-3.3.5-win32.zip HTTP/1.1 Host: download.seznam.cz
Oct 2, 2024 12:16:48.599261045 CEST	197	IN	HTTP/1.1 301 Moved Permanently location: https://download.seznam.cz/update/cz.seznam.software.ielisticka3-3.3.5-win32.zip date: Wed, 02 Oct 2024 10:16:48 GMT server: envoy content-length: 0
Oct 2, 2024 12:16:49.720643044 CEST	90	OUT	GET /update/szn-software-fflisticka-4.0.8-win32.zip HTTP/1.1 Host: download.seznam.cz
Oct 2, 2024 12:16:49.917794943 CEST	190	IN	HTTP/1.1 301 Moved Permanently location: https://download.seznam.cz/update/szn-software-fflisticka-4.0.8-win32.zip date: Wed, 02 Oct 2024 10:16:49 GMT server: envoy content-length: 0

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.16	49702	184.28.90.27	443

Timestamp	Bytes transferred	Direction	Data
2024-10-02 10:15:33 UTC	161	OUT	HEAD /fs/windows/config.json HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity User-Agent: Microsoft BITS/7.8 Host: fs.microsoft.com
2024-10-02 10:15:33 UTC	467	IN	HTTP/1.1 200 OK Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json Content-Type: application/octet-stream ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7" Last-Modified: Tue, 16 May 2017 22:58:00 GMT Server: ECAcc (lpl/EF06) X-CID: 11 X-Ms-ApiVersion: Distribute 1.2 X-Ms-Region: prod-neu-z1 Cache-Control: public, max-age=109817 Date: Wed, 02 Oct 2024 10:15:33 GMT Connection: close X-CID: 2

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.16	49704	184.28.90.27	443

Timestamp	Bytes transferred	Direction	Data
2024-10-02 10:15:34 UTC	239	OUT	GET /fs/windows/config.json HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity If-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMT Range: bytes=0-2147483646 User-Agent: Microsoft BITS/7.8 Host: fs.microsoft.com
2024-10-02 10:15:34 UTC	515	IN	HTTP/1.1 200 OK ApiVersion: Distribute 1.1 Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json Content-Type: application/octet-stream ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7" Last-Modified: Tue, 16 May 2017 22:58:00 GMT Server: ECAcc (lpl/EF06) X-CID: 11 X-Ms-ApiVersion: Distribute 1.2 X-Ms-Region: prod-weu-z1 Cache-Control: public, max-age=109760 Date: Wed, 02 Oct 2024 10:15:34 GMT Content-Length: 55 Connection: close X-CID: 2
2024-10-02 10:15:34 UTC	55	IN	Data Raw: 7b 22 66 6f 6e 74 53 65 74 55 72 69 22 3a 22 66 6f 6e 74 73 65 74 2d 32 30 31 37 2d 30 34 2e 6a 73 6f 6e 22 2c 22 62 61 73 65 55 72 69 22 3a 22 66 6f 6e 74 73 22 7d Data Ascii: {"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.16	49708	77.75.76.70	443	7028	C:\Users\user\AppData\Roaming\Seznam.cz\sznsetup-lt.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-02 10:16:22 UTC	87	OUT	GET /update/packages.inf HTTP/1.1 Host: download.seznam.cz Connection: Keep-Alive
2024-10-02 10:16:23 UTC	278	IN	HTTP/1.1 200 OK server: envoy date: Wed, 02 Oct 2024 10:16:23 GMT content-type: application/octet-stream content-length: 16698 last-modified: Fri, 27 Sep 2024 10:06:22 GMT etag: "66f6839e-413a" accept-ranges: bytes x-envoy-upstream-service-time: 0 connection: close
2024-10-02 10:16:23 UTC	13624	IN	Data Raw: 20 22 70 61 63 6b 61 67 65 73 22 3d 7b 5b 20 22 63 6f 6d 2e 6d 69 63 72 6f 73 6f 66 74 2e 6d 73 64 6e 2e 6d 73 76 63 72 31 30 30 22 20 22 31 30 2e 30 2e 34 30 32 31 39 2e 33 32 35 22 20 22 69 6e 73 74 76 65 72 22 3d 7b 20 22 22 7d 20 22 64 65 70 65 6e 64 73 22 3d 7b 5b 20 22 73 7a 6e 2d 73 6f 66 74 77 61 72 65 2d 62 61 73 65 22 5d 7d 20 22 63 6f 6e 66 6c 69 63 74 73 22 3d 7b 5b 5d 7d 20 22 72 65 70 6c 61 63 65 73 22 3d 7b 5b 5d 7d 20 22 69 6d 70 6c 65 6d 65 6e 74 73 22 3d 7b 5b 5d 7d 20 22 74 72 69 67 67 65 72 73 22 3d 7b 5b 5d 7d 20 22 69 6e 73 74 61 6c 6c 22 3d 7b 20 22 69 6e 73 74 61 6c 6c 2e 62 61 74 22 7d 20 22 75 6e 69 6e 73 74 61 6c 6c 22 3d 7b 20 22 75 6e 69 6e 73 74 61 6c 6c 2e 62 61 74 22 7d 20 22 70 6f 73 74 49 6e 73 74 61 6c 6c 22 3d 7b 20 22 Data Ascii: "packages"={[ "com.microsoft.msdn.msvcr100" "10.0.40219.325" "instver"={ ""} "depends"={[ "szn-software-base"]} "conflicts"={[]} "replaces"={[]} "implements"={[]} "triggers"={[]} "install"={ "install.bat"} "uninstall"={ "uninstall.bat"} "postInstall"={ "
2024-10-02 10:16:23 UTC	2776	IN	Data Raw: 6c 69 62 73 7a 6e 64 65 73 6b 74 6f 70 20 28 3e 3d 20 32 2e 31 2e 33 35 29 22 5d 7d 20 22 63 6f 6e 66 6c 69 63 74 73 22 3d 7b 5b 5d 7d 20 22 72 65 70 6c 61 63 65 73 22 3d 7b 5b 5d 7d 20 22 69 6d 70 6c 65 6d 65 6e 74 73 22 3d 7b 5b 5d 7d 20 22 74 72 69 67 67 65 72 73 22 3d 7b 5b 5d 7d 20 22 69 6e 73 74 61 6c 6c 22 3d 7b 20 22 69 6e 73 74 61 6c 6c 2e 62 61 74 22 7d 20 22 75 6e 69 6e 73 74 61 6c 6c 22 3d 7b 20 22 75 6e 69 6e 73 74 61 6c 6c 2e 62 61 74 22 7d 20 22 70 6f 73 74 49 6e 73 74 61 6c 6c 22 3d 7b 20 22 22 7d 20 22 70 72 65 55 6e 69 6e 73 74 61 6c 6c 22 3d 7b 20 22 22 7d 20 22 72 65 63 6f 6e 66 69 67 75 72 65 22 3d 7b 20 22 22 7d 20 22 61 70 70 6e 61 6d 65 22 3d 7b 20 22 53 65 7a 6e 61 6d 20 4c 69 c5 a1 74 69 c4 8d 6b 61 20 70 72 6f 20 46 69 72 65 66 Data Ascii: libszndesktop (>= 2.1.35)"]} "conflicts"={[]} "replaces"={[]} "implements"={[]} "triggers"={[]} "install"={ "install.bat"} "uninstall"={ "uninstall.bat"} "postInstall"={ ""} "preUninstall"={ ""} "reconfigure"={ ""} "appname"={ "Seznam Litika pro Firef
2024-10-02 10:16:23 UTC	298	IN	Data Raw: 22 3d 7b 20 22 22 7d 20 22 72 65 63 6f 6e 66 69 67 75 72 65 22 3d 7b 20 22 22 7d 20 22 61 70 70 6e 61 6d 65 22 3d 7b 20 22 55 6b 61 7a 61 74 65 6c 20 53 2d 52 61 6e 6b 7c 5a 6f 62 72 61 7a 75 6a 65 20 75 6b 61 7a 61 74 65 6c 20 53 2d 52 61 6e 6b 20 76 20 49 6e 74 65 72 6e 65 74 20 45 78 70 6c 6f 72 65 72 75 22 7d 20 22 6d 64 35 22 3d 7b 20 22 62 35 38 39 39 37 36 62 34 64 65 31 66 34 64 66 65 61 32 35 32 39 38 62 38 66 37 66 33 34 30 33 22 7d 20 22 73 6f 75 72 63 65 22 3d 7b 20 22 22 7d 20 22 73 69 7a 65 22 3d 7b 31 30 30 32 7d 20 22 69 73 6c 69 62 22 3d 7b 74 72 75 65 7d 20 22 6c 6f 63 61 74 69 6f 6e 22 3d 7b 20 22 73 7a 6e 2d 73 6f 66 74 77 61 72 65 2d 73 72 61 6e 6b 2d 34 2e 31 2e 33 2d 77 69 6e 33 32 2e 7a 69 70 22 7d 20 22 64 6f 77 6e 6c 6f 61 64 73 Data Ascii: "={ ""} "reconfigure"={ ""} "appname"={ "Ukazatel S-Rank\|Zobrazuje ukazatel S-Rank v Internet Exploreru"} "md5"={ "b589976b4de1f4dfea25298b8f7f3403"} "source"={ ""} "size"={1002} "islib"={true} "location"={ "szn-software-srank-4.1.3-win32.zip"} "downloads

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.16	49709	77.75.76.70	443	7028	C:\Users\user\AppData\Roaming\Seznam.cz\sznsetup-lt.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-02 10:16:24 UTC	118	OUT	GET /update/cz.seznam.software.sznsetup-1.2.7-win32.zip HTTP/1.1 Host: download.seznam.cz Connection: Keep-Alive
2024-10-02 10:16:25 UTC	273	IN	HTTP/1.1 200 OK server: envoy date: Wed, 02 Oct 2024 10:16:25 GMT content-type: application/zip content-length: 1163119 last-modified: Tue, 01 Oct 2024 14:17:28 GMT etag: "66fc0478-11bf6f" accept-ranges: bytes x-envoy-upstream-service-time: 0 connection: close
2024-10-02 10:16:25 UTC	13629	IN	Data Raw: 50 4b 03 04 14 00 02 00 08 00 2f 76 7b 4c 2d 05 cf f8 9a 00 00 00 c7 00 00 00 0b 00 00 00 63 6f 6e 74 72 6f 6c 2e 69 6e 69 3d 8d 3d 0e c2 30 0c 46 f7 48 b9 43 4e 10 89 32 30 e5 06 88 a5 1b 88 c1 2d 2e 0a 6d 9d 28 76 a8 54 71 19 06 8e d2 7b d1 52 60 fa 9e 3e ff bc 53 84 ba 85 2b 9e b5 22 e8 d1 d5 a3 65 1c 67 b4 1c 1a 19 20 a1 e5 91 18 25 47 ad ee 98 d8 07 72 1b 5b d8 9d 56 9e 58 a0 eb dc 37 6d 05 a2 55 a6 5f fd a7 75 10 3b 90 26 a4 de 0d 9e b6 c5 7c cd 7b 5f 39 49 19 b5 82 18 0f 8b bd fc a8 4d b9 e8 1e 47 b8 f9 e9 39 bd f2 0d cd fa 09 6a 6f da d0 c7 40 48 62 c2 c5 ac fb 59 ab 37 50 4b 03 04 14 00 00 00 08 00 e6 54 2d 41 62 45 6d b6 35 00 00 00 5a 00 00 00 0b 00 00 00 69 6e 73 74 61 6c 6c 2e 62 61 74 cb 4c 53 48 ad c8 2c 2e 51 50 52 ad 33 8c 29 ae ca 2b 4e Data Ascii: PK/v{L-control.ini==0FHCN20-.m(vTq{R`>S+"eg %Gr[VX7mU_u;&\|{_9IMG9jo@HbY7PKT-AbEm5Zinstall.batLSH,.QPR3)+N
2024-10-02 10:16:25 UTC	16384	IN	Data Raw: 68 30 8a 29 57 ac f0 37 af 50 03 72 be e2 86 66 e0 c4 28 9b 4b c9 81 13 d6 ea 5f 21 10 f3 2d 05 d6 ea ad 06 49 1c 5b 35 20 64 8c cc c4 1d bb 5c 62 da 83 49 0a a3 45 96 3b 77 91 03 eb c5 22 f5 3e 34 41 4e a1 41 8c 4c 63 be c2 c6 fc 14 b9 aa c0 a6 cf 2a e6 ed 73 b9 2b 14 8f a8 e2 09 4a 69 09 af da 25 26 3d 03 45 fd 11 69 33 30 2b d7 de 9f 84 3f f3 57 42 25 83 2c 7f da c3 35 95 f2 2c 2f 8c 7c f4 af 2a 78 9b 3f 8d e5 99 2b 42 30 26 95 d8 a4 79 b6 e0 f4 54 da 8e 3b fc ef 31 20 4f 8b dd 50 82 4a 0b 3f 22 d4 8b b4 a5 9a 7c 96 ac 55 70 a4 45 17 48 29 8c d4 4e 68 df a3 39 a8 92 b2 92 07 6c a4 a6 4a 56 eb 8a 89 94 92 e6 4b 3a ad 53 32 76 5a 6a 61 7a 4e a3 95 85 8d 88 24 29 5d 09 23 c4 5f 41 8a 20 d4 e4 14 61 80 37 24 93 85 c1 72 c2 3d 34 33 46 61 4c 5a 03 8b bb 19 Data Ascii: h0)W7Prf(K_!-I[5 d\bIE;w">4ANALcs+Ji%&=Ei30+?WB%,5,/\|x?+B0&yT;1 OPJ?"\|UpEH)Nh9lJVK:S2vZjazN$)]#_A a7$r=43FaLZ
2024-10-02 10:16:25 UTC	11376	IN	Data Raw: 7c f9 87 ad a1 ac c3 ca 7a ba f2 22 c5 37 2a aa ca 73 13 3d e5 dc c9 4c c7 45 6b b2 85 33 42 7a 2a 0b d2 b4 17 05 4c e5 c7 04 e5 fc 32 d5 2a 7f 1e 56 f3 0e c4 01 83 0d e5 15 04 d6 94 94 96 49 7b ba ae a1 07 0d 67 b3 4d 0c 6e 56 ee 05 b3 72 4f 53 f1 5f 1b cf 58 a7 40 7c 8c 8f 69 b9 07 4d cb 3d dc b4 8c f1 87 9c 59 cc fc 99 4a bd e8 c3 3c 77 81 d7 ce 54 46 68 ca 76 05 b7 9e f7 71 eb 79 3f 5a cf 9f 7c 6e ac 5c 47 a9 1b 0b 26 c1 74 50 70 b0 b5 2c 8e 31 b5 de 06 a7 c9 bf 36 48 9b b7 9e 39 13 c3 e5 16 b0 a0 e3 15 cc 12 95 09 5d bc de 17 4a d2 22 9b b1 d1 7e 2e da fa 18 ac 37 86 36 a1 13 5b 1f 5a d1 ab 23 5b d1 df 79 76 2c 46 47 32 28 4e 91 dd 98 24 9f 0d 1f a2 fa 74 a1 89 ba 1f d2 e2 0d f7 09 a2 c5 b4 ce 7c 76 c6 91 a6 d7 d1 b2 be 16 89 f1 be ce 63 5f 3f 10 e3 Data Ascii: \|z"7s=LEk3BzL2*VI{gMnVrOS_X@\|iM=YJ<wTFhvqy?Z\|n\G&tPp,16H9]J"~.76[Z#[yv,FG2(N$t\|vc_?
2024-10-02 10:16:25 UTC	16384	IN	Data Raw: fa 85 00 fd 72 80 e8 b2 86 63 a1 17 50 0d 3b 03 35 0c f5 93 64 dc d3 dc 51 00 81 ae 63 90 ab 69 30 75 b7 a0 36 d8 ec 6e 32 4c fe 28 a6 cd 83 90 d1 d5 72 43 57 c7 25 18 7a 2c 5f f1 96 8b d2 c0 b3 ea 2b 97 65 d8 84 0e d4 fa a7 78 c6 5d cc 6e dd a2 41 4a 25 5b 0e 49 22 8f 63 75 a6 83 2d 06 d7 43 85 94 de 13 8f 6c 83 69 04 76 23 5d 09 ec c9 3e c8 d3 27 fe 7f c5 f6 c0 2c 4f 6c c7 27 43 e0 12 93 41 18 31 0e 3e 35 62 9b f3 9d 8d 01 27 de 30 ac 3f 4b 86 c5 97 0f c5 48 5f b0 92 38 f9 0c 79 2c a9 64 f9 0a 96 34 68 f8 7a 0d 74 04 89 57 34 60 7e 48 1e d4 ff 1f 6d d7 1f 17 57 75 e5 67 e0 31 0c f8 ca 10 1d 63 b4 d4 c4 3a d1 68 d2 2d 86 68 89 83 66 30 0c 90 1f 43 06 08 8c 1a 03 ae db f2 a9 d1 b6 d1 cc 90 a8 4b 4a 9c f0 91 eb cd 6b 74 bb 31 fa f9 a8 eb ba ae b6 bb 6e 6b Data Ascii: rcP;5dQci0u6n2L(rCW%z,_+ex]nAJ%[I"cu-Cliv#]>',Ol'CA1>5b'0?KH_8y,d4hztW4`~HmWug1c:h-hf0CKJkt1nk
2024-10-02 10:16:25 UTC	3048	IN	Data Raw: 75 d2 f3 30 11 d9 71 f8 7a 66 ce b5 87 e8 7d 0f 5b 11 20 51 43 b3 d7 b3 d9 f6 5b 52 33 82 2c 4e e9 62 82 df b4 9a 8b 49 94 af f6 47 12 d1 2a 90 93 b0 2e a1 b4 e7 6a 5c c4 95 04 e9 a5 88 ce 77 90 67 95 f5 f3 d9 a8 c1 f7 93 91 3c 7c cf ee 4f e6 9f c9 e6 b7 dd c2 6f 52 93 02 96 0f 27 1d 19 f2 96 73 f2 d8 fa 30 8a f4 45 d6 68 4a 79 58 b7 9b d2 c1 79 d8 f3 cb 82 74 8b 4e 1f 5a 59 5d 8c 3e 7f d4 90 83 5a 2e 07 95 91 3c 72 10 c8 96 03 33 7d 3b 4c f4 63 89 96 c4 43 6a d2 97 32 a8 1b e1 d4 8d e8 9d 17 59 06 6c 84 99 39 b7 f8 7b 19 71 ae 20 3d dc 92 65 f1 ff 65 84 e7 d3 72 fb c9 2b 37 9b 96 b4 f5 26 fb 49 90 83 8a b0 93 e0 f6 8e 08 25 f9 fd 01 4b 68 a9 8d f9 03 54 ee 07 50 19 6c d4 97 a8 e8 46 c8 88 9d 4b 65 14 a3 65 05 e4 33 e2 dc f1 a7 28 4f b5 78 97 c2 60 30 a8 Data Ascii: u0qzf}[ QC[R3,NbIG*.j\wg<\|OoR's0EhJyXytNZY]>Z.<r3};LcCj2Yl9{q =eer+7&I%KhTPlFKee3(Ox`0
2024-10-02 10:16:25 UTC	1388	IN	Data Raw: e5 bd 2a b6 79 59 5a 12 bf 30 3d 65 fc fd 47 2d 77 79 f5 1d 68 8f 72 26 1a ee b0 05 b4 5d 88 ed b1 0b c2 d8 52 8c 9f c7 df 6e 12 6b 80 ca 7c f8 37 20 69 44 f7 81 e0 a1 4e 70 7e 21 d0 7e 8a 28 8b 98 66 27 da af 05 e5 d6 10 0e 8d 08 96 1b 2a f4 b2 85 76 21 51 7f a6 a4 81 8c 41 36 e4 9a 2b 2a 10 3b d1 dd 4a ba ec 39 ad 56 38 81 bb d1 ef b4 cb d2 71 55 1a 51 3d c3 ec 8b 97 ac b8 65 47 e8 74 bf dc 15 1e 49 75 6c be 04 7e 47 73 23 3d 0d 65 82 1a 10 c9 73 4e 79 96 ba 24 8b b5 62 2c 44 9a 17 7c 7a 46 7b 52 89 d8 e9 79 72 13 f2 4c d1 f3 54 8a c8 ab 42 1e e4 62 21 85 f3 b4 27 f1 09 12 26 85 f7 9e f4 b1 81 5f 5a 85 93 bd d3 db 4a a8 fc 1b 3e d6 6b 7c 91 08 ca a7 19 c6 66 3e cc 30 03 65 41 02 28 ee 73 03 65 32 81 52 a7 b5 7c b2 57 87 65 71 c2 9b d9 6d f8 59 0a 23 74 Data Ascii: yYZ0=eG-wyhr&]Rnk\|7 iDNp~!~(f'v!QA6+*;J9V8qUQ=eGtIul~Gs#=esNy$b,D\|zF{RyrLTBb!'&_ZJ>k\|f>0eA(se2R\|WeqmY#t
2024-10-02 10:16:25 UTC	15268	IN	Data Raw: f9 39 3a 80 27 7b a9 f8 4c c3 33 c7 af 07 ce 41 df 4b 5b 5c 41 b4 46 6e 3a cd 3a ac 14 7e 5c 2e 17 e5 8d 80 34 4e 0d 27 12 f6 c1 df ce 47 f3 cf 69 64 e3 99 2d 6f cc 91 37 e6 72 fa 55 2c 05 7f 49 ab a7 7c d6 2b f8 4b ae 9c 29 6f cc 97 37 16 ca 1b e7 9c d5 e2 93 c3 bb e5 8b 04 fb 95 f1 8e 84 2a ed ca db ca de bc bd ee 7d 8d 17 ed e9 ca c6 c8 be 0c f6 3f b4 67 c1 c8 be 43 14 d9 f7 27 f7 60 64 5f d1 fd 76 63 4a 5e 17 8c 5b a6 f2 36 5a 51 fd 1a 79 f1 72 9b 97 09 57 24 1f cd 1b f4 cd 26 f6 43 d3 02 ff 5d 03 a2 79 d1 77 60 6f c2 2c e5 25 98 a3 04 29 78 30 d7 59 a3 1c 8a 05 d5 ac e8 89 89 65 4b f2 d1 09 8e 2e 96 99 30 34 9d 69 0f 63 be 0e a3 62 c9 e8 16 e4 9c fc 99 14 b3 57 ae 34 33 1c ad c2 5b 2d 7b de 1d 43 48 bc 94 a0 39 9f 84 c4 64 cd ae 19 bb 75 4e fe 4b 68 Data Ascii: 9:'{L3AK[\AFn::~\.4N'Gid-o7rU,I\|+K)o7*}?gC'`d_vcJ^[6ZQyrW$&C]yw`o,%)x0YeK.04icbW43[-{CH9duNKh
2024-10-02 10:16:25 UTC	16384	IN	Data Raw: 46 0d b3 61 8b b4 02 2e b6 68 f2 f0 5e 8b 3c cd 51 0d 45 15 78 b2 24 4e b1 b9 78 5a 3b a8 9c 12 ca 40 3a 8d d2 69 c1 72 f9 07 b2 74 1d 4e 14 a0 78 03 25 b3 bc 4a 99 bf 50 f4 3f 80 bf 3f 64 0b ce 5f a4 83 3e 9d 28 5f 2b 55 f0 7e 3a b6 12 4c 3e 3e 01 7f 4d 5a 05 37 3b 96 2c b2 8b fe 27 b1 6a 51 48 8c c6 a3 18 8d c7 4c 98 5a f2 f2 0b 61 a9 d9 ff 37 94 95 5e bc 45 f4 af 81 9f c5 92 b9 bf 0e fe cd 83 7f ef c0 7c f6 c3 56 d1 ff 34 12 4b c9 ea 05 f6 dc 30 27 eb 5a ec 6b 9d 45 3b cf ca 73 aa c5 20 41 79 36 39 b1 d8 d1 2d fa ce 60 f3 53 95 82 c5 76 ca b2 9a e1 b9 dc 37 9c e0 49 f5 0d 4f f0 4c f6 0d 4f f4 24 41 e3 9e 04 df 70 bc e8 a7 24 ae 07 b0 89 2f cd d4 04 35 f0 39 19 48 e1 eb 79 22 27 c4 c4 2e 23 42 bc 4d fd ad 94 6a 0c 56 b2 17 75 64 fe 70 8e 93 89 ee 3f 20 Data Ascii: Fa.h^<QEx$NxZ;@:irtNx%JP??d_>(_+U~:L>>MZ7;,'jQHLZa7^E\|V4K0'ZkE;s Ay69-`Sv7IOLO$Ap$/59Hy"'.#BMjVudp?
2024-10-02 10:16:25 UTC	3048	IN	Data Raw: 55 81 41 f9 0f d6 ee 66 3d 78 34 1c d6 4e 60 94 ad 6d 79 d3 44 ca 4a f3 b3 e2 25 df 6b f8 fb 3d 55 fa 16 7a 76 16 7c c8 8e f8 c2 ec c8 53 c4 8e f0 33 f3 a6 59 01 3c 6c 6e 83 9c 05 fe d3 9e 8d 5a 75 9e 6a 5e 55 f5 77 a1 9a 83 f7 91 83 6e f5 79 89 7a 7f 17 bc aa af 0a 84 8e dd 8e 2c 28 eb 99 a5 f9 c3 6a 53 d7 df 47 6a 4e 53 21 db e3 5a c9 2a 5e 72 14 bc 5a 6e 28 f9 2a 96 f4 1e 19 98 3b 89 e2 4f 92 74 fe a4 4f 3b c8 cf 07 a2 f9 93 be 74 ca 86 fc c9 87 c6 d1 79 c7 30 3a 2d 7c 74 3e ff 26 f9 bd 46 47 b1 dd b7 78 ef 57 0a 61 9a 78 bf 52 b2 68 50 26 de 87 1f f6 73 f8 a4 5f 7c 93 3e 69 17 d7 33 47 a5 07 6c 1e 26 56 7d 40 63 25 36 50 54 b5 50 eb 9e 6f 43 a9 87 78 a9 65 d0 96 3f d4 56 95 af fb db 9e 78 f8 d7 e9 cd 55 9c 7d fa 50 bc 38 93 9a 7c 05 f2 01 ef 72 13 d6 Data Ascii: UAf=x4N`myDJ%k=Uzv\|S3Y<lnZuj^Uwnyz,(jSGjNS!Z^rZn(;OtO;ty0:-\|t>&FGxWaxRhP&s_\|>i3Gl&V}@c%6PTPoCxe?VxU}P8\|r
2024-10-02 10:16:25 UTC	4164	IN	Data Raw: 93 40 e9 d9 1b f2 cd 1e b7 6c 1d c7 5d b9 4a 4a a4 0a 3b db d3 1d c0 cb 74 4b 5c 35 ca 4a 4f 6e 4d fc b0 9a b3 2b 46 39 c1 f8 eb 3f a2 54 82 ae 95 b0 4a f0 99 47 29 e2 2b 3d 6e a8 eb f6 be 1c 76 32 f4 52 b7 b0 c0 aa f8 11 2a c6 0c 94 87 bd 2f 83 86 20 60 95 62 57 f8 4b 10 2f d2 b2 04 9a fb ab 68 f0 fa 93 db bf 4b 78 dd 38 32 11 bc 7e b8 e5 3b 82 d7 fb a1 a3 d6 fc cb 34 78 ad 3a d7 1c 5e 47 a7 54 4e 08 af 8d 92 96 8d 5e b9 43 54 96 bb a3 76 02 d7 ac 2f 00 5c cb 54 70 2d 23 70 2d 38 22 d7 e6 c9 b5 1a c0 96 e5 cb b5 85 72 59 91 5c 5b 42 72 54 54 74 12 b0 da 11 e4 2a 8b 72 6d 51 d8 0f b1 68 2a 9e 7c 02 4b 95 d7 e5 b2 db 44 79 dd 2c b4 ca 55 78 98 3d 6a 23 60 85 86 4b 67 a8 c0 8a 2d 09 52 a7 53 36 51 b9 4c f2 ee 33 85 23 67 d4 f6 a0 0e e8 33 c5 5d 69 6d f7 67 Data Ascii: @l]JJ;tK\5JOnM+F9?TJG)+=nv2R/ `bWK/hKx82~;4x:^GTN^CTv/\Tp-#p-8"rY\[BrTTtrmQh*\|KDy,Ux=j#`Kg-RS6QL3#g3]img

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.16	49714	77.75.76.70	443	7028	C:\Users\user\AppData\Roaming\Seznam.cz\sznsetup-lt.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-02 10:16:27 UTC	121	OUT	GET /update/cz.seznam.software.szninstall-1.1.15-win32.zip HTTP/1.1 Host: download.seznam.cz Connection: Keep-Alive
2024-10-02 10:16:27 UTC	271	IN	HTTP/1.1 200 OK server: envoy date: Wed, 02 Oct 2024 10:16:27 GMT content-type: application/zip content-length: 433495 last-modified: Fri, 23 Aug 2024 12:19:22 GMT etag: "66c87e4a-69d57" accept-ranges: bytes x-envoy-upstream-service-time: 0 connection: close
2024-10-02 10:16:27 UTC	13631	IN	Data Raw: 50 4b 03 04 14 00 02 00 08 00 13 7c 7b 4c d5 65 37 97 b7 00 00 00 12 01 00 00 0b 00 00 00 63 6f 6e 74 72 6f 6c 2e 69 6e 69 75 4e 41 0a c2 30 10 bc 07 f2 87 1c f5 b2 60 45 3c e5 01 82 78 f1 28 1e b6 ed b6 04 db 24 64 53 0b c5 2f f8 08 5f e0 23 d4 7f 59 6d ed 4d f6 30 03 33 b3 33 07 8f d9 09 4b 3a 4a 61 b1 26 9d 75 c0 d4 f5 14 d8 15 b1 c5 40 c0 9d 35 96 23 56 95 14 67 0a 6c 9c d5 0b e8 6f 25 c5 28 e8 11 21 c5 28 45 f3 f3 eb 89 0d 42 4e 9e 6c ce 7f 4a 98 62 e3 d5 6c 01 09 ac e7 52 f8 0a 63 e1 42 ad 5b 63 97 49 5f c5 5b 93 ea 18 1a 9a 6a 29 4c 43 d0 fb dd 67 ff fe fb 57 6d 06 c3 65 c0 c7 2d ba a0 7c 70 65 c0 fa 75 57 ec 5d 45 cf ab 75 1c 8d 1a 12 90 75 0a 81 41 8a 37 50 4b 03 04 14 00 00 00 08 00 fc 65 2d 41 74 ae c0 97 89 01 00 00 8c 03 00 00 0b 00 00 00 69 Data Ascii: PK\|{Le7control.iniuNA0`E<x($dS/_#YmM033K:Ja&u@5#Vglo%(!(EBNlJblRcB[cI_[j)LCgWme-\|peuW]EuuA7PKe-Ati
2024-10-02 10:16:27 UTC	1388	IN	Data Raw: 06 18 8e 57 bd 42 d8 98 c8 8f 10 c6 a5 80 d8 d1 cf 21 ae 0b 0e 39 0e af 02 06 a0 b0 1a 0a 6b 0f f7 2b 52 c6 32 0e a1 1b 47 e6 e6 c6 0e 81 70 35 da 23 7c 10 c3 fd 2f 0f 3c a6 d7 9f 24 fd 79 69 fd 76 b1 0a 78 54 17 48 b4 ec f2 b8 db 92 dc 8f 51 f6 ea 1f d9 1e 86 7a f0 53 20 fb 1f a3 7f 4d 9d 63 70 ec 5d 39 11 2c 11 c7 2a 31 b8 e0 3a 94 78 ab 4a 1d 7b 57 14 2b 60 20 ff 8c b9 e0 60 d4 e2 c6 30 6e dc b1 8a 8a 14 bb 8f a5 a7 ee cd f2 b3 bc b5 9d 99 da 41 6f 75 e6 bc c3 1f 38 3a 81 56 fa c9 45 3e 55 3d fe 39 06 42 e2 27 dd 36 39 e1 b1 25 59 8d 82 aa 1e c2 66 c3 f8 49 5b 27 63 00 5c df e7 2c 46 cd e0 50 7b 3e c7 53 f6 9f 63 d1 f0 eb 50 40 dd 7c 0c 3e 1d 87 50 d7 8c fd 89 ef 80 b2 56 89 4a f1 33 dc c3 fa c1 b6 38 f8 8a da fd 29 5e 72 6b 3c 62 3c a2 b0 e6 14 56 52 Data Ascii: WB!9k+R2Gp5#\|/<$yivxTHQzS Mcp]9,*1:xJ{W+` `0nAou8:VE>U=9B'69%YfI['c\,FP{>ScP@\|>PVJ38)^rk<b<VR
2024-10-02 10:16:27 UTC	16384	IN	Data Raw: 8c 79 dd df 10 fd f3 f8 e4 bd 85 57 22 31 0e 03 93 0b 82 15 98 6e 6c b4 cb f1 e9 8a bf 9e d8 8d d7 f1 ec dc cd a8 cf bc ee 77 f1 e9 fe b5 e9 3f 3c dd a5 39 6c ba 33 d2 4d f7 b4 1c dd 74 1b e3 d3 fd 1b 53 ba e9 ae de f3 9f 9c ee ba 27 f4 d3 bd 6d 5c 86 76 27 cd 05 4d 77 64 f7 bf 31 dd a1 dd e9 a7 3b 9f 4f 37 61 ec 99 4f 7a 6c 74 b1 c2 1e 1d 61 9c 7d f3 bd 55 67 92 ab 3a fc 3a e0 bf 65 cf 5e 4e 0e ff 64 0f 8c dd 04 ae 84 09 25 61 26 98 8a 65 f3 ba 97 91 49 31 ee a4 5a cb 81 1c aa e8 0d b9 b0 d0 ef 8f cf fc 6f c5 7f 77 e6 b3 b4 39 57 c2 6c e6 e7 5b d8 cc a3 d3 05 89 02 51 19 9f 7f 7a 15 5a 65 9b b5 99 cf 74 6c e6 33 7f 5c 4c 37 f3 37 fc f1 3f 39 f3 cb 7e a3 9f f9 c7 cd 6c e6 c5 0b 9c f9 ce e7 fe 8d 99 57 9e 3b 8f 85 8e 4b 9c cd 69 60 52 7c 3e c7 31 9b c6 10 Data Ascii: yW"1nlw?<9l3MtS'm\v'Mwd1;O7aOzlta}Ug::e^Nd%a&eI1Zow9Wl[QzZetl3\L77?9~lW;Ki`R\|>1
2024-10-02 10:16:27 UTC	9988	IN	Data Raw: 4b 5f e0 c3 0e 60 7c 40 f7 2a 37 e7 c9 a4 55 a5 f2 ad 30 5a a0 47 b9 f6 1d 82 9d 65 45 52 d8 a2 4f ca 2b f8 a9 34 c5 56 65 94 bd 40 96 a8 77 63 63 85 ee e4 1b 86 c4 da 5c fc 47 d1 e2 47 17 df 19 27 f4 70 fb 04 e4 d6 62 ea e1 91 7c f4 55 31 41 a2 de 6c b4 4c 90 81 a9 7c c8 55 9a 9e 24 33 0d 41 40 ec 03 a7 27 32 9f fe b7 99 fb 21 a2 6e 7b 0a d9 ee 0b 88 ec 83 ce 0a fe ce 54 da 87 cf 4a d4 15 fd e6 26 31 a3 6c bf be e1 2c ff 63 ef 10 8c 0b fc 67 31 b1 b6 b6 ad a4 f4 1f f3 28 7d 76 9a b7 dd 6b 1a a2 4a 94 ba 03 0e f6 0e e7 95 a6 a5 33 2d cf fd 98 1c 07 3e 1f 63 8d 03 eb 3d e3 c0 a9 fb 2d 8b 0e 65 e7 c5 b7 f1 d3 8b 6f d3 47 0a 03 be 8d bf 62 86 35 1c fd 2e 43 4c fb da 76 12 41 27 93 3d a3 d0 9d f7 62 cb 23 19 99 8c c3 56 07 10 15 5f a6 b8 ea 0e 39 f8 b1 4a b4 Data Ascii: K_`\|@*7U0ZGeERO+4Ve@wcc\GG'pb\|U1AlL\|U$3A@'2!n{TJ&1l,cg1(}vkJ3->c=-eoGb5.CLvA'=b#V_9J
2024-10-02 10:16:27 UTC	16384	IN	Data Raw: 91 ca 2e d4 b4 c2 bf c9 b8 65 3f 51 52 34 c6 a8 1e 35 42 fd ca d4 6f ab 33 4d 22 72 e1 1d 8f 02 51 8d dd 44 32 c9 f2 a3 e1 92 1e fb 64 8f 84 4c b2 87 f6 52 62 df 24 75 f6 13 d5 61 8c e2 25 46 99 c2 5a e9 5e 1d 83 51 f6 37 d2 80 e1 ff 16 ef f1 6b 9a a0 6e 45 b2 dd 5b 13 0c a7 74 f1 0a 52 2e e7 be 68 af ac ce ba 5a 63 6b 76 65 4a 5b 90 1d 58 cc 42 b2 43 2a 15 1c 15 e5 3e e0 55 65 61 16 05 db 29 6f a5 e0 ab 0d 45 f5 9f 85 bb 29 be 45 8c 2d 09 56 6b 5e f5 71 0f 0f fc 9d 22 c1 55 d0 1f 6c d7 44 f7 74 b3 2a 4c 15 93 34 52 16 66 10 04 5f d6 63 2c c0 da 7e a3 3d d1 95 4e b8 1a ee e8 d2 7a 8e c3 8d 5d 0e c2 55 49 ad 51 b2 31 ab f3 11 e8 c3 fe 43 d1 fb ef e8 ab 83 96 f7 c0 a7 3f 79 c6 ac 0e d1 b3 05 be 36 7c 9b 28 7a 36 b2 c0 81 14 65 5b 61 20 d0 40 71 03 49 06 d7 Data Ascii: .e?QR45Bo3M"rQD2dLRb$ua%FZ^Q7knE[tR.hZckveJ[XBC>Uea)oE)E-Vk^q"UlDtL4Rf_c,~=Nz]UIQ1C?y6\|(z6e[a @qI
2024-10-02 10:16:27 UTC	16384	IN	Data Raw: 66 09 15 ba e6 4f 21 f4 2d c1 c0 5c d4 bd 3f c6 01 24 6e a6 d1 9a fa f2 13 3c e6 d6 88 6e d1 1a 96 ff 06 3b 06 60 51 2a 76 55 3f fc 82 ab 05 a8 8f 29 59 a2 3c 58 11 97 51 18 1c e0 2f c7 19 d5 b9 11 85 9f 7d 84 11 de 30 43 31 ff 26 b5 84 15 e2 e9 85 1d 68 02 30 55 9b 11 63 d5 e9 a4 95 7b 48 ae fe be a8 f9 97 76 34 10 6c e7 df cf 37 49 ae f2 40 f2 73 a4 61 c3 a2 74 30 bb 05 6b d5 52 82 34 01 17 72 4b b6 69 3e aa 35 c4 7c db f8 e4 d8 fa 1e 2d ef 4e 97 b1 09 bd d1 0f c8 cc 9b ee 32 cc 1b ae 43 38 f3 52 04 a6 7f 03 1f 7d ed 4a 99 71 a1 67 5b 7f c4 c9 c4 68 f6 0c 79 e7 6d 7f 7a d0 88 0f a3 ab e8 ed 49 fc d6 61 ed 5d 7f 61 ed fd f2 a1 70 79 ff eb e9 5b 5a a4 ab 51 72 e6 7c c2 04 54 6d 84 a9 5c d2 df 47 95 8b c2 33 bf 8b 2a 17 61 24 78 67 92 a1 72 e1 82 6a f3 d1 Data Ascii: fO!-\?$n<n;`QvU?)Y<XQ/}0C1&h0Uc{Hv4l7I@sat0kR4rKi>5\|-N2C8R}Jqg[hymzIa]apy[ZQr\|Tm\G3a$xgrj
2024-10-02 10:16:27 UTC	3320	IN	Data Raw: dc bb 7c da 36 31 79 52 b2 80 e5 63 72 30 80 48 ab f1 61 91 56 e3 c3 a0 b7 08 a1 db e3 f6 ca 99 82 2d d3 ec 8a 1a 5b 5d 83 cc 31 5d e0 e4 48 e7 18 63 d1 a7 02 33 cb 44 a1 c7 fa a0 0c c0 e3 96 e0 a7 a5 ca c8 4d 18 b6 92 62 53 11 4a ba 4f 7b dd 6c 18 b9 1d 21 b4 aa ee 6c 25 59 5a 1a 3c 87 ce 05 e8 8c 1c 25 89 a0 79 80 4e 08 b2 df df 7f 27 a8 7e 55 98 1d 43 0f 59 eb a2 b8 27 87 78 91 b6 73 7b aa b5 ed dc ff b3 46 dd ce cd bb 97 b3 8f a3 e3 25 69 2a bc 52 74 21 4f ce 3e 25 3b 8e e7 e6 b0 1f ea 1c a7 68 de 8e 8d 03 e6 75 1c cf 51 ee c7 e3 9a 1c d6 e0 24 f6 2e f1 ea 53 7f ea 6e 3f 1e c6 ab 2f e8 b6 b9 e5 9b 59 39 ba c1 52 76 c8 83 ef 4a a9 93 07 bf 3e 83 17 83 b4 cb c2 e2 5c e5 ec 28 92 d0 23 b7 d3 6e b8 30 81 67 3a 77 e1 e4 fe a8 ae fc 51 5a 32 d0 08 c6 45 49 Data Ascii: \|61yRcr0HaV-[]1]Hc3DMbSJO{l!l%YZ<%yN'~UCY'xs{F%i*Rt!O>%;huQ$.Sn?/Y9RvJ>\(#n0g:wQZ2EI
2024-10-02 10:16:28 UTC	16384	IN	Data Raw: 13 31 a6 b4 70 ce 8b 37 dd 68 f0 a6 56 d7 ce 37 9e 4c 76 98 67 43 8f d9 71 28 60 14 db 68 f0 a7 66 01 c1 a5 3d 68 7e 7d 98 97 11 ac 44 fb 3d 69 99 92 41 18 69 9c ee bb 0b 20 6c 2d f6 20 9e fb dc 40 f9 36 50 e2 17 a2 dc 27 ae 2f fd c5 3b 21 0b 5f af 75 16 40 a2 55 8b 3e 98 75 39 61 f8 79 90 af b0 12 ef 3c 7d eb 37 89 dd 05 b6 6a a6 dd 3d 26 9f 59 e9 e9 1d 8e 81 fd 05 04 16 56 1b a8 73 8d fb fa 30 ca 36 ce af 24 c5 e2 5c 31 b0 26 35 86 c5 d7 9a 58 3c a1 1f 16 97 a7 5a b0 d8 83 a0 41 d5 72 78 64 04 32 c8 25 d5 6d c0 5a d3 d8 1b 44 aa 34 1a 91 02 07 2b 11 38 c4 82 34 46 60 00 72 83 47 d5 68 bb ce 15 d4 86 17 62 7b 50 a3 51 e4 5b 18 bd e3 ff ad 93 6f c9 17 b1 39 a4 26 81 bd 76 7d 56 0b 6b 35 7e 9d 14 57 97 a2 1f f6 f4 6b a5 ae 1a 07 be 00 d1 45 64 2d 2c cc 4f Data Ascii: 1p7hV7LvgCq(`hf=h~}D=iAi l- @6P'/;!_u@U>u9ay<}7j=&YVs06$\1&5X<ZArxd2%mZD4+84F`rGhb{PQ[o9&v}Vk5~WkEd-,O
2024-10-02 10:16:28 UTC	3048	IN	Data Raw: 38 9f f5 48 58 68 d9 ce 43 27 71 5e cd ee f3 55 f1 ab 9e 04 f4 7a fe 4e 82 63 c7 a0 50 77 a1 f3 d5 b5 13 11 a8 a6 8b c2 6e 87 b4 98 6e cc 26 bb 9d 8f 85 dd 8e c4 17 a2 ee 4a a2 af 16 ba 8e 9e 62 13 d7 d1 d1 f5 17 ea 8a 6e b1 ad a7 71 8e 0e 5f 2b c7 18 41 9f 72 24 1a 41 f7 3b a2 2e 1a d1 6d 68 6f 16 ac a6 5c 76 12 e6 08 56 5c 31 4b a3 e5 55 f8 79 e7 e7 22 ce cd ef 77 c1 dc 6c 12 ee f4 de cd d6 51 25 65 a7 4b 1a 4f 1a 7a c2 7e 7a e5 8c 02 9a 9e d0 3f d0 44 5a 13 96 b3 f7 e0 b2 a7 59 39 70 3d 74 b9 c9 b5 c1 4e ca 47 6b 6e ad b3 18 13 b3 c0 95 89 f4 01 b6 4e b4 b7 46 97 5b 68 0b 4d f3 a1 3c 64 ce 07 fa 5d e3 b5 5f b5 e1 bd 37 da eb de e3 23 3b 6c 58 50 fc ae 89 92 74 1c 96 f9 71 68 e9 e4 d8 cd 0f cd 97 4e a6 b4 c0 bf 7c 34 1c 68 d8 22 57 16 2b cf 0a 78 6b ad Data Ascii: 8HXhC'q^UzNcPwnn&Jbnq_+Ar$A;.mho\vV\1KUy"wlQ%eKOz~z?DZY9p=tNGknNF[hM<d]_7#;lXPtqhN\|4h"W+xk
2024-10-02 10:16:28 UTC	5552	IN	Data Raw: d4 1f 97 5a 2a 86 42 76 fc 90 36 bd ad c5 a3 f7 8c df 61 81 1f 40 43 a5 69 5f 48 ae 84 52 0d f5 7f 95 82 d9 4d e8 41 e5 62 13 fa 07 a8 ee f5 f7 8c 21 9f c9 3c 07 d7 37 ff 26 cc 43 43 7d 97 14 9c d3 58 7f 54 0a 4e 6d ac ef 97 d6 de c2 42 fd 44 5f 58 c5 51 1f bb c8 6f 86 4c 95 a1 4f 7a c4 d7 4c f8 0a e5 71 ab a2 38 7d 17 c9 fe 0c be 63 6b 21 57 43 bd 2e 05 6f c6 1e b2 8b d0 a2 a7 d7 0b 2d 56 98 2d fa 38 b7 62 8b 90 67 3c e6 09 8e 21 7d 61 8b e7 ec 57 3c 7d 88 e5 15 7d ac fa 6c 63 18 86 77 2f af b7 d2 a1 03 35 55 08 9b c8 5b 2f 3f a6 08 90 d3 9b 9f 45 4e 1f c1 ce 46 c0 d2 1f fa 15 9d 86 fa 99 e7 a8 17 a0 42 1c 01 a8 ba 37 51 2e fc fe a0 f8 6e 02 8f f1 2a 38 f6 af 5a e4 ec b9 3b 1e 80 56 8e c2 b3 e1 00 04 70 26 67 20 36 6c 98 31 a8 03 3a b3 fe b5 77 c6 20 f3 Data Ascii: ZBv6a@Ci_HRMAb!<7&CC}XTNmBD_XQoLOzLq8}ck!WC.o-V-8bg<!}aW<}}lcw/5U[/?ENFB7Q.n8Z;Vp&g 6l1:w

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.16	49716	172.217.23.110	443	3184	C:\Program Files (x86)\Internet Explorer\iexplore.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-02 10:16:28 UTC	290	OUT	GET /picasa/answer/93773?hl=en HTTP/1.1 Accept: text/html, application/xhtml+xml, image/jxr, / Accept-Language: en-CH User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko Accept-Encoding: gzip, deflate Connection: Keep-Alive Host: support.google.com
2024-10-02 10:16:28 UTC	531	IN	HTTP/1.1 301 Moved Permanently Location: https://support.google.com/picasa/answer/157000?hl=en&visit_id=638634609885905976-1351747924&rd=1 X-Robots-Tag: follow,index Date: Wed, 02 Oct 2024 10:16:28 GMT Expires: Wed, 02 Oct 2024 10:16:28 GMT Cache-Control: private, max-age=0 Content-Type: text/html; charset=UTF-8 X-Content-Type-Options: nosniff Server: support-content-ui Content-Length: 302 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-10-02 10:16:28 UTC	302	IN	Data Raw: 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 63 6f 6e 74 65 6e 74 2d 74 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 3e 0a 3c 54 49 54 4c 45 3e 33 30 31 20 4d 6f 76 65 64 3c 2f 54 49 54 4c 45 3e 3c 2f 48 45 41 44 3e 3c 42 4f 44 59 3e 0a 3c 48 31 3e 33 30 31 20 4d 6f 76 65 64 3c 2f 48 31 3e 0a 54 68 65 20 64 6f 63 75 6d 65 6e 74 20 68 61 73 20 6d 6f 76 65 64 0a 3c 41 20 48 52 45 46 3d 22 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 70 69 63 61 73 61 2f 61 6e 73 77 65 72 2f 31 35 37 30 30 30 3f 68 6c 3d 65 6e 26 61 6d 70 3b 76 69 73 69 74 5f 69 64 3d 36 33 38 36 33 34 36 30 39 38 38 35 39 30 35 39 37 36 2d 31 Data Ascii: <HTML><HEAD><meta http-equiv="content-type" content="text/html;charset=utf-8"><TITLE>301 Moved</TITLE></HEAD><BODY><H1>301 Moved</H1>The document has moved<A HREF="https://support.google.com/picasa/answer/157000?hl=en&visit_id=638634609885905976-1

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.16	49715	172.217.23.110	443	3184	C:\Program Files (x86)\Internet Explorer\iexplore.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-02 10:16:28 UTC	335	OUT	GET /picasa/answer/157000?hl=en&visit_id=638634609885905976-1351747924&rd=1 HTTP/1.1 Accept: text/html, application/xhtml+xml, image/jxr, / Accept-Language: en-CH User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko Accept-Encoding: gzip, deflate Connection: Keep-Alive Host: support.google.com
2024-10-02 10:16:28 UTC	531	IN	HTTP/1.1 301 Moved Permanently Location: https://support.google.com/picasa/answer/156347?hl=en&visit_id=638634609885905976-1351747924&rd=2 X-Robots-Tag: follow,index Date: Wed, 02 Oct 2024 10:16:28 GMT Expires: Wed, 02 Oct 2024 10:16:28 GMT Cache-Control: private, max-age=0 Content-Type: text/html; charset=UTF-8 X-Content-Type-Options: nosniff Server: support-content-ui Content-Length: 302 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-10-02 10:16:28 UTC	302	IN	Data Raw: 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 63 6f 6e 74 65 6e 74 2d 74 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 3e 0a 3c 54 49 54 4c 45 3e 33 30 31 20 4d 6f 76 65 64 3c 2f 54 49 54 4c 45 3e 3c 2f 48 45 41 44 3e 3c 42 4f 44 59 3e 0a 3c 48 31 3e 33 30 31 20 4d 6f 76 65 64 3c 2f 48 31 3e 0a 54 68 65 20 64 6f 63 75 6d 65 6e 74 20 68 61 73 20 6d 6f 76 65 64 0a 3c 41 20 48 52 45 46 3d 22 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 70 69 63 61 73 61 2f 61 6e 73 77 65 72 2f 31 35 36 33 34 37 3f 68 6c 3d 65 6e 26 61 6d 70 3b 76 69 73 69 74 5f 69 64 3d 36 33 38 36 33 34 36 30 39 38 38 35 39 30 35 39 37 36 2d 31 Data Ascii: <HTML><HEAD><meta http-equiv="content-type" content="text/html;charset=utf-8"><TITLE>301 Moved</TITLE></HEAD><BODY><H1>301 Moved</H1>The document has moved<A HREF="https://support.google.com/picasa/answer/156347?hl=en&visit_id=638634609885905976-1

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.16	49720	172.217.23.110	443	3184	C:\Program Files (x86)\Internet Explorer\iexplore.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-02 10:16:29 UTC	335	OUT	GET /picasa/answer/156347?hl=en&visit_id=638634609885905976-1351747924&rd=2 HTTP/1.1 Accept: text/html, application/xhtml+xml, image/jxr, / Accept-Language: en-CH User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko Accept-Encoding: gzip, deflate Connection: Keep-Alive Host: support.google.com
2024-10-02 10:16:30 UTC	532	IN	HTTP/1.1 301 Moved Permanently Location: https://support.google.com/picasa/answer/6383491?hl=en&visit_id=638634609885905976-1351747924&rd=3 X-Robots-Tag: follow,index Date: Wed, 02 Oct 2024 10:16:29 GMT Expires: Wed, 02 Oct 2024 10:16:29 GMT Cache-Control: private, max-age=0 Content-Type: text/html; charset=UTF-8 X-Content-Type-Options: nosniff Server: support-content-ui Content-Length: 303 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-10-02 10:16:30 UTC	303	IN	Data Raw: 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 63 6f 6e 74 65 6e 74 2d 74 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 3e 0a 3c 54 49 54 4c 45 3e 33 30 31 20 4d 6f 76 65 64 3c 2f 54 49 54 4c 45 3e 3c 2f 48 45 41 44 3e 3c 42 4f 44 59 3e 0a 3c 48 31 3e 33 30 31 20 4d 6f 76 65 64 3c 2f 48 31 3e 0a 54 68 65 20 64 6f 63 75 6d 65 6e 74 20 68 61 73 20 6d 6f 76 65 64 0a 3c 41 20 48 52 45 46 3d 22 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 70 69 63 61 73 61 2f 61 6e 73 77 65 72 2f 36 33 38 33 34 39 31 3f 68 6c 3d 65 6e 26 61 6d 70 3b 76 69 73 69 74 5f 69 64 3d 36 33 38 36 33 34 36 30 39 38 38 35 39 30 35 39 37 36 2d Data Ascii: <HTML><HEAD><meta http-equiv="content-type" content="text/html;charset=utf-8"><TITLE>301 Moved</TITLE></HEAD><BODY><H1>301 Moved</H1>The document has moved<A HREF="https://support.google.com/picasa/answer/6383491?hl=en&visit_id=638634609885905976-

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.16	49721	172.217.23.110	443	3184	C:\Program Files (x86)\Internet Explorer\iexplore.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-02 10:16:30 UTC	336	OUT	GET /picasa/answer/6383491?hl=en&visit_id=638634609885905976-1351747924&rd=3 HTTP/1.1 Accept: text/html, application/xhtml+xml, image/jxr, / Accept-Language: en-CH User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko Accept-Encoding: gzip, deflate Connection: Keep-Alive Host: support.google.com
2024-10-02 10:16:30 UTC	1972	IN	HTTP/1.1 200 OK P3P: CP="This is not a P3P policy! See g.co/p3phelp for more info." P3P: CP="This is not a P3P policy! See g.co/p3phelp for more info." Strict-Transport-Security: max-age=31536000; includeSubdomains Content-Type: text/html; charset=UTF-8 Date: Wed, 02 Oct 2024 10:16:30 GMT Expires: Wed, 02 Oct 2024 10:16:30 GMT Cache-Control: private, max-age=0 Content-Security-Policy-Report-Only: object-src 'none';base-uri 'self';script-src 'nonce-b9Qq+iio0bqdtrDckkkW' 'unsafe-inline' 'unsafe-eval' 'strict-dynamic' https: http: 'report-sample';report-uri https://csp.withgoogle.com/csp/scfe P3P: CP="This is not a P3P policy! See g.co/p3phelp for more info." X-Content-Type-Options: nosniff Server: support-content-ui X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Set-Cookie: NID=517=qr4w1GgJjt0d2ifTarx3-KuOJKWw5bh2F4evOzqBRAM3F_gIqIUHz_Q5snFZezYyKAhQrVj-ZmVukx-98EgEqAkzYfpJpNN5O0v-W7Xdfyhr9KNDrb_8dt1Ee7v65eFtnra0mP-3bJi2cJHJSXIVGnn8eYJQaPiqTBIeWUywDRSHukk-HQ; expires=Thu, 03-Apr-2025 10:16:30 GMT; path=/; domain=.google.com; Secure; HttpOnly; SameSite=none Set-Cookie: NID=517=m-X95JoeCPCfoIHtcSxsmDi2wuwakqGlxl54bZGUpbMC8a-isGAbpG2Na1kJthkxyJutWyJR96BInrx1gm8GqFOkcoEY6cxDpArB931-8AEywgrSdlj_NkfkwtkvrNVCdHigO3n64T5OJjG2D0NbQ4RfOIRTD2zql-Sl_sWD3ScVAutPLTLnrvnwfcdARGW7_nOeLc_Xx6R7hL6-4RWij2UVns3pTxlpxWQcdbV_SDnZauyMgzVrmQ; expires=Thu, 03-Apr-2025 10:16:30 GMT; path=/; domain=.google.com; Secure; HttpOnly; SameSite=none Set-Cookie: NID=517=m-X95JoeCPCfoIHtcSxsmDi2wuwakqGlxl54bZGUpbMC8a-isGAbpG2Na1kJthkxyJutWyJR96BInrx1gm8GqFOkcoEY6cxDpArB931-8AEywgrSdlj_NkfkwtkvrNVCdHigO3n64T5OJjG2D0NbQ4RfOIRTD2zql-Sl_sWD3ScVAutPLTLnrvnwfcdARGW7_nOeLc_Xx6R7hL6-4RWij2UVns3pTxlpxWQcdbV_SDnZauyMgzVrmQ; expires=Thu, 03-Apr-2025 10:16:30 GMT; path=/; domain=.google.com; Secure; HttpOnly; SameSite=none Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-10-02 10:16:30 UTC	1972	IN	Data Raw: 38 30 30 30 0d 0a 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 68 63 66 65 22 20 64 61 74 61 2d 70 61 67 65 2d 74 79 70 65 3d 22 41 4e 53 57 45 52 22 20 6c 61 6e 67 3d 22 65 6e 22 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 57 68 61 74 27 73 20 68 61 70 70 65 6e 69 6e 67 20 74 6f 20 50 69 63 61 73 61 2c 20 50 69 63 61 73 61 20 57 65 62 20 41 6c 62 75 6d 73 2c 20 61 6e 64 20 74 68 65 20 50 69 63 61 73 61 20 57 65 62 20 41 6c 62 75 6d 73 20 41 50 49 3f 20 2d 20 50 69 63 61 73 61 20 61 6e 64 20 50 69 63 61 73 61 20 57 65 62 20 41 6c 62 75 6d 73 20 48 65 6c 70 3c 2f 74 69 74 6c 65 3e 3c 6d 65 74 61 20 63 6f 6e 74 65 6e 74 3d 22 65 6d 61 69 6c 3d 6e 6f 22 20 6e 61 6d 65 3d 22 66 6f 72 6d 61 74 2d 64 65 74 65 63 74 69 6f 6e Data Ascii: 8000<!doctype html><html class="hcfe" data-page-type="ANSWER" lang="en"><head><title>What's happening to Picasa, Picasa Web Albums, and the Picasa Web Albums API? - Picasa and Picasa Web Albums Help</title><meta content="email=no" name="format-detection
2024-10-02 10:16:30 UTC	1972	IN	Data Raw: 65 22 20 69 64 3d 22 66 6f 6e 74 2d 6e 63 65 22 20 72 65 6c 3d 22 70 72 65 6c 6f 61 64 22 20 6e 6f 6e 63 65 3d 22 62 39 51 71 2b 69 69 6f 30 62 71 64 74 72 44 63 6b 6b 6b 57 22 3e 3c 73 63 72 69 70 74 20 6e 6f 6e 63 65 3d 22 62 39 51 71 2b 69 69 6f 30 62 71 64 74 72 44 63 6b 6b 6b 57 22 3e 64 6f 63 75 6d 65 6e 74 2e 67 65 74 45 6c 65 6d 65 6e 74 42 79 49 64 28 27 66 6f 6e 74 2d 67 73 74 27 29 2e 61 64 64 45 76 65 6e 74 4c 69 73 74 65 6e 65 72 28 27 6c 6f 61 64 27 2c 66 75 6e 63 74 69 6f 6e 28 29 7b 74 68 69 73 2e 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 3b 7d 29 3b 64 6f 63 75 6d 65 6e 74 2e 67 65 74 45 6c 65 6d 65 6e 74 42 79 49 64 28 27 66 6f 6e 74 2d 6e 63 65 27 29 2e 61 64 64 45 76 65 6e 74 4c 69 73 74 65 6e 65 72 28 27 6c 6f 61 64 27 2c 66 75 Data Ascii: e" id="font-nce" rel="preload" nonce="b9Qq+iio0bqdtrDckkkW"><script nonce="b9Qq+iio0bqdtrDckkkW">document.getElementById('font-gst').addEventListener('load',function(){this.rel="stylesheet";});document.getElementById('font-nce').addEventListener('load',fu
2024-10-02 10:16:30 UTC	1972	IN	Data Raw: 35 72 65 6d 20 30 7d 2e 68 63 66 65 20 61 7b 63 6f 6c 6f 72 3a 23 30 62 35 37 64 30 3b 74 65 78 74 2d 64 65 63 6f 72 61 74 69 6f 6e 3a 6e 6f 6e 65 7d 2e 68 63 66 65 20 61 20 69 6d 67 7b 62 6f 72 64 65 72 3a 30 7d 2e 68 63 66 65 20 61 72 74 69 63 6c 65 20 73 65 63 74 69 6f 6e 20 73 65 63 74 69 6f 6e 7b 70 61 64 64 69 6e 67 3a 30 7d 2e 73 6b 69 70 2d 6c 69 6e 6b 7b 70 6f 73 69 74 69 6f 6e 3a 61 62 73 6f 6c 75 74 65 3b 6c 65 66 74 3a 2d 36 30 30 72 65 6d 3b 74 6f 70 3a 61 75 74 6f 3b 77 69 64 74 68 3a 30 2e 30 36 32 35 72 65 6d 3b 68 65 69 67 68 74 3a 30 2e 30 36 32 35 72 65 6d 3b 6f 76 65 72 66 6c 6f 77 3a 68 69 64 64 65 6e 3b 7a 2d 69 6e 64 65 78 3a 31 7d 2e 73 6b 69 70 2d 6c 69 6e 6b 3a 66 6f 63 75 73 7b 64 69 73 70 6c 61 79 3a 62 6c 6f 63 6b 3b 70 6f 73 Data Ascii: 5rem 0}.hcfe a{color:#0b57d0;text-decoration:none}.hcfe a img{border:0}.hcfe article section section{padding:0}.skip-link{position:absolute;left:-600rem;top:auto;width:0.0625rem;height:0.0625rem;overflow:hidden;z-index:1}.skip-link:focus{display:block;pos
2024-10-02 10:16:30 UTC	1972	IN	Data Raw: 7d 7d 2e 70 72 69 6d 61 72 79 2d 63 6f 6e 74 61 69 6e 65 72 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 74 72 61 6e 73 70 61 72 65 6e 74 3b 70 61 64 64 69 6e 67 3a 30 7d 40 6d 65 64 69 61 20 28 6d 69 6e 2d 77 69 64 74 68 3a 36 31 72 65 6d 29 7b 2e 70 61 67 65 2d 77 69 64 74 68 2d 63 6f 6e 74 61 69 6e 65 72 7b 64 69 73 70 6c 61 79 3a 66 6c 65 78 7d 7d 2e 73 63 2d 61 73 73 65 72 74 69 76 65 2d 6c 69 76 65 2d 72 65 67 69 6f 6e 2c 2e 73 63 2d 70 6f 6c 69 74 65 2d 6c 69 76 65 2d 72 65 67 69 6f 6e 7b 70 6f 73 69 74 69 6f 6e 3a 61 62 73 6f 6c 75 74 65 3b 6c 65 66 74 3a 2d 31 30 30 30 30 70 78 3b 77 69 64 74 68 3a 31 70 78 3b 68 65 69 67 68 74 3a 31 70 78 3b 6f 76 65 72 66 6c 6f 77 3a 68 69 64 64 65 6e 7d 2e 68 63 66 65 20 61 72 74 69 63 6c 65 20 73 65 63 74 69 6f 6e 7b Data Ascii: }}.primary-container{background:transparent;padding:0}@media (min-width:61rem){.page-width-container{display:flex}}.sc-assertive-live-region,.sc-polite-live-region{position:absolute;left:-10000px;width:1px;height:1px;overflow:hidden}.hcfe article section{
2024-10-02 10:16:30 UTC	1972	IN	Data Raw: 2d 6e 61 6d 65 7b 62 6f 74 74 6f 6d 3a 30 3b 64 69 73 70 6c 61 79 3a 62 6c 6f 63 6b 3b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 27 47 6f 6f 67 6c 65 20 53 61 6e 73 27 2c 27 50 72 6f 64 75 63 74 20 53 61 6e 73 27 2c 52 6f 62 6f 74 6f 2c 73 61 6e 73 2d 73 65 72 69 66 3b 66 6f 6e 74 2d 73 69 7a 65 3a 31 2e 31 32 35 72 65 6d 3b 6c 65 66 74 3a 35 32 70 78 3b 6c 69 6e 65 2d 68 65 69 67 68 74 3a 35 30 70 78 3b 6d 61 72 67 69 6e 3a 61 75 74 6f 3b 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 30 2e 35 72 65 6d 3b 70 6f 73 69 74 69 6f 6e 3a 61 62 73 6f 6c 75 74 65 3b 72 69 67 68 74 3a 31 35 32 70 78 3b 74 65 78 74 2d 61 6c 69 67 6e 3a 6c 65 66 74 3b 74 65 78 74 2d 6f 76 65 72 66 6c 6f 77 3a 65 6c 6c 69 70 73 69 73 3b 74 6f 70 3a 30 7d 2e 70 72 6f 6d 6f 74 65 64 2d 73 65 61 72 63 Data Ascii: -name{bottom:0;display:block;font-family:'Google Sans','Product Sans',Roboto,sans-serif;font-size:1.125rem;left:52px;line-height:50px;margin:auto;margin-left:0.5rem;position:absolute;right:152px;text-align:left;text-overflow:ellipsis;top:0}.promoted-searc
2024-10-02 10:16:30 UTC	1972	IN	Data Raw: 69 6f 6e 2d 6d 65 6e 75 2d 2d 62 6f 74 74 6f 6d 7b 70 61 64 64 69 6e 67 2d 62 6f 74 74 6f 6d 3a 31 34 70 78 7d 40 6d 65 64 69 61 20 28 6d 69 6e 2d 77 69 64 74 68 3a 33 30 72 65 6d 29 7b 2e 6e 61 76 69 67 61 74 69 6f 6e 2d 6d 65 6e 75 20 6c 69 7b 66 6f 6e 74 2d 73 69 7a 65 3a 31 72 65 6d 3b 70 61 64 64 69 6e 67 3a 31 39 70 78 20 30 20 31 39 70 78 20 36 36 70 78 7d 2e 6e 61 76 69 67 61 74 69 6f 6e 2d 6d 65 6e 75 20 6c 69 3a 68 6f 76 65 72 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 32 66 32 66 32 7d 2e 6e 61 76 69 67 61 74 69 6f 6e 2d 6d 65 6e 75 2d 2d 6e 65 73 74 65 64 20 6c 69 7b 70 61 64 64 69 6e 67 2d 6c 65 66 74 3a 39 30 70 78 7d 2e 6e 61 76 69 67 61 74 69 6f 6e 2d 6d 65 6e 75 2d 2d 62 6f 74 74 6f 6d 7b 70 61 64 64 69 6e 67 2d 62 6f 74 74 6f 6d 3a 31 39 Data Ascii: ion-menu--bottom{padding-bottom:14px}@media (min-width:30rem){.navigation-menu li{font-size:1rem;padding:19px 0 19px 66px}.navigation-menu li:hover{background:#f2f2f2}.navigation-menu--nested li{padding-left:90px}.navigation-menu--bottom{padding-bottom:19
2024-10-02 10:16:30 UTC	1972	IN	Data Raw: 54 67 75 4e 6a 63 67 4d 54 63 75 4e 6a 4d 67 4d 54 67 75 4d 54 5a 4d 4d 6a 49 67 4d 54 4a 4d 4d 54 63 75 4e 6a 4d 67 4e 53 34 34 4e 46 70 4e 4d 54 59 67 4d 54 64 49 4e 56 59 33 53 44 45 32 54 44 45 35 4c 6a 55 31 49 44 45 79 54 44 45 32 49 44 45 33 57 69 49 67 5a 6d 6c 73 62 44 30 69 49 7a 56 47 4e 6a 4d 32 4f 43 49 76 50 67 6f 38 4c 33 4e 32 5a 7a 34 4b 29 7d 2e 73 65 61 72 63 68 2d 71 75 65 72 79 2d 69 63 6f 6e 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 69 6d 61 67 65 3a 75 72 6c 28 64 61 74 61 3a 69 6d 61 67 65 2f 73 76 67 2b 78 6d 6c 3b 62 61 73 65 36 34 2c 50 48 4e 32 5a 79 42 34 62 57 78 75 63 7a 30 69 61 48 52 30 63 44 6f 76 4c 33 64 33 64 79 35 33 4d 79 35 76 63 6d 63 76 4d 6a 41 77 4d 43 39 7a 64 6d 63 69 49 48 64 70 5a 48 52 6f 50 53 49 79 4e 43 49 67 Data Ascii: TguNjcgMTcuNjMgMTguMTZMMjIgMTJMMTcuNjMgNS44NFpNMTYgMTdINVY3SDE2TDE5LjU1IDEyTDE2IDE3WiIgZmlsbD0iIzVGNjM2OCIvPgo8L3N2Zz4K)}.search-query-icon{background-image:url(data:image/svg+xml;base64,PHN2ZyB4bWxucz0iaHR0cDovL3d3dy53My5vcmcvMjAwMC9zdmciIHdpZHRoPSIyNCIg
2024-10-02 10:16:30 UTC	1972	IN	Data Raw: 6d 35 76 62 6e 70 6c 63 6d 38 69 49 47 31 68 63 32 73 39 49 6e 56 79 62 43 67 6a 59 69 6b 69 49 47 51 39 49 6b 30 74 4d 69 34 33 4e 6a 6b 74 4d 69 34 33 4e 6a 6c 6f 4d 54 63 75 4e 54 4d 34 56 6a 67 75 4d 7a 41 34 53 43 30 79 4c 6a 63 32 4f 58 6f 69 4c 7a 34 38 63 47 46 30 61 43 42 6d 61 57 78 73 50 53 49 6a 4d 55 45 33 4d 30 55 34 49 69 42 6d 61 57 78 73 4c 58 4a 31 62 47 55 39 49 6d 35 76 62 6e 70 6c 63 6d 38 69 49 47 31 68 63 32 73 39 49 6e 56 79 62 43 67 6a 59 69 6b 69 49 47 51 39 49 6b 30 34 4c 6a 4d 77 4f 43 30 79 4c 6a 63 32 4f 57 67 78 4d 53 34 77 4e 7a 64 57 4f 43 34 7a 4d 44 68 49 4f 43 34 7a 4d 44 68 36 49 69 38 2b 50 48 42 68 64 47 67 67 5a 6d 6c 73 62 44 30 69 49 30 51 35 4d 7a 41 79 4e 53 49 67 5a 6d 6c 73 62 43 31 79 64 57 78 6c 50 53 4a 75 Data Ascii: m5vbnplcm8iIG1hc2s9InVybCgjYikiIGQ9Ik0tMi43NjktMi43NjloMTcuNTM4VjguMzA4SC0yLjc2OXoiLz48cGF0aCBmaWxsPSIjMUE3M0U4IiBmaWxsLXJ1bGU9Im5vbnplcm8iIG1hc2s9InVybCgjYikiIGQ9Ik04LjMwOC0yLjc2OWgxMS4wNzdWOC4zMDhIOC4zMDh6Ii8+PHBhdGggZmlsbD0iI0Q5MzAyNSIgZmlsbC1ydWxlPSJu
2024-10-02 10:16:30 UTC	1972	IN	Data Raw: 4c 6a 59 31 4c 6a 49 35 4c 53 34 77 4d 53 41 77 4c 53 34 77 4d 53 34 77 4d 53 30 75 4d 44 49 75 4d 44 45 74 4c 6a 49 75 4d 54 45 74 4c 6a 4d 35 4c 6a 49 79 4c 53 34 31 4e 69 34 7a 4e 53 30 75 4e 44 55 75 4d 7a 55 74 4c 6a 63 31 4c 6a 63 33 4c 53 34 33 4e 53 41 78 4c 6a 49 32 64 6a 45 75 4f 44 46 68 4e 79 34 35 4e 7a 45 67 4e 79 34 35 4e 7a 45 67 4d 43 41 77 49 44 45 74 4e 53 34 77 4e 53 30 79 4c 6a 63 78 59 7a 45 75 4d 44 45 74 4c 6a 51 79 49 44 49 75 4d 7a 4d 74 4c 6a 63 78 49 44 4d 75 4e 44 45 74 4c 6a 63 78 61 43 34 77 4e 6d 4d 75 4e 44 49 74 4c 6a 63 32 49 44 45 75 4d 54 51 74 4d 53 34 7a 4d 79 41 78 4c 6a 6b 32 4c 54 45 75 4e 7a 63 74 4c 6a 67 74 4c 6a 45 32 4c 54 45 75 4e 54 4d 74 4c 6a 49 7a 4c 54 49 75 4d 44 49 74 4c 6a 49 7a 4c 54 45 67 4d 43 30 Data Ascii: LjY1LjI5LS4wMSAwLS4wMS4wMS0uMDIuMDEtLjIuMTEtLjM5LjIyLS41Ni4zNS0uNDUuMzUtLjc1Ljc3LS43NSAxLjI2djEuODFhNy45NzEgNy45NzEgMCAwIDEtNS4wNS0yLjcxYzEuMDEtLjQyIDIuMzMtLjcxIDMuNDEtLjcxaC4wNmMuNDItLjc2IDEuMTQtMS4zMyAxLjk2LTEuNzctLjgtLjE2LTEuNTMtLjIzLTIuMDItLjIzLTEgMC0
2024-10-02 10:16:30 UTC	1972	IN	Data Raw: 2d 64 69 61 6c 6f 67 2d 6d 69 6e 69 6d 69 7a 65 64 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 31 66 31 66 31 66 3b 62 6f 72 64 65 72 3a 30 3b 62 6f 72 64 65 72 2d 72 61 64 69 75 73 3a 2e 32 35 72 65 6d 20 2e 32 35 72 65 6d 20 30 20 30 3b 62 6f 74 74 6f 6d 3a 30 3b 62 6f 78 2d 73 68 61 64 6f 77 3a 30 20 2e 35 72 65 6d 20 2e 36 32 35 72 65 6d 20 2e 30 36 32 35 72 65 6d 20 72 67 62 61 28 30 2c 30 2c 30 2c 30 2e 31 34 29 2c 30 20 2e 31 38 37 35 72 65 6d 20 2e 38 37 35 72 65 6d 20 2e 31 32 35 72 65 6d 20 72 67 62 61 28 30 2c 30 2c 30 2c 30 2e 31 32 29 2c 30 20 2e 33 31 32 35 72 65 6d 20 2e 33 31 32 35 72 65 6d 20 2d 2e 31 38 37 35 72 65 6d 20 72 67 62 61 28 30 2c 30 2c 30 2c 30 2e 32 29 3b 63 6f 6c 6f 72 3a 23 66 66 66 66 66 66 3b 63 75 72 73 6f 72 3a 70 6f 69 6e Data Ascii: -dialog-minimized{background:#1f1f1f;border:0;border-radius:.25rem .25rem 0 0;bottom:0;box-shadow:0 .5rem .625rem .0625rem rgba(0,0,0,0.14),0 .1875rem .875rem .125rem rgba(0,0,0,0.12),0 .3125rem .3125rem -.1875rem rgba(0,0,0,0.2);color:#ffffff;cursor:poin

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.16	49723	172.217.23.97	443	4912	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-02 10:16:30 UTC	594	OUT	GET /crx/blobs/AY4GWKDHKllS27BO_e8bCnbax_jg8ytdTG4Uzua5Kte91Msonmjt9Ssh1u4j53F3UYy-997sHknkzKEy9994XId3zBBDiju_YSunzv5QYwyL8XEx9VuF26n3JIgkmCYaLzIAxlKa5UdUDZoPCHdwU63c7rFT0JUxfsWG/GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_82_1_0.crx HTTP/1.1 Host: clients2.googleusercontent.com Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-10-02 10:16:30 UTC	566	IN	HTTP/1.1 200 OK Accept-Ranges: bytes Content-Length: 135800 X-GUploader-UploadID: AD-8lju06NrZMi7JQB1k-8VJ57KtAu8qqh7Wo8tJPUL9HeLUEvIO-AlYMCOAlzQiyt4rRYRLQjg X-Goog-Hash: crc32c=2rkoIg== Server: UploadServer Date: Tue, 01 Oct 2024 18:29:00 GMT Expires: Wed, 01 Oct 2025 18:29:00 GMT Cache-Control: public, max-age=31536000 Age: 56850 Last-Modified: Wed, 25 Sep 2024 18:28:43 GMT ETag: c770f43b_2e4e8419_a87d1040_314358aa_d4b28262 Content-Type: application/x-chrome-extension Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-10-02 10:16:30 UTC	824	IN	Data Raw: 43 72 32 34 03 00 00 00 e0 15 00 00 12 ac 04 0a a6 02 30 82 01 22 30 0d 06 09 2a 86 48 86 f7 0d 01 01 01 05 00 03 82 01 0f 00 30 82 01 0a 02 82 01 01 00 9c 5e d1 18 b0 31 22 89 f4 fd 77 8d 67 83 0b 74 fd c3 32 4a 0e 47 31 00 29 58 34 b1 bf 3d 26 90 3f 5b 6a 2c 4c 7a fd d5 6a b0 75 cf 65 5b 49 85 71 2a 42 61 2f 58 dd ee dc 50 c1 68 fc cd 84 4c 04 88 b9 99 dc 32 25 33 5f 6f f4 ae b5 ad 19 0d d4 b8 48 f7 29 27 b9 3d d6 95 65 f8 ac c8 9c 3f 15 e6 ef 1f 08 ab 11 6a e1 a9 c8 33 55 48 fd 7c bf 58 8c 4d 06 e3 97 75 cc c2 9c 73 5b a6 2a f2 ea 3f 24 f3 9c db 8a 05 9f 46 25 11 1d 18 b4 49 08 19 94 80 29 08 f2 2c 2d c0 2f 90 65 35 29 a6 66 83 e7 4f e4 b2 71 14 5e ff 90 92 01 8d d3 bf ca a0 d0 39 a0 08 28 e3 d2 5f d5 70 68 32 fe 10 5e d5 59 42 50 58 66 5f 38 cc 0b 08 Data Ascii: Cr240"0H0^1"wgt2JG1)X4=&?[j,Lzjue[IqBa/XPhL2%3_oH)'=e?j3UH\|XMus[*?$F%I),-/e5)fOq^9(_ph2^YBPXf_8
2024-10-02 10:16:30 UTC	1390	IN	Data Raw: 8c 97 6b ff e3 2f 3f c6 cf aa aa f3 5b fd a7 a1 fa fc d3 e9 a2 aa 1f 7f fe 71 bb 9c fb 4a fe bd bc f6 63 d5 8f 3f fe f2 8f 1f 43 fe 54 d7 5c ea cf 57 cf a0 29 4c db 10 dc 36 52 b3 ae 4b b3 56 e5 f3 f0 c2 ad db 25 eb a6 af cc 1c 4f a5 a9 5e 44 72 78 41 fb 9f 36 ba 3c 2e c2 53 bd 48 91 71 68 ae 17 fd f9 3a 6c a8 79 f8 fe 7b a7 6e 22 0d 2f 91 1a 7f 3d f4 4e 2d bd f3 25 ba 1c a6 b0 39 df 4b cf ee bf 3f 53 76 db 2f 09 b7 d7 2c 45 d7 ef ef 0b 13 71 f1 34 26 ce cf cf a4 1d 31 62 70 a4 dd d8 08 0f 75 79 47 81 9c d9 a1 04 01 42 40 ec 48 17 3c 73 3f d8 54 9e b0 c5 33 d8 1e fd db a5 f4 a0 91 ef 0e 2f 07 b5 bd 15 26 aa 0b 8f cd 47 13 76 47 13 a8 d2 42 b5 30 f5 75 37 cc 85 b9 b9 1c 77 c1 b3 30 b7 ff 9e e7 f7 b3 05 53 ee aa 9e 59 f5 3e 81 0c 1d b9 f8 4a 3a 06 39 87 17 Data Ascii: k/?[qJc?CT\W)L6RKV%O^DrxA6<.SHqh:ly{n"/=N-%9K?Sv/,Eq4&1bpuyGB@H<s?T3/&GvGB0u7w0SY>J:9
2024-10-02 10:16:30 UTC	1390	IN	Data Raw: 82 a5 ad 63 16 2d b2 d7 de 7f e5 f8 38 9b d9 24 52 5d ef 15 36 91 61 58 94 c1 5c ba c8 2b f6 30 ce 7d 84 43 e5 5a b2 ab 77 d8 85 5a 03 02 5c 3e 81 8f 0d f9 b5 38 7e 7f 58 eb b9 37 64 0e c6 b0 57 4a 18 93 73 a4 e8 11 d2 b1 a3 4a ee 8a bd 74 93 bd 0c 4a 2a 62 0c b0 53 f6 5a a3 a9 d6 23 46 a7 d0 5f 5e fb f2 ff a1 c1 65 83 87 cc a8 95 f4 c5 67 6e aa 34 71 c3 91 f8 8e 1b 37 a2 17 66 90 e1 4e 87 82 e5 5c 84 2b 32 da 89 f7 52 41 07 9b 72 b3 9c 7b 72 2d ff 51 fb dc 0d f6 84 8b e6 ba 95 6e 60 12 00 3b e4 0b 91 1b c3 91 cc 5a 03 3c cc 43 ff a7 19 9b 8f 07 f3 71 9c 51 bc af ba f3 63 91 bf b5 36 f7 06 17 29 d8 a6 d6 f0 26 95 3b 47 b0 6e 09 40 14 5b 75 a0 7b 8c 44 b4 60 d6 bd 0e d5 f5 c0 8b 0d f0 86 88 f2 4a 0b 9a c5 b2 f7 bb e6 2b d9 e3 56 dd b2 46 b9 55 ef 18 61 2f Data Ascii: c-8$R]6aX\+0}CZwZ\>8~X7dWJsJtJ*bSZ#F_^egn4q7fN\+2RAr{r-Qn`;Z<CqQc6)&;Gn@[u{D`J+VFUa/
2024-10-02 10:16:30 UTC	1390	IN	Data Raw: b0 ab ba e9 3d 4a 8c 67 e9 cb cf dc c0 29 23 70 9f c0 01 e6 b3 68 45 a7 fb 8e 25 f6 96 53 af f5 39 11 dd d8 94 07 9d e0 07 40 00 fb 40 ed e0 0a 6e d7 bc 81 88 d0 31 c6 9e 7d 27 5d ad b8 0b cd 84 21 bb ea e0 07 d6 b1 b9 c4 be f4 56 b2 57 03 cd 1b 28 ca c6 b9 94 7c 7b 24 14 9b b1 85 37 a2 13 6f 19 71 be 88 76 fd b8 dd d6 88 6f 9f cc c8 00 69 5f 41 62 95 20 df ff 5c 62 ff d0 7c 77 74 a5 ee 94 be 3b 09 78 b6 44 3b 68 e6 41 cf f6 78 4c 3a 14 11 57 eb 10 6d 1f df fb 8d c4 1b 6e 99 25 be f3 af cd fa e0 19 7a 87 e7 ff c1 df 48 81 43 d7 c6 3f 03 db 83 4c 1d 83 bb e3 5b 6c 6c fd 42 21 1e cf ac 4d 60 3c 53 d8 da 9c 8f 2f e1 de c9 12 22 41 49 d1 15 ab a1 11 33 5c d4 fd b2 5b 59 73 15 d6 fd 6b 70 8f 9b b3 1d ba b6 9b eb f9 e5 5e 9d 14 50 5d 28 3c 03 ce 86 b4 22 ca 94 Data Ascii: =Jg)#phE%S9@@n1}']!VW(\|{$7oqvoi_Ab \b\|wt;xD;hAxL:Wmn%zHC?L[llB!M`<S/"AI3\[Yskp^P](<"
2024-10-02 10:16:30 UTC	1390	IN	Data Raw: 55 70 3d 77 b8 fd 66 30 94 7e fc 5f c6 0d 40 08 61 5d 00 dd 2f ef 95 cd 58 3d 12 b7 8e 73 0e 93 b2 41 2e 6e c7 bd f6 36 43 6c 9d 37 12 28 8a 40 fb 2c dc 31 0b 55 f0 bb f5 2d 4d f6 94 9d 6a f4 d8 56 61 05 9f 3a ce 4e 59 a7 ee a9 e5 e8 31 ff eb f8 28 57 41 82 1b d8 54 7d 30 73 1e 3e 63 f6 ad 71 07 80 5c 31 c4 c4 dd e0 14 be 23 4b 36 d8 d0 3a e7 d6 3d 31 ae a3 6c d4 7c e8 81 d4 f7 eb f4 58 63 96 c6 df f7 32 be 99 ff 3b 96 6e 87 ee 9f e7 2d 4f 7f 78 ce f2 5f df 1d a4 c7 c6 d4 54 ed bf ce 4a d6 3a 46 ed 7b ae e3 42 f0 f1 51 f0 ad ca 4c fb 5e 74 ea 56 74 b6 f6 9f d3 57 e1 d5 9f b9 d7 5e fe f7 bb 96 8e e7 1e 0d df b9 f3 7d 16 f3 d8 9c 9f c7 c6 fd fe ff 43 c7 97 a1 e3 ee ab 80 5b 53 b3 98 73 ae f5 ad b9 4e a7 f8 df 87 46 f3 f1 fe 59 dd 7e fc e5 af ff f8 51 57 b9 Data Ascii: Up=wf0~_@a]/X=sA.n6Cl7(@,1U-MjVa:NY1(WAT}0s>cq\1#K6:=1l\|Xc2;n-Ox_TJ:F{BQL^tVtW^}C[SsNFY~QW
2024-10-02 10:16:30 UTC	1390	IN	Data Raw: a5 13 86 33 b7 40 6b 0f 86 85 bc f0 6a 25 cf 40 74 87 b6 74 ed 60 34 fb 8b 3f 7d ee d9 8f 7b 03 36 3c 4d 13 55 ac f5 48 7f 94 cf f0 fa fe b6 7e 2d 9f 9f 0f c6 cc fe f1 e8 01 fd 70 24 26 d7 1c cf 8f 61 96 f1 93 48 6e b6 58 e2 6f 12 fe 3a 8e 8e e3 6e 37 10 bb 35 09 4d ba b5 b9 29 5f 6b a0 03 f2 6e 58 45 60 6d 8d cf b7 c3 de 55 02 9c 01 e6 8b 6d 0a 88 ed 2d 15 29 33 76 6d 26 48 d9 d5 28 bd 98 b5 81 ca b1 e3 12 d8 bb 61 35 13 59 6a d2 a8 29 63 61 f2 92 13 f8 e1 33 03 85 e9 05 d0 08 06 88 73 1e 46 81 20 c1 d9 24 4d 7f a7 9b 9b ae f5 1b 1a f2 ed 17 91 e7 e9 3e 55 a3 33 cd 8c 04 64 f9 04 00 a2 f3 11 e7 0e 09 80 b4 34 ab cd cd d5 89 06 44 bb 24 e6 36 62 36 40 56 8a 6f 45 c3 92 e6 c0 7a 8e e6 c3 28 05 94 e4 a5 39 f4 88 2f 2e 03 93 94 f2 bd 04 af eb 8e 22 01 a3 1a Data Ascii: 3@kj%@tt`4?}{6<MUH~-p$&aHnXo:n75M)_knXE`mUm-)3vm&H(a5Yj)ca3sF $M>U3d4D$6b6@VoEz(9/."
2024-10-02 10:16:30 UTC	1390	IN	Data Raw: d8 43 75 8e 66 09 40 82 c5 f4 87 9e df e7 0c 49 2e f1 85 3d 0b ea cb 82 b7 a1 d5 d1 1c 5d 4e 68 57 68 59 c6 d6 cf de bb 12 5c 63 d8 90 0c a3 05 fc 6d 08 3b 9e 73 81 e0 0e bd dc 6e 17 e6 4b c9 18 2c 4a f8 19 54 98 53 58 01 a0 6f 44 dc da 40 06 b1 d9 80 b3 d8 a1 21 fe 9c 70 09 a9 83 68 d7 17 24 fd 84 0b 3e 7d 4f 09 84 4d 9c 87 58 f2 30 a1 67 5c e1 2a 20 94 65 37 1f 58 4b 9f 4b 6f 58 8f c5 e9 6d 6b c9 9d 02 c3 85 92 fe 69 38 14 aa 59 b0 71 ca 95 33 fd ca 4b dc 53 a1 a1 11 b2 43 7d de 21 e0 6b d5 d6 c0 06 fb 61 21 1b 94 7b 99 9a ed 24 ee 71 d7 2b 0b a1 80 48 c6 7a 5d 10 0a 96 25 1b c4 bf c3 e3 37 20 a6 bf 8d 83 1e db da 82 7f c2 b0 b9 b9 09 78 2a c4 9b 43 10 e6 00 fb d0 7a 37 ae 1d 72 40 73 6c f1 e0 75 bd ee 27 6e df 98 c8 85 7b 28 ed 74 77 5a 00 03 6b d4 e7 Data Ascii: Cuf@I.=]NhWhY\cm;snK,JTSXoD@!ph$>}OMX0g\* e7XKKoXmki8Yq3KSC}!ka!{$q+Hz]%7 x*Cz7r@slu'n{(twZk
2024-10-02 10:16:30 UTC	1390	IN	Data Raw: 3d 62 43 e6 84 e3 41 ca 26 a6 61 a3 82 c6 ac c0 b4 44 74 ec 16 2d ae 5b 28 6c dd 50 50 e4 63 b4 2b 59 fc 5e 55 72 0d d8 8b e5 47 98 13 7e d8 f5 c5 ae ad 70 c9 c6 bc 81 d5 c6 01 fa 80 6e be 68 ae 8b 6a 96 d9 22 7c fb 47 cd d5 a8 b9 72 2b d4 f6 35 ed dc a9 6c 88 4f b0 d4 14 10 f3 7d 66 1a 28 ca ca 34 2e 88 41 bd 80 e6 1b 7a b4 a0 f9 a7 a1 a0 35 30 6f 52 92 fa fe 29 ed 4f 24 fc 64 47 b7 3a 5d f5 79 57 00 3d 90 66 2f 31 fe 54 c6 36 a4 b3 b5 e2 4d ac dd 47 40 b0 90 58 a1 0f ce bb 8a 81 71 c5 46 34 0c 4c 22 09 e3 d2 24 b8 b7 20 49 dc 44 68 d4 4b 8d 8c c2 ed 82 cf ff ff 73 b0 b8 8a 83 25 9a 83 c5 82 77 6d 24 24 bd c4 c0 9e 12 cd b7 12 9a 53 0c 1c 2a a9 78 cf 5b b3 be 95 b8 17 2a c7 7a fd 33 58 2a cd bd 32 c1 7b 32 83 7b c5 fa 27 32 9e 58 b7 66 d4 95 f2 e3 4a fd Data Ascii: =bCA&aDt-[(lPPc+Y^UrG~pnhj"\|Gr+5lO}f(4.Az50oR)O$dG:]yW=f/1T6MG@XqF4L"$ IDhKs%wm$$Sx[z3X*2{2{'2XfJ
2024-10-02 10:16:30 UTC	1390	IN	Data Raw: 1b ca 95 d0 89 da ac c3 b7 7b 6f 4a 7f a1 46 c7 61 74 92 a1 1d b5 1d 6c d9 51 4d 03 c7 e4 9f 16 8b c8 74 ad ae 8d 7d d7 63 39 af 1a 8b d1 ae 6a 4b 00 8c f7 a0 9d b4 e4 7a 60 a1 13 f3 75 fe 39 87 ed b7 f6 88 89 7f 89 d1 07 3a 66 fa 37 93 67 bd e4 aa 90 44 d3 60 a7 a7 03 98 71 23 02 39 d1 57 d4 c1 70 c7 ec 30 e3 90 d8 06 b3 fc 7a 44 41 ca 54 e7 e9 b6 54 2c ca 44 74 8a f6 50 11 7b 20 2b f9 db da aa 60 c7 d4 a5 b7 aa ef 05 e5 52 f3 d1 b4 e8 65 33 31 b3 14 84 29 85 88 e2 5d 84 9a e1 72 b5 d7 95 62 06 3c 34 40 2e 25 3c 2e c3 e7 e2 9d d1 3b c2 71 73 73 cd 07 23 2a 40 c9 e5 ce 88 cd 7a 67 69 0d 09 29 fa 23 b6 5a 9d df ac bd a3 30 e3 52 8c 86 ec b7 c6 80 f4 d2 ee 5a 5b f2 56 40 6f ad 03 3a 9a d7 a8 06 ac 6d 42 12 a8 e8 de 44 8e 32 3c 89 d1 25 26 8c f6 08 d5 dd a6 Data Ascii: {oJFatlQMt}c9jKz`u9:f7gD`q#9Wp0zDATT,DtP{ +`Re31)]rb<4@.%<.;qss#*@zgi)#Z0RZ[V@o:mBD2<%&
2024-10-02 10:16:30 UTC	1390	IN	Data Raw: e6 46 61 22 0c 5a 6b ed 56 94 f4 46 d9 1a 00 1a b9 a5 5b c8 ac 28 ba f9 91 39 b0 72 75 1c 90 c8 f0 82 8e 6f 2c ba d9 ea 6c 90 34 46 73 1d 2b 7b c0 79 63 b7 97 1f 8c 66 d5 bb 57 7e 75 9b b4 81 a3 5e 8e c6 42 1e c8 28 8d b5 2b e6 75 43 e7 f4 7f 45 e1 38 ea 88 46 d6 94 f7 84 49 db 9f e8 26 4b 36 7e b3 c9 69 55 93 a5 f2 b2 49 c3 8a 14 29 85 47 c2 e6 a9 74 bf e8 c0 03 e3 ab ca 20 41 49 69 c2 48 9f 50 d3 62 ce 8a bd 48 8a 37 20 d6 f8 29 3f 53 0d 4d 26 4f 53 ab 8b e4 49 aa 5d 8f 06 b2 cd 2d 94 a1 f3 0e 03 76 f9 16 94 1c 5c d0 11 fd 05 f6 d5 1f 8d cf 39 ed ad e1 3b c3 de 73 16 c9 ec 04 25 57 0d 6a 5a 42 e5 11 ca 9a 83 db c9 f1 7c e2 6e ce 34 3d 4b 61 ab 5d 3a be 73 ce 26 23 00 34 7c 52 06 01 d8 50 86 4d 49 f6 c1 6c 73 98 99 44 80 b0 7b 4a 0b e6 48 2b 0e 2f 16 b0 Data Ascii: Fa"ZkVF[(9ruo,l4Fs+{ycfW~u^B(+uCE8FI&K6~iUI)Gt AIiHPbH7 )?SM&OSI]-v\9;s%WjZB\|n4=Ka]:s&#4\|RPMIlsD{JH+/

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.16	49737	142.250.186.65	443	3184	C:\Program Files (x86)\Internet Explorer\iexplore.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-02 10:16:31 UTC	470	OUT	GET /euPTmjj_6KOIZQJEA6eBnNPDVsQh79w_GUOZOjxdi8mCA2a5YlFg95RYLD3X8aJkxB0u=w36-h36 HTTP/1.1 Accept: image/png, image/svg+xml, image/jxr, image/;q=0.8, /*;q=0.5 Referer: https://support.google.com/picasa/answer/6383491?hl=en&visit_id=638634609885905976-1351747924&rd=3 Accept-Language: en-CH User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko Accept-Encoding: gzip, deflate Host: lh3.googleusercontent.com Connection: Keep-Alive
2024-10-02 10:16:32 UTC	531	IN	HTTP/1.1 200 OK Access-Control-Allow-Origin: * Timing-Allow-Origin: * Access-Control-Expose-Headers: Content-Length Content-Disposition: inline;filename="unnamed.png" X-Content-Type-Options: nosniff Server: fife Content-Length: 213 X-XSS-Protection: 0 Date: Wed, 02 Oct 2024 06:28:35 GMT Expires: Thu, 03 Oct 2024 06:28:35 GMT Cache-Control: public, max-age=86400, no-transform Age: 13677 ETag: "v1" Content-Type: image/png Vary: Origin Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-10-02 10:16:32 UTC	213	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 18 00 00 00 18 08 04 00 00 00 4a 7e f5 73 00 00 00 9c 49 44 41 54 78 01 bd 93 55 01 04 21 14 00 cf fb 9d d1 64 32 9c f4 80 4c eb 25 08 b0 ee ee cc d7 ca 00 cf 0e 7b 2f 6e 08 14 16 3a c4 42 21 b8 f5 fd fe c4 c5 af e1 f2 6c ff f9 c8 1f bf 83 1f c7 a6 f0 c3 ef e1 db bc 8c 3f c0 a3 1a aa 57 fd 1c bf ad c7 72 2d 04 81 df 2f c4 88 42 50 f8 23 90 85 60 8d 12 cc 42 d0 a3 ae a4 17 08 d6 28 c1 6c 06 dd 2f c8 05 69 bd e1 8e 2e dc f8 d6 58 d2 7c b1 70 ec 51 be 1c db 67 e2 d1 3a 40 8f be 99 bb 22 90 98 e8 10 13 89 28 42 dd 6b 05 95 2b bd 27 b9 11 c4 90 00 00 00 00 49 45 4e 44 ae 42 60 82 Data Ascii: PNGIHDRJ~sIDATxU!d2L%{/n:B!l?Wr-/BP#`B(l/i.X\|pQg:@"(Bk+'IENDB`

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.16	49749	172.64.41.3	443	4912	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-02 10:16:33 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-10-02 10:16:33 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP
2024-10-02 10:16:33 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Wed, 02 Oct 2024 10:16:33 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8cc3f0079e4b4201-EWR alt-svc: h3=":443"; ma=86400
2024-10-02 10:16:33 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 00 e1 00 04 8e fa 50 03 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcomP)

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.16	49750	172.64.41.3	443	4912	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-02 10:16:33 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-10-02 10:16:33 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP
2024-10-02 10:16:33 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Wed, 02 Oct 2024 10:16:33 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8cc3f0077c928cc3-EWR alt-svc: h3=":443"; ma=86400
2024-10-02 10:16:33 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 01 1c 00 04 8e fb 28 e3 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom()

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.2.16	49751	162.159.61.3	443	4912	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-02 10:16:33 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-10-02 10:16:33 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP
2024-10-02 10:16:33 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Wed, 02 Oct 2024 10:16:33 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8cc3f0080c617d1c-EWR alt-svc: h3=":443"; ma=86400
2024-10-02 10:16:33 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 01 10 00 04 8e fa 50 63 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcomPc)

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
14	192.168.2.16	49755	142.250.185.174	443	3184	C:\Program Files (x86)\Internet Explorer\iexplore.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-02 10:16:33 UTC	785	OUT	GET /_/scs/abc-static/_/js/k=gapi.gapi.en.SpvAvsXfWWo.O/m=gapi_iframes,googleapis_client/rt=j/sv=1/d=1/ed=1/am=AACA/rs=AHpOoo-MoqWi0fF1M09Ccs-6QfulXvxfdg/cb=gapi.loaded_0 HTTP/1.1 Accept: application/javascript, /;q=0.8 Referer: https://support.google.com/picasa/answer/6383491?hl=en&visit_id=638634609885905976-1351747924&rd=3 Accept-Language: en-CH User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko Accept-Encoding: gzip, deflate Host: apis.google.com Connection: Keep-Alive Cookie: NID=517=m-X95JoeCPCfoIHtcSxsmDi2wuwakqGlxl54bZGUpbMC8a-isGAbpG2Na1kJthkxyJutWyJR96BInrx1gm8GqFOkcoEY6cxDpArB931-8AEywgrSdlj_NkfkwtkvrNVCdHigO3n64T5OJjG2D0NbQ4RfOIRTD2zql-Sl_sWD3ScVAutPLTLnrvnwfcdARGW7_nOeLc_Xx6R7hL6-4RWij2UVns3pTxlpxWQcdbV_SDnZauyMgzVrmQ
2024-10-02 10:16:33 UTC	915	IN	HTTP/1.1 200 OK Accept-Ranges: bytes Access-Control-Allow-Origin: * Content-Security-Policy-Report-Only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/social-frontend-mpm-access Cross-Origin-Resource-Policy: cross-origin Cross-Origin-Opener-Policy: same-origin; report-to="social-frontend-mpm-access" Report-To: {"group":"social-frontend-mpm-access","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/social-frontend-mpm-access"}]} Content-Length: 126135 X-Content-Type-Options: nosniff Server: sffe X-XSS-Protection: 0 Date: Tue, 01 Oct 2024 08:20:52 GMT Expires: Wed, 01 Oct 2025 08:20:52 GMT Cache-Control: public, max-age=31536000 Last-Modified: Fri, 06 Sep 2024 22:07:50 GMT Content-Type: text/javascript; charset=UTF-8 Vary: Accept-Encoding Age: 93341 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-10-02 10:16:33 UTC	475	IN	Data Raw: 67 61 70 69 2e 6c 6f 61 64 65 64 5f 30 28 66 75 6e 63 74 69 6f 6e 28 5f 29 7b 76 61 72 20 77 69 6e 64 6f 77 3d 74 68 69 73 3b 0a 5f 2e 5f 46 5f 74 6f 67 67 6c 65 73 5f 69 6e 69 74 69 61 6c 69 7a 65 3d 66 75 6e 63 74 69 6f 6e 28 61 29 7b 28 74 79 70 65 6f 66 20 67 6c 6f 62 61 6c 54 68 69 73 21 3d 3d 22 75 6e 64 65 66 69 6e 65 64 22 3f 67 6c 6f 62 61 6c 54 68 69 73 3a 74 79 70 65 6f 66 20 73 65 6c 66 21 3d 3d 22 75 6e 64 65 66 69 6e 65 64 22 3f 73 65 6c 66 3a 74 68 69 73 29 2e 5f 46 5f 74 6f 67 67 6c 65 73 3d 61 7c 7c 5b 5d 7d 3b 28 30 2c 5f 2e 5f 46 5f 74 6f 67 67 6c 65 73 5f 69 6e 69 74 69 61 6c 69 7a 65 29 28 5b 30 78 38 30 30 30 30 30 2c 20 5d 29 3b 0a 76 61 72 20 62 61 2c 66 61 2c 68 61 2c 6e 61 2c 6f 61 2c 73 61 2c 75 61 2c 77 61 3b 62 61 3d 66 75 6e Data Ascii: gapi.loaded_0(function(_){var window=this;_._F_toggles_initialize=function(a){(typeof globalThis!=="undefined"?globalThis:typeof self!=="undefined"?self:this)._F_toggles=a\|\|[]};(0,_._F_toggles_initialize)([0x800000, ]);var ba,fa,ha,na,oa,sa,ua,wa;ba=fun
2024-10-02 10:16:33 UTC	1390	IN	Data Raw: 6e 20 61 3b 61 5b 62 5d 3d 63 2e 76 61 6c 75 65 3b 72 65 74 75 72 6e 20 61 7d 3b 0a 68 61 3d 66 75 6e 63 74 69 6f 6e 28 61 29 7b 61 3d 5b 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 67 6c 6f 62 61 6c 54 68 69 73 26 26 67 6c 6f 62 61 6c 54 68 69 73 2c 61 2c 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 77 69 6e 64 6f 77 26 26 77 69 6e 64 6f 77 2c 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 73 65 6c 66 26 26 73 65 6c 66 2c 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 67 6c 6f 62 61 6c 26 26 67 6c 6f 62 61 6c 5d 3b 66 6f 72 28 76 61 72 20 62 3d 30 3b 62 3c 61 2e 6c 65 6e 67 74 68 3b 2b 2b 62 29 7b 76 61 72 20 63 3d 61 5b 62 5d 3b 69 66 28 63 26 26 63 2e 4d 61 74 68 3d 3d 4d 61 74 68 29 72 65 74 75 72 6e 20 63 7d 74 68 72 6f 77 20 45 Data Ascii: n a;a[b]=c.value;return a};ha=function(a){a=["object"==typeof globalThis&&globalThis,a,"object"==typeof window&&window,"object"==typeof self&&self,"object"==typeof global&&global];for(var b=0;b<a.length;++b){var c=a[b];if(c&&c.Math==Math)return c}throw E
2024-10-02 10:16:33 UTC	1390	IN	Data Raw: 65 66 69 6e 65 64 22 26 26 53 79 6d 62 6f 6c 2e 69 74 65 72 61 74 6f 72 26 26 61 5b 53 79 6d 62 6f 6c 2e 69 74 65 72 61 74 6f 72 5d 3b 69 66 28 62 29 72 65 74 75 72 6e 20 62 2e 63 61 6c 6c 28 61 29 3b 69 66 28 74 79 70 65 6f 66 20 61 2e 6c 65 6e 67 74 68 3d 3d 22 6e 75 6d 62 65 72 22 29 72 65 74 75 72 6e 7b 6e 65 78 74 3a 62 61 28 61 29 7d 3b 74 68 72 6f 77 20 45 72 72 6f 72 28 22 62 60 22 2b 53 74 72 69 6e 67 28 61 29 29 3b 7d 3b 73 61 3d 66 75 6e 63 74 69 6f 6e 28 61 2c 62 29 7b 72 65 74 75 72 6e 20 4f 62 6a 65 63 74 2e 70 72 6f 74 6f 74 79 70 65 2e 68 61 73 4f 77 6e 50 72 6f 70 65 72 74 79 2e 63 61 6c 6c 28 61 2c 62 29 7d 3b 75 61 3d 74 79 70 65 6f 66 20 4f 62 6a 65 63 74 2e 61 73 73 69 67 6e 3d 3d 22 66 75 6e 63 74 69 6f 6e 22 3f 4f 62 6a 65 63 74 2e Data Ascii: efined"&&Symbol.iterator&&a[Symbol.iterator];if(b)return b.call(a);if(typeof a.length=="number")return{next:ba(a)};throw Error("b`"+String(a));};sa=function(a,b){return Object.prototype.hasOwnProperty.call(a,b)};ua=typeof Object.assign=="function"?Object.
2024-10-02 10:16:33 UTC	1390	IN	Data Raw: 3b 74 68 69 73 2e 51 72 3d 5b 5d 3b 74 68 69 73 2e 6a 56 3d 21 31 3b 76 61 72 20 6b 3d 74 68 69 73 2e 6a 46 28 29 3b 74 72 79 7b 68 28 6b 2e 72 65 73 6f 6c 76 65 2c 6b 2e 72 65 6a 65 63 74 29 7d 63 61 74 63 68 28 6c 29 7b 6b 2e 72 65 6a 65 63 74 28 6c 29 7d 7d 3b 65 2e 70 72 6f 74 6f 74 79 70 65 2e 6a 46 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 66 75 6e 63 74 69 6f 6e 20 68 28 6d 29 7b 72 65 74 75 72 6e 20 66 75 6e 63 74 69 6f 6e 28 6e 29 7b 6c 7c 7c 28 6c 3d 21 30 2c 6d 2e 63 61 6c 6c 28 6b 2c 6e 29 29 7d 7d 76 61 72 20 6b 3d 74 68 69 73 2c 6c 3d 21 31 3b 72 65 74 75 72 6e 7b 72 65 73 6f 6c 76 65 3a 68 28 74 68 69 73 2e 58 64 61 29 2c 72 65 6a 65 63 74 3a 68 28 74 68 69 73 2e 56 4a 29 7d 7d 3b 65 2e 70 72 6f 74 6f 74 79 70 65 2e 58 64 61 3d 66 75 6e 63 74 69 Data Ascii: ;this.Qr=[];this.jV=!1;var k=this.jF();try{h(k.resolve,k.reject)}catch(l){k.reject(l)}};e.prototype.jF=function(){function h(m){return function(n){l\|\|(l=!0,m.call(k,n))}}var k=this,l=!1;return{resolve:h(this.Xda),reject:h(this.VJ)}};e.prototype.Xda=functi
2024-10-02 10:16:33 UTC	1390	IN	Data Raw: 74 6f 74 79 70 65 2e 47 37 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 69 66 28 74 68 69 73 2e 51 72 21 3d 6e 75 6c 6c 29 7b 66 6f 72 28 76 61 72 20 68 3d 30 3b 68 3c 74 68 69 73 2e 51 72 2e 6c 65 6e 67 74 68 3b 2b 2b 68 29 66 2e 5a 4f 28 74 68 69 73 2e 51 72 5b 68 5d 29 3b 0a 74 68 69 73 2e 51 72 3d 6e 75 6c 6c 7d 7d 3b 76 61 72 20 66 3d 6e 65 77 20 62 3b 65 2e 70 72 6f 74 6f 74 79 70 65 2e 44 66 61 3d 66 75 6e 63 74 69 6f 6e 28 68 29 7b 76 61 72 20 6b 3d 74 68 69 73 2e 6a 46 28 29 3b 68 2e 6c 79 28 6b 2e 72 65 73 6f 6c 76 65 2c 6b 2e 72 65 6a 65 63 74 29 7d 3b 65 2e 70 72 6f 74 6f 74 79 70 65 2e 45 66 61 3d 66 75 6e 63 74 69 6f 6e 28 68 2c 6b 29 7b 76 61 72 20 6c 3d 74 68 69 73 2e 6a 46 28 29 3b 74 72 79 7b 68 2e 63 61 6c 6c 28 6b 2c 6c 2e 72 65 73 6f 6c 76 65 Data Ascii: totype.G7=function(){if(this.Qr!=null){for(var h=0;h<this.Qr.length;++h)f.ZO(this.Qr[h]);this.Qr=null}};var f=new b;e.prototype.Dfa=function(h){var k=this.jF();h.ly(k.resolve,k.reject)};e.prototype.Efa=function(h,k){var l=this.jF();try{h.call(k,l.resolve
2024-10-02 10:16:33 UTC	1390	IN	Data Raw: 65 67 75 6c 61 72 20 65 78 70 72 65 73 73 69 6f 6e 22 29 3b 72 65 74 75 72 6e 20 61 2b 22 22 7d 3b 0a 6e 61 28 22 53 74 72 69 6e 67 2e 70 72 6f 74 6f 74 79 70 65 2e 73 74 61 72 74 73 57 69 74 68 22 2c 66 75 6e 63 74 69 6f 6e 28 61 29 7b 72 65 74 75 72 6e 20 61 3f 61 3a 66 75 6e 63 74 69 6f 6e 28 62 2c 63 29 7b 76 61 72 20 64 3d 45 61 28 74 68 69 73 2c 62 2c 22 73 74 61 72 74 73 57 69 74 68 22 29 2c 65 3d 64 2e 6c 65 6e 67 74 68 2c 66 3d 62 2e 6c 65 6e 67 74 68 3b 63 3d 4d 61 74 68 2e 6d 61 78 28 30 2c 4d 61 74 68 2e 6d 69 6e 28 63 7c 30 2c 64 2e 6c 65 6e 67 74 68 29 29 3b 66 6f 72 28 76 61 72 20 68 3d 30 3b 68 3c 66 26 26 63 3c 65 3b 29 69 66 28 64 5b 63 2b 2b 5d 21 3d 62 5b 68 2b 2b 5d 29 72 65 74 75 72 6e 21 31 3b 72 65 74 75 72 6e 20 68 3e 3d 66 7d 7d Data Ascii: egular expression");return a+""};na("String.prototype.startsWith",function(a){return a?a:function(b,c){var d=Ea(this,b,"startsWith"),e=d.length,f=b.length;c=Math.max(0,Math.min(c\|0,d.length));for(var h=0;h<f&&c<e;)if(d[c++]!=b[h++])return!1;return h>=f}}
2024-10-02 10:16:33 UTC	1390	IN	Data Raw: 68 69 73 2e 73 65 74 28 6d 5b 30 5d 2c 6d 5b 31 5d 29 7d 7d 3b 6b 2e 70 72 6f 74 6f 74 79 70 65 2e 73 65 74 3d 66 75 6e 63 74 69 6f 6e 28 6c 2c 6d 29 7b 69 66 28 21 63 28 6c 29 29 74 68 72 6f 77 20 45 72 72 6f 72 28 22 65 22 29 3b 64 28 6c 29 3b 69 66 28 21 73 61 28 6c 2c 66 29 29 74 68 72 6f 77 20 45 72 72 6f 72 28 22 66 60 22 2b 6c 29 3b 6c 5b 66 5d 5b 74 68 69 73 2e 47 61 5d 3d 6d 3b 72 65 74 75 72 6e 20 74 68 69 73 7d 3b 6b 2e 70 72 6f 74 6f 74 79 70 65 2e 67 65 74 3d 66 75 6e 63 74 69 6f 6e 28 6c 29 7b 72 65 74 75 72 6e 20 63 28 6c 29 26 26 73 61 28 6c 2c 66 29 3f 6c 5b 66 5d 5b 74 68 69 73 2e 47 61 5d 3a 76 6f 69 64 20 30 7d 3b 6b 2e 70 72 6f 74 6f 74 79 70 65 2e 68 61 73 3d 66 75 6e 63 74 69 6f 6e 28 6c 29 7b 72 65 74 75 72 6e 20 63 28 6c 29 26 26 Data Ascii: his.set(m[0],m[1])}};k.prototype.set=function(l,m){if(!c(l))throw Error("e");d(l);if(!sa(l,f))throw Error("f`"+l);l[f][this.Ga]=m;return this};k.prototype.get=function(l){return c(l)&&sa(l,f)?l[f][this.Ga]:void 0};k.prototype.has=function(l){return c(l)&&
2024-10-02 10:16:33 UTC	1390	IN	Data Raw: 74 2c 6b 2e 65 66 2e 6e 65 78 74 2e 55 6b 3d 0a 6b 2e 65 66 2e 55 6b 2c 6b 2e 65 66 2e 68 65 61 64 3d 6e 75 6c 6c 2c 74 68 69 73 2e 73 69 7a 65 2d 2d 2c 21 30 29 3a 21 31 7d 3b 63 2e 70 72 6f 74 6f 74 79 70 65 2e 63 6c 65 61 72 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 74 68 69 73 5b 30 5d 3d 7b 7d 3b 74 68 69 73 5b 31 5d 3d 74 68 69 73 5b 31 5d 2e 55 6b 3d 66 28 29 3b 74 68 69 73 2e 73 69 7a 65 3d 30 7d 3b 63 2e 70 72 6f 74 6f 74 79 70 65 2e 68 61 73 3d 66 75 6e 63 74 69 6f 6e 28 6b 29 7b 72 65 74 75 72 6e 21 21 64 28 74 68 69 73 2c 6b 29 2e 65 66 7d 3b 63 2e 70 72 6f 74 6f 74 79 70 65 2e 67 65 74 3d 66 75 6e 63 74 69 6f 6e 28 6b 29 7b 72 65 74 75 72 6e 28 6b 3d 64 28 74 68 69 73 2c 6b 29 2e 65 66 29 26 26 6b 2e 76 61 6c 75 65 7d 3b 63 2e 70 72 6f 74 6f 74 79 Data Ascii: t,k.ef.next.Uk=k.ef.Uk,k.ef.head=null,this.size--,!0):!1};c.prototype.clear=function(){this[0]={};this[1]=this[1].Uk=f();this.size=0};c.prototype.has=function(k){return!!d(this,k).ef};c.prototype.get=function(k){return(k=d(this,k).ef)&&k.value};c.prototy
2024-10-02 10:16:33 UTC	1390	IN	Data Raw: 69 7a 65 21 3d 31 7c 7c 64 2e 61 64 64 28 7b 78 3a 34 7d 29 21 3d 64 7c 7c 64 2e 73 69 7a 65 21 3d 32 29 72 65 74 75 72 6e 21 31 3b 76 61 72 20 65 3d 64 2e 65 6e 74 72 69 65 73 28 29 2c 66 3d 65 2e 6e 65 78 74 28 29 3b 69 66 28 66 2e 64 6f 6e 65 7c 7c 66 2e 76 61 6c 75 65 5b 30 5d 21 3d 63 7c 7c 66 2e 76 61 6c 75 65 5b 31 5d 21 3d 63 29 72 65 74 75 72 6e 21 31 3b 66 3d 65 2e 6e 65 78 74 28 29 3b 72 65 74 75 72 6e 20 66 2e 64 6f 6e 65 7c 7c 66 2e 76 61 6c 75 65 5b 30 5d 3d 3d 63 7c 7c 66 2e 76 61 6c 75 65 5b 30 5d 2e 78 21 3d 34 7c 7c 66 2e 76 61 6c 75 65 5b 31 5d 21 3d 66 2e 76 61 6c 75 65 5b 30 5d 3f 21 31 3a 65 2e 6e 65 78 74 28 29 2e 64 6f 6e 65 7d 63 61 74 63 68 28 68 29 7b 72 65 74 75 72 6e 21 31 7d 7d 28 29 29 72 65 74 75 72 6e 20 61 3b 76 61 72 20 Data Ascii: ize!=1\|\|d.add({x:4})!=d\|\|d.size!=2)return!1;var e=d.entries(),f=e.next();if(f.done\|\|f.value[0]!=c\|\|f.value[1]!=c)return!1;f=e.next();return f.done\|\|f.value[0]==c\|\|f.value[0].x!=4\|\|f.value[1]!=f.value[0]?!1:e.next().done}catch(h){return!1}}())return a;var
2024-10-02 10:16:33 UTC	1390	IN	Data Raw: 34 31 31 31 7c 7c 65 21 3d 3d 4d 61 74 68 2e 66 6c 6f 6f 72 28 65 29 29 74 68 72 6f 77 20 6e 65 77 20 52 61 6e 67 65 45 72 72 6f 72 28 22 69 6e 76 61 6c 69 64 5f 63 6f 64 65 5f 70 6f 69 6e 74 20 22 2b 65 29 3b 65 3c 3d 36 35 35 33 35 3f 63 2b 3d 53 74 72 69 6e 67 2e 66 72 6f 6d 43 68 61 72 43 6f 64 65 28 65 29 3a 28 65 2d 3d 36 35 35 33 36 2c 63 2b 3d 53 74 72 69 6e 67 2e 66 72 6f 6d 43 68 61 72 43 6f 64 65 28 65 3e 3e 3e 31 30 26 31 30 32 33 7c 35 35 32 39 36 29 2c 63 2b 3d 53 74 72 69 6e 67 2e 66 72 6f 6d 43 68 61 72 43 6f 64 65 28 65 26 31 30 32 33 7c 35 36 33 32 30 29 29 7d 72 65 74 75 72 6e 20 63 7d 7d 29 3b 6e 61 28 22 41 72 72 61 79 2e 70 72 6f 74 6f 74 79 70 65 2e 65 6e 74 72 69 65 73 22 2c 66 75 6e 63 74 69 6f 6e 28 61 29 7b 72 65 74 75 72 6e 20 Data Ascii: 4111\|\|e!==Math.floor(e))throw new RangeError("invalid_code_point "+e);e<=65535?c+=String.fromCharCode(e):(e-=65536,c+=String.fromCharCode(e>>>10&1023\|55296),c+=String.fromCharCode(e&1023\|56320))}return c}});na("Array.prototype.entries",function(a){return

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
15	192.168.2.16	49772	172.217.23.110	443	3720	C:\Program Files\Internet Explorer\iexplore.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-02 10:16:35 UTC	227	OUT	GET /favicon.ico HTTP/1.1 Accept: / UA-CPU: AMD64 Accept-Encoding: gzip, deflate User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Host: support.google.com Connection: Keep-Alive
2024-10-02 10:16:36 UTC	464	IN	HTTP/1.1 200 OK Content-Type: image/x-icon Cross-Origin-Resource-Policy: cross-origin Date: Wed, 02 Oct 2024 10:16:35 GMT Expires: Wed, 02 Oct 2024 10:16:35 GMT Cache-Control: private, max-age=300 X-Content-Type-Options: nosniff Server: support-content-ui X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-10-02 10:16:36 UTC	926	IN	Data Raw: 31 35 33 36 0d 0a 00 00 01 00 02 00 10 10 00 00 01 00 20 00 68 04 00 00 26 00 00 00 20 20 00 00 01 00 20 00 a8 10 00 00 8e 04 00 00 28 00 00 00 10 00 00 00 20 00 00 00 01 00 20 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ff ff ff 30 fd fd fd 96 fd fd fd d8 fd fd fd f9 fd fd fd f9 fd fd fd d7 fd fd fd 94 fe fe fe 2e 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 fe fe fe 09 fd fd fd 99 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff fd fd fd 95 ff ff ff 08 00 00 00 00 00 00 00 00 00 00 00 00 fe fe fe 09 fd fd fd c1 ff ff ff ff fa fd f9 ff b4 d9 a7 ff 76 ba 5d ff 58 ab 3a ff 58 aa 3a ff 72 b8 59 ff ac d5 9d Data Ascii: 1536 h& ( 0.v]X:X:rY
2024-10-02 10:16:36 UTC	1390	IN	Data Raw: fd c3 ff ff ff ff f9 f9 fe ff a5 ac f6 ff 5d 69 ee ff 3c 4a eb ff 3a 47 ea ff 5a 66 ee ff a2 a9 f5 ff f9 f9 fe ff ff ff ff ff fd fd fd c1 fe fe fe 09 00 00 00 00 00 00 00 00 00 00 00 00 ff ff ff 0a fd fd fd 9d ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff fd fd fd 99 fe fe fe 09 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 fe fe fe 32 fd fd fd 99 fd fd fd db fd fd fd fa fd fd fd fa fd fd fd da fd fd fd 98 ff ff ff 30 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f0 0f 00 00 c0 03 00 00 80 01 00 00 80 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 01 00 00 80 01 00 00 c0 03 00 00 f0 0f 00 00 28 00 00 00 20 00 00 00 40 Data Ascii: ]i<J:GZf20( @
2024-10-02 10:16:36 UTC	1390	IN	Data Raw: 53 a8 34 ff 77 a0 37 ff e3 89 41 ff f4 85 42 ff f4 85 42 ff fc d8 c3 ff ff ff ff ff ff ff ff ff ff ff ff ff fd fd fd fa fe fe fe 23 00 00 00 00 00 00 00 00 fd fd fd 9d ff ff ff ff ff ff ff ff ff ff ff ff ea f4 e6 ff 5b ac 3e ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 67 b2 4c ff cc e5 c2 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff e0 ef da ff a8 b1 63 ff f1 85 42 ff f4 85 42 ff f4 85 42 ff f4 85 42 ff f5 90 54 ff fe f9 f6 ff ff ff ff ff ff ff ff ff ff ff ff ff fd fd fd 9a 00 00 00 00 fe fe fe 0e fd fd fd f6 ff ff ff ff ff ff ff ff ff ff ff ff 82 c7 8f ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 75 b9 5c ff f2 f9 f0 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff Data Ascii: S4w7ABB#[>S4S4S4S4gLcBBBBTS4S4S4S4u\
2024-10-02 10:16:36 UTC	1390	IN	Data Raw: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff fd fd fd 99 fe fe fe 5a ff ff ff ff ff ff ff ff ff ff ff ff dd f6 fe ff 07 b9 fb ff 20 77 f1 ff 35 43 ea ff 35 43 ea ff 48 55 ec ff ee f0 fd ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff fe fe fe 57 ff ff ff 0f fd fd fd f7 ff ff ff ff ff ff ff ff ff ff ff ff 6d 90 f4 ff 35 43 ea ff 35 43 ea ff 35 43 ea ff 35 43 ea ff 61 6c ef ff f2 f2 fe ff ff ff ff ff ff ff ff ff ff ff ff ff ff Data Ascii: Z w5C5CHUWm5C5C5C5Cal
2024-10-02 10:16:36 UTC	342	IN	Data Raw: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff fd fd fd f6 fd fd fd 9d fe fe fe 25 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 fe fe fe 0e fe fe fe 5a fd fd fd 9c fd fd fd cb fd fd fd ed fd fd fd fa fd fd fd fa fd fd fd ec fd fd fd cb fd fd fd 9c fe fe fe 59 fe fe fe 0e 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ff c0 03 ff ff 00 00 ff fc 00 00 3f f8 00 00 1f f0 00 00 0f e0 00 00 07 c0 00 00 03 c0 00 00 03 80 00 00 01 80 00 00 01 00 00 00 Data Ascii: %ZY?
2024-10-02 10:16:36 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
16	192.168.2.16	49775	172.217.23.110	443

Timestamp	Bytes transferred	Direction	Data
2024-10-02 10:16:35 UTC	89	OUT	GET /picasa/answer/favicon.ico HTTP/1.1 User-Agent: AutoIt Host: support.google.com
2024-10-02 10:16:36 UTC	1428	IN	HTTP/1.1 404 Not Found P3P: CP="This is not a P3P policy! See g.co/p3phelp for more info." Strict-Transport-Security: max-age=31536000; includeSubdomains Content-Type: text/html; charset=UTF-8 Date: Wed, 02 Oct 2024 10:16:36 GMT Expires: Wed, 02 Oct 2024 10:16:36 GMT Cache-Control: private, max-age=0 Content-Security-Policy-Report-Only: object-src 'none';base-uri 'self';script-src 'nonce-IP6YhjyZ5zH1GbKIYwQC' 'unsafe-inline' 'unsafe-eval' 'strict-dynamic' https: http: 'report-sample';report-uri https://csp.withgoogle.com/csp/scfe P3P: CP="This is not a P3P policy! See g.co/p3phelp for more info." X-Content-Type-Options: nosniff Server: support-content-ui X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Set-Cookie: NID=517=6vc2afBzm5gk4mPKuql_mQ3rKSVagR0-666zy5fO9R-BJd9VVHTKac1hL8PYBKfsE7QKQj--ZkI9P2x8fL0XJIMzeE4-wSN0Cx7P3rE203XNog8Dh9kYHu1KGT7J4c_LQKQm2PrvT5_GZStgW-Jm8tj9Ltn_84w_euix-7o-Le3edvPI2Q; expires=Thu, 03-Apr-2025 10:16:36 GMT; path=/; domain=.google.com; HttpOnly Set-Cookie: NID=517=6vc2afBzm5gk4mPKuql_mQ3rKSVagR0-666zy5fO9R-BJd9VVHTKac1hL8PYBKfsE7QKQj--ZkI9P2x8fL0XJIMzeE4-wSN0Cx7P3rE203XNog8Dh9kYHu1KGT7J4c_LQKQm2PrvT5_GZStgW-Jm8tj9Ltn_84w_euix-7o-Le3edvPI2Q; expires=Thu, 03-Apr-2025 10:16:36 GMT; path=/; domain=.google.com; HttpOnly Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-10-02 10:16:36 UTC	1428	IN	Data Raw: 38 30 30 30 0d 0a 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 68 63 66 65 22 20 64 61 74 61 2d 70 61 67 65 2d 74 79 70 65 3d 22 41 4e 53 57 45 52 22 20 6c 61 6e 67 3d 22 65 6e 22 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 53 6f 72 72 79 2c 20 74 68 69 73 20 70 61 67 65 20 63 61 6e 27 74 20 62 65 20 66 6f 75 6e 64 2e 20 2d 20 50 69 63 61 73 61 20 61 6e 64 20 50 69 63 61 73 61 20 57 65 62 20 41 6c 62 75 6d 73 20 48 65 6c 70 3c 2f 74 69 74 6c 65 3e 3c 6d 65 74 61 20 63 6f 6e 74 65 6e 74 3d 22 65 6d 61 69 6c 3d 6e 6f 22 20 6e 61 6d 65 3d 22 66 6f 72 6d 61 74 2d 64 65 74 65 63 74 69 6f 6e 22 3e 3c 6d 65 74 61 20 63 6f 6e 74 65 6e 74 3d 22 66 6f 6c 6c 6f 77 2c 69 6e 64 65 78 22 20 6e 61 6d 65 3d 22 72 6f 62 6f 74 73 22 3e Data Ascii: 8000<!doctype html><html class="hcfe" data-page-type="ANSWER" lang="en"><head><title>Sorry, this page can't be found. - Picasa and Picasa Web Albums Help</title><meta content="email=no" name="format-detection"><meta content="follow,index" name="robots">
2024-10-02 10:16:36 UTC	1428	IN	Data Raw: 2e 63 6f 6d 2f 73 2f 67 6f 6f 67 6c 65 73 61 6e 73 2f 76 31 36 2f 34 55 61 62 72 45 4e 48 73 78 4a 6c 47 44 75 47 6f 31 4f 49 6c 4c 55 39 34 59 74 7a 43 77 4d 2e 74 74 66 29 66 6f 72 6d 61 74 28 27 74 72 75 65 74 79 70 65 27 29 3b 7d 3c 2f 73 74 79 6c 65 3e 3c 6c 69 6e 6b 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 66 6f 6e 74 73 2e 67 6f 6f 67 6c 65 61 70 69 73 2e 63 6f 6d 2f 63 73 73 32 3f 66 61 6d 69 6c 79 3d 47 6f 6f 67 6c 65 2b 53 61 6e 73 2b 54 65 78 74 3a 77 67 68 74 40 34 30 30 3b 35 30 30 3b 37 30 30 26 61 6d 70 3b 64 69 73 70 6c 61 79 3d 73 77 61 70 22 20 61 73 3d 22 73 74 79 6c 65 22 20 69 64 3d 22 66 6f 6e 74 2d 67 73 74 22 20 72 65 6c 3d 22 70 72 65 6c 6f 61 64 22 20 6e 6f 6e 63 65 3d 22 49 50 36 59 68 6a 79 5a 35 7a 48 31 47 62 4b 49 59 77 Data Ascii: .com/s/googlesans/v16/4UabrENHsxJlGDuGo1OIlLU94YtzCwM.ttf)format('truetype');}</style><link href="https://fonts.googleapis.com/css2?family=Google+Sans+Text:wght@400;500;700&display=swap" as="style" id="font-gst" rel="preload" nonce="IP6YhjyZ5zH1GbKIYw

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
17	192.168.2.16	49776	77.75.76.70	443	3540	C:\Users\user\AppData\Roaming\Seznam.cz\sznsetup.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-02 10:16:36 UTC	87	OUT	GET /update/packages.inf HTTP/1.1 Host: download.seznam.cz Connection: Keep-Alive
2024-10-02 10:16:36 UTC	278	IN	HTTP/1.1 200 OK server: envoy date: Wed, 02 Oct 2024 10:16:36 GMT content-type: application/octet-stream content-length: 16698 last-modified: Tue, 01 Oct 2024 14:17:26 GMT etag: "66fc0476-413a" accept-ranges: bytes x-envoy-upstream-service-time: 0 connection: close
2024-10-02 10:16:36 UTC	13624	IN	Data Raw: 20 22 70 61 63 6b 61 67 65 73 22 3d 7b 5b 20 22 63 6f 6d 2e 6d 69 63 72 6f 73 6f 66 74 2e 6d 73 64 6e 2e 6d 73 76 63 72 31 30 30 22 20 22 31 30 2e 30 2e 34 30 32 31 39 2e 33 32 35 22 20 22 69 6e 73 74 76 65 72 22 3d 7b 20 22 22 7d 20 22 64 65 70 65 6e 64 73 22 3d 7b 5b 20 22 73 7a 6e 2d 73 6f 66 74 77 61 72 65 2d 62 61 73 65 22 5d 7d 20 22 63 6f 6e 66 6c 69 63 74 73 22 3d 7b 5b 5d 7d 20 22 72 65 70 6c 61 63 65 73 22 3d 7b 5b 5d 7d 20 22 69 6d 70 6c 65 6d 65 6e 74 73 22 3d 7b 5b 5d 7d 20 22 74 72 69 67 67 65 72 73 22 3d 7b 5b 5d 7d 20 22 69 6e 73 74 61 6c 6c 22 3d 7b 20 22 69 6e 73 74 61 6c 6c 2e 62 61 74 22 7d 20 22 75 6e 69 6e 73 74 61 6c 6c 22 3d 7b 20 22 75 6e 69 6e 73 74 61 6c 6c 2e 62 61 74 22 7d 20 22 70 6f 73 74 49 6e 73 74 61 6c 6c 22 3d 7b 20 22 Data Ascii: "packages"={[ "com.microsoft.msdn.msvcr100" "10.0.40219.325" "instver"={ ""} "depends"={[ "szn-software-base"]} "conflicts"={[]} "replaces"={[]} "implements"={[]} "triggers"={[]} "install"={ "install.bat"} "uninstall"={ "uninstall.bat"} "postInstall"={ "
2024-10-02 10:16:36 UTC	1388	IN	Data Raw: 6c 69 62 73 7a 6e 64 65 73 6b 74 6f 70 20 28 3e 3d 20 32 2e 31 2e 33 35 29 22 5d 7d 20 22 63 6f 6e 66 6c 69 63 74 73 22 3d 7b 5b 5d 7d 20 22 72 65 70 6c 61 63 65 73 22 3d 7b 5b 5d 7d 20 22 69 6d 70 6c 65 6d 65 6e 74 73 22 3d 7b 5b 5d 7d 20 22 74 72 69 67 67 65 72 73 22 3d 7b 5b 5d 7d 20 22 69 6e 73 74 61 6c 6c 22 3d 7b 20 22 69 6e 73 74 61 6c 6c 2e 62 61 74 22 7d 20 22 75 6e 69 6e 73 74 61 6c 6c 22 3d 7b 20 22 75 6e 69 6e 73 74 61 6c 6c 2e 62 61 74 22 7d 20 22 70 6f 73 74 49 6e 73 74 61 6c 6c 22 3d 7b 20 22 22 7d 20 22 70 72 65 55 6e 69 6e 73 74 61 6c 6c 22 3d 7b 20 22 22 7d 20 22 72 65 63 6f 6e 66 69 67 75 72 65 22 3d 7b 20 22 22 7d 20 22 61 70 70 6e 61 6d 65 22 3d 7b 20 22 53 65 7a 6e 61 6d 20 4c 69 c5 a1 74 69 c4 8d 6b 61 20 70 72 6f 20 46 69 72 65 66 Data Ascii: libszndesktop (>= 2.1.35)"]} "conflicts"={[]} "replaces"={[]} "implements"={[]} "triggers"={[]} "install"={ "install.bat"} "uninstall"={ "uninstall.bat"} "postInstall"={ ""} "preUninstall"={ ""} "reconfigure"={ ""} "appname"={ "Seznam Litika pro Firef
2024-10-02 10:16:36 UTC	1388	IN	Data Raw: 6d 2e 73 6f 66 74 77 61 72 65 2e 63 68 72 6f 6d 65 6c 69 73 74 69 63 6b 61 22 2c 20 22 63 7a 2e 73 65 7a 6e 61 6d 2e 73 6f 66 74 77 61 72 65 2e 70 70 22 5d 7d 20 22 63 6f 6e 66 6c 69 63 74 73 22 3d 7b 5b 20 22 63 7a 2e 73 65 7a 6e 61 6d 2e 73 6f 66 74 77 61 72 65 2e 70 61 72 74 6e 65 72 73 6b 79 2d 70 72 6f 67 72 61 6d 22 5d 7d 20 22 72 65 70 6c 61 63 65 73 22 3d 7b 5b 5d 7d 20 22 69 6d 70 6c 65 6d 65 6e 74 73 22 3d 7b 5b 5d 7d 20 22 74 72 69 67 67 65 72 73 22 3d 7b 5b 5d 7d 20 22 69 6e 73 74 61 6c 6c 22 3d 7b 20 22 69 6e 73 74 61 6c 6c 2e 62 61 74 22 7d 20 22 75 6e 69 6e 73 74 61 6c 6c 22 3d 7b 20 22 75 6e 69 6e 73 74 61 6c 6c 2e 62 61 74 22 7d 20 22 70 6f 73 74 49 6e 73 74 61 6c 6c 22 3d 7b 20 22 22 7d 20 22 70 72 65 55 6e 69 6e 73 74 61 6c 6c 22 3d 7b Data Ascii: m.software.chromelisticka", "cz.seznam.software.pp"]} "conflicts"={[ "cz.seznam.software.partnersky-program"]} "replaces"={[]} "implements"={[]} "triggers"={[]} "install"={ "install.bat"} "uninstall"={ "uninstall.bat"} "postInstall"={ ""} "preUninstall"={
2024-10-02 10:16:36 UTC	298	IN	Data Raw: 22 3d 7b 20 22 22 7d 20 22 72 65 63 6f 6e 66 69 67 75 72 65 22 3d 7b 20 22 22 7d 20 22 61 70 70 6e 61 6d 65 22 3d 7b 20 22 55 6b 61 7a 61 74 65 6c 20 53 2d 52 61 6e 6b 7c 5a 6f 62 72 61 7a 75 6a 65 20 75 6b 61 7a 61 74 65 6c 20 53 2d 52 61 6e 6b 20 76 20 49 6e 74 65 72 6e 65 74 20 45 78 70 6c 6f 72 65 72 75 22 7d 20 22 6d 64 35 22 3d 7b 20 22 62 35 38 39 39 37 36 62 34 64 65 31 66 34 64 66 65 61 32 35 32 39 38 62 38 66 37 66 33 34 30 33 22 7d 20 22 73 6f 75 72 63 65 22 3d 7b 20 22 22 7d 20 22 73 69 7a 65 22 3d 7b 31 30 30 32 7d 20 22 69 73 6c 69 62 22 3d 7b 74 72 75 65 7d 20 22 6c 6f 63 61 74 69 6f 6e 22 3d 7b 20 22 73 7a 6e 2d 73 6f 66 74 77 61 72 65 2d 73 72 61 6e 6b 2d 34 2e 31 2e 33 2d 77 69 6e 33 32 2e 7a 69 70 22 7d 20 22 64 6f 77 6e 6c 6f 61 64 73 Data Ascii: "={ ""} "reconfigure"={ ""} "appname"={ "Ukazatel S-Rank\|Zobrazuje ukazatel S-Rank v Internet Exploreru"} "md5"={ "b589976b4de1f4dfea25298b8f7f3403"} "source"={ ""} "size"={1002} "islib"={true} "location"={ "szn-software-srank-4.1.3-win32.zip"} "downloads

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
18	192.168.2.16	49777	23.200.0.9	443	4912	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-02 10:16:36 UTC	442	OUT	OPTIONS /api/report?cat=bingbusiness HTTP/1.1 Host: bzib.nelreports.net Connection: keep-alive Origin: https://business.bing.com Access-Control-Request-Method: POST Access-Control-Request-Headers: content-type User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-10-02 10:16:36 UTC	333	IN	HTTP/1.1 200 OK Content-Length: 0 Server: Kestrel Date: Wed, 02 Oct 2024 10:16:36 GMT Connection: close PMUSER_FORMAT_QS: X-CDN-TraceId: 0.09ac2d17.1727864196.1181fc2 Access-Control-Allow-Headers: * Access-Control-Allow-Credentials: false Access-Control-Allow-Methods: GET, OPTIONS, POST Access-Control-Allow-Origin: *

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
19	192.168.2.16	49779	13.107.246.40	443	4912	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-02 10:16:36 UTC	711	OUT	GET /assets/domains_config_gz/2.8.76/asset?assetgroup=EntityExtractionDomainsConfig HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Edge-Asset-Group: EntityExtractionDomainsConfig Sec-Mesh-Client-Edge-Version: 117.0.2045.47 Sec-Mesh-Client-Edge-Channel: stable Sec-Mesh-Client-OS: Windows Sec-Mesh-Client-OS-Version: 10.0.19045 Sec-Mesh-Client-Arch: x86_64 Sec-Mesh-Client-WebView: 0 Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-10-02 10:16:37 UTC	556	IN	HTTP/1.1 200 OK Date: Wed, 02 Oct 2024 10:16:37 GMT Content-Type: application/octet-stream Content-Length: 70207 Connection: close Content-Encoding: gzip Last-Modified: Wed, 25 Sep 2024 23:20:16 GMT ETag: 0x8DCDDB89D35644B x-ms-request-id: 737931d0-401e-006b-3cb4-143551000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241002T101636Z-15767c5fc55n4msds84xh4z67w0000000320000000007ycr Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_MISS Accept-Ranges: bytes
2024-10-02 10:16:37 UTC	15828	IN	Data Raw: 1f 8b 08 08 b0 9a f4 66 02 ff 61 73 73 65 74 00 ec bd 0b 97 db 36 b2 30 f8 57 b2 b9 33 b3 dd 89 d5 d6 5b dd d9 cd fa f4 d3 f1 f8 39 6d 3b 19 db f1 d5 01 49 48 a2 45 91 0c 1f 6a ab c3 be bf 7d 0b 05 80 00 08 50 52 db ce 77 ef b7 67 67 9c 16 09 14 0a 40 a1 50 a8 2a 14 c0 3f bf f7 93 78 16 ce bf ff e9 bb 3f bf 2f 92 25 8d a7 51 b8 0a 0b 78 ef 8d bb dd 07 df 7d 9f 92 39 9d fa 65 91 cc 66 90 38 1c f4 59 62 40 67 a4 8c 8a 69 94 f8 24 a2 d3 15 49 11 81 c7 f0 c0 df 0e 3c 00 94 97 e3 6b de f1 08 7b a5 11 7b a5 51 67 9e e1 6b 8c af 71 a7 cc f1 15 81 69 de 59 7d c6 d7 02 5f 8b 0e a5 ec d5 c7 5c 3f ef f8 b7 ec 35 20 ec 35 20 9d 60 89 af 14 5f 69 27 40 e0 19 e6 ce 48 27 c4 8a 66 21 be 86 1d 78 60 af 19 be 66 9d 19 e6 2e b0 ec 82 76 c2 08 5f 31 77 91 75 16 3c b7 c4 d7 Data Ascii: fasset60W3[9m;IHEj}PRwgg@P*?x?/%Qx}9ef8Yb@gi$I<k{{QgkqiY}_\?5 5 `_i'@H'f!x`f.v_1wu<
2024-10-02 10:16:37 UTC	16384	IN	Data Raw: 65 c0 2a 8a c3 88 95 9c 7c 3e a9 79 09 d4 fa 9a 9f 30 4a 49 28 2b d7 97 ff 7a 7b f9 fa cd f4 c9 05 68 2b 37 9c c1 08 01 cb 2f 28 f3 02 34 de 08 0c a6 34 da 38 c6 ec 48 27 33 28 96 9f 45 d9 4f 9f 12 f7 54 d2 47 a6 39 87 08 81 e9 6d 4f c1 43 97 10 bf ad 59 55 67 39 13 fe 1e 05 67 65 16 87 6c 9b f5 cb 90 60 eb 3d ea 25 09 33 8b f9 4a fb 10 ef 11 3b 7c e8 61 60 14 a0 60 b9 7c 16 e7 69 54 b1 c3 22 c0 e0 29 df c2 05 4c 8f bc f0 67 5e 04 75 33 51 9a b7 e1 61 1a 61 48 f5 c3 30 f7 62 91 d5 a8 34 39 2a 97 ff 2d f5 aa c1 c2 6c 78 e0 35 33 d1 42 b3 75 c4 be 3b f4 d0 68 83 51 a7 81 2d a0 ff 0d 5d 10 62 ed 7f 55 a5 99 9f 25 2b 2f a4 4d 09 21 65 43 c7 04 cf 93 19 f3 c1 d0 b6 e9 14 38 59 31 29 8b 4d 52 3a c4 97 c1 d0 1d 5d d0 58 b3 51 22 09 e8 37 c0 b1 dc 86 43 a9 41 db Data Ascii: e\|>y0JI(+z{h+7/(448H'3(EOTG9mOCYUg9gel`=%3J;\|a``\|iT")Lg^u3QaaH0b49-lx53Bu;hQ-]bU%+/M!eC8Y1)MR:]XQ"7CA
2024-10-02 10:16:37 UTC	16384	IN	Data Raw: 20 15 b1 bc 1f 82 9a 8d 98 a7 af db 80 6b 74 e7 ab 7c e6 18 7d 9a 2b 3e 34 2d 1a e7 c0 d5 e8 b4 a0 0e d4 7d 19 bb 69 52 58 a2 33 32 78 db 4b 2d cd 54 dd d2 2b 9c a0 29 69 1a ba 4a ee 0a 4d 33 5a 7b a7 1a 83 5f f3 f7 fe 2c 2f 84 3b 39 d0 56 82 ef 75 a4 f3 69 57 af 58 09 8c 2a 1d 24 b9 4e 6b cf 63 d0 74 99 e3 02 0f 26 7f 1a 86 a9 a8 69 fa 5a d8 25 83 c1 ea f8 fd 12 62 16 86 38 17 5a 19 6f 13 03 00 e6 6a 07 a4 40 be bb 20 de a6 de bf d1 06 75 32 1f c3 4f 67 41 ad 31 bd b0 9c ee 44 47 33 2a 92 9c d3 f6 35 64 a9 b1 d3 f6 b1 c7 a7 b4 80 af ea c1 2a 6c dd 81 a0 0b 67 ca d2 b2 11 7c 8d dc 39 47 56 d1 bd 08 e8 ec 3e 4f c9 56 d6 7a d3 9a 56 4d 17 50 41 9b 17 9b 37 36 da 2e 7c a4 ba 63 f5 72 cd 6b 58 b5 9b 70 5a 19 73 3e 85 d2 c6 f8 80 22 71 cd f5 40 34 cd c4 ce 27 Data Ascii: kt\|}+>4-}iRX32xK-T+)iJM3Z{_,/;9VuiWX$Nkct&iZ%b8Zoj@ u2OgA1DG35d*lg\|9GV>OVzVMPA76.\|crkXpZs>"q@4'
2024-10-02 10:16:37 UTC	16384	IN	Data Raw: 5f 43 54 c9 8d d7 76 7a 14 e4 6f 3b 80 f7 6a 61 e8 6f 47 e9 2d cb 60 84 66 2b c0 b9 77 09 1b c0 32 5c aa 6c 0e 25 81 ed a0 5e 61 25 37 6f 3c a5 bc 1f 04 1a dd b1 04 1d c9 73 16 3a 58 a8 69 4d 12 c1 5e e9 66 5f 14 6c e4 9e d4 61 25 e1 2f c3 fc b8 ed df 80 5d 2b 3a 5b 4c 56 c9 72 1f 59 1d 6a 72 0b d2 b0 4c 8e d5 67 db 16 79 41 90 65 4f 4b 68 63 f6 d1 e5 db b6 6a 18 e6 ca 5f 04 79 2e 71 69 5d 0e 19 cc d9 f6 58 27 58 af 1c 18 04 f1 98 d2 bf 15 1e 37 ce e0 1e 88 54 83 3c 82 f8 a8 05 5f b0 1b 3f 2f 02 8f 31 a4 e9 1d ed 45 e6 e4 85 e6 b9 66 4c fd cd 8d e4 58 f7 79 73 8b 47 40 25 b6 0d 7f 78 ff a8 fe e7 7d 69 4a fc 00 c7 b0 37 a9 44 f0 40 1e e8 bd 41 8a b4 0a 5d 5a 2c 0e 60 f7 fb 81 3b 35 42 38 50 3b bc 9c d4 76 22 35 66 3f 5d d9 fb 8e 7d 65 84 fb 4f 5b 04 9b a8 Data Ascii: _CTvzo;jaoG-`f+w2\l%^a%7o<s:XiM^f_la%/]+:[LVrYjrLgyAeOKhcj_y.qi]X'X7T<_?/1EfLXysG@%x}iJ7D@A]Z,`;5B8P;v"5f?]}eO[
2024-10-02 10:16:37 UTC	5227	IN	Data Raw: 20 b1 61 ca d2 f5 ed 38 df 10 b9 60 88 4c 48 ac b1 cd 10 b5 8f 76 49 19 f2 b6 d5 54 1d d1 9c b1 20 7a d3 64 f7 91 a2 0c 4d 73 6d e0 da be ee e6 87 03 9f 5e f7 4f 98 9c 12 cd 88 68 4c 2e b1 48 00 60 c3 31 74 31 8d 87 b4 32 56 02 4f bf e1 a9 3b c0 40 d6 24 8e 10 55 c7 c3 e7 8c f3 78 28 78 d3 94 de b0 5a 4d 22 eb 28 5c 22 00 98 8e 15 1a f8 ab ac 54 f4 5d 80 d0 a5 aa 6e 87 83 fd d6 f1 b0 c0 82 f7 f4 5e ef 2f 2b b8 62 a2 13 a1 4d ae 60 cf 59 3c b1 b1 f4 40 4d 41 74 7c ac 2c 5a 9e ef f4 d2 81 6d 69 e1 d3 8b 73 2c 84 2c 06 37 fd 72 38 10 a5 b2 13 51 f1 a0 a2 06 7d 3f 89 8f 72 35 a0 58 a0 46 79 2f b7 1f cc 57 92 ec c8 b4 b5 f2 5c 65 e7 30 5a 93 e3 b1 8e 5f f5 91 44 87 44 19 1d 59 83 cf 54 85 de 92 34 2e 26 d2 d8 ca 80 2c 56 f9 34 27 86 21 28 e6 0e 92 0c 4e 75 b7 Data Ascii: a8`LHvIT zdMsm^OhL.H`1t12VO;@$Ux(xZM"(\"T]n^/+bM`Y<@MAt\|,Zmis,,7r8Q}?r5XFy/W\e0Z_DDYT4.&,V4'!(Nu

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
20	192.168.2.16	49778	13.107.246.40	443	4912	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-02 10:16:36 UTC	470	OUT	GET /assets/edge_hub_apps_manifest_gz/4.7.107/asset?assetgroup=Shoreline HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Edge-Asset-Group: Shoreline Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-10-02 10:16:37 UTC	564	IN	HTTP/1.1 200 OK Date: Wed, 02 Oct 2024 10:16:37 GMT Content-Type: application/octet-stream Content-Length: 306698 Connection: close Content-Encoding: gzip Last-Modified: Tue, 10 Oct 2023 17:24:31 GMT ETag: 0x8DBC9B5C40EBFF4 x-ms-request-id: f329f7da-401e-0049-25b4-145b67000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241002T101636Z-15767c5fc554l9xf959gp9cb1s00000003n00000000032gp Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 69316365 X-Cache: TCP_MISS Accept-Ranges: bytes
2024-10-02 10:16:37 UTC	15820	IN	Data Raw: 1f 8b 08 08 cf 88 25 65 02 ff 61 73 73 65 74 00 ec 7d 69 93 db 46 92 e8 5f a9 f0 97 fd e0 96 05 10 00 09 4c c4 8b 17 2d f9 92 6d f9 92 6d 8d fd 66 43 51 00 0a 24 9a 20 40 e1 60 ab 7b 76 fe fb ab cc 2c 10 09 82 07 c8 a6 bc 9e 8d 0d 5b 68 b0 8e bc eb 44 55 e6 3f 3f 59 c9 3c 4d 54 55 bf db a8 b2 4a 8b fc 93 bf 89 4f dc cf ac cf ac 4f 6e c4 27 8b 26 7c 27 d7 eb 4a 27 fe bf 7f 7e 92 c6 90 19 c5 ee d4 f7 65 f0 4c f9 be ff cc f5 95 7c 26 63 df 7e 36 9b da 81 13 7b d3 d0 0e 15 d4 cd e5 4a 41 f9 77 ef 5e bf f9 ea 1d fc 7a f7 0e d2 19 1e fb 33 fd df 0c 12 63 55 45 65 ba ae 4d 06 d5 61 89 54 75 a9 1e 20 f7 f5 ab 57 2f 5e dd dd 7e ff 62 be 7c bf 58 a6 5f 05 f7 d6 8b db 9f be f8 f2 f6 f6 87 97 b7 3f f9 b7 90 ff 72 fe ad 7e ff e2 76 9d 58 77 ee 57 8b 1f de ff 14 f9 fe Data Ascii: %easset}iF_L-mmfCQ$ @`{v,[hDU??Y<MTUJOOn'&\|'J'~eL\|&c~6{JAw^z3cUEeMaTu W/^~b\|X_?r~vXwW
2024-10-02 10:16:37 UTC	16384	IN	Data Raw: 68 0d 8c 7c 07 bb 14 ee 07 cf ac 5b ca 81 54 5b 25 f6 36 51 93 15 e8 c2 2b 22 50 fc 52 36 6d 55 35 59 19 67 e4 56 be d8 2d df fd 8c 1c b1 48 e9 85 d8 d5 6f a1 88 16 05 b8 ea d5 42 20 2f c6 fa c5 ab 21 ae b4 7e 71 4c 7c 69 3b da be 2c c4 3c 45 31 58 f6 5a d0 75 29 2d 10 91 2f b6 81 a8 f1 77 27 4d cb 46 c3 d1 f2 cb e7 17 7d 3c d0 6a 30 b1 ed 19 11 24 85 30 ed b3 77 98 0a a3 d3 4d 8a a4 58 a6 1a 92 6f 39 a0 66 5b a9 58 c4 f8 d7 db 13 a4 38 9f 53 18 72 e3 d6 58 c9 9c 2a 85 f1 21 3d 9d 12 35 51 d6 f4 74 9e 6e f9 3a 6f 4c fc e5 2c 53 f9 7a 94 a9 7c 50 ab 8e d8 56 01 86 95 11 92 ce 4d 82 a9 12 26 c6 7f 9c 55 b4 0d eb a8 c4 4f 75 f1 df 12 7e 7b 85 2d 18 bd 99 6f 4d 95 18 8d 35 7f b9 51 da bc b3 17 f2 61 66 41 16 70 9d 0a 0c 87 07 e7 d4 da 16 34 27 65 eb d7 87 be Data Ascii: h\|[T[%6Q+"PR6mU5YgV-HoB /!~qL\|i;,<E1XZu)-/w'MF}<j0$0wMXo9f[X8SrX*!=5Qtn:oL,Sz\|PVM&UOu~{-oM5QafAp4'e
2024-10-02 10:16:37 UTC	16384	IN	Data Raw: 26 b9 4f 37 c4 67 1e 9d 6b d1 e4 03 44 91 0f c7 24 3e 9c a5 f8 80 ce e1 c3 bd 55 1f 7c 0d 7d f0 d6 f4 e1 f6 6d f9 6c 42 78 a7 7a 8f cf 80 2a 42 b1 ca af 46 95 01 06 85 53 be 7a 50 c8 12 ce 7e 7c 44 29 29 63 83 14 66 50 e5 69 9e ba 94 a2 14 a9 44 53 56 22 78 06 d0 d3 7d 25 3d 51 7e fc 63 e8 77 69 11 9c 24 cb 92 42 e9 e0 d4 ac cc c6 c2 0a 92 55 72 f4 61 88 91 31 1f 4c 69 b4 9b 0f a5 64 32 91 6a 99 5a 87 05 9b b8 18 4d b6 69 0c 05 60 46 80 c2 34 75 85 d5 88 cf a4 31 10 78 28 99 44 01 7e 6d 51 37 26 3d f1 aa c8 64 77 98 90 c3 4a 88 b9 d5 8c 73 bc 9b 5c 69 65 23 a6 fb 16 9b 26 25 05 ac fc cc 1e 87 56 e3 bd 7f 86 8d d9 de 4d 93 29 aa 7c fe d1 06 5b da c5 90 55 b0 c9 33 35 1b d9 51 ad b2 ea c6 9a c4 a2 90 04 54 de 86 42 2d d9 e8 78 24 ab 24 51 69 66 82 d7 44 e8 Data Ascii: &O7gkD$>U\|}mlBxz*BFSzP~\|D))cfPiDSV"x}%=Q~cwi$BUra1Lid2jZMi`F4u1x(D~mQ7&=dwJs\ie#&%VM)\|[U35QTB-x$$QifD
2024-10-02 10:16:37 UTC	16384	IN	Data Raw: 0f a6 db fd c0 cf 6a 73 b5 e6 a0 67 39 bd 50 cf ce e5 f5 33 b4 5b f6 96 18 f6 1d 3d 5b 1c 62 ee 08 9c b4 27 31 5c bf 95 0d 07 a0 cf bc bf ec e9 f3 e3 25 7d d1 cd 7e e8 fe 69 3f 94 32 74 6d 41 40 30 f4 9d 21 ef 18 ab 09 e0 e5 30 bf 56 97 43 99 8d fb 5c b1 3a 15 2a 0c 9d 5f c9 d3 47 70 60 b0 6e 17 9c 16 bc 33 94 8f dc 87 1c 2e 65 5f 80 b0 c7 e2 bb 6a f4 3b c8 60 00 83 b2 83 02 16 e1 3f 69 68 e4 62 45 17 99 ba 9d 9d b7 00 7d 2a 5a 5f 88 af 8b 22 5d 84 79 61 b8 38 c9 2f d4 62 3c 2f ee 0a 38 04 98 69 d8 af 45 cf 43 a8 9b 3e 6e dd 69 b8 01 0b 4d c5 2a d4 d8 5d 7a b1 5f 94 d0 5d 79 e7 c9 87 c6 d5 b9 5d 89 1b 44 f3 5a 14 67 85 e9 1a ef c2 74 b9 63 86 3e c2 71 a7 08 94 eb 44 58 ad 1a 5c 09 02 5c 4d 1b c8 2c 53 c1 71 b8 50 80 6e 30 91 49 05 4e 42 60 22 53 9e 67 6f Data Ascii: jsg9P3[=[b'1\%}~i?2tmA@0!0VC\:_Gp`n3.e_j;`?ihbE}Z_"]ya8/b</8iEC>niM*]z_]y]DZgtc>qDX\\M,SqPn0INB`"Sgo
2024-10-02 10:16:37 UTC	16384	IN	Data Raw: ff 6b b9 2f c1 49 79 7f 7f fe e2 4d 8e 52 97 9f 5c d2 a4 d2 9b 7f 21 19 ca ff db 31 e3 e4 f2 51 b8 7c 74 b3 4c aa e5 59 09 49 a3 cf 51 d6 87 a5 4c 6d 23 e7 30 3b 3e ce a2 ff dd d2 a2 4d 1f 0e 14 fd d7 52 7f fd 1c ea cf 13 55 dc a3 6d 85 4b 4e 63 b4 12 03 65 33 26 36 bd 72 f4 19 04 1a d9 86 f6 84 1c dd 9e ee 21 e8 65 4d aa 2f f0 f8 0a fb d1 85 1e 53 4d 3f 5f a5 fc d4 0d f8 28 79 f7 b1 c1 a5 fc 51 df bc 30 df bf cb 6f cb 2a 09 d7 1f 99 f4 19 6a 7e d9 a5 f8 7e 7b c5 59 31 55 b2 99 9f 7d 02 06 e8 6e c6 98 ec a9 7c 3f 2a 1d 34 e5 bd 0a 8f e7 88 3e 74 c3 0b e7 6b 10 2c 4f 53 5d 7c 86 e2 09 77 99 7d ee 02 3a 9d f3 a7 29 a2 13 79 ee 15 d2 a7 37 fd 67 b6 f7 67 33 72 df b2 23 59 ef 55 5d e5 6f cb 55 7e 43 6c b7 99 fc 2e 56 9e 6f 2b 5e 74 f2 ea 6e 17 ed 6d 37 04 2d Data Ascii: k/IyMR\!1Q\|tLYIQLm#0;>MRUmKNce3&6r!eM/SM?_(yQ0oj~~{Y1U}n\|?4>tk,OS]\|w}:)y7gg3r#YU]oU~Cl.Vo+^tnm7-
2024-10-02 10:16:37 UTC	16384	IN	Data Raw: 07 4d 31 65 8e 49 77 c3 9c 0b 06 79 cd 66 e0 72 84 3b 54 b9 74 ef 35 53 7d 3b 8c b0 a9 fd 1b 50 a9 de 74 45 72 7e 1b f0 2a c4 ee 75 56 a9 f1 4f 0b e2 ef 4c 0e 04 e6 c1 13 43 d1 a3 91 83 19 d3 3d c4 08 0f b5 d5 e1 f0 41 7b 02 cf 94 80 35 8c 5f 5f 02 90 85 fa 86 bb ab e1 02 93 a8 c3 01 b8 10 ce 1a 84 70 ba 2a 74 48 e2 74 7c 83 87 f5 42 38 70 15 c2 ce 65 08 08 86 a0 47 21 98 5b b8 58 62 21 c8 96 0d 6c 09 61 e7 32 c4 b3 5e a1 8d a0 20 7d 39 b0 28 5c c6 6d 21 84 b7 80 4c dc 70 c4 2e c4 f3 19 21 9c 8e d6 1f 96 d8 f4 9d 32 40 37 a4 47 84 1e d1 c7 65 89 5f 63 82 1d d4 5a 86 2d e5 f8 15 59 45 61 ea 67 ab 2d d9 61 85 e3 91 0f 94 e7 67 25 02 3d 4f 28 55 ad 17 c6 a0 29 6a 5d 21 2a cd 7e af 45 5e 0b 01 e5 6c bb ed 07 fa bc 5c f7 4e 60 6b e1 20 c2 ba 99 b8 6d 1e 51 d5 Data Ascii: M1eIwyfr;Tt5S};PtEr~uVOLC=A{5__ptHt\|B8peG![Xb!la2^ }9(\m!Lp.!2@7Ge_cZ-YEag-ag%=O(U)j]!*~E^l\N`k mQ
2024-10-02 10:16:37 UTC	16384	IN	Data Raw: 6d 06 c3 c0 20 42 f6 62 01 a8 b8 2e 41 68 d5 3e af 78 77 09 5e a1 a8 7e 3d bf 65 90 da ff 6d 58 c3 e3 86 29 f6 22 00 98 2a 9c 68 97 65 63 ac 5c ad 09 2b 23 82 8f 3f 2b 34 4c 1f 01 76 0d 06 ed 44 0f a9 a0 b1 63 30 c2 0d f2 ad 15 f9 9d a6 73 4a 64 c6 38 b2 91 d1 0a 38 ec f1 61 a5 51 a1 65 d6 96 da 34 5b b9 be df 70 92 06 98 c1 37 67 b8 7a fd 34 cd 5e 44 c0 aa b0 27 6e 0c f2 e2 f9 5e 7c 0a 17 b4 b4 16 73 66 52 b2 05 40 56 84 20 c3 90 88 0a 5a 8e f1 3d 96 59 b7 5f a7 63 31 3c 17 3a a9 04 30 4b 80 0e 09 8b 60 e1 5d df da 55 e1 6d 20 56 de 3a 5a 4e 4e 36 25 71 5c 12 7e f1 93 97 31 94 a1 29 89 f2 0a 40 a9 02 bf 55 03 2f 98 74 5f 78 73 cb c5 29 4c e9 ad ef d3 e0 e9 ec 15 b9 9a 03 cf 91 db 7e f5 f0 08 3e bd 4a a1 b3 a7 63 d1 45 bf 50 93 bc bc 7d c3 e9 75 22 5d 68 Data Ascii: m Bb.Ah>xw^~=emX)"*hec\+#?+4LvDc0sJd88aQe4[p7gz4^D'n^\|sfR@V Z=Y_c1<:0K`]Um V:ZNN6%q\~1)@U/t_xs)L~>JcEP}u"]h
2024-10-02 10:16:37 UTC	16384	IN	Data Raw: ea 58 64 70 1a 03 5a 75 5c b5 f2 6d d4 e3 16 ed 7d 0a 76 94 c1 8e a7 30 9e 08 64 07 27 9d 18 c0 52 7d e4 67 ff 5d dd ba 83 b1 dc 5d 98 95 9f fd f7 4f 5a 26 c7 8a 7a a4 2b 67 ea ac d1 ee 4b f3 ee 5b 7c 55 87 5f ce 64 5a d1 d6 85 f4 9d 84 43 1d a5 d1 4e 33 c2 52 b6 ac ef d9 7f de 15 61 44 a2 b6 4f fe 03 39 27 95 29 d1 71 16 47 ff 7e 40 2f ff 09 6e 49 c5 ba 2c 58 72 fd b4 fc 2b 2f d4 a3 80 7f e2 4e fd ca 3b f8 f4 09 87 9a 38 33 24 7f 45 a2 7e d3 4f 4e 87 8c cb 8b 02 7f df 7f ff 57 75 a1 22 3d 51 a9 78 41 7d 1b c5 f8 9b d0 7f 72 fc 7d ff 85 6a 70 ab 5e dc aa 41 ca 56 bd b0 55 00 76 02 c7 a0 ea 57 7d b2 c3 fb 0a b5 58 bd 1f ab f6 63 d5 ec bd 82 b3 c7 5f d5 89 ed 15 3f f6 0a e5 7d 86 bf 7b f2 4f 82 f3 1a ea 09 06 a9 c9 03 c6 95 ea 57 bd 73 50 18 1d 54 fb 07 d5 Data Ascii: XdpZu\m}v0d'R}g]]OZ&z+gK[\|U_dZCN3RaDO9')qG~@/nI,Xr+/N;83$E~ONWu"=QxA}r}jp^AVUvW}Xc_?}{OWsPT
2024-10-02 10:16:37 UTC	16384	IN	Data Raw: 9a b4 be 3b 59 b1 6b f9 9e 4a 6a 38 c3 9d 71 93 60 68 53 6d 70 93 f4 d8 cb 92 d6 1c 64 0c 55 29 d1 f7 86 61 3a 23 da d5 06 e4 b2 85 18 31 bb 0e 46 71 38 52 33 8f 24 f5 9e 43 1a 6d 32 5a be 90 91 0a d3 47 69 32 eb 74 ec 30 03 b3 0a 2f 45 60 14 c3 56 8c 9b d3 2c f6 4c cc 87 6e 54 d0 da 28 ed 5d 8d 3a 4d 4a aa f1 2e 74 2f 9f 56 e9 a4 49 86 4c 15 33 4f 70 79 ad 9c 27 57 fe 5f f1 b5 af dc 2b a5 7e 6a ff d6 06 bc 0c 5d f6 df fe e1 b9 f2 44 21 e0 ef 42 ef 50 c9 9d 6d c4 b7 e0 a2 c1 1c b4 2f 36 29 c7 0d cd c5 5f 01 b2 80 f3 b0 10 3b 89 01 c5 9d d8 7c 07 2e 18 db 27 d6 4f f2 63 9c b0 f6 f2 ae c9 8b 6c b2 c4 37 76 c1 ad 55 68 26 ab 9f 6e 0d f6 97 8b d0 7b ae f0 47 ed 5d 9f e5 af 8e d0 8d 25 c1 76 f1 dc 48 82 c0 c8 4e c8 12 40 65 5d 3f 2f 1b ab ff 79 9a 2b b3 79 5d Data Ascii: ;YkJj8q`hSmpdU)a:#1Fq8R3$Cm2ZGi2t0/E`V,LnT(]:MJ.t/VIL3Opy'W_+~j]D!BPm/6)_;\|.'Ocl7vUh&n{G]%vHN@e]?/y+y]
2024-10-02 10:16:37 UTC	16384	IN	Data Raw: 50 c3 87 e4 2f 7d 48 49 98 d9 64 0e 08 ef 71 ff 50 b9 f3 86 37 4a 22 88 52 55 4a 91 92 53 0e 3c c2 3f 65 33 a3 28 fd 5a 9a 2e 91 76 ec f5 34 94 dc 1a 84 a2 be c1 0e 7a 8b 67 39 3e 58 c7 23 2c 7e 30 2a a9 04 8f 00 e5 ea b9 90 8e 19 22 31 4f 88 ac 1a 1f 76 bd 44 ab b4 23 ff 6a 0e 16 d3 4b 19 b1 5f 46 1a 8c 28 02 0b 82 4d 75 9f bc a7 ab d3 c0 ac 12 2c 1a e1 ca 61 62 a5 73 bf 90 ea 26 30 cc b6 60 ae a5 03 4b 60 ea 7c b9 bf 27 e4 0d 14 35 5a 3a 2d d3 09 b2 1d da a4 23 ee 1b c6 42 eb 6f 46 58 98 31 2d 33 81 d2 c7 b9 ea 4a e4 45 53 f8 1b 85 d6 9a f9 1c dd e5 4a cf 08 96 59 af e8 ce 28 b3 02 0e 0d ee 14 62 4a 58 2a 40 44 d3 12 5b 39 93 33 26 50 17 82 cc e2 88 1a 71 ab dd fe 3c 12 6a 79 40 5e 32 8d a6 25 53 15 5e 3f 60 3e a6 cb e9 d4 75 42 52 43 29 e8 e5 94 bf 82 Data Ascii: P/}HIdqP7J"RUJS<?e3(Z.v4zg9>X#,~0"1OvD#jK_F(Mu,abs&0`K`\|'5Z:-#BoFX1-3JESJY(bJX@D[93&Pq<jy@^2%S^?`>uBRC)

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
21	192.168.2.16	49781	104.118.10.2	443	4912	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-02 10:16:36 UTC	752	OUT	GET /edge/welcome?form=M10004&mb03=true HTTP/1.1 Host: www.microsoft.com Connection: keep-alive Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: none Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: document sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" sec-ch-ua-platform-version: "10.0.0" Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-10-02 10:16:36 UTC	997	IN	HTTP/1.1 302 Moved Temporarily Content-Length: 140 Content-Type: text/html; charset=utf-8 Location: /edge/welcome?form=M10004&mb03=true&ch=1 Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Origin-Agent-Cluster: ?1 X-Content-Type-Options: nosniff X-Download-Options: noopen X-Frame-Options: SAMEORIGIN X-Permitted-Cross-Domain-Policies: none X-XSS-Protection: 0 Accept-CH: Sec-CH-UA-Platform-Version, Sec-CH-UA-Full-Version, Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-Prefers-Color-Scheme Critical-CH: Sec-CH-UA-Platform-Version, Sec-CH-UA-Full-Version, Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-Prefers-Color-Scheme x-azure-ref: 20241002T101636Z-r154656d9bcmxqxrqrw0qrf8hg000000032g00000000f94x Expires: Wed, 02 Oct 2024 10:16:36 GMT Cache-Control: max-age=0, no-cache, no-store Pragma: no-cache Date: Wed, 02 Oct 2024 10:16:36 GMT Connection: close TLS_version: tls1.3 ms-cv: CASMicrosoftCV392eb9fe.0 ms-cv-esi: CASMicrosoftCV392eb9fe.0 X-RTag: RT
2024-10-02 10:16:36 UTC	140	IN	Data Raw: 3c 70 3e 46 6f 75 6e 64 2e 20 52 65 64 69 72 65 63 74 69 6e 67 20 74 6f 20 3c 61 20 68 72 65 66 3d 22 2f 65 64 67 65 2f 77 65 6c 63 6f 6d 65 3f 66 6f 72 6d 3d 4d 31 30 30 30 34 26 61 6d 70 3b 6d 62 30 33 3d 74 72 75 65 26 61 6d 70 3b 63 68 3d 31 22 3e 2f 65 64 67 65 2f 77 65 6c 63 6f 6d 65 3f 66 6f 72 6d 3d 4d 31 30 30 30 34 26 61 6d 70 3b 6d 62 30 33 3d 74 72 75 65 26 61 6d 70 3b 63 68 3d 31 3c 2f 61 3e 3c 2f 70 3e Data Ascii: <p>Found. Redirecting to <a href="/edge/welcome?form=M10004&mb03=true&ch=1">/edge/welcome?form=M10004&mb03=true&ch=1</a></p>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
22	192.168.2.16	49782	23.200.0.9	443	4912	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-02 10:16:37 UTC	382	OUT	POST /api/report?cat=bingbusiness HTTP/1.1 Host: bzib.nelreports.net Connection: keep-alive Content-Length: 471 Content-Type: application/reports+json User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-10-02 10:16:37 UTC	471	OUT	Data Raw: 5b 7b 22 61 67 65 22 3a 32 2c 22 62 6f 64 79 22 3a 7b 22 65 6c 61 70 73 65 64 5f 74 69 6d 65 22 3a 32 31 32 32 2c 22 6d 65 74 68 6f 64 22 3a 22 47 45 54 22 2c 22 70 68 61 73 65 22 3a 22 61 70 70 6c 69 63 61 74 69 6f 6e 22 2c 22 70 72 6f 74 6f 63 6f 6c 22 3a 22 68 74 74 70 2f 31 2e 31 22 2c 22 72 65 66 65 72 72 65 72 22 3a 22 22 2c 22 73 61 6d 70 6c 69 6e 67 5f 66 72 61 63 74 69 6f 6e 22 3a 31 2e 30 2c 22 73 65 72 76 65 72 5f 69 70 22 3a 22 31 33 2e 31 30 37 2e 36 2e 31 35 38 22 2c 22 73 74 61 74 75 73 5f 63 6f 64 65 22 3a 34 30 31 2c 22 74 79 70 65 22 3a 22 68 74 74 70 2e 65 72 72 6f 72 22 7d 2c 22 74 79 70 65 22 3a 22 6e 65 74 77 6f 72 6b 2d 65 72 72 6f 72 22 2c 22 75 72 6c 22 3a 22 68 74 74 70 73 3a 2f 2f 62 75 73 69 6e 65 73 73 2e 62 69 6e 67 2e 63 6f Data Ascii: [{"age":2,"body":{"elapsed_time":2122,"method":"GET","phase":"application","protocol":"http/1.1","referrer":"","sampling_fraction":1.0,"server_ip":"13.107.6.158","status_code":401,"type":"http.error"},"type":"network-error","url":"https://business.bing.co
2024-10-02 10:16:37 UTC	333	IN	HTTP/1.1 200 OK Content-Length: 0 Server: Kestrel Date: Wed, 02 Oct 2024 10:16:37 GMT Connection: close PMUSER_FORMAT_QS: X-CDN-TraceId: 0.09ac2d17.1727864197.1182148 Access-Control-Allow-Headers: * Access-Control-Allow-Credentials: false Access-Control-Allow-Methods: GET, OPTIONS, POST Access-Control-Allow-Origin: *

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
23	192.168.2.16	49783	104.118.10.106	443	4912	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-02 10:16:37 UTC	739	OUT	GET /fwlink/?linkid=2195291 HTTP/1.1 Host: go.microsoft.com Connection: keep-alive Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" sec-ch-ua-platform-version: "10.0.0" Sec-Fetch-Site: none Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: document Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-10-02 10:16:37 UTC	466	IN	HTTP/1.1 302 Moved Temporarily Content-Length: 0 Server: Kestrel Location: https://www.microsoft.com/edge/welcome?form=M10004&mb03=true Request-Context: appId=cid-v1:9b037ab9-fa5a-4c09-81bd-41ffa859f01e X-Response-Cache-Status: True Expires: Wed, 02 Oct 2024 10:16:37 GMT Cache-Control: max-age=0, no-cache, no-store Pragma: no-cache Date: Wed, 02 Oct 2024 10:16:37 GMT Connection: close Strict-Transport-Security: max-age=31536000 ; includeSubDomains

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
24	192.168.2.16	49784	77.75.76.70	443	3540	C:\Users\user\AppData\Roaming\Seznam.cz\sznsetup.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-02 10:16:37 UTC	128	OUT	GET /update/cz.seznam.software.lightspeed-1210-12.10.18-win32.zip HTTP/1.1 Host: download.seznam.cz Connection: Keep-Alive
2024-10-02 10:16:38 UTC	271	IN	HTTP/1.1 200 OK server: envoy date: Wed, 02 Oct 2024 10:16:38 GMT content-type: application/zip content-length: 304459 last-modified: Tue, 30 Apr 2024 09:02:56 GMT etag: "6630b3c0-4a54b" accept-ranges: bytes x-envoy-upstream-service-time: 0 connection: close
2024-10-02 10:16:38 UTC	16113	IN	Data Raw: 50 4b 03 04 14 00 02 00 08 00 bb 70 54 4c 99 e9 25 e1 0a 01 00 00 a0 01 00 00 0b 00 00 00 63 6f 6e 74 72 6f 6c 2e 69 6e 69 85 4f 3b 6e c3 30 0c dd 05 e8 0e ba 40 84 c8 45 81 2e 3a 41 8b 2e 19 8b 0e b2 cc 24 82 25 4a 90 d4 04 35 7a 85 1c a0 c8 94 a1 43 07 9f c2 f6 bd 2a a3 f9 0c 1d 4a 02 24 41 be c7 47 52 f2 12 94 6e d5 06 5e 29 41 e5 40 ea 8e 27 e8 4a c9 93 5f e7 bd 8a c0 ad d9 6c 73 0a 00 cd 42 54 62 49 c9 0e 62 32 1e a5 a8 b8 58 72 f1 40 49 03 01 b0 49 32 75 b8 b8 f0 16 b5 4a c0 6e 76 43 69 ef b8 33 3a fa 19 ca 5d 6a b0 84 9d 8e 62 5e ae 3d ae ad d1 39 fd 7b ca b2 08 1b 4c 59 59 2b cf 99 d7 2a 53 f2 86 97 f6 b5 fa 1d 04 ab f2 da 47 27 f7 06 ef aa c2 4e d6 d4 52 50 a2 42 78 9e bf 7f 44 b3 f5 3b 54 ec 69 16 5a cd 42 1f ab 66 e8 2d e0 70 62 ed df 29 0b d1 Data Ascii: PKpTL%control.iniO;n0@E.:A.$%J5zCJ$AGRn^)A@'J_lsBTbIb2Xr@II2uJnvCi3:]jb^=9{LYY+SG'NRPBxD;TiZBf-pb)
2024-10-02 10:16:38 UTC	16384	IN	Data Raw: 05 41 0e e0 af 0b cc 75 8a fc 51 f0 06 83 b7 a0 a8 38 53 9f 8d 69 8c 72 3a 41 e4 d8 82 2f 62 f8 0e f6 1f c3 46 45 fa 52 3e 53 87 7d eb 8e 11 4b e5 d9 8a ef 21 7c a4 fb 99 6d e3 83 9a 5c 00 bb 0e 21 0f e1 1a 08 f3 32 fe 6d 47 ec 8a 16 79 3e 4e d3 1d 74 76 32 15 51 5a 68 45 cb 47 23 04 4d aa 37 61 52 41 c1 ce 77 57 5a ed 8b 5c 9e eb 3a 85 c0 ad 46 8c 5c 82 06 96 63 28 62 df 4b 63 ba 69 04 54 ca 06 af 7c 8c ad e1 63 7c 74 38 ef 67 4e cc c7 f3 01 2e 1d 91 49 15 6f 15 dd fb 0e 0e 64 4f c4 db 77 7c 5c bc 77 52 fe 00 3c 8b a3 e7 97 7c 78 d6 6b 4a 55 e1 b3 17 17 6d da 0f b7 ad 72 a4 b0 15 e4 ac aa 8f de 38 d3 c7 84 56 29 52 b8 5f 55 e1 b9 33 e2 81 29 b1 88 f3 06 ed 67 d3 a2 cd 4a ad 3b 0a 1b d4 a5 0e e6 fe 36 ec 92 0d 1e 58 27 7d 18 71 27 f6 9d d6 f8 06 8f a3 39 Data Ascii: AuQ8Sir:A/bFER>S}K!\|m\!2mGy>Ntv2QZhEG#M7aRAwWZ\:F\c(bKciT\|c\|t8gN.IodOw\|\wR<\|xkJUmr8V)R_U3)gJ;6X'}q'9
2024-10-02 10:16:38 UTC	16384	IN	Data Raw: c1 83 69 75 2b 46 b9 22 63 d1 db 02 01 05 56 20 14 d3 f0 92 fc 83 4b 23 b8 f1 3d 33 1c 9c 06 fd bc 72 e9 70 78 a3 78 1b e2 93 ce 56 d8 d1 4b 53 28 ad c8 76 4a d1 73 6c 6c bc 22 1d e6 ba 21 6a 51 5a a8 b1 74 fc e0 58 51 5a 43 00 72 74 57 c5 8b d2 1d 30 2e c2 6b f9 c4 57 2e 26 be 06 58 e8 d8 bc fb 53 8c 85 87 47 5b f0 67 3b 14 06 de b3 09 10 8d af 7f ef 54 44 ef 53 e4 ca 48 a1 8a 54 50 90 71 ba 37 36 43 51 73 1b 4a b3 52 71 a7 65 82 60 b6 fd d0 47 8a a8 77 2d 4e d5 11 1f 74 58 6a 83 ac d1 9d 36 14 93 a8 69 e1 4e 6e 46 29 d3 30 fb 74 99 67 9f 21 36 59 32 f1 9e 7d 72 1f 8e 65 3a 8f 1d 14 88 37 f5 ef 45 26 c6 6b d1 7a 9e a9 de 0e 1a 17 02 dd e4 44 ef 81 74 2f c7 9d 15 8d 9c 32 60 55 08 b3 59 90 65 71 b4 cd 93 7f 66 c9 21 8e 64 73 87 71 e0 fb 0e eb 89 6f 67 fc Data Ascii: iu+F"cV K#=3rpxxVKS(vJsll"!jQZtXQZCrtW0.kW.&XSG[g;TDSHTPq76CQsJRqe`Gw-NtXj6iNnF)0tg!6Y2}re:7E&kzDt/2`UYeqf!dsqog
2024-10-02 10:16:38 UTC	16384	IN	Data Raw: a8 b2 df 2f d1 a0 ca 8a 0f e2 71 28 0d b2 6c 57 71 3a 64 59 94 55 96 72 64 d9 32 be 10 78 08 59 16 f3 ab 0b bb 0b a7 5b 29 5f d8 cb f8 c2 ee a1 85 fd e3 77 12 7a e3 09 b2 bd 9a 92 2d fa 2e cb c6 d7 7f 0f de cb b7 bd a3 a7 6c e4 47 7a ca 9e 83 7b 39 bf 38 19 01 1b f8 a1 02 d3 24 fe 4a 5f 52 10 d9 40 56 ad fc 06 9c 3b 91 9f d7 98 42 0d 2c 26 c9 3e 8b 23 8f 41 03 fe 21 a6 3a fb a6 c4 49 49 e3 98 94 6c 4f 82 86 6f d3 60 81 46 93 5f b3 24 18 7b 08 f8 88 37 9f 45 ec 6d 3e 45 cd b7 f0 83 90 15 ef e5 db ff 90 b0 1f 46 7b d7 9f e2 ea ce 4d 5e 5d 69 4c 5e 67 46 2c df 4a 47 e5 f3 39 8a 42 f6 ae b6 ec 71 ec 5d 77 bd a1 5f ea ad 70 2f f7 b9 f4 f6 ae 04 0a 0a 2b 54 75 81 fc e3 cf c7 14 8c 30 cf e5 7f de b6 dd 5b b7 a0 76 e8 6c cd 06 fc 81 59 36 a0 7b 6d b5 53 f2 db 11 Data Ascii: /q(lWq:dYUrd2xY[)_wz-.lGz{98$J_R@V;B,&>#A!:IIlOo`F_${7Em>EF{M^]iL^gF,JG9Bq]w_p/+Tu0[vlY6{mS
2024-10-02 10:16:38 UTC	16384	IN	Data Raw: f6 46 0e af 7f e1 ce 01 2a ad 83 5a c7 52 13 c7 1a 4d f4 46 35 11 aa 5d b8 93 bf 69 d8 e4 5c b8 13 db 37 1e 51 c2 63 00 c3 8a b5 e7 1d 6b fe 06 a4 a7 fd 6c e0 f3 1b 84 31 67 cd 13 d4 84 3c 0c f5 d5 72 d6 99 b3 a1 0d 66 a3 55 0c 2d b7 c8 1c 10 5d cd 5f 41 01 16 60 0b 97 d1 9d 59 67 44 b8 a6 93 4a fb b7 ea 3b 6c 0e 8c aa a1 5b 31 60 91 71 68 53 f6 94 45 dc c5 4b f6 24 58 34 25 09 ee b8 8f fc ed d7 53 5c 1e 45 5d a8 c0 c0 15 c4 28 08 0b 28 0a 82 76 05 39 f9 97 b9 b1 4e 77 da c4 d3 68 cc 1f 2a 97 42 0d ba 9f 26 b5 5a 71 ed a9 09 57 c3 24 5d e5 ae 61 f7 1e 93 30 a9 65 17 c6 00 40 8f 3a f3 e6 da c4 c3 1a 7e ff 22 99 23 1c c3 e5 5f 24 25 78 ea 13 c3 83 9e 38 3e b1 40 12 15 f2 74 8e 8d 27 8e 5c da a0 41 0d b4 43 33 3c 72 e8 3b b4 76 1e 47 79 f6 aa f3 da 03 98 7d Data Ascii: FZRMF5]i\7Qckl1g<rfU-]_A`YgDJ;l[1`qhSEK$X4%S\E]((v9NwhB&ZqW$]a0e@:~"#_$%x8>@t'\AC3<r;vGy}
2024-10-02 10:16:38 UTC	16384	IN	Data Raw: e7 4b 8a ea d7 bd c7 63 a9 09 fa aa 15 f4 99 ef 42 cb ee 43 fc d5 21 14 a8 bf 80 5a f7 f4 3d b8 d0 fc 60 1f 58 19 e0 c6 7b f1 bb 6c 18 1a e0 a7 05 df 95 b2 b7 db 06 78 de f5 17 05 8f 31 b2 c7 1a 79 99 35 32 82 f8 c5 8a 8c 91 df 5f 91 6b 64 fe 07 f7 ec 58 61 95 50 42 1b bc 23 1e 43 ee 5e 1b 92 92 21 ad f3 af 30 89 df 8f cb 32 2d ca e3 92 72 68 21 0a 21 be 9c af b2 05 d1 4a 64 8c 65 23 fd 70 bf fb 06 78 59 a7 af 26 b5 9b dd 89 37 2e 97 1d e7 05 31 5e 67 30 d8 96 3a 1e ac f4 6b 47 fc 1a 7b d2 b8 9d d4 41 a8 8c 7e d4 ba 1f df 77 7d ca ba 41 85 6a c7 a6 7e 9c 79 3d 94 79 bd 04 4f 0d 26 44 31 3b 3c 59 ae 47 6d d7 49 bd a3 1d fd 5e 32 13 d2 68 fc c4 bf d3 38 8f 4c ac 0f d9 f4 75 23 1e 41 01 47 cb a9 9a 13 64 06 d4 a0 b8 92 2c 91 27 0f 3e 74 23 99 a1 90 91 49 ff Data Ascii: KcBC!Z=`X{lx1y52_kdXaPB#C^!02-rh!!Jde#pxY&7.1^g0:kG{A~w}Aj~y=yO&D1;<YGmI^2h8Lu#AGd,'>t#I
2024-10-02 10:16:38 UTC	16384	IN	Data Raw: 57 12 fa f7 69 89 87 93 a5 03 6d ef 64 ad 93 aa d2 ba 75 33 d4 a7 e7 0f a2 52 a0 dc 07 fb 7c be 8d 16 89 23 b0 17 94 d3 e8 79 e5 ac c6 88 af ce c5 74 9c 8b 19 62 2e 66 8b b9 98 43 73 f1 95 4e 53 08 99 08 5a 0b 90 51 d0 da 2f 3a 75 0b 7c 36 52 e6 88 05 3e 4f 2c f0 2e 5a e0 df 42 ca e0 a6 c1 29 c5 a6 91 27 36 0d 17 6d 1a 4f 85 7f 9a 07 c2 65 af 55 3f 8d 81 70 93 3a c3 fd cd f2 b9 74 b2 ef a0 51 ac 0d 71 1f 59 dd ca 1d 71 7c 86 20 52 46 13 5f 33 c7 e6 5c 06 2d 44 a1 83 73 2c 7e af 2d d8 8d 76 f6 9a 98 85 39 b0 5c c2 bf 74 8a 56 e0 bd 07 64 63 89 7f ba 4c 57 be ff 01 ef 4c 4c ea 44 89 58 b6 51 67 b6 d7 66 b2 87 a9 3b da 9d 5f 58 1b df c3 01 69 ce a5 5c 41 87 d2 da 31 87 61 39 ee 69 89 c2 87 f0 e4 19 e8 5e 0b eb a3 c1 6e 23 e6 60 ca fe 06 cb e4 f9 7f ac 5b 26 Data Ascii: Wimdu3R\|#ytb.fCsNSZQ/:u\|6R>O,.ZB)'6mOeU?p:tQqYq\| RF_3\-Ds,~-v9\tVdcLWLLDXQgf;_Xi\A1a9i^n#`[&
2024-10-02 10:16:38 UTC	16384	IN	Data Raw: d0 f3 87 e5 5f 69 42 87 7e c6 85 46 34 8b 55 28 34 8a fc b4 9a a4 3e 0f 4e ce 8b 62 92 3a 8a ab 68 99 ea a2 91 a9 be 58 cf 54 ff fa 79 aa 18 c3 15 6a a6 fa 9b bf e1 99 ea 73 12 33 d5 cf 69 78 16 af a5 ca 54 cf 91 85 17 a1 aa 05 1e 15 c9 e2 d1 14 48 16 b7 be 88 8b bb a9 b3 d4 f7 cd 77 c4 65 96 af 81 63 b9 01 9a ad 51 bd f1 2c 75 95 8d 59 cf 52 27 36 e6 96 69 f1 59 ea 39 0b e3 eb da be 00 ea 9a fa 82 ba 45 81 52 d4 62 ce 0a b6 dc d9 74 26 d4 3f 5f 5b 7d 5a ca c6 83 2b bd 51 60 17 c0 e5 f0 b0 39 16 38 3a 06 46 01 54 43 86 bd 3b b7 0b 0c dd c1 aa dc f6 55 2b fd 07 c5 a3 9a be e4 01 da 97 b9 be 74 57 f2 07 7a f0 58 f6 4d 33 eb 4b 66 e8 cb 86 d8 cb f0 27 ed 94 5f 55 9b e1 3a a7 03 26 f5 98 bc 89 f8 3c 25 82 7c f2 8c 95 9f c5 f4 9e 3d 96 14 4a 15 8d f2 a2 b3 84 Data Ascii: _iB~F4U(4>Nb:hXTyjs3ixTHwecQ,uYR'6iY9ERbt&?_[}Z+Q`98:FTC;U+tWzXM3Kf'_U:&<%\|=J
2024-10-02 10:16:38 UTC	16384	IN	Data Raw: 54 75 d6 dc 96 15 dc 45 9f da 76 94 53 2b ae 61 7d 0f 1c c5 76 04 ba 26 99 de 5f cc 4c 8b d5 72 68 47 39 b6 e3 e8 e2 a9 d5 13 fc d7 93 0a 00 6b f7 ec d3 23 6a bd dc 71 92 22 ed dc 23 88 15 3e 9f 75 69 6d 69 68 08 93 e7 4a 26 2a 1b b2 5a 15 c2 11 cd 9e 26 06 cc 99 07 f7 dc ff a4 3c 21 14 db f0 ba 39 6c 2b b1 25 52 3f fe 01 b7 6d 26 93 38 03 f2 5f 01 0c 88 fd 81 7f 42 7a 32 da 9c 0f 24 e3 8f 11 de d9 04 da d5 9a 3d 98 09 9d 2e 1d e0 fb cc 04 3c f9 37 11 67 a0 92 55 9b 49 25 88 bb 5c 8f 57 01 ae 07 1f 7f de c0 af d8 79 5e 55 ab ad 20 1d 39 0c c1 72 b3 ef db 8b d1 33 c7 eb ab 24 d0 b9 6a bb 87 df f8 08 62 9d c6 e4 4f 69 fc 25 b8 cf d0 e7 e9 90 79 be de 81 79 66 ca 3c ed be ab 10 2d fc e5 35 a3 b2 e9 15 0e 60 d1 fb 98 f5 e0 8a 43 a9 51 fd 41 be 49 e7 9c 45 0a Data Ascii: TuEvS+a}v&_LrhG9k#jq"#>uimihJ&*Z&<!9l+%R?m&8_Bz2$=.<7gUI%\Wy^U 9r3$jbOi%yyf<-5`CQAIE
2024-10-02 10:16:38 UTC	16384	IN	Data Raw: 3f 4e be 08 9c 9f c6 f7 a1 52 e3 09 3a 3f 15 ed 8c 21 77 f9 ad 36 0e 30 06 ed 8f 90 77 ae 5d 69 c9 c4 5d a7 f5 c0 b0 3a 07 fd 72 94 f9 76 54 63 cc 8b e9 c1 79 f2 fb 54 a8 df bc b8 1e 5c 04 3d 38 4b 5b ef 16 c9 84 29 fc 9e 87 49 1b ae 7d 89 c6 6c f3 68 e9 b3 11 7d d0 fa 37 0f d7 3f b6 84 f0 c9 fc 06 98 fa 8b db 70 43 47 14 18 76 0b bb af 52 a7 4f fe 36 cb ca f8 3c 04 2b 86 a4 6a e1 a7 5b 68 fe f9 b4 62 f8 27 bf 1c 56 9f ce d6 24 f1 be 71 56 3b 7f ea cd 0b ea 66 7c c4 b0 8a a5 e8 ac 53 9b 4d 26 0c 6c bf cc 28 4d d4 17 de 46 32 fa c9 ea e8 62 b5 5e 4c 3b bd 7a 33 2e 7e 47 64 fe 2e d8 a7 87 8c a8 d3 ab 35 0b e4 bc ed 24 85 e0 52 9a 85 99 52 36 f2 5b 35 0f 90 1a d8 1e d6 20 3e 20 9a 57 fc 61 25 f5 22 d9 23 e4 c0 22 5a 6a e4 3f 7f 90 d6 ea e2 24 e4 af dc fc 38 Data Ascii: ?NR:?!w60w]i]:rvTcyT\=8K[)I}lh}7?pCGvRO6<+j[hb'V$qV;f\|SM&l(MF2b^L;z3.~Gd.5$RR6[5 > Wa%"#"Zj?$8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
25	192.168.2.16	49785	104.118.10.2	443	4912	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-02 10:16:38 UTC	877	OUT	GET /edge/welcome?form=M10004&mb03=true HTTP/1.1 Host: www.microsoft.com Connection: keep-alive Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: none Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: document sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" sec-ch-ua-platform-version: "10.0.0" sec-ch-ua-full-version: "117.0.2045.47" sec-ch-ua-arch: "x86" sec-ch-ua-bitness: "64" sec-ch-prefers-color-scheme: light Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-10-02 10:16:38 UTC	742	IN	HTTP/1.1 302 Moved Temporarily Content-Length: 134 Content-Type: text/html; charset=utf-8 Location: /en-gb/edge/welcome?form=M10004&mb03=true Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Origin-Agent-Cluster: ?1 X-Content-Type-Options: nosniff X-Download-Options: noopen X-Frame-Options: SAMEORIGIN X-Permitted-Cross-Domain-Policies: none X-XSS-Protection: 0 x-azure-ref: 20241002T101638Z-r175c8566f4bshdkpbpscmwtmg000000023g00000000tztc Expires: Wed, 02 Oct 2024 10:16:38 GMT Cache-Control: max-age=0, no-cache, no-store Pragma: no-cache Date: Wed, 02 Oct 2024 10:16:38 GMT Connection: close TLS_version: tls1.3 ms-cv: CASMicrosoftCV392ebf59.0 ms-cv-esi: CASMicrosoftCV392ebf59.0 X-RTag: RT
2024-10-02 10:16:38 UTC	134	IN	Data Raw: 3c 70 3e 46 6f 75 6e 64 2e 20 52 65 64 69 72 65 63 74 69 6e 67 20 74 6f 20 3c 61 20 68 72 65 66 3d 22 2f 65 6e 2d 67 62 2f 65 64 67 65 2f 77 65 6c 63 6f 6d 65 3f 66 6f 72 6d 3d 4d 31 30 30 30 34 26 61 6d 70 3b 6d 62 30 33 3d 74 72 75 65 22 3e 2f 65 6e 2d 67 62 2f 65 64 67 65 2f 77 65 6c 63 6f 6d 65 3f 66 6f 72 6d 3d 4d 31 30 30 30 34 26 61 6d 70 3b 6d 62 30 33 3d 74 72 75 65 3c 2f 61 3e 3c 2f 70 3e Data Ascii: <p>Found. Redirecting to <a href="/en-gb/edge/welcome?form=M10004&mb03=true">/en-gb/edge/welcome?form=M10004&mb03=true</a></p>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
26	192.168.2.16	49786	104.118.10.2	443	4912	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-02 10:16:38 UTC	883	OUT	GET /en-gb/edge/welcome?form=M10004&mb03=true HTTP/1.1 Host: www.microsoft.com Connection: keep-alive Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: none Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: document sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-full-version: "117.0.2045.47" sec-ch-ua-arch: "x86" sec-ch-ua-platform: "Windows" sec-ch-ua-platform-version: "10.0.0" sec-ch-ua-bitness: "64" sec-ch-prefers-color-scheme: light Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-10-02 10:16:39 UTC	2305	IN	HTTP/1.1 200 OK Content-Type: text/html; charset=utf-8 ETag: "29fe9-TztwqgjNhIowMHew6AgylxadOE0" Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Origin-Agent-Cluster: ?1 X-Content-Type-Options: nosniff X-Download-Options: noopen X-Frame-Options: SAMEORIGIN X-Permitted-Cross-Domain-Policies: none X-XSS-Protection: 0 Content-Security-Policy: default-src 'self' https://edgestatic.azureedge.net https://.microsoft.com; script-src 'self' 'self' 'unsafe-eval' 'unsafe-inline' https://ajax.aspnetcdn.com https://az725175.vo.msecnd.net https://.microsoft.com https://mem.gfx.ms https://edgestatic.azureedge.net https://js.monitor.azure.com https://mwf-service.akamaized.net https://.clarity.ms https://.bing.com http://.bing.com https://.adnxs.com https://connect.facebook.net https://snap.licdn.com https://www.youtube.com; style-src 'self' 'unsafe-inline' https://.microsoft.com https://statics-marketingsites-wcus-ms-com.akamaized.net https://statics-marketingsites-eus-ms-com.akamaized.net https://statics-marketingsites-neu-ms-com.akamaized.net https://statics-marketingsites-eas-ms-com.akamaized.net https://edgestatic.azureedge.net; font-src 'self' data: https://.microsoft.com http://c.s-microsoft.com https://c.s-microsoft.com https://edgestatic.azureedge.net; connect-src 'self' http://.microsoft.com https://.microsoft.com ht [TRUNCATED] x-azure-ref: 20241002T101638Z-1767f7688dc5std64kd3n8sca400000000sg00000000bpvt Date: Wed, 02 Oct 2024 10:16:39 GMT Transfer-Encoding: chunked Connection: close Connection: Transfer-Encoding TLS_version: tls1.3 ms-cv: CASMicrosoftCV45d16692.0 ms-cv-esi: CASMicrosoftCV45d16692.0 X-RTag: RT
2024-10-02 10:16:39 UTC	14079	IN	Data Raw: 30 30 30 30 36 30 30 30 0d 0a 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 64 61 74 61 2d 6e 2d 68 65 61 64 2d 73 73 72 20 6c 61 6e 67 3d 22 65 6e 22 20 64 69 72 3d 22 6c 74 72 22 20 64 61 74 61 2d 6e 2d 68 65 61 64 3d 22 25 37 42 25 32 32 6c 61 6e 67 25 32 32 3a 25 37 42 25 32 32 73 73 72 25 32 32 3a 25 32 32 65 6e 25 32 32 25 37 44 2c 25 32 32 64 69 72 25 32 32 3a 25 37 42 25 32 32 73 73 72 25 32 32 3a 25 32 32 6c 74 72 25 32 32 25 37 44 25 37 44 22 3e 0a 20 20 3c 68 65 61 64 20 3e 0a 20 20 20 20 3c 6d 65 74 61 20 64 61 74 61 2d 6e 2d 68 65 61 64 3d 22 73 73 72 22 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 3c 6d 65 74 61 20 64 61 74 61 2d 6e 2d 68 65 61 64 3d 22 73 73 72 22 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 Data Ascii: 00006000<!doctype html><html data-n-head-ssr lang="en" dir="ltr" data-n-head="%7B%22lang%22:%7B%22ssr%22:%22en%22%7D,%22dir%22:%7B%22ssr%22:%22ltr%22%7D%7D"> <head > <meta data-n-head="ssr" charset="utf-8"><meta data-n-head="ssr" name="viewport"
2024-10-02 10:16:39 UTC	10509	IN	Data Raw: 22 61 6c 74 65 72 6e 61 74 65 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 65 6e 2d 69 6e 2f 65 64 67 65 2f 77 65 6c 63 6f 6d 65 3f 66 6f 72 6d 3d 4d 31 30 30 30 34 26 61 6d 70 3b 6d 62 30 33 3d 74 72 75 65 22 20 68 72 65 66 6c 61 6e 67 3d 22 65 6e 2d 69 6e 22 3e 3c 6c 69 6e 6b 20 64 61 74 61 2d 6e 2d 68 65 61 64 3d 22 73 73 72 22 20 64 61 74 61 2d 68 69 64 3d 22 69 31 38 6e 2d 61 6c 74 2d 65 73 22 20 72 65 6c 3d 22 61 6c 74 65 72 6e 61 74 65 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 65 73 2d 65 73 2f 65 64 67 65 2f 77 65 6c 63 6f 6d 65 3f 66 6f 72 6d 3d 4d 31 30 30 30 34 26 61 6d 70 3b 6d 62 30 33 3d 74 72 75 65 22 20 68 72 65 66 6c 61 6e Data Ascii: "alternate" href="https://www.microsoft.com/en-in/edge/welcome?form=M10004&mb03=true" hreflang="en-in"><link data-n-head="ssr" data-hid="i18n-alt-es" rel="alternate" href="https://www.microsoft.com/es-es/edge/welcome?form=M10004&mb03=true" hreflan
2024-10-02 10:16:39 UTC	16384	IN	Data Raw: 30 30 30 30 36 30 30 30 0d 0a 3d 4d 31 30 30 30 34 26 61 6d 70 3b 6d 62 30 33 3d 74 72 75 65 22 20 68 72 65 66 6c 61 6e 67 3d 22 6d 72 2d 69 6e 22 3e 3c 6c 69 6e 6b 20 64 61 74 61 2d 6e 2d 68 65 61 64 3d 22 73 73 72 22 20 64 61 74 61 2d 68 69 64 3d 22 69 31 38 6e 2d 61 6c 74 2d 6d 73 22 20 72 65 6c 3d 22 61 6c 74 65 72 6e 61 74 65 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 6d 73 2d 6d 79 2f 65 64 67 65 2f 77 65 6c 63 6f 6d 65 3f 66 6f 72 6d 3d 4d 31 30 30 30 34 26 61 6d 70 3b 6d 62 30 33 3d 74 72 75 65 22 20 68 72 65 66 6c 61 6e 67 3d 22 6d 73 22 3e 3c 6c 69 6e 6b 20 64 61 74 61 2d 6e 2d 68 65 61 64 3d 22 73 73 72 22 20 64 61 74 61 2d 68 69 64 3d 22 69 31 38 6e 2d 61 6c 74 2d 6d 73 2d 6d 79 22 20 Data Ascii: 00006000=M10004&mb03=true" hreflang="mr-in"><link data-n-head="ssr" data-hid="i18n-alt-ms" rel="alternate" href="https://www.microsoft.com/ms-my/edge/welcome?form=M10004&mb03=true" hreflang="ms"><link data-n-head="ssr" data-hid="i18n-alt-ms-my"
2024-10-02 10:16:39 UTC	8204	IN	Data Raw: 65 5f 5f 70 61 67 65 2d 6c 6f 61 64 2d 61 63 74 69 6f 6e 73 22 3e 3c 2f 64 69 76 3e 20 3c 21 2d 2d 2d 2d 3e 3c 2f 64 69 76 3e 20 3c 64 69 76 20 63 6c 61 73 73 3d 22 65 64 67 65 2d 64 6c 2d 65 6d 62 65 64 22 3e 3c 21 2d 2d 2d 2d 3e 3c 2f 64 69 76 3e 3c 2f 64 69 76 3e 20 3c 21 2d 2d 2d 2d 3e 20 3c 21 2d 2d 2d 2d 3e 3c 2f 6d 61 69 6e 3e 20 3c 21 2d 2d 2d 2d 3e 20 3c 21 2d 2d 2d 2d 3e 20 3c 21 2d 2d 2d 2d 3e 3c 2f 64 69 76 3e 3c 2f 64 69 76 3e 3c 2f 64 69 76 3e 3c 73 63 72 69 70 74 3e 77 69 6e 64 6f 77 2e 5f 5f 4e 55 58 54 5f 5f 3d 28 66 75 6e 63 74 69 6f 6e 28 61 2c 62 2c 63 2c 64 2c 65 2c 66 2c 67 2c 68 2c 69 2c 6a 2c 6b 2c 6c 2c 6d 2c 6e 2c 6f 2c 70 2c 71 2c 72 2c 73 2c 74 2c 75 2c 76 2c 77 2c 78 2c 79 2c 7a 2c 41 2c 42 2c 43 2c 44 2c 45 2c 46 2c 47 2c 48 Data Ascii: e__page-load-actions"></div> ...--></div> <div class="edge-dl-embed">...--></div></div> ...--> ...--></main> ...--> ...--> ...--></div></div></div><script>window.__NUXT__=(function(a,b,c,d,e,f,g,h,i,j,k,l,m,n,o,p,q,r,s,t,u,v,w,x,y,z,A,B,C,D,E,F,G,H
2024-10-02 10:16:40 UTC	16384	IN	Data Raw: 30 30 30 30 34 30 30 30 0d 0a 20 75 73 65 20 4d 69 63 72 6f 73 6f 66 74 20 45 64 67 65 2e 20 45 71 75 69 70 70 65 64 20 77 69 74 68 20 41 49 2d 70 6f 77 65 72 65 64 20 4d 69 63 72 6f 73 6f 66 74 20 43 6f 70 69 6c 6f 74 2c 20 62 72 6f 77 73 65 72 20 61 63 74 69 6f 6e 73 2c 20 74 61 62 20 6f 72 67 61 6e 69 73 61 74 69 6f 6e 20 61 6e 64 20 61 64 76 61 6e 63 65 64 20 70 65 72 66 6f 72 6d 61 6e 63 65 20 66 65 61 74 75 72 65 73 2c 20 45 64 67 65 20 69 73 20 62 75 69 6c 74 20 74 6f 20 68 65 6c 70 20 79 6f 75 20 64 6f 20 6d 6f 72 65 20 77 69 74 68 20 65 76 65 72 79 20 6d 69 6e 75 74 65 20 79 6f 75 20 73 70 65 6e 64 20 6f 6e 6c 69 6e 65 2e 5c 75 30 30 33 43 5c 75 30 30 32 46 70 5c 75 30 30 33 45 22 2c 73 75 70 70 6c 65 6d 65 6e 74 61 6c 3a 61 2c 66 69 6e 65 70 72 Data Ascii: 00004000 use Microsoft Edge. Equipped with AI-powered Microsoft Copilot, browser actions, tab organisation and advanced performance features, Edge is built to help you do more with every minute you spend online.\u003C\u002Fp\u003E",supplemental:a,finepr
2024-10-02 10:16:40 UTC	12	IN	Data Raw: 41 63 74 69 6f 6e 4d 65 73 73 0d 0a Data Ascii: ActionMess
2024-10-02 10:16:40 UTC	16384	IN	Data Raw: 30 30 30 30 34 30 30 30 0d 0a 61 67 65 53 74 79 6c 65 3a 44 2c 6d 65 64 69 61 41 63 74 69 6f 6e 4d 65 73 73 61 67 65 3a 61 2c 6d 65 64 69 61 41 63 74 69 6f 6e 55 72 6c 4e 65 77 54 61 62 3a 61 7d 2c 6d 65 64 69 61 41 63 74 69 6f 6e 73 3a 5b 5d 7d 2c 61 63 74 69 6f 6e 73 3a 5b 7b 74 79 70 65 3a 69 2c 6c 61 62 65 6c 3a 70 2c 62 75 74 74 6f 6e 56 61 72 69 61 6e 74 3a 64 2c 65 63 69 64 41 63 74 69 6f 6e 3a 65 2c 69 63 6f 6e 3a 62 2c 69 63 6f 6e 53 69 7a 65 3a 61 2c 6b 6e 6f 77 6e 43 75 73 74 6f 6d 41 63 74 69 6f 6e 49 64 3a 61 2c 63 75 73 74 6f 6d 41 63 74 69 6f 6e 49 64 3a 61 2c 61 63 63 65 73 73 69 62 6c 65 4c 61 62 65 6c 3a 61 2c 69 6e 50 72 6f 67 72 65 73 73 4c 61 62 65 6c 3a 61 2c 63 6f 6d 70 6c 65 74 65 64 4c 61 62 65 6c 3a 61 2c 64 69 73 61 62 6c 65 57 Data Ascii: 00004000ageStyle:D,mediaActionMessage:a,mediaActionUrlNewTab:a},mediaActions:[]},actions:[{type:i,label:p,buttonVariant:d,ecidAction:e,icon:b,iconSize:a,knownCustomActionId:a,customActionId:a,accessibleLabel:a,inProgressLabel:a,completedLabel:a,disableW
2024-10-02 10:16:40 UTC	12	IN	Data Raw: 2c 6d 61 78 57 69 64 74 68 3a 0d 0a Data Ascii: ,maxWidth:
2024-10-02 10:16:40 UTC	16384	IN	Data Raw: 30 30 30 30 34 30 30 30 0d 0a 61 2c 61 6c 69 67 6e 58 3a 6a 2c 61 6c 69 67 6e 59 3a 6a 2c 73 74 72 65 74 63 68 54 6f 46 69 6c 6c 3a 63 2c 6c 61 79 65 72 73 3a 5b 5d 2c 6d 65 64 69 61 41 63 74 69 6f 6e 3a 7b 6d 65 64 69 61 41 63 74 69 6f 6e 55 72 6c 3a 64 2c 6d 65 64 69 61 41 63 74 69 6f 6e 4d 65 73 73 61 67 65 53 74 79 6c 65 3a 61 2c 6d 65 64 69 61 41 63 74 69 6f 6e 4d 65 73 73 61 67 65 3a 61 2c 6d 65 64 69 61 41 63 74 69 6f 6e 55 72 6c 4e 65 77 54 61 62 3a 61 7d 2c 6d 65 64 69 61 41 63 74 69 6f 6e 73 3a 5b 5d 7d 2c 61 63 74 69 6f 6e 73 3a 5b 7b 74 79 70 65 3a 69 2c 6c 61 62 65 6c 3a 70 2c 62 75 74 74 6f 6e 56 61 72 69 61 6e 74 3a 64 2c 65 63 69 64 41 63 74 69 6f 6e 3a 65 2c 69 63 6f 6e 3a 62 2c 69 63 6f 6e 53 69 7a 65 3a 61 2c 6b 6e 6f 77 6e 43 75 73 74 Data Ascii: 00004000a,alignX:j,alignY:j,stretchToFill:c,layers:[],mediaAction:{mediaActionUrl:d,mediaActionMessageStyle:a,mediaActionMessage:a,mediaActionUrlNewTab:a},mediaActions:[]},actions:[{type:i,label:p,buttonVariant:d,ecidAction:e,icon:b,iconSize:a,knownCust
2024-10-02 10:16:40 UTC	12	IN	Data Raw: 2c 77 69 64 74 68 3a 74 2c 68 0d 0a Data Ascii: ,width:t,h

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
27	192.168.2.16	49787	77.75.76.70	443	3540	C:\Users\user\AppData\Roaming\Seznam.cz\sznsetup.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-02 10:16:39 UTC	124	OUT	GET /update/cz.seznam.software.libszndesktop-2.1.35-win32.zip HTTP/1.1 Host: download.seznam.cz Connection: Keep-Alive
2024-10-02 10:16:40 UTC	271	IN	HTTP/1.1 200 OK server: envoy date: Wed, 02 Oct 2024 10:16:39 GMT content-type: application/zip content-length: 996238 last-modified: Fri, 23 Aug 2024 12:19:22 GMT etag: "66c87e4a-f338e" accept-ranges: bytes x-envoy-upstream-service-time: 0 connection: close
2024-10-02 10:16:40 UTC	13631	IN	Data Raw: 50 4b 03 04 14 00 00 00 08 00 5c 85 85 4d 63 8f f0 2e 0c 01 00 00 9e 01 00 00 0b 00 00 00 63 6f 6e 74 72 6f 6c 2e 69 6e 69 6d 50 b1 4e c3 30 10 dd fd 15 1e db a1 56 9c aa 62 f2 c6 c0 00 08 89 4e 20 86 8b 73 49 dc 38 b6 65 3b a9 14 f1 27 4c 0c 8c 7c 05 f4 bf 70 68 03 08 75 b9 7b 77 ef 74 77 ef 3d 3a 90 2d d4 f8 44 0c 74 28 e4 c8 02 8e 09 b2 60 ab b8 07 8f 4c ab 22 8c a6 c4 d0 46 eb c8 80 3e 28 6b 44 ce 38 5b 6f 88 32 21 82 d6 e2 94 59 01 91 f4 66 ee 4e e8 b7 ef 51 5a 53 a9 ba f7 28 fe e0 6f ce 69 88 95 f5 9d d8 2b b3 ce 49 89 0e 4d 19 44 3a bc 9a 1f 59 15 10 f0 87 91 b6 63 9d 92 de 4e 34 eb 42 69 52 18 a4 e7 3c 9b 67 ce 8b a9 9b 18 1c 62 b9 e2 39 cf e8 82 27 21 19 e3 17 4b 32 3d a4 95 8c ff ae 1e 37 cc f2 c1 b9 db c9 a7 cb 63 4d af b6 db 3b 7a 8f 3e d9 42 Data Ascii: PK\Mc.control.inimPN0VbN sI8e;'L\|phu{wtw=:-Dt(`L"F>(kD8[o2!YfNQZS(oi+IMD:YcN4BiR<gb9'!K2=7cM;z>B
2024-10-02 10:16:40 UTC	16384	IN	Data Raw: 29 92 e9 58 97 29 a5 4e 84 28 86 32 91 91 e5 bc c0 23 fb 9c fa 84 98 8f 99 27 42 ca f5 f2 3d a6 cb 94 72 4d 5b 1b 6f c5 07 ef 07 b4 60 ea 5d 55 1b 7c 77 bd 41 39 e3 39 0b f7 3b 8a a7 73 64 5d d0 61 1b 70 c7 0b 85 71 2f 33 9f 70 e1 f8 c9 08 9a d1 41 8e 16 e1 10 87 a9 ff a8 01 b5 7e 96 6a fd 14 a5 59 a7 7e 87 df 0b 18 2a 8c 33 32 a5 2e 63 77 86 4c ac 74 46 c6 ca 6a 46 3a a6 43 a5 75 46 26 92 4a bc 45 29 36 25 ba f0 5c 8e c4 e8 3c 44 08 a2 e3 4d 53 f9 62 dd 2b c9 8c a3 d4 63 5e 3c 41 25 4b f6 aa be ad 60 34 c2 b2 b1 9c bf fb 66 1d a3 08 41 9d f8 90 28 76 35 f2 a0 cc 4f b9 cc 6e 94 b7 8a 91 8b 6c b2 d1 2c 4a 71 88 91 c5 a2 6a c7 8b f1 f9 f2 a3 13 5a 5f 2c ff 77 3a cc df c5 87 9d 2f d2 fd 57 c9 3c 3e 63 43 67 3a c6 35 33 22 23 d9 18 ab c1 c8 b7 36 78 b5 57 4f Data Ascii: )X)N(2#'B=rM[o`]U\|wA99;sd]apq/3pA~jY~*32.cwLtFjF:CuF&JE)6%\<DMSb+c^<A%K`4fA(v5Onl,JqjZ_,w:/W<>cCg:53"#6xWO
2024-10-02 10:16:40 UTC	15540	IN	Data Raw: bb 1d 32 70 33 52 3d 88 ad b1 55 1d cf b2 ef 33 70 e7 d1 fb a9 14 8d 04 97 0a c5 c5 59 c7 48 bd 8f 61 3c 7c 39 1e da 33 f7 74 8c 4f cd 3b cb ce 3b ee 4e 03 d5 93 6a 7f ab 6f 71 b3 b0 ec 02 a4 55 24 2c 92 0b bf 15 3e 3c 94 fb e8 29 48 4f 41 56 92 e3 9f a4 ef d9 00 3c 22 0e 4b 57 6e f9 94 74 68 7b 0f 3b b4 dd 6e 3a b4 71 74 33 7b 82 ed a7 7f e9 4f ef 96 0e 6d 43 f1 52 30 4a 8c 46 63 74 4c a0 ea c8 20 5b 06 6b 4b fd 9d 8f fb 71 36 e7 fb ec e0 e9 c5 46 f4 93 16 80 15 5c 2f 23 6c 5c 1a d0 30 55 d0 60 97 ef a7 f2 13 71 69 3e d7 2c 71 69 3e 67 e1 d2 14 db b8 34 27 6d 5c 1a 76 4d 1b 3b 2e 0d 99 95 48 5c 9a c5 24 e8 4b c1 a5 d9 ef 74 4e c3 eb a4 ee f8 1f e0 75 ec 56 9c 78 1d 3c df d6 fd 75 54 f9 b4 35 df c8 87 bb 46 39 72 83 6d 24 90 23 8c 04 42 c2 48 20 4f d8 03 Data Ascii: 2p3R=U3pYHa<\|93tO;;NjoqU$,><)HOAV<"KWnth{;n:qt3{OmCR0JFctL [kKq6F\/#l\0U`qi>,qi>g4'm\vM;.H\$KtNuVx<uT5F9rm$#BH O
2024-10-02 10:16:40 UTC	16384	IN	Data Raw: 82 68 4c 1c 6a cb 16 9f 2f 18 99 6f 8c 27 91 44 92 73 55 2d e7 2a 9c aa 81 8c e8 6a f3 94 24 92 34 18 bf 85 a4 39 ff 7c 3c ea 12 f3 31 9e e6 63 94 dd 20 b3 ce d8 92 c8 ac 71 76 49 66 9d 50 ee a7 c7 2d 92 2a 13 ee d3 fd c3 cd 44 0e 97 3c ab bc 8b 76 f4 86 e9 23 a0 94 8e 69 b4 56 27 bf 99 41 2e fb b8 62 2b 23 5a cb 34 e3 85 49 84 0c 0f 12 fb c5 d8 17 bb 38 97 5a b4 d0 5e 45 29 a9 2e 50 5c e5 5e 1f 16 5d d2 5c 62 2c 25 cf 7a b7 15 22 47 1e 48 e6 9b 73 15 dc 00 0a 3c c0 b4 5c e9 c0 c3 73 9a e5 02 3d 1c 0a 7a b7 7f cf 2e a8 33 f5 26 ec 9f d6 5f 05 7a 99 44 db 27 a2 95 ee 49 46 a3 64 da 0a 08 93 44 5b 0d 89 46 35 06 0e a4 a6 af 64 63 f7 1b 8d fd 22 f1 3c 72 2b 69 2d 5b ec 3e e0 ff 98 38 d3 0c cf 3a 78 2d ef 77 08 94 a8 24 94 f8 3b 85 4c 96 66 35 fd a3 3a 69 88 Data Ascii: hLj/o'DsU-j$49\|<1c qvIfP-D<v#iV'A.b+#Z4I8Z^E).P\^]\b,%z"GHs<\s=z.3&_zD'IFdD[F5dc"<r+i-[>8:x-w$;Lf5:i
2024-10-02 10:16:40 UTC	15540	IN	Data Raw: 2e 32 93 db 92 fb 30 a2 fd 2b c8 55 63 c9 22 f8 7a ee c5 f5 64 e3 9e 80 5f 43 35 ee e7 e9 7a 50 56 55 b3 77 f2 51 67 25 35 b0 fa 9c 96 f7 f2 9b b3 1f 0f 77 7c 89 7d 9f 5d 2c 1f 4b 25 7f 6b f4 18 9d 02 bd 51 4a 6a d4 46 a2 78 7f 06 d2 25 9e bd 47 66 27 ce 91 18 07 87 2e f0 ae aa 21 87 67 44 e8 b2 e4 7b 06 49 7f 98 c8 f9 38 f6 8a d5 78 1f 86 e8 6f ea 34 20 8b ca 4d 12 16 d6 b4 71 45 85 e3 45 e5 28 0b fd 87 2b b4 a8 63 e1 c5 b8 4c ba b8 06 9e 92 9a bf 8e a4 e5 bc 65 56 c8 2d 93 03 49 14 3b 9a 6f 7d 17 51 6d 96 55 6a b3 9c 64 d9 2c 31 82 fe 7b 7e 6f dd 73 e4 2c b8 53 7b 0e e6 8b f7 9c 86 bd bc a3 f2 f4 3a 53 39 1d e2 a7 d3 e4 86 03 64 48 df 70 80 32 bc e1 4c fa 38 6d 38 34 d3 3b 32 fc 1f c4 6f 23 06 54 ae c2 45 e7 c5 3d fd 8c 05 d6 b7 a6 96 de 9b 7d 41 61 74 Data Ascii: .20+Uc"zd_C5zPVUwQg%5w\|}],K%kQJjFx%Gf'.!gD{I8xo4 MqEE(+cLeV-I;o}QmUjd,1{~os,S{:S9dHp2L8m84;2o#TE=}Aat
2024-10-02 10:16:40 UTC	1388	IN	Data Raw: 01 89 0d c3 ec ae 72 21 b7 ee 10 e6 3b 04 6e 07 ca 89 da 99 b9 cb ff d3 09 b6 f6 0b 18 7e 94 70 41 3e 86 27 c5 2f e1 9e ca 70 8f 24 b8 af 1d e6 50 97 40 aa b2 44 9b 0a c0 a7 12 e0 6f 2c 99 50 9d 1b ff bc 74 24 79 96 4d 7c 0c d0 96 da b8 37 f8 13 00 02 5b 8c 97 da 2c 3f c0 44 37 a4 ab 28 d1 dd 6a ea 14 75 b8 28 4b 76 f8 02 9b fa 11 ee 92 d3 04 ea 8d 9c cf 40 92 31 f4 a3 46 77 7a e0 ab fa b3 fb b3 be c8 1e da f3 c0 aa e0 8e bf 0c 68 ee f4 b1 ad bf b8 cf 10 03 1a bd ea 50 62 da 9f 13 71 55 fd ca f9 34 02 b3 83 ca d1 25 a1 d9 1f 8d 0d 98 bc 24 31 3b b8 d4 66 a0 d5 0c e7 15 5a 54 98 ec 60 f3 b1 ac c6 81 7c b4 f9 e4 7e bb ad 12 f3 1c c4 ff 8f aa b5 60 e2 e1 7d 79 db a7 8e d1 02 9c 76 a4 67 05 a6 f3 77 3e 45 35 aa c1 69 8c 8c 07 48 65 84 a4 b2 25 30 44 88 e1 28 Data Ascii: r!;n~pA>'/p$P@Do,Pt$yM\|7[,?D7(ju(Kv@1FwzhPbqU4%$1;fZT`\|~`}yvgw>E5iHe%0D(
2024-10-02 10:16:40 UTC	16384	IN	Data Raw: f2 93 e1 81 ab 5c 9e ed 8f 35 1f 2e ea ce 4b 4e 7e 38 7c b6 4c 5e de 3d 24 39 f9 0e 24 1b 38 59 db 7c dc db b8 00 ac 19 2c f5 1d 3b 12 69 6d e6 19 6d 06 ef 14 6d e6 cb 8d 51 88 b4 6c b3 dc 45 7b 22 a7 32 9e ad 81 b1 d3 b2 e9 da 6c ee af ed a1 2b 31 dc 13 35 b6 d1 80 2d 0c dd bf d4 1f 32 db 2f f5 41 15 4a b3 05 55 88 bb 2c 14 a1 32 fb 0c 29 c2 67 2f c1 b8 df c1 56 3d 0f 90 62 53 d0 85 39 a3 75 67 82 6c 10 ff 55 9d 34 e0 4d 3a 69 c8 dd 6e 97 d1 28 ce 0c fe a6 0f 07 ff 8f 2f ce 04 ff 57 47 f5 1b fe 59 bf d7 e1 47 a5 4e 48 6d 8a db 19 5c 98 6d 0c 2e c5 84 4a ab 0d a9 42 71 53 ab 04 8e fa 8b 7c 6b c3 e4 a9 6b 14 35 bb 99 1b 29 47 b3 ad e6 66 b9 3d d2 ee 38 d3 ed b1 62 ca fe 6a 18 89 d6 d4 a2 5e 1f 88 68 b1 f6 2b ae f6 4a 17 21 c8 39 cc 45 62 bc d4 87 c8 4c 03 Data Ascii: \5.KN~8\|L^=$9$8Y\|,;immmQlE{"2l+15-2/AJU,2)g/V=bS9uglU4M:in(/WGYGNHm\m.JBqS\|kk5)Gf=8bj^h+J!9EbL
2024-10-02 10:16:40 UTC	1660	IN	Data Raw: 6d c7 9d b1 0f b0 67 73 7d 22 27 16 10 c4 a3 1a 74 c4 34 39 45 23 39 8b 59 00 ca 0d e1 20 fd 8b 34 4a f8 8c 38 ad d7 48 11 e3 91 97 a2 93 ef 85 a3 2e 39 83 f7 ff c4 74 be 48 f3 64 28 c0 64 c0 26 da 8d b0 53 dc b8 77 40 a7 2f d2 9d 02 81 3a b2 ae a7 8a 37 48 f1 75 fc bc 49 9b 48 4f 36 bd 75 d9 de 5a 32 0b 0b 28 78 e2 17 5b 36 f7 7c fb 73 4b 71 12 26 66 86 94 f1 e6 9e 1d da 87 e9 8a 76 d5 26 c9 3f 41 3e 24 f1 bf 7c c2 ac 65 d2 6e 3d e8 8f 63 7b 99 fe 00 e5 d1 e3 c4 37 21 68 2e b1 f1 e9 97 65 d8 44 f5 3e 1d 5c 3a 9a d0 21 bd 48 9c f8 fa 49 9d 97 99 ec 73 b9 47 dc f7 6b 29 45 86 50 99 5b 5c bf 67 40 9f d0 a9 e8 7b d4 3f a0 ea c7 aa 22 94 51 10 c2 1b d9 a6 bc c9 c6 15 9c ce b7 7b 3c 4b d4 e2 35 28 4a 71 aa fd 62 fa 8d 88 ae bd ac c5 cd 2c 6a fa 15 cf 6c 96 82 Data Ascii: mgs}"'t49E#9Y 4J8H.9tHd(d&Sw@/:7HuIHO6uZ2(x[6\|sKq&fv&?A>$\|en=c{7!h.eD>\:!HIsGk)EP[\g@{?"Q{<K5(Jqb,jl
2024-10-02 10:16:40 UTC	1388	IN	Data Raw: e1 4d 66 5f 13 fd fc 0a cc ce c9 d2 eb 75 55 7a ff 3e bb 0d 72 84 6d ee d3 dd 5d 8c 15 83 7b 53 d5 d6 15 20 93 89 3c 79 9b b3 48 df 08 93 37 4f ee 6d cc ba d1 9c f6 2d 4e ea dc ef 44 f6 16 a7 20 26 3a 40 02 18 df c4 98 3f ea 6e f1 bf b5 bf ed 90 9b 50 1b 16 7d 27 74 63 08 0e e7 24 e9 cf 39 29 63 31 c7 1c 0b fd 84 7d 2c b2 cf 70 2c 86 5b 46 e1 bf 8c a1 9c 77 8b a1 1b 3d 26 86 48 c0 8c b9 a0 bd 04 b8 57 ac c7 b2 a6 2f 87 3a 51 ce 31 f8 78 46 dd 5e 77 2f a9 bb ea 01 64 20 5e da 1c c5 16 01 e3 24 4d 7b 32 b9 df 8f bd 34 f9 3e bd 29 00 fa 33 f4 01 eb fb f4 a3 88 9a 69 65 26 6e 46 84 21 95 48 ec 37 04 1d ea 39 e8 16 89 aa 82 c9 c6 be 90 cf fb 42 39 bb af b0 ee 0b b5 88 89 d8 f6 05 58 63 63 75 c4 1d 01 66 e9 e3 c9 bb ad 9b b0 ba 28 bf 84 77 ee d1 dd ab 38 cd 85 Data Ascii: Mf_uUz>rm]{S <yH7Om-ND &:@?nP}'tc$9)c1},p,[Fw=&HW/:Q1xF^w/d ^$M{24>)3ie&nF!H79B9Xccuf(w8
2024-10-02 10:16:40 UTC	16384	IN	Data Raw: eb cf a5 7b fc d5 7f 82 88 f2 f2 2e 9c ed c7 d1 9b fc 38 1c 8f a2 cb ea 1c 11 0b 28 61 3f 5f 92 f5 a5 ec fd 0e d2 89 c8 57 d1 68 60 05 05 6a 59 94 8d 9e 8f c8 07 d4 6d 5e ed 22 ea 73 5d fc 1e 0f dd 4f f5 3d 33 0d 83 a4 fa 1e 96 11 80 2c 34 84 55 91 dd 3d dd 07 8b 86 90 7a 5f 33 1a d7 71 dd cb b2 50 85 a6 11 98 e2 f2 76 5e 58 25 4a 16 aa 0c e1 e4 c2 e2 ae b7 67 e9 7a a6 8b 78 57 ea 7c df 74 e9 19 c8 33 c7 a7 1d e1 d9 ce 5b e1 74 70 17 ea 4c c9 e5 f4 e5 05 c9 81 2d 87 3c 86 28 73 27 cf de d7 a7 4b 51 66 84 2c a2 cc fb 7e 8a f5 99 c1 8e 4c 97 c9 bf 23 69 c1 99 3e f6 09 f4 f6 b2 cb 89 9b 07 99 e4 2b c8 f5 15 64 6a df 02 5b 0f 97 17 62 76 c0 75 de 5e 9e 5f 74 20 8a 31 f8 98 bf 40 ed 2d 8d f5 49 f9 e2 c0 cb 76 f9 62 0a 8b 62 3c 79 d9 f8 11 7f b3 a2 24 6c e7 47 Data Ascii: {.8(a?_Wh`jYm^"s]O=3,4U=z_3qPv^X%JgzxW\|t3[tpL-<(s'KQf,~L#i>+dj[bvu^_t 1@-Ivbb<y$lG

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
28	192.168.2.16	49792	13.107.246.40	443	4912	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-02 10:16:40 UTC	600	OUT	GET /shared/edgeweb/css/2e4b955.css HTTP/1.1 Host: edgestatic.azureedge.net Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: text/css,/;q=0.1 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: style Referer: https://www.microsoft.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-10-02 10:16:40 UTC	807	IN	HTTP/1.1 200 OK Date: Wed, 02 Oct 2024 10:16:40 GMT Content-Type: text/css; charset=UTF-8 Content-Length: 302299 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Access-Control-Allow-Origin: * Cache-Control: public, max-age=31536000, immutable ETag: W/"49cdb-19245e6b591" Last-Modified: Tue, 01 Oct 2024 02:26:40 GMT Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Origin-Agent-Cluster: ?1 X-Content-Type-Options: nosniff X-Download-Options: noopen X-Frame-Options: SAMEORIGIN X-Permitted-Cross-Domain-Policies: none X-XSS-Protection: 0 x-azure-ref: 20241002T101640Z-15767c5fc55kg97hfq5uqyxxaw00000009ag00000000bbsg x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-02 10:16:40 UTC	15577	IN	Data Raw: 2e 63 6f 6d 6d 6f 6e 2d 62 61 63 6b 67 72 6f 75 6e 64 2d 69 6d 61 67 65 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 72 65 70 65 61 74 3a 6e 6f 2d 72 65 70 65 61 74 3b 62 61 63 6b 67 72 6f 75 6e 64 2d 73 69 7a 65 3a 63 6f 6e 74 61 69 6e 3b 62 6f 74 74 6f 6d 3a 30 3b 6c 65 66 74 3a 30 3b 70 6f 73 69 74 69 6f 6e 3a 61 62 73 6f 6c 75 74 65 3b 72 69 67 68 74 3a 30 3b 74 6f 70 3a 30 7d 40 6d 65 64 69 61 20 73 63 72 65 65 6e 20 61 6e 64 20 28 6d 61 78 2d 77 69 64 74 68 3a 38 31 30 70 78 29 7b 2e 63 6f 6d 6d 6f 6e 2d 62 61 63 6b 67 72 6f 75 6e 64 2d 69 6d 61 67 65 2d 2d 6d 6f 62 69 6c 65 2d 68 69 64 65 7b 64 69 73 70 6c 61 79 3a 6e 6f 6e 65 7d 7d 40 6d 65 64 69 61 20 73 63 72 65 65 6e 20 61 6e 64 20 28 6d 69 6e 2d 77 69 64 74 68 3a 38 31 30 70 78 29 7b 2e 63 6f 6d 6d 6f Data Ascii: .common-background-image{background-repeat:no-repeat;background-size:contain;bottom:0;left:0;position:absolute;right:0;top:0}@media screen and (max-width:810px){.common-background-image--mobile-hide{display:none}}@media screen and (min-width:810px){.commo
2024-10-02 10:16:41 UTC	16384	IN	Data Raw: 28 3a 6c 61 73 74 2d 63 68 69 6c 64 29 2c 2e 6d 69 6e 69 2d 62 6c 6f 63 6b 2d 74 65 78 74 2d 2d 66 69 6e 65 70 72 69 6e 74 20 75 6c 3a 6e 6f 74 28 3a 6c 61 73 74 2d 63 68 69 6c 64 29 7b 6d 61 72 67 69 6e 2d 62 6f 74 74 6f 6d 3a 2e 37 35 65 6d 7d 2e 6d 69 6e 69 2d 62 6c 6f 63 6b 2d 74 65 78 74 2d 2d 66 69 6e 65 70 72 69 6e 74 20 6c 69 3a 6e 6f 74 28 3a 6c 61 73 74 2d 63 68 69 6c 64 29 7b 6d 61 72 67 69 6e 2d 62 6f 74 74 6f 6d 3a 2e 33 37 35 65 6d 7d 2e 6d 69 6e 69 2d 62 6c 6f 63 6b 2d 74 65 78 74 2d 2d 66 69 6e 65 70 72 69 6e 74 20 70 7b 70 61 64 64 69 6e 67 3a 30 7d 2e 6d 69 6e 69 2d 62 6c 6f 63 6b 2d 74 65 78 74 2d 2d 66 69 6e 65 70 72 69 6e 74 20 70 3a 66 69 72 73 74 2d 63 68 69 6c 64 7b 6d 61 72 67 69 6e 2d 74 6f 70 3a 30 21 69 6d 70 6f 72 74 61 6e 74 Data Ascii: (:last-child),.mini-block-text--fineprint ul:not(:last-child){margin-bottom:.75em}.mini-block-text--fineprint li:not(:last-child){margin-bottom:.375em}.mini-block-text--fineprint p{padding:0}.mini-block-text--fineprint p:first-child{margin-top:0!important
2024-10-02 10:16:41 UTC	16384	IN	Data Raw: 74 6c 69 6e 65 2d 73 68 61 6b 65 2d 67 72 61 64 69 65 6e 74 2d 62 6f 72 64 65 72 2d 70 75 72 70 6c 65 3a 66 6f 63 75 73 2d 76 69 73 69 62 6c 65 2c 2e 63 6f 6d 6d 6f 6e 2d 62 75 74 74 6f 6e 2d 2d 61 74 74 65 6e 74 69 6f 6e 2d 72 75 62 62 65 72 62 61 6e 64 3a 66 6f 63 75 73 2d 76 69 73 69 62 6c 65 2c 2e 63 6f 6d 6d 6f 6e 2d 62 75 74 74 6f 6e 2d 2d 61 74 74 65 6e 74 69 6f 6e 2d 73 68 61 6b 65 2d 67 72 61 64 69 65 6e 74 2d 62 6f 72 64 65 72 2d 62 6c 75 65 3a 66 6f 63 75 73 2d 76 69 73 69 62 6c 65 2c 2e 63 6f 6d 6d 6f 6e 2d 62 75 74 74 6f 6e 2d 2d 61 74 74 65 6e 74 69 6f 6e 2d 73 68 61 6b 65 2d 67 72 61 64 69 65 6e 74 2d 62 6f 72 64 65 72 2d 62 6c 75 65 67 72 65 65 6e 3a 66 6f 63 75 73 2d 76 69 73 69 62 6c 65 2c 2e 63 6f 6d 6d 6f 6e 2d 62 75 74 74 6f 6e 2d 2d Data Ascii: tline-shake-gradient-border-purple:focus-visible,.common-button--attention-rubberband:focus-visible,.common-button--attention-shake-gradient-border-blue:focus-visible,.common-button--attention-shake-gradient-border-bluegreen:focus-visible,.common-button--
2024-10-02 10:16:41 UTC	16384	IN	Data Raw: 69 6e 2d 77 69 64 74 68 3a 36 65 6d 3b 70 61 64 64 69 6e 67 2d 69 6e 6c 69 6e 65 2d 65 6e 64 3a 31 65 6d 3b 70 61 64 64 69 6e 67 2d 69 6e 6c 69 6e 65 2d 73 74 61 72 74 3a 31 65 6d 7d 2e 63 6f 6d 6d 6f 6e 2d 62 75 74 74 6f 6e 2d 2d 62 6c 75 65 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 76 61 72 28 2d 2d 74 68 65 6d 65 2d 62 6c 75 65 29 7d 2e 63 6f 6d 6d 6f 6e 2d 62 75 74 74 6f 6e 2d 2d 62 6c 75 65 3a 68 6f 76 65 72 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 76 61 72 28 2d 2d 74 68 65 6d 65 2d 62 6c 75 65 2d 6c 69 67 68 74 65 72 29 7d 2e 63 6f 6d 6d 6f 6e 2d 62 75 74 74 6f 6e 2d 2d 62 6c 75 65 3a 61 63 74 69 76 65 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 76 61 72 28 2d 2d 74 68 65 6d 65 2d 62 6c 75 65 2d 64 61 72 6b 65 72 Data Ascii: in-width:6em;padding-inline-end:1em;padding-inline-start:1em}.common-button--blue{background-color:var(--theme-blue)}.common-button--blue:hover{background-color:var(--theme-blue-lighter)}.common-button--blue:active{background-color:var(--theme-blue-darker
2024-10-02 10:16:41 UTC	16384	IN	Data Raw: 74 6f 6e 2d 2d 64 6f 77 6e 6c 6f 61 64 2d 61 6e 64 72 6f 69 64 3a 68 6f 76 65 72 2c 2e 63 6f 6d 6d 6f 6e 2d 62 75 74 74 6f 6e 2d 2d 64 6f 77 6e 6c 6f 61 64 2d 69 6f 73 3a 68 6f 76 65 72 2c 2e 63 6f 6d 6d 6f 6e 2d 62 75 74 74 6f 6e 2d 2d 64 6f 77 6e 6c 6f 61 64 2d 6d 73 73 74 6f 72 65 3a 68 6f 76 65 72 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 33 30 33 30 33 30 7d 2e 63 6f 6d 6d 6f 6e 2d 62 75 74 74 6f 6e 2d 2d 64 6f 77 6e 6c 6f 61 64 2d 61 6e 64 72 6f 69 64 3e 73 70 61 6e 2c 2e 63 6f 6d 6d 6f 6e 2d 62 75 74 74 6f 6e 2d 2d 64 6f 77 6e 6c 6f 61 64 2d 69 6f 73 3e 73 70 61 6e 2c 2e 63 6f 6d 6d 6f 6e 2d 62 75 74 74 6f 6e 2d 2d 64 6f 77 6e 6c 6f 61 64 2d 6d 73 73 74 6f 72 65 3e 73 70 61 6e 7b 63 6c 69 70 3a 72 65 63 74 28 31 70 78 20 31 70 78 20 Data Ascii: ton--download-android:hover,.common-button--download-ios:hover,.common-button--download-msstore:hover{background-color:#303030}.common-button--download-android>span,.common-button--download-ios>span,.common-button--download-msstore>span{clip:rect(1px 1px
2024-10-02 10:16:41 UTC	16384	IN	Data Raw: 6d 6d 6f 6e 2d 62 75 74 74 6f 6e 5f 5f 63 6f 6e 74 65 6e 74 7b 74 72 61 6e 73 69 74 69 6f 6e 3a 74 72 61 6e 73 66 6f 72 6d 20 2e 34 73 20 63 75 62 69 63 2d 62 65 7a 69 65 72 28 2e 31 36 35 2c 2e 38 34 2c 2e 34 34 2c 31 29 20 30 6d 73 7d 2e 63 6f 6d 6d 6f 6e 2d 62 75 74 74 6f 6e 2d 2d 74 65 6d 70 2d 6e 65 78 74 2d 33 20 2e 63 6f 6d 6d 6f 6e 2d 62 75 74 74 6f 6e 5f 5f 63 6f 6e 74 65 6e 74 3a 61 66 74 65 72 7b 6f 70 61 63 69 74 79 3a 30 3b 70 6f 73 69 74 69 6f 6e 3a 61 62 73 6f 6c 75 74 65 3b 74 72 61 6e 73 66 6f 72 6d 3a 74 72 61 6e 73 6c 61 74 65 58 28 2d 2e 37 35 65 6d 29 3b 74 72 61 6e 73 69 74 69 6f 6e 3a 6f 70 61 63 69 74 79 20 2e 34 73 20 63 75 62 69 63 2d 62 65 7a 69 65 72 28 2e 31 36 35 2c 2e 38 34 2c 2e 34 34 2c 31 29 20 30 6d 73 2c 74 72 61 6e 73 Data Ascii: mmon-button__content{transition:transform .4s cubic-bezier(.165,.84,.44,1) 0ms}.common-button--temp-next-3 .common-button__content:after{opacity:0;position:absolute;transform:translateX(-.75em);transition:opacity .4s cubic-bezier(.165,.84,.44,1) 0ms,trans
2024-10-02 10:16:41 UTC	16384	IN	Data Raw: 6d 6d 6f 6e 2d 62 75 74 74 6f 6e 5f 5f 63 6f 6e 74 65 6e 74 7b 66 6f 6e 74 2d 73 69 7a 65 3a 2e 39 65 6d 3b 66 6f 6e 74 2d 77 65 69 67 68 74 3a 36 30 30 7d 2e 63 6f 6d 6d 6f 6e 2d 62 75 74 74 6f 6e 2d 2d 74 65 6d 70 2d 73 65 63 6f 6e 64 61 72 79 2d 39 3a 68 6f 76 65 72 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 31 35 37 61 65 39 30 64 3b 62 6f 72 64 65 72 2d 63 6f 6c 6f 72 3a 23 31 35 37 61 65 39 3b 63 6f 6c 6f 72 3a 23 31 35 37 61 65 39 7d 40 6b 65 79 66 72 61 6d 65 73 20 74 65 6d 70 2d 63 6f 6e 74 65 6e 74 2d 73 6c 69 64 65 2d 75 70 7b 30 25 7b 6f 70 61 63 69 74 79 3a 31 3b 74 72 61 6e 73 66 6f 72 6d 3a 74 72 61 6e 73 6c 61 74 65 59 28 30 29 7d 36 30 25 7b 6f 70 61 63 69 74 79 3a 30 3b 74 72 61 6e 73 66 6f 72 6d 3a 74 72 61 6e 73 6c 61 74 Data Ascii: mmon-button__content{font-size:.9em;font-weight:600}.common-button--temp-secondary-9:hover{background-color:#157ae90d;border-color:#157ae9;color:#157ae9}@keyframes temp-content-slide-up{0%{opacity:1;transform:translateY(0)}60%{opacity:0;transform:translat
2024-10-02 10:16:41 UTC	16384	IN	Data Raw: 74 6f 6d 3a 2d 32 70 78 3b 63 6f 6e 74 65 6e 74 3a 22 22 3b 64 69 73 70 6c 61 79 3a 62 6c 6f 63 6b 3b 6c 65 66 74 3a 2d 32 70 78 3b 6f 70 61 63 69 74 79 3a 30 3b 70 6f 73 69 74 69 6f 6e 3a 61 62 73 6f 6c 75 74 65 3b 72 69 67 68 74 3a 2d 32 70 78 3b 74 6f 70 3a 2d 32 70 78 3b 74 72 61 6e 73 69 74 69 6f 6e 3a 6f 70 61 63 69 74 79 20 2e 33 73 20 63 75 62 69 63 2d 62 65 7a 69 65 72 28 2e 31 36 35 2c 2e 38 34 2c 2e 34 34 2c 31 29 20 30 6d 73 7d 2e 63 6f 6d 6d 6f 6e 2d 62 75 74 74 6f 6e 2d 2d 63 6f 70 69 6c 6f 74 2d 73 6f 6c 69 64 2d 70 75 72 70 6c 65 3a 68 6f 76 65 72 3a 62 65 66 6f 72 65 7b 6f 70 61 63 69 74 79 3a 2e 30 36 7d 2e 63 6f 6d 6d 6f 6e 2d 62 75 74 74 6f 6e 2d 2d 63 6f 70 69 6c 6f 74 2d 73 6f 6c 69 64 2d 70 75 72 70 6c 65 3a 61 63 74 69 76 65 3a 62 Data Ascii: tom:-2px;content:"";display:block;left:-2px;opacity:0;position:absolute;right:-2px;top:-2px;transition:opacity .3s cubic-bezier(.165,.84,.44,1) 0ms}.common-button--copilot-solid-purple:hover:before{opacity:.06}.common-button--copilot-solid-purple:active:b
2024-10-02 10:16:41 UTC	16384	IN	Data Raw: 65 2d 6e 61 76 7b 63 75 72 73 6f 72 3a 70 6f 69 6e 74 65 72 7d 61 2e 63 6f 6d 6d 6f 6e 2d 74 61 67 3a 68 6f 76 65 72 7b 6f 70 61 63 69 74 79 3a 2e 39 7d 2e 6d 69 6e 69 2d 62 6c 6f 63 6b 2d 74 61 67 73 7b 64 69 73 70 6c 61 79 3a 66 6c 65 78 3b 66 6c 65 78 2d 77 72 61 70 3a 77 72 61 70 3b 67 61 70 3a 2e 35 65 6d 7d 2e 70 78 2d 74 72 61 6e 73 69 74 69 6f 6e 2d 65 78 70 61 6e 64 2d 65 6e 74 65 72 2d 61 63 74 69 76 65 2c 2e 70 78 2d 74 72 61 6e 73 69 74 69 6f 6e 2d 65 78 70 61 6e 64 2d 6c 65 61 76 65 2d 61 63 74 69 76 65 7b 74 72 61 6e 73 69 74 69 6f 6e 3a 68 65 69 67 68 74 20 2e 36 73 20 63 75 62 69 63 2d 62 65 7a 69 65 72 28 2e 31 36 35 2c 2e 38 34 2c 2e 34 34 2c 31 29 2c 6f 70 61 63 69 74 79 20 2e 36 73 20 63 75 62 69 63 2d 62 65 7a 69 65 72 28 2e 31 36 35 Data Ascii: e-nav{cursor:pointer}a.common-tag:hover{opacity:.9}.mini-block-tags{display:flex;flex-wrap:wrap;gap:.5em}.px-transition-expand-enter-active,.px-transition-expand-leave-active{transition:height .6s cubic-bezier(.165,.84,.44,1),opacity .6s cubic-bezier(.165
2024-10-02 10:16:41 UTC	16384	IN	Data Raw: 6c 66 3a 63 65 6e 74 65 72 3b 6d 61 78 2d 77 69 64 74 68 3a 31 30 30 25 3b 70 61 64 64 69 6e 67 2d 62 6f 74 74 6f 6d 3a 31 2e 32 35 65 6d 7d 2e 6d 65 64 69 61 2d 69 74 65 6d 2d 73 6c 69 64 65 72 5f 5f 73 65 6c 65 63 74 6f 72 2d 61 72 72 6f 77 7b 61 6c 69 67 6e 2d 73 65 6c 66 3a 66 6c 65 78 2d 73 74 61 72 74 3b 70 61 64 64 69 6e 67 3a 30 3b 70 6f 73 69 74 69 6f 6e 3a 72 65 6c 61 74 69 76 65 3b 77 69 64 74 68 3a 61 75 74 6f 7d 2e 6d 65 64 69 61 2d 69 74 65 6d 2d 73 6c 69 64 65 72 5f 5f 73 65 6c 65 63 74 6f 72 2d 61 72 72 6f 77 2d 69 63 6f 6e 7b 77 69 64 74 68 3a 35 76 77 7d 2e 6d 65 64 69 61 2d 69 74 65 6d 2d 73 6c 69 64 65 72 5f 5f 73 65 6c 65 63 74 6f 72 7b 64 69 73 70 6c 61 79 3a 66 6c 65 78 3b 67 61 70 3a 31 2e 37 35 65 6d 3b 6a 75 73 74 69 66 79 2d 73 Data Ascii: lf:center;max-width:100%;padding-bottom:1.25em}.media-item-slider__selector-arrow{align-self:flex-start;padding:0;position:relative;width:auto}.media-item-slider__selector-arrow-icon{width:5vw}.media-item-slider__selector{display:flex;gap:1.75em;justify-s

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
29	192.168.2.16	49788	13.107.246.40	443	4912	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-02 10:16:40 UTC	600	OUT	GET /shared/edgeweb/css/105d560.css HTTP/1.1 Host: edgestatic.azureedge.net Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: text/css,/;q=0.1 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: style Referer: https://www.microsoft.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-10-02 10:16:40 UTC	785	IN	HTTP/1.1 200 OK Date: Wed, 02 Oct 2024 10:16:40 GMT Content-Type: text/css; charset=UTF-8 Content-Length: 94832 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Access-Control-Allow-Origin: * Cache-Control: public, max-age=31536000, immutable ETag: W/"17270-192442de020" Last-Modified: Mon, 30 Sep 2024 18:25:10 GMT Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Origin-Agent-Cluster: ?1 X-Content-Type-Options: nosniff X-Download-Options: noopen X-Frame-Options: SAMEORIGIN X-Permitted-Cross-Domain-Policies: none X-XSS-Protection: 0 x-azure-ref: 20241002T101640Z-15767c5fc55rg5b7sh1vuv8t7n00000009r00000000077pn x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-02 10:16:40 UTC	15599	IN	Data Raw: 2e 73 65 61 72 63 68 2d 62 6f 78 5f 5f 6e 6f 72 65 73 75 6c 74 73 7b 63 6f 6c 6f 72 3a 74 68 65 6d 65 2d 76 61 72 28 70 61 67 65 2d 66 67 29 3b 64 69 73 70 6c 61 79 3a 62 6c 6f 63 6b 3b 70 61 64 64 69 6e 67 3a 31 65 6d 20 2e 37 35 65 6d 20 31 2e 31 35 65 6d 7d 2e 73 65 61 72 63 68 2d 62 6f 78 5f 5f 6e 6f 72 65 73 75 6c 74 73 20 73 70 61 6e 7b 63 6f 6c 6f 72 3a 74 68 65 6d 65 2d 76 61 72 28 6c 69 6e 6b 29 3b 6d 61 72 67 69 6e 2d 69 6e 6c 69 6e 65 2d 73 74 61 72 74 3a 2e 32 35 65 6d 7d 2e 73 65 61 72 63 68 2d 62 6f 78 5f 5f 6e 6f 72 65 73 75 6c 74 73 20 73 76 67 7b 6d 61 72 67 69 6e 2d 69 6e 6c 69 6e 65 2d 73 74 61 72 74 3a 2e 31 35 65 6d 3b 6d 61 72 67 69 6e 2d 74 6f 70 3a 2d 2e 31 65 6d 7d 2e 73 65 61 72 63 68 2d 62 6f 78 5f 5f 6e 6f 72 65 73 75 6c 74 73 Data Ascii: .search-box__noresults{color:theme-var(page-fg);display:block;padding:1em .75em 1.15em}.search-box__noresults span{color:theme-var(link);margin-inline-start:.25em}.search-box__noresults svg{margin-inline-start:.15em;margin-top:-.1em}.search-box__noresults
2024-10-02 10:16:41 UTC	16384	IN	Data Raw: 2c 5b 64 69 73 61 62 6c 65 64 5d 7b 63 75 72 73 6f 72 3a 6e 6f 74 2d 61 6c 6c 6f 77 65 64 7d 5b 61 72 69 61 2d 68 69 64 64 65 6e 3d 66 61 6c 73 65 5d 5b 68 69 64 64 65 6e 5d 7b 64 69 73 70 6c 61 79 3a 69 6e 69 74 69 61 6c 7d 5b 61 72 69 61 2d 68 69 64 64 65 6e 3d 66 61 6c 73 65 5d 5b 68 69 64 64 65 6e 5d 3a 6e 6f 74 28 3a 66 6f 63 75 73 29 7b 63 6c 69 70 3a 72 65 63 74 28 30 2c 30 2c 30 2c 30 29 3b 70 6f 73 69 74 69 6f 6e 3a 61 62 73 6f 6c 75 74 65 7d 68 74 6d 6c 7b 66 6f 6e 74 2d 73 69 7a 65 3a 63 6c 61 6d 70 28 31 34 70 78 2c 31 2e 30 35 32 36 33 31 35 37 38 39 76 77 2c 31 36 70 78 29 7d 40 6d 65 64 69 61 20 73 63 72 65 65 6e 20 61 6e 64 20 28 6d 61 78 2d 77 69 64 74 68 3a 31 33 36 36 70 78 29 7b 68 74 6d 6c 7b 66 6f 6e 74 2d 73 69 7a 65 3a 2d 31 7d 7d Data Ascii: ,[disabled]{cursor:not-allowed}[aria-hidden=false][hidden]{display:initial}[aria-hidden=false][hidden]:not(:focus){clip:rect(0,0,0,0);position:absolute}html{font-size:clamp(14px,1.0526315789vw,16px)}@media screen and (max-width:1366px){html{font-size:-1}}
2024-10-02 10:16:41 UTC	16384	IN	Data Raw: 30 7d 2e 65 75 6c 61 2d 64 6f 77 6e 6c 6f 61 64 2d 73 65 63 74 69 6f 6e 5f 5f 62 61 63 6b 7b 61 70 70 65 61 72 61 6e 63 65 3a 6e 6f 6e 65 3b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 30 30 30 30 3b 62 6f 72 64 65 72 3a 6e 6f 6e 65 3b 62 6f 78 2d 73 69 7a 69 6e 67 3a 62 6f 72 64 65 72 2d 62 6f 78 3b 63 75 72 73 6f 72 3a 70 6f 69 6e 74 65 72 3b 66 6f 6e 74 2d 73 69 7a 65 3a 69 6e 68 65 72 69 74 3b 6d 61 72 67 69 6e 2d 74 6f 70 3a 2e 37 35 65 6d 3b 6f 75 74 6c 69 6e 65 3a 6e 6f 6e 65 3b 70 6f 73 69 74 69 6f 6e 3a 72 65 6c 61 74 69 76 65 3b 77 68 69 74 65 2d 73 70 61 63 65 3a 6e 6f 77 72 61 70 7d 2e 65 75 6c 61 2d 64 6f 77 6e 6c 6f 61 64 2d 73 65 63 74 69 6f 6e 5f 5f 62 61 63 6b 20 73 76 67 7b 6d 61 72 67 69 6e 2d 72 69 67 68 74 3a 2e 35 65 6d 7d Data Ascii: 0}.eula-download-section__back{appearance:none;background-color:#0000;border:none;box-sizing:border-box;cursor:pointer;font-size:inherit;margin-top:.75em;outline:none;position:relative;white-space:nowrap}.eula-download-section__back svg{margin-right:.5em}
2024-10-02 10:16:41 UTC	16384	IN	Data Raw: 2d 69 74 65 6d 73 3a 63 65 6e 74 65 72 3b 63 6f 6c 6f 72 3a 76 61 72 28 2d 2d 74 68 65 6d 65 2d 70 61 67 65 2d 66 67 29 3b 64 69 73 70 6c 61 79 3a 66 6c 65 78 3b 66 6c 65 78 2d 64 69 72 65 63 74 69 6f 6e 3a 63 6f 6c 75 6d 6e 3b 6a 75 73 74 69 66 79 2d 63 6f 6e 74 65 6e 74 3a 63 65 6e 74 65 72 3b 6f 76 65 72 66 6c 6f 77 3a 68 69 64 64 65 6e 3b 70 6f 73 69 74 69 6f 6e 3a 72 65 6c 61 74 69 76 65 3b 77 69 64 74 68 3a 31 30 30 25 7d 2e 62 6c 6f 63 6b 2d 65 6d 62 65 64 2d 7a 6f 6f 6d 2d 68 65 72 6f 5f 5f 62 67 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 70 6f 73 69 74 69 6f 6e 3a 35 30 25 3b 62 61 63 6b 67 72 6f 75 6e 64 2d 72 65 70 65 61 74 3a 6e 6f 2d 72 65 70 65 61 74 3b 62 61 63 6b 67 72 6f 75 6e 64 2d 73 69 7a 65 3a 63 6f 76 65 72 7d 2e 62 6c 6f 63 6b 2d 65 6d 62 Data Ascii: -items:center;color:var(--theme-page-fg);display:flex;flex-direction:column;justify-content:center;overflow:hidden;position:relative;width:100%}.block-embed-zoom-hero__bg{background-position:50%;background-repeat:no-repeat;background-size:cover}.block-emb
2024-10-02 10:16:41 UTC	16384	IN	Data Raw: 2d 74 68 65 6d 65 2d 70 61 67 65 2d 66 67 2d 72 67 62 29 2c 2e 31 35 29 3b 62 6f 78 2d 73 68 61 64 6f 77 3a 30 20 34 70 78 20 35 2e 35 70 78 20 2d 31 2e 35 70 78 20 72 67 62 61 28 30 2c 30 2c 30 2c 2e 30 34 38 29 2c 30 20 39 70 78 20 31 33 2e 35 70 78 20 30 20 72 67 62 61 28 30 2c 30 2c 30 2c 2e 30 31 33 29 2c 30 20 33 70 78 20 31 37 2e 35 70 78 20 30 20 72 67 62 61 28 30 2c 30 2c 30 2c 2e 30 31 36 29 7d 2e 65 6d 62 65 64 2d 73 65 61 72 63 68 2d 61 64 76 61 6e 63 65 64 2d 2d 65 78 70 30 32 20 66 6f 72 6d 3a 66 6f 63 75 73 2d 77 69 74 68 69 6e 3a 62 65 66 6f 72 65 7b 6f 75 74 6c 69 6e 65 2d 63 6f 6c 6f 72 3a 72 67 62 61 28 76 61 72 28 2d 2d 74 68 65 6d 65 2d 6d 65 64 62 6c 75 65 2d 72 67 62 29 2c 2e 35 29 7d 2e 65 6d 62 65 64 2d 73 65 61 72 63 68 2d 61 64 Data Ascii: -theme-page-fg-rgb),.15);box-shadow:0 4px 5.5px -1.5px rgba(0,0,0,.048),0 9px 13.5px 0 rgba(0,0,0,.013),0 3px 17.5px 0 rgba(0,0,0,.016)}.embed-search-advanced--exp02 form:focus-within:before{outline-color:rgba(var(--theme-medblue-rgb),.5)}.embed-search-ad
2024-10-02 10:16:41 UTC	13697	IN	Data Raw: 3a 6e 6f 6e 65 7d 40 6d 65 64 69 61 20 73 63 72 65 65 6e 20 61 6e 64 20 28 6d 61 78 2d 77 69 64 74 68 3a 38 31 30 70 78 29 7b 2e 73 68 6f 70 70 69 6e 67 2d 73 6c 69 64 65 73 2d 64 65 61 6c 2d 67 72 69 64 7b 66 69 6c 74 65 72 6e 3a 6e 6f 6e 65 3b 70 61 64 64 69 6e 67 3a 30 7d 2e 73 68 6f 70 70 69 6e 67 2d 73 6c 69 64 65 73 2d 64 65 61 6c 2d 67 72 69 64 5f 5f 67 72 69 64 7b 64 69 73 70 6c 61 79 3a 6e 6f 6e 65 7d 2e 73 68 6f 70 70 69 6e 67 2d 73 6c 69 64 65 73 2d 64 65 61 6c 2d 67 72 69 64 5f 5f 6d 6f 62 69 6c 65 2d 67 72 69 64 7b 64 69 73 70 6c 61 79 3a 66 6c 65 78 3b 66 6c 65 78 2d 64 69 72 65 63 74 69 6f 6e 3a 63 6f 6c 75 6d 6e 3b 67 61 70 3a 31 30 70 78 7d 7d 2e 65 6d 62 65 64 2d 64 65 61 6c 73 7b 66 6f 6e 74 2d 73 69 7a 65 3a 63 6c 61 6d 70 28 31 34 70 Data Ascii: :none}@media screen and (max-width:810px){.shopping-slides-deal-grid{filtern:none;padding:0}.shopping-slides-deal-grid__grid{display:none}.shopping-slides-deal-grid__mobile-grid{display:flex;flex-direction:column;gap:10px}}.embed-deals{font-size:clamp(14p

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
30	192.168.2.16	49793	13.107.246.40	443	4912	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-02 10:16:40 UTC	600	OUT	GET /shared/edgeweb/css/16d7f8e.css HTTP/1.1 Host: edgestatic.azureedge.net Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: text/css,/;q=0.1 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: style Referer: https://www.microsoft.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-10-02 10:16:40 UTC	783	IN	HTTP/1.1 200 OK Date: Wed, 02 Oct 2024 10:16:40 GMT Content-Type: text/css; charset=UTF-8 Content-Length: 7004 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Access-Control-Allow-Origin: * Cache-Control: public, max-age=31536000, immutable ETag: W/"1b5c-192442e2a5c" Last-Modified: Mon, 30 Sep 2024 18:25:29 GMT Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Origin-Agent-Cluster: ?1 X-Content-Type-Options: nosniff X-Download-Options: noopen X-Frame-Options: SAMEORIGIN X-Permitted-Cross-Domain-Policies: none X-XSS-Protection: 0 x-azure-ref: 20241002T101640Z-15767c5fc55gq5fmm10nm5qqr800000009k0000000003hqs x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-02 10:16:40 UTC	7004	IN	Data Raw: 3a 72 6f 6f 74 7b 2d 2d 62 72 65 61 6b 70 6f 69 6e 74 2d 6e 61 6d 65 73 3a 78 6c 20 6c 67 20 6d 64 20 73 6d 20 6d 6f 62 69 6c 65 20 78 73 3b 2d 2d 62 72 65 61 6b 70 6f 69 6e 74 2d 73 69 7a 65 73 3a 31 39 32 30 70 78 20 31 36 30 30 70 78 20 31 33 36 36 70 78 20 31 30 32 34 70 78 20 38 31 30 70 78 20 36 34 30 70 78 7d 40 6d 65 64 69 61 20 73 63 72 65 65 6e 20 61 6e 64 20 28 6d 61 78 2d 77 69 64 74 68 3a 31 39 32 30 70 78 29 7b 3a 72 6f 6f 74 7b 2d 2d 62 72 65 61 6b 70 6f 69 6e 74 3a 78 6c 3b 2d 2d 62 72 65 61 6b 70 6f 69 6e 74 2d 73 74 72 3a 22 78 6c 22 3b 2d 2d 62 72 65 61 6b 70 6f 69 6e 74 2d 77 69 64 74 68 3a 31 39 32 30 70 78 3b 2d 2d 69 73 2d 6d 6f 62 69 6c 65 3a 66 61 6c 73 65 7d 7d 40 6d 65 64 69 61 20 73 63 72 65 65 6e 20 61 6e 64 20 28 6d 61 78 2d Data Ascii: :root{--breakpoint-names:xl lg md sm mobile xs;--breakpoint-sizes:1920px 1600px 1366px 1024px 810px 640px}@media screen and (max-width:1920px){:root{--breakpoint:xl;--breakpoint-str:"xl";--breakpoint-width:1920px;--is-mobile:false}}@media screen and (max-

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
31	192.168.2.16	49790	13.107.246.40	443	4912	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-02 10:16:40 UTC	600	OUT	GET /shared/edgeweb/css/ec09bb6.css HTTP/1.1 Host: edgestatic.azureedge.net Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: text/css,/;q=0.1 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: style Referer: https://www.microsoft.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-10-02 10:16:40 UTC	784	IN	HTTP/1.1 200 OK Date: Wed, 02 Oct 2024 10:16:40 GMT Content-Type: text/css; charset=UTF-8 Content-Length: 19621 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Access-Control-Allow-Origin: * Cache-Control: public, max-age=31536000, immutable ETag: W/"4ca5-19245e6b998" Last-Modified: Tue, 01 Oct 2024 02:26:41 GMT Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Origin-Agent-Cluster: ?1 X-Content-Type-Options: nosniff X-Download-Options: noopen X-Frame-Options: SAMEORIGIN X-Permitted-Cross-Domain-Policies: none X-XSS-Protection: 0 x-azure-ref: 20241002T101640Z-15767c5fc55xgp8c992y5v5w1800000009mg000000000e04 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-02 10:16:40 UTC	15600	IN	Data Raw: 2e 63 6d 73 2d 62 75 74 74 6f 6e 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 63 63 32 39 32 62 3b 62 6f 74 74 6f 6d 3a 30 3b 63 6f 6c 6f 72 3a 23 66 66 66 3b 63 75 72 73 6f 72 3a 70 6f 69 6e 74 65 72 3b 68 65 69 67 68 74 3a 33 30 70 78 3b 70 61 64 64 69 6e 67 3a 35 70 78 20 33 36 70 78 20 35 70 78 20 38 70 78 3b 70 6f 73 69 74 69 6f 6e 3a 66 69 78 65 64 3b 72 69 67 68 74 3a 30 3b 7a 2d 69 6e 64 65 78 3a 39 39 39 39 7d 2e 63 6d 73 2d 62 75 74 74 6f 6e 20 2e 63 6d 73 2d 62 75 74 74 6f 6e 2d 73 61 76 65 64 7b 66 6f 6e 74 2d 73 69 7a 65 3a 2e 37 65 6d 3b 70 6f 73 69 74 69 6f 6e 3a 72 65 6c 61 74 69 76 65 3b 74 6f 70 3a 2d 32 70 78 7d 2e 63 6d 73 2d 62 75 74 74 6f 6e 20 2e 63 6d 73 2d 62 75 74 74 6f 6e 2d 63 6c 6f 73 65 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c Data Ascii: .cms-button{background:#cc292b;bottom:0;color:#fff;cursor:pointer;height:30px;padding:5px 36px 5px 8px;position:fixed;right:0;z-index:9999}.cms-button .cms-button-saved{font-size:.7em;position:relative;top:-2px}.cms-button .cms-button-close{background-col
2024-10-02 10:16:41 UTC	4021	IN	Data Raw: 5b 61 72 69 61 2d 63 6f 6e 74 72 6f 6c 73 5d 7b 63 75 72 73 6f 72 3a 70 6f 69 6e 74 65 72 7d 5b 61 72 69 61 2d 64 69 73 61 62 6c 65 64 3d 74 72 75 65 5d 2c 5b 64 69 73 61 62 6c 65 64 5d 7b 63 75 72 73 6f 72 3a 6e 6f 74 2d 61 6c 6c 6f 77 65 64 7d 5b 61 72 69 61 2d 68 69 64 64 65 6e 3d 66 61 6c 73 65 5d 5b 68 69 64 64 65 6e 5d 7b 64 69 73 70 6c 61 79 3a 69 6e 69 74 69 61 6c 7d 5b 61 72 69 61 2d 68 69 64 64 65 6e 3d 66 61 6c 73 65 5d 5b 68 69 64 64 65 6e 5d 3a 6e 6f 74 28 3a 66 6f 63 75 73 29 7b 63 6c 69 70 3a 72 65 63 74 28 30 2c 30 2c 30 2c 30 29 3b 70 6f 73 69 74 69 6f 6e 3a 61 62 73 6f 6c 75 74 65 7d 68 74 6d 6c 7b 66 6f 6e 74 2d 73 69 7a 65 3a 63 6c 61 6d 70 28 31 34 70 78 2c 31 2e 30 35 32 36 33 31 35 37 38 39 76 77 2c 31 36 70 78 29 7d 40 6d 65 64 69 Data Ascii: [aria-controls]{cursor:pointer}[aria-disabled=true],[disabled]{cursor:not-allowed}[aria-hidden=false][hidden]{display:initial}[aria-hidden=false][hidden]:not(:focus){clip:rect(0,0,0,0);position:absolute}html{font-size:clamp(14px,1.0526315789vw,16px)}@medi

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
32	192.168.2.16	49791	13.107.246.40	443	4912	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-02 10:16:40 UTC	600	OUT	GET /shared/edgeweb/css/659e497.css HTTP/1.1 Host: edgestatic.azureedge.net Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: text/css,/;q=0.1 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: style Referer: https://www.microsoft.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-10-02 10:16:40 UTC	689	IN	HTTP/1.1 200 OK Date: Wed, 02 Oct 2024 10:16:40 GMT Content-Type: text/css; charset=UTF-8 Content-Length: 510 Connection: close Access-Control-Allow-Origin: * Cache-Control: public, max-age=31536000, immutable ETag: W/"1fe-191e2824c02" Last-Modified: Wed, 11 Sep 2024 19:14:35 GMT Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Origin-Agent-Cluster: ?1 X-Content-Type-Options: nosniff X-Download-Options: noopen X-Frame-Options: SAMEORIGIN X-Permitted-Cross-Domain-Policies: none X-XSS-Protection: 0 x-azure-ref: 20241002T101640Z-15767c5fc55lghvzbxktxfqntw00000008y000000000dqb0 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-02 10:16:40 UTC	510	IN	Data Raw: 2e 65 75 6c 61 2d 70 6f 70 75 70 5f 5f 64 69 61 6c 6f 67 20 2e 61 70 70 2d 70 6f 70 75 70 2d 6c 61 79 6f 75 74 20 2e 61 70 70 2d 70 6f 70 75 70 2d 67 72 61 70 68 69 63 2d 69 6d 61 67 65 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 70 6f 73 69 74 69 6f 6e 3a 35 30 25 7d 62 6f 64 79 2e 73 6c 69 64 65 73 7b 6f 76 65 72 66 6c 6f 77 2d 78 3a 68 69 64 64 65 6e 21 69 6d 70 6f 72 74 61 6e 74 3b 77 69 64 74 68 3a 31 30 30 25 21 69 6d 70 6f 72 74 61 6e 74 7d 62 6f 64 79 2e 73 6c 69 64 65 73 20 2e 73 6c 69 64 65 73 2d 70 61 67 65 7b 68 65 69 67 68 74 3a 31 30 30 76 68 3b 6c 65 66 74 3a 30 3b 70 6f 73 69 74 69 6f 6e 3a 66 69 78 65 64 3b 74 6f 70 3a 30 3b 77 69 64 74 68 3a 31 30 30 76 77 7d 40 6d 65 64 69 61 20 73 63 72 65 65 6e 20 61 6e 64 20 28 6d 61 78 2d 77 69 64 74 68 3a Data Ascii: .eula-popup__dialog .app-popup-layout .app-popup-graphic-image{background-position:50%}body.slides{overflow-x:hidden!important;width:100%!important}body.slides .slides-page{height:100vh;left:0;position:fixed;top:0;width:100vw}@media screen and (max-width:

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
33	192.168.2.16	49789	13.107.246.40	443	4912	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-02 10:16:40 UTC	600	OUT	GET /shared/edgeweb/css/287b8b9.css HTTP/1.1 Host: edgestatic.azureedge.net Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: text/css,/;q=0.1 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: style Referer: https://www.microsoft.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-10-02 10:16:40 UTC	783	IN	HTTP/1.1 200 OK Date: Wed, 02 Oct 2024 10:16:40 GMT Content-Type: text/css; charset=UTF-8 Content-Length: 6424 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Access-Control-Allow-Origin: * Cache-Control: public, max-age=31536000, immutable ETag: W/"1918-191e2824bd3" Last-Modified: Wed, 11 Sep 2024 19:14:35 GMT Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Origin-Agent-Cluster: ?1 X-Content-Type-Options: nosniff X-Download-Options: noopen X-Frame-Options: SAMEORIGIN X-Permitted-Cross-Domain-Policies: none X-XSS-Protection: 0 x-azure-ref: 20241002T101640Z-15767c5fc55tsfp92w7yna557w000000099g00000000ckz0 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-02 10:16:40 UTC	6424	IN	Data Raw: 2e 73 6c 69 64 65 2d 67 72 69 64 7b 77 69 64 74 68 3a 31 30 30 25 7d 2e 73 6c 69 64 65 2d 67 72 69 64 5f 5f 67 72 69 64 7b 64 69 73 70 6c 61 79 3a 67 72 69 64 3b 67 72 69 64 2d 74 65 6d 70 6c 61 74 65 2d 61 72 65 61 73 3a 22 6c 65 66 74 2d 73 74 61 72 74 20 6c 65 66 74 20 6c 65 66 74 2d 65 6e 64 20 72 69 67 68 74 2d 73 74 61 72 74 20 72 69 67 68 74 20 72 69 67 68 74 2d 65 6e 64 22 3b 67 72 69 64 2d 74 65 6d 70 6c 61 74 65 2d 63 6f 6c 75 6d 6e 73 3a 31 66 72 20 76 61 72 28 2d 2d 73 6c 69 64 65 2d 67 72 69 64 2d 6c 65 66 74 29 20 31 66 72 20 31 66 72 20 76 61 72 28 2d 2d 73 6c 69 64 65 2d 67 72 69 64 2d 72 69 67 68 74 29 20 31 66 72 3b 67 72 69 64 2d 74 65 6d 70 6c 61 74 65 2d 72 6f 77 73 3a 31 30 30 25 3b 77 69 64 74 68 3a 31 30 30 25 7d 2e 73 6c 69 64 65 Data Ascii: .slide-grid{width:100%}.slide-grid__grid{display:grid;grid-template-areas:"left-start left left-end right-start right right-end";grid-template-columns:1fr var(--slide-grid-left) 1fr 1fr var(--slide-grid-right) 1fr;grid-template-rows:100%;width:100%}.slide

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
34	192.168.2.16	49796	13.107.246.40	443	4912	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-02 10:16:41 UTC	600	OUT	GET /shared/edgeweb/css/859decd.css HTTP/1.1 Host: edgestatic.azureedge.net Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: text/css,/;q=0.1 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: style Referer: https://www.microsoft.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-10-02 10:16:41 UTC	807	IN	HTTP/1.1 200 OK Date: Wed, 02 Oct 2024 10:16:41 GMT Content-Type: text/css; charset=UTF-8 Content-Length: 154293 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Access-Control-Allow-Origin: * Cache-Control: public, max-age=31536000, immutable ETag: W/"25ab5-19245e6b979" Last-Modified: Tue, 01 Oct 2024 02:26:41 GMT Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Origin-Agent-Cluster: ?1 X-Content-Type-Options: nosniff X-Download-Options: noopen X-Frame-Options: SAMEORIGIN X-Permitted-Cross-Domain-Policies: none X-XSS-Protection: 0 x-azure-ref: 20241002T101641Z-15767c5fc55d6fcl6x6bw8cpdc000000097000000000amda x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-02 10:16:41 UTC	15577	IN	Data Raw: 2e 70 78 2d 73 6c 69 64 65 73 2d 74 72 61 6e 73 69 74 69 6f 6e 7b 68 65 69 67 68 74 3a 31 30 30 25 3b 6f 70 61 63 69 74 79 3a 30 3b 77 69 64 74 68 3a 31 30 30 25 7d 2e 70 78 2d 73 6c 69 64 65 73 7b 2d 77 65 62 6b 69 74 2d 74 6f 75 63 68 2d 63 61 6c 6c 6f 75 74 3a 6e 6f 6e 65 3b 64 69 73 70 6c 61 79 3a 67 72 69 64 3b 67 72 69 64 2d 74 65 6d 70 6c 61 74 65 2d 61 72 65 61 73 3a 22 63 6f 6e 74 65 6e 74 22 3b 67 72 69 64 2d 74 65 6d 70 6c 61 74 65 2d 63 6f 6c 75 6d 6e 73 3a 6d 69 6e 6d 61 78 28 30 2c 31 66 72 29 3b 67 72 69 64 2d 74 65 6d 70 6c 61 74 65 2d 72 6f 77 73 3a 6d 69 6e 6d 61 78 28 30 2c 31 66 72 29 3b 2d 77 65 62 6b 69 74 2d 74 72 61 6e 73 66 6f 72 6d 2d 73 74 79 6c 65 3a 70 72 65 73 65 72 76 65 2d 33 64 3b 2d 77 65 62 6b 69 74 2d 75 73 65 72 2d 73 Data Ascii: .px-slides-transition{height:100%;opacity:0;width:100%}.px-slides{-webkit-touch-callout:none;display:grid;grid-template-areas:"content";grid-template-columns:minmax(0,1fr);grid-template-rows:minmax(0,1fr);-webkit-transform-style:preserve-3d;-webkit-user-s
2024-10-02 10:16:41 UTC	16384	IN	Data Raw: 68 74 3a 31 30 30 25 3b 74 72 61 6e 73 69 74 69 6f 6e 3a 63 6f 6c 6f 72 20 2e 34 73 20 63 75 62 69 63 2d 62 65 7a 69 65 72 28 2e 31 36 35 2c 2e 38 34 2c 2e 34 34 2c 31 29 20 30 6d 73 3b 77 69 64 74 68 3a 31 30 30 25 7d 2e 73 6c 69 64 65 2d 6d 69 6e 69 2d 62 6c 6f 63 6b 73 5f 5f 63 6f 6e 74 65 6e 74 2d 62 6c 6f 63 6b 73 7b 64 69 73 70 6c 61 79 3a 67 72 69 64 3b 67 72 69 64 2d 61 72 65 61 3a 31 2f 31 3b 67 72 69 64 2d 74 65 6d 70 6c 61 74 65 2d 63 6f 6c 75 6d 6e 73 3a 31 66 72 3b 67 72 69 64 2d 74 65 6d 70 6c 61 74 65 2d 72 6f 77 73 3a 6d 69 6e 6d 61 78 28 30 2c 61 75 74 6f 29 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 31 30 30 25 3b 70 6f 73 69 74 69 6f 6e 3a 72 65 6c 61 74 69 76 65 7d 2e 73 6c 69 64 65 2d 6d 69 6e 69 2d 62 6c 6f 63 6b 73 5f 5f 6d 69 6e 69 2d 62 Data Ascii: ht:100%;transition:color .4s cubic-bezier(.165,.84,.44,1) 0ms;width:100%}.slide-mini-blocks__content-blocks{display:grid;grid-area:1/1;grid-template-columns:1fr;grid-template-rows:minmax(0,auto);min-height:100%;position:relative}.slide-mini-blocks__mini-b
2024-10-02 10:16:41 UTC	16384	IN	Data Raw: 2d 73 65 6c 65 63 74 65 64 2c 2e 73 6c 69 64 65 2d 6e 61 76 2d 2d 6e 75 6d 62 65 72 65 64 2d 65 78 70 61 6e 64 20 2e 73 6c 69 64 65 2d 6e 61 76 5f 5f 6e 61 76 2d 69 74 65 6d 2d 2d 6e 61 76 20 2e 73 6c 69 64 65 2d 6e 61 76 5f 5f 6e 61 76 2d 69 74 65 6d 2d 6e 65 77 2d 2d 73 65 6c 65 63 74 65 64 7b 6d 61 78 2d 77 69 64 74 68 3a 32 30 65 6d 3b 6f 70 61 63 69 74 79 3a 31 7d 2e 73 6c 69 64 65 2d 6e 61 76 2d 2d 6e 75 6d 62 65 72 65 64 2d 65 78 70 61 6e 64 20 2e 73 6c 69 64 65 2d 6e 61 76 5f 5f 73 65 6c 65 63 74 69 6f 6e 2d 62 61 72 7b 64 69 73 70 6c 61 79 3a 6e 6f 6e 65 21 69 6d 70 6f 72 74 61 6e 74 7d 2e 73 6c 69 64 65 2d 69 6e 74 72 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 72 67 62 61 28 76 61 72 28 2d 2d 74 68 65 6d 65 2d 70 61 67 65 2d 62 67 Data Ascii: -selected,.slide-nav--numbered-expand .slide-nav__nav-item--nav .slide-nav__nav-item-new--selected{max-width:20em;opacity:1}.slide-nav--numbered-expand .slide-nav__selection-bar{display:none!important}.slide-intro{background-color:rgba(var(--theme-page-bg
2024-10-02 10:16:41 UTC	16384	IN	Data Raw: 74 68 65 6d 65 2d 62 72 69 67 68 74 62 6c 75 65 3a 23 30 30 38 64 66 66 3b 2d 2d 74 68 65 6d 65 2d 62 72 69 67 68 74 62 6c 75 65 2d 72 67 62 3a 30 2c 31 34 31 2c 32 35 35 3b 2d 2d 74 68 65 6d 65 2d 62 72 69 67 68 74 62 6c 75 65 2d 6c 69 67 68 74 65 72 3a 23 33 33 61 34 66 66 3b 2d 2d 74 68 65 6d 65 2d 62 72 69 67 68 74 62 6c 75 65 2d 64 61 72 6b 65 72 3a 23 30 30 37 31 63 63 3b 2d 2d 74 68 65 6d 65 2d 64 61 72 6b 62 6c 75 65 3a 23 32 36 33 34 38 33 3b 2d 2d 74 68 65 6d 65 2d 64 61 72 6b 62 6c 75 65 2d 72 67 62 3a 33 38 2c 35 32 2c 31 33 31 3b 2d 2d 74 68 65 6d 65 2d 64 61 72 6b 62 6c 75 65 2d 6c 69 67 68 74 65 72 3a 23 33 31 34 34 61 62 3b 2d 2d 74 68 65 6d 65 2d 64 61 72 6b 62 6c 75 65 2d 64 61 72 6b 65 72 3a 23 31 62 32 34 35 62 3b 2d 2d 74 68 65 6d 65 Data Ascii: theme-brightblue:#008dff;--theme-brightblue-rgb:0,141,255;--theme-brightblue-lighter:#33a4ff;--theme-brightblue-darker:#0071cc;--theme-darkblue:#263483;--theme-darkblue-rgb:38,52,131;--theme-darkblue-lighter:#3144ab;--theme-darkblue-darker:#1b245b;--theme
2024-10-02 10:16:42 UTC	16384	IN	Data Raw: 23 66 66 66 3b 2d 2d 74 68 65 6d 65 2d 73 65 63 74 69 6f 6e 2d 62 67 2d 6c 69 67 68 74 62 6c 75 65 2d 64 61 72 6b 65 72 3a 23 62 64 65 30 66 66 3b 2d 2d 74 68 65 6d 65 2d 73 65 63 74 69 6f 6e 2d 62 67 2d 6c 69 67 68 74 67 72 61 64 3a 6c 69 6e 65 61 72 2d 67 72 61 64 69 65 6e 74 28 31 30 33 64 65 67 2c 23 66 35 66 36 66 66 20 31 30 25 2c 23 64 66 66 34 66 62 29 3b 2d 2d 74 68 65 6d 65 2d 65 6d 2d 67 72 61 64 69 65 6e 74 3a 6c 69 6e 65 61 72 2d 67 72 61 64 69 65 6e 74 28 39 30 64 65 67 2c 23 37 32 30 39 64 34 2c 23 32 38 33 32 64 34 20 33 33 25 2c 23 30 30 61 35 62 32 29 3b 2d 2d 74 68 65 6d 65 2d 65 6d 2d 67 72 61 64 69 65 6e 74 2d 70 69 6e 6b 3a 6c 69 6e 65 61 72 2d 67 72 61 64 69 65 6e 74 28 39 30 64 65 67 2c 23 65 64 37 30 37 37 2c 23 39 61 33 34 65 37 Data Ascii: #fff;--theme-section-bg-lightblue-darker:#bde0ff;--theme-section-bg-lightgrad:linear-gradient(103deg,#f5f6ff 10%,#dff4fb);--theme-em-gradient:linear-gradient(90deg,#7209d4,#2832d4 33%,#00a5b2);--theme-em-gradient-pink:linear-gradient(90deg,#ed7077,#9a34e7
2024-10-02 10:16:42 UTC	16384	IN	Data Raw: 2e 35 70 78 20 2d 33 70 78 20 23 30 30 30 30 30 30 31 63 2c 30 20 31 38 2e 35 70 78 20 32 38 2e 35 70 78 20 30 20 72 67 62 61 28 30 2c 30 2c 30 2c 2e 30 33 37 29 2c 30 20 37 70 78 20 33 37 2e 35 70 78 20 30 20 72 67 62 61 28 30 2c 30 2c 30 2c 2e 30 32 39 29 7d 2e 62 6c 6f 63 6b 2d 63 61 72 64 2d 6c 69 73 74 2d 63 61 72 64 2d 2d 68 69 67 68 6c 69 67 68 74 2d 6e 65 78 74 2d 67 72 65 65 6e 3a 6e 6f 74 28 2e 62 6c 6f 63 6b 2d 63 61 72 64 2d 6c 69 73 74 2d 63 61 72 64 2d 2d 65 6e 61 62 6c 65 64 29 20 2e 62 6c 6f 63 6b 2d 63 61 72 64 2d 6c 69 73 74 2d 63 61 72 64 5f 5f 67 72 69 64 7b 6f 70 61 63 69 74 79 3a 2e 35 7d 2e 62 6c 6f 63 6b 2d 63 61 72 64 2d 6c 69 73 74 2d 63 61 72 64 2d 2d 68 69 67 68 6c 69 67 68 74 2d 6e 65 78 74 2d 62 6c 75 65 7b 74 72 61 6e 73 69 Data Ascii: .5px -3px #0000001c,0 18.5px 28.5px 0 rgba(0,0,0,.037),0 7px 37.5px 0 rgba(0,0,0,.029)}.block-card-list-card--highlight-next-green:not(.block-card-list-card--enabled) .block-card-list-card__grid{opacity:.5}.block-card-list-card--highlight-next-blue{transi
2024-10-02 10:16:42 UTC	16384	IN	Data Raw: 74 65 72 3b 66 6c 65 78 2d 64 69 72 65 63 74 69 6f 6e 3a 72 6f 77 2d 72 65 76 65 72 73 65 3b 67 61 70 3a 2e 37 35 65 6d 3b 6a 75 73 74 69 66 79 2d 63 6f 6e 74 65 6e 74 3a 73 70 61 63 65 2d 62 65 74 77 65 65 6e 3b 6a 75 73 74 69 66 79 2d 63 6f 6e 74 65 6e 74 3a 66 6c 65 78 2d 65 6e 64 3b 6d 61 72 67 69 6e 2d 74 6f 70 3a 2d 2e 35 65 6d 3b 70 61 64 64 69 6e 67 3a 30 3b 77 69 64 74 68 3a 31 30 30 25 7d 2e 74 69 70 2d 63 61 72 64 2d 2d 73 69 7a 65 2d 64 69 61 6c 6f 67 20 2e 74 69 70 2d 63 61 72 64 5f 5f 6d 65 74 61 3e 2a 7b 6d 61 72 67 69 6e 2d 62 6f 74 74 6f 6d 3a 30 7d 2e 74 69 70 2d 63 61 72 64 2d 2d 73 69 7a 65 2d 64 69 61 6c 6f 67 20 2e 74 69 70 2d 63 61 72 64 5f 5f 69 63 6f 6e 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 70 6f 73 69 74 69 6f 6e 3a 30 3b 66 6c 65 Data Ascii: ter;flex-direction:row-reverse;gap:.75em;justify-content:space-between;justify-content:flex-end;margin-top:-.5em;padding:0;width:100%}.tip-card--size-dialog .tip-card__meta>*{margin-bottom:0}.tip-card--size-dialog .tip-card__icon{background-position:0;fle
2024-10-02 10:16:42 UTC	16384	IN	Data Raw: 72 74 69 63 61 6c 3b 64 69 73 70 6c 61 79 3a 2d 77 65 62 6b 69 74 2d 62 6f 78 3b 66 6f 6e 74 2d 73 69 7a 65 3a 63 6c 61 6d 70 28 31 39 70 78 2c 31 2e 35 37 38 39 34 37 33 36 38 34 76 77 2c 32 34 70 78 29 3b 66 6f 6e 74 2d 77 65 69 67 68 74 3a 36 30 30 3b 6f 76 65 72 66 6c 6f 77 3a 68 69 64 64 65 6e 7d 2e 6d 69 6e 69 2d 63 61 72 64 5f 5f 64 65 73 63 72 69 70 74 69 6f 6e 7b 68 65 69 67 68 74 3a 61 75 74 6f 3b 6c 69 6e 65 2d 68 65 69 67 68 74 3a 31 2e 34 3b 77 69 64 74 68 3a 31 30 30 25 7d 2e 6d 69 6e 69 2d 63 61 72 64 5f 5f 6c 61 62 65 6c 7b 63 6f 6c 6f 72 3a 76 61 72 28 2d 2d 74 68 65 6d 65 2d 6c 69 6e 6b 29 7d 2e 6d 69 6e 69 2d 63 61 72 64 5f 5f 69 63 6f 6e 7b 6d 61 72 67 69 6e 2d 69 6e 6c 69 6e 65 2d 73 74 61 72 74 3a 2e 32 35 65 6d 3b 6d 61 72 67 69 6e Data Ascii: rtical;display:-webkit-box;font-size:clamp(19px,1.5789473684vw,24px);font-weight:600;overflow:hidden}.mini-card__description{height:auto;line-height:1.4;width:100%}.mini-card__label{color:var(--theme-link)}.mini-card__icon{margin-inline-start:.25em;margin
2024-10-02 10:16:42 UTC	16384	IN	Data Raw: 62 6c 65 7b 70 6f 73 69 74 69 6f 6e 3a 72 65 6c 61 74 69 76 65 7d 2e 63 68 61 74 2d 72 65 73 70 6f 6e 73 65 5f 5f 69 63 6f 6e 7b 66 69 6c 74 65 72 3a 64 72 6f 70 2d 73 68 61 64 6f 77 28 30 20 36 2e 36 70 78 20 34 2e 35 70 78 20 72 67 62 61 28 30 2c 30 2c 30 2c 2e 30 37 35 29 29 20 64 72 6f 70 2d 73 68 61 64 6f 77 28 30 20 31 32 2e 35 70 78 20 31 39 70 78 20 72 67 62 61 28 30 2c 30 2c 30 2c 2e 30 31 36 38 37 35 29 29 20 64 72 6f 70 2d 73 68 61 64 6f 77 28 30 20 34 2e 35 70 78 20 32 35 70 78 20 72 67 62 61 28 30 2c 30 2c 30 2c 2e 30 32 32 35 29 29 3b 70 6f 73 69 74 69 6f 6e 3a 61 62 73 6f 6c 75 74 65 3b 74 6f 70 3a 2d 31 65 6d 3b 74 72 61 6e 73 66 6f 72 6d 3a 74 72 61 6e 73 6c 61 74 65 59 28 2d 35 30 25 29 3b 77 69 64 74 68 3a 32 2e 35 65 6d 3b 7a 2d 69 6e Data Ascii: ble{position:relative}.chat-response__icon{filter:drop-shadow(0 6.6px 4.5px rgba(0,0,0,.075)) drop-shadow(0 12.5px 19px rgba(0,0,0,.016875)) drop-shadow(0 4.5px 25px rgba(0,0,0,.0225));position:absolute;top:-1em;transform:translateY(-50%);width:2.5em;z-in
2024-10-02 10:16:42 UTC	7644	IN	Data Raw: 3a 61 62 73 6f 6c 75 74 65 3b 74 6f 70 3a 35 30 25 7d 2e 62 6c 6f 63 6b 2d 63 68 61 74 2d 73 6c 69 64 65 72 2d 70 72 65 76 2d 73 65 6c 65 63 74 6f 72 2d 6d 6f 62 69 6c 65 5f 5f 61 72 72 6f 77 62 75 74 74 6f 6e 2d 2d 70 72 65 76 7b 6c 65 66 74 3a 30 3b 74 72 61 6e 73 66 6f 72 6d 3a 74 72 61 6e 73 6c 61 74 65 28 2d 35 30 25 2c 2d 35 30 25 29 7d 2e 62 6c 6f 63 6b 2d 63 68 61 74 2d 73 6c 69 64 65 72 2d 70 72 65 76 2d 73 65 6c 65 63 74 6f 72 2d 6d 6f 62 69 6c 65 5f 5f 61 72 72 6f 77 62 75 74 74 6f 6e 2d 2d 6e 65 78 74 7b 72 69 67 68 74 3a 30 3b 74 72 61 6e 73 66 6f 72 6d 3a 74 72 61 6e 73 6c 61 74 65 28 35 30 25 2c 2d 35 30 25 29 7d 2e 62 6c 6f 63 6b 2d 63 68 61 74 2d 73 6c 69 64 65 72 2d 70 72 65 76 2d 73 65 6c 65 63 74 6f 72 2d 6d 6f 62 69 6c 65 5f 5f 6c 61 Data Ascii: :absolute;top:50%}.block-chat-slider-prev-selector-mobile__arrowbutton--prev{left:0;transform:translate(-50%,-50%)}.block-chat-slider-prev-selector-mobile__arrowbutton--next{right:0;transform:translate(50%,-50%)}.block-chat-slider-prev-selector-mobile__la

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
35	192.168.2.16	49794	13.107.246.40	443	4912	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-02 10:16:41 UTC	581	OUT	GET /shared/edgeweb/5b15c2a.js HTTP/1.1 Host: edgestatic.azureedge.net Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://www.microsoft.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-10-02 10:16:41 UTC	818	IN	HTTP/1.1 200 OK Date: Wed, 02 Oct 2024 10:16:41 GMT Content-Type: application/javascript; charset=UTF-8 Content-Length: 7084 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Access-Control-Allow-Origin: * Cache-Control: public, max-age=31536000, immutable ETag: W/"1bac-19245e6b591" Last-Modified: Tue, 01 Oct 2024 02:26:40 GMT Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Origin-Agent-Cluster: ?1 X-Content-Type-Options: nosniff X-Download-Options: noopen X-Frame-Options: SAMEORIGIN X-Permitted-Cross-Domain-Policies: none X-XSS-Protection: 0 x-azure-ref: 20241002T101641Z-15767c5fc55w69c2zvnrz0gmgw00000009n0000000006k59 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-02 10:16:41 UTC	7084	IN	Data Raw: 21 66 75 6e 63 74 69 6f 6e 28 65 29 7b 66 75 6e 63 74 69 6f 6e 20 63 28 64 61 74 61 29 7b 66 6f 72 28 76 61 72 20 63 2c 64 2c 74 3d 64 61 74 61 5b 30 5d 2c 6f 3d 64 61 74 61 5b 31 5d 2c 6c 3d 64 61 74 61 5b 32 5d 2c 69 3d 30 2c 68 3d 5b 5d 3b 69 3c 74 2e 6c 65 6e 67 74 68 3b 69 2b 2b 29 64 3d 74 5b 69 5d 2c 4f 62 6a 65 63 74 2e 70 72 6f 74 6f 74 79 70 65 2e 68 61 73 4f 77 6e 50 72 6f 70 65 72 74 79 2e 63 61 6c 6c 28 72 2c 64 29 26 26 72 5b 64 5d 26 26 68 2e 70 75 73 68 28 72 5b 64 5d 5b 30 5d 29 2c 72 5b 64 5d 3d 30 3b 66 6f 72 28 63 20 69 6e 20 6f 29 4f 62 6a 65 63 74 2e 70 72 6f 74 6f 74 79 70 65 2e 68 61 73 4f 77 6e 50 72 6f 70 65 72 74 79 2e 63 61 6c 6c 28 6f 2c 63 29 26 26 28 65 5b 63 5d 3d 6f 5b 63 5d 29 3b 66 6f 72 28 6d 26 26 6d 28 64 61 74 61 29 Data Ascii: !function(e){function c(data){for(var c,d,t=data[0],o=data[1],l=data[2],i=0,h=[];i<t.length;i++)d=t[i],Object.prototype.hasOwnProperty.call(r,d)&&r[d]&&h.push(r[d][0]),r[d]=0;for(c in o)Object.prototype.hasOwnProperty.call(o,c)&&(e[c]=o[c]);for(m&&m(data)

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
36	192.168.2.16	49795	13.107.246.40	443	4912	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-02 10:16:41 UTC	581	OUT	GET /shared/edgeweb/24b82ee.js HTTP/1.1 Host: edgestatic.azureedge.net Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://www.microsoft.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-10-02 10:16:41 UTC	821	IN	HTTP/1.1 200 OK Date: Wed, 02 Oct 2024 10:16:41 GMT Content-Type: application/javascript; charset=UTF-8 Content-Length: 309771 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Access-Control-Allow-Origin: * Cache-Control: public, max-age=31536000, immutable ETag: W/"4ba0b-192442de0ad" Last-Modified: Mon, 30 Sep 2024 18:25:10 GMT Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Origin-Agent-Cluster: ?1 X-Content-Type-Options: nosniff X-Download-Options: noopen X-Frame-Options: SAMEORIGIN X-Permitted-Cross-Domain-Policies: none X-XSS-Protection: 0 x-azure-ref: 20241002T101641Z-15767c5fc55852fxfeh7csa2dn00000009b000000000426h x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-02 10:16:41 UTC	15563	IN	Data Raw: 2f 2a 21 20 46 6f 72 20 6c 69 63 65 6e 73 65 20 69 6e 66 6f 72 6d 61 74 69 6f 6e 20 70 6c 65 61 73 65 20 73 65 65 20 4c 49 43 45 4e 53 45 53 20 2a 2f 0a 28 77 69 6e 64 6f 77 2e 77 65 62 70 61 63 6b 4a 73 6f 6e 70 3d 77 69 6e 64 6f 77 2e 77 65 62 70 61 63 6b 4a 73 6f 6e 70 7c 7c 5b 5d 29 2e 70 75 73 68 28 5b 5b 32 5d 2c 5b 66 75 6e 63 74 69 6f 6e 28 74 2c 65 2c 6e 29 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 66 75 6e 63 74 69 6f 6e 20 72 28 74 2c 65 2c 6e 2c 72 2c 6f 2c 63 2c 66 2c 6c 29 7b 76 61 72 20 68 2c 64 3d 22 66 75 6e 63 74 69 6f 6e 22 3d 3d 74 79 70 65 6f 66 20 74 3f 74 2e 6f 70 74 69 6f 6e 73 3a 74 3b 69 66 28 65 26 26 28 64 2e 72 65 6e 64 65 72 3d 65 2c 64 2e 73 74 61 74 69 63 52 65 6e 64 65 72 46 6e 73 3d 6e 2c 64 2e 5f 63 6f 6d 70 69 6c 65 64 Data Ascii: /! For license information please see LICENSES /(window.webpackJsonp=window.webpackJsonp\|\|[]).push([[2],[function(t,e,n){"use strict";function r(t,e,n,r,o,c,f,l){var h,d="function"==typeof t?t.options:t;if(e&&(d.render=e,d.staticRenderFns=n,d._compiled
2024-10-02 10:16:41 UTC	16384	IN	Data Raw: 20 6e 20 69 6e 20 74 29 7b 76 61 72 20 72 3d 65 5b 6e 5d 2c 6f 3d 74 5b 6e 5d 3b 65 5b 6e 5d 3d 72 3f 5b 5d 2e 63 6f 6e 63 61 74 28 72 2c 6f 29 3a 6f 7d 7d 65 6c 73 65 3b 72 65 74 75 72 6e 20 64 61 74 61 7d 66 75 6e 63 74 69 6f 6e 20 5f 65 28 74 2c 65 2c 6e 2c 72 29 7b 65 3d 65 7c 7c 7b 24 73 74 61 62 6c 65 3a 21 6e 7d 3b 66 6f 72 28 76 61 72 20 69 3d 30 3b 69 3c 74 2e 6c 65 6e 67 74 68 3b 69 2b 2b 29 7b 76 61 72 20 73 6c 6f 74 3d 74 5b 69 5d 3b 63 28 73 6c 6f 74 29 3f 5f 65 28 73 6c 6f 74 2c 65 2c 6e 29 3a 73 6c 6f 74 26 26 28 73 6c 6f 74 2e 70 72 6f 78 79 26 26 28 73 6c 6f 74 2e 66 6e 2e 70 72 6f 78 79 3d 21 30 29 2c 65 5b 73 6c 6f 74 2e 6b 65 79 5d 3d 73 6c 6f 74 2e 66 6e 29 7d 72 65 74 75 72 6e 20 72 26 26 28 65 2e 24 6b 65 79 3d 72 29 2c 65 7d 66 75 Data Ascii: n in t){var r=e[n],o=t[n];e[n]=r?[].concat(r,o):o}}else;return data}function _e(t,e,n,r){e=e\|\|{$stable:!n};for(var i=0;i<t.length;i++){var slot=t[i];c(slot)?_e(slot,e,n):slot&&(slot.proxy&&(slot.fn.proxy=!0),e[slot.key]=slot.fn)}return r&&(e.$key=r),e}fu
2024-10-02 10:16:41 UTC	16384	IN	Data Raw: 63 72 65 61 74 65 28 74 7c 7c 6e 75 6c 6c 29 3b 72 65 74 75 72 6e 20 65 3f 46 28 6f 2c 65 29 3a 6f 7d 48 6e 2e 64 61 74 61 3d 66 75 6e 63 74 69 6f 6e 28 74 2c 65 2c 6e 29 7b 72 65 74 75 72 6e 20 6e 3f 57 6e 28 74 2c 65 2c 6e 29 3a 65 26 26 22 66 75 6e 63 74 69 6f 6e 22 21 3d 74 79 70 65 6f 66 20 65 3f 74 3a 57 6e 28 74 2c 65 29 7d 2c 58 2e 66 6f 72 45 61 63 68 28 28 66 75 6e 63 74 69 6f 6e 28 74 29 7b 48 6e 5b 74 5d 3d 47 6e 7d 29 29 2c 51 2e 66 6f 72 45 61 63 68 28 28 66 75 6e 63 74 69 6f 6e 28 74 29 7b 48 6e 5b 74 2b 22 73 22 5d 3d 4b 6e 7d 29 29 2c 48 6e 2e 77 61 74 63 68 3d 66 75 6e 63 74 69 6f 6e 28 74 2c 65 2c 6e 2c 72 29 7b 69 66 28 74 3d 3d 3d 76 74 26 26 28 74 3d 76 6f 69 64 20 30 29 2c 65 3d 3d 3d 76 74 26 26 28 65 3d 76 6f 69 64 20 30 29 2c 21 Data Ascii: create(t\|\|null);return e?F(o,e):o}Hn.data=function(t,e,n){return n?Wn(t,e,n):e&&"function"!=typeof e?t:Wn(t,e)},X.forEach((function(t){Hn[t]=Gn})),Q.forEach((function(t){Hn[t+"s"]=Kn})),Hn.watch=function(t,e,n,r){if(t===vt&&(t=void 0),e===vt&&(e=void 0),!
2024-10-02 10:16:42 UTC	16384	IN	Data Raw: 6e 65 6e 74 49 6e 73 74 61 6e 63 65 7c 7c 74 2e 65 6c 6d 2c 66 3d 65 3f 6e 75 6c 6c 3a 6f 2c 68 3d 65 3f 76 6f 69 64 20 30 3a 6f 3b 69 66 28 76 28 6e 29 29 56 65 28 6e 2c 72 2c 5b 66 5d 2c 72 2c 22 74 65 6d 70 6c 61 74 65 20 72 65 66 20 66 75 6e 63 74 69 6f 6e 22 29 3b 65 6c 73 65 7b 76 61 72 20 64 3d 74 2e 64 61 74 61 2e 72 65 66 49 6e 46 6f 72 2c 79 3d 22 73 74 72 69 6e 67 22 3d 3d 74 79 70 65 6f 66 20 6e 7c 7c 22 6e 75 6d 62 65 72 22 3d 3d 74 79 70 65 6f 66 20 6e 2c 6d 3d 51 74 28 6e 29 2c 77 3d 72 2e 24 72 65 66 73 3b 69 66 28 79 7c 7c 6d 29 69 66 28 64 29 7b 76 61 72 20 78 3d 79 3f 77 5b 6e 5d 3a 6e 2e 76 61 6c 75 65 3b 65 3f 63 28 78 29 26 26 43 28 78 2c 6f 29 3a 63 28 78 29 3f 78 2e 69 6e 63 6c 75 64 65 73 28 6f 29 7c 7c 78 2e 70 75 73 68 28 6f 29 Data Ascii: nentInstance\|\|t.elm,f=e?null:o,h=e?void 0:o;if(v(n))Ve(n,r,[f],r,"template ref function");else{var d=t.data.refInFor,y="string"==typeof n\|\|"number"==typeof n,m=Qt(n),w=r.$refs;if(y\|\|m)if(d){var x=y?w[n]:n.value;e?c(x)&&C(x,o):c(x)?x.includes(o)\|\|x.push(o)
2024-10-02 10:16:42 UTC	16384	IN	Data Raw: 69 66 28 21 64 7c 7c 21 24 28 64 2c 63 5b 76 5d 2c 6e 2c 72 29 29 7b 66 3d 21 31 3b 62 72 65 61 6b 7d 64 3d 64 2e 6e 65 78 74 53 69 62 6c 69 6e 67 7d 69 66 28 21 66 7c 7c 64 29 72 65 74 75 72 6e 21 31 7d 65 6c 73 65 20 78 28 65 2c 63 2c 6e 29 3b 69 66 28 6c 28 64 61 74 61 29 29 7b 76 61 72 20 79 3d 21 31 3b 66 6f 72 28 76 61 72 20 77 20 69 6e 20 64 61 74 61 29 69 66 28 21 49 28 77 29 29 7b 79 3d 21 30 2c 4f 28 65 2c 6e 29 3b 62 72 65 61 6b 7d 21 79 26 26 64 61 74 61 2e 63 6c 61 73 73 26 26 73 6e 28 64 61 74 61 2e 63 6c 61 73 73 29 7d 7d 65 6c 73 65 20 74 2e 64 61 74 61 21 3d 3d 65 2e 74 65 78 74 26 26 28 74 2e 64 61 74 61 3d 65 2e 74 65 78 74 29 3b 72 65 74 75 72 6e 21 30 7d 72 65 74 75 72 6e 20 66 75 6e 63 74 69 6f 6e 28 74 2c 65 2c 72 2c 63 29 7b 69 66 Data Ascii: if(!d\|\|!$(d,c[v],n,r)){f=!1;break}d=d.nextSibling}if(!f\|\|d)return!1}else x(e,c,n);if(l(data)){var y=!1;for(var w in data)if(!I(w)){y=!0,O(e,n);break}!y&&data.class&&sn(data.class)}}else t.data!==e.text&&(t.data=e.text);return!0}return function(t,e,r,c){if
2024-10-02 10:16:42 UTC	16384	IN	Data Raw: 29 7b 30 7d 29 2c 7b 64 65 65 70 3a 21 30 2c 73 79 6e 63 3a 21 30 7d 29 7d 28 74 29 2c 72 26 26 28 6e 26 26 74 2e 5f 77 69 74 68 43 6f 6d 6d 69 74 28 28 66 75 6e 63 74 69 6f 6e 28 29 7b 72 2e 5f 64 61 74 61 2e 24 24 73 74 61 74 65 3d 6e 75 6c 6c 7d 29 29 2c 79 2e 6e 65 78 74 54 69 63 6b 28 28 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 72 2e 24 64 65 73 74 72 6f 79 28 29 7d 29 29 29 7d 66 75 6e 63 74 69 6f 6e 20 53 28 74 2c 65 2c 70 61 74 68 2c 6e 2c 72 29 7b 76 61 72 20 6f 3d 21 70 61 74 68 2e 6c 65 6e 67 74 68 2c 63 3d 74 2e 5f 6d 6f 64 75 6c 65 73 2e 67 65 74 4e 61 6d 65 73 70 61 63 65 28 70 61 74 68 29 3b 69 66 28 6e 2e 6e 61 6d 65 73 70 61 63 65 64 26 26 28 74 2e 5f 6d 6f 64 75 6c 65 73 4e 61 6d 65 73 70 61 63 65 4d 61 70 5b 63 5d 2c 74 2e Data Ascii: ){0}),{deep:!0,sync:!0})}(t),r&&(n&&t._withCommit((function(){r._data.$$state=null})),y.nextTick((function(){return r.$destroy()})))}function S(t,e,path,n,r){var o=!path.length,c=t._modules.getNamespace(path);if(n.namespaced&&(t._modulesNamespaceMap[c],t.
2024-10-02 10:16:42 UTC	16384	IN	Data Raw: 72 2e 64 6f 6e 65 3f 5f 3a 77 2c 64 2e 61 72 67 3d 3d 3d 4f 29 63 6f 6e 74 69 6e 75 65 3b 72 65 74 75 72 6e 7b 76 61 6c 75 65 3a 64 2e 61 72 67 2c 64 6f 6e 65 3a 72 2e 64 6f 6e 65 7d 7d 22 74 68 72 6f 77 22 3d 3d 3d 64 2e 74 79 70 65 26 26 28 6f 3d 5f 2c 72 2e 6d 65 74 68 6f 64 3d 22 74 68 72 6f 77 22 2c 72 2e 61 72 67 3d 64 2e 61 72 67 29 7d 7d 7d 66 75 6e 63 74 69 6f 6e 20 24 28 74 2c 6e 29 7b 76 61 72 20 72 3d 6e 2e 6d 65 74 68 6f 64 2c 6f 3d 74 2e 69 74 65 72 61 74 6f 72 5b 72 5d 3b 69 66 28 6f 3d 3d 3d 65 29 72 65 74 75 72 6e 20 6e 2e 64 65 6c 65 67 61 74 65 3d 6e 75 6c 6c 2c 22 74 68 72 6f 77 22 3d 3d 3d 72 26 26 74 2e 69 74 65 72 61 74 6f 72 2e 72 65 74 75 72 6e 26 26 28 6e 2e 6d 65 74 68 6f 64 3d 22 72 65 74 75 72 6e 22 2c 6e 2e 61 72 67 3d 65 2c Data Ascii: r.done?_:w,d.arg===O)continue;return{value:d.arg,done:r.done}}"throw"===d.type&&(o=_,r.method="throw",r.arg=d.arg)}}}function $(t,n){var r=n.method,o=t.iterator[r];if(o===e)return n.delegate=null,"throw"===r&&t.iterator.return&&(n.method="return",n.arg=e,
2024-10-02 10:16:42 UTC	16384	IN	Data Raw: 3d 6c 28 74 68 69 73 29 2c 6f 3d 66 28 65 29 3f 76 6f 69 64 20 30 3a 76 28 65 2c 74 29 3b 72 65 74 75 72 6e 20 6f 3f 72 28 6f 2c 65 2c 6e 29 3a 6e 65 77 20 52 65 67 45 78 70 28 65 29 5b 74 5d 28 64 28 6e 29 29 7d 2c 66 75 6e 63 74 69 6f 6e 28 74 29 7b 76 61 72 20 72 3d 63 28 74 68 69 73 29 2c 6f 3d 64 28 74 29 2c 66 3d 6e 28 65 2c 72 2c 6f 29 3b 69 66 28 66 2e 64 6f 6e 65 29 72 65 74 75 72 6e 20 66 2e 76 61 6c 75 65 3b 76 61 72 20 6c 3d 72 2e 6c 61 73 74 49 6e 64 65 78 3b 68 28 6c 2c 30 29 7c 7c 28 72 2e 6c 61 73 74 49 6e 64 65 78 3d 30 29 3b 76 61 72 20 76 3d 79 28 72 2c 6f 29 3b 72 65 74 75 72 6e 20 68 28 72 2e 6c 61 73 74 49 6e 64 65 78 2c 6c 29 7c 7c 28 72 2e 6c 61 73 74 49 6e 64 65 78 3d 6c 29 2c 6e 75 6c 6c 3d 3d 3d 76 3f 2d 31 3a 76 2e 69 6e 64 65 Data Ascii: =l(this),o=f(e)?void 0:v(e,t);return o?r(o,e,n):new RegExp(e)[t](d(n))},function(t){var r=c(this),o=d(t),f=n(e,r,o);if(f.done)return f.value;var l=r.lastIndex;h(l,0)\|\|(r.lastIndex=0);var v=y(r,o);return h(r.lastIndex,l)\|\|(r.lastIndex=l),null===v?-1:v.inde
2024-10-02 10:16:42 UTC	16384	IN	Data Raw: 22 29 2c 41 3d 3d 6f 29 7b 66 6f 72 28 76 61 72 20 6b 3d 69 2c 6a 3d 33 36 3b 3b 6a 2b 3d 33 36 29 7b 76 61 72 20 43 3d 6a 3c 3d 63 3f 31 3a 6a 3e 3d 63 2b 32 36 3f 32 36 3a 6a 2d 63 3b 69 66 28 6b 3c 43 29 62 72 65 61 6b 3b 76 61 72 20 54 3d 6b 2d 43 2c 52 3d 33 36 2d 43 3b 6e 2e 70 75 73 68 28 53 28 45 28 43 2b 54 25 52 2c 30 29 29 29 2c 6b 3d 4f 28 54 2f 52 29 7d 6e 2e 70 75 73 68 28 53 28 45 28 6b 2c 30 29 29 29 2c 63 3d 75 28 69 2c 61 2c 70 3d 3d 68 29 2c 69 3d 30 2c 2b 2b 70 7d 7d 7d 63 61 74 63 68 28 74 29 7b 5f 2e 65 28 74 29 7d 66 69 6e 61 6c 6c 79 7b 5f 2e 66 28 29 7d 2b 2b 69 2c 2b 2b 6f 7d 72 65 74 75 72 6e 20 6e 2e 6a 6f 69 6e 28 22 22 29 7d 28 74 29 3a 74 7d 29 29 2e 6a 6f 69 6e 28 22 2e 22 29 3b 72 65 74 75 72 6e 20 72 2b 6f 7d 28 74 29 7d Data Ascii: "),A==o){for(var k=i,j=36;;j+=36){var C=j<=c?1:j>=c+26?26:j-c;if(k<C)break;var T=k-C,R=36-C;n.push(S(E(C+T%R,0))),k=O(T/R)}n.push(S(E(k,0))),c=u(i,a,p==h),i=0,++p}}}catch(t){_.e(t)}finally{_.f()}++i,++o}return n.join("")}(t):t})).join(".");return r+o}(t)}
2024-10-02 10:16:42 UTC	16384	IN	Data Raw: 70 65 63 69 65 73 22 29 3b 74 2e 65 78 70 6f 72 74 73 3d 66 75 6e 63 74 69 6f 6e 28 74 2c 65 29 7b 76 61 72 20 6e 2c 6c 3d 72 28 74 29 2e 63 6f 6e 73 74 72 75 63 74 6f 72 3b 72 65 74 75 72 6e 20 76 6f 69 64 20 30 3d 3d 3d 6c 7c 7c 63 28 6e 3d 72 28 6c 29 5b 66 5d 29 3f 65 3a 6f 28 6e 29 7d 7d 2c 66 75 6e 63 74 69 6f 6e 28 74 2c 65 2c 6e 29 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 76 61 72 20 72 3d 6e 28 31 30 35 29 2c 6f 3d 6e 28 32 34 29 3b 74 2e 65 78 70 6f 72 74 73 3d 66 75 6e 63 74 69 6f 6e 28 74 29 7b 69 66 28 22 46 75 6e 63 74 69 6f 6e 22 3d 3d 3d 72 28 74 29 29 72 65 74 75 72 6e 20 6f 28 74 29 7d 7d 2c 66 75 6e 63 74 69 6f 6e 28 74 2c 65 2c 6e 29 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 76 61 72 20 72 3d 6e 28 34 32 29 2c 6f 3d 6e 28 31 36 33 29 Data Ascii: pecies");t.exports=function(t,e){var n,l=r(t).constructor;return void 0===l\|\|c(n=r(l)[f])?e:o(n)}},function(t,e,n){"use strict";var r=n(105),o=n(24);t.exports=function(t){if("Function"===r(t))return o(t)}},function(t,e,n){"use strict";var r=n(42),o=n(163)

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
37	192.168.2.16	49797	13.107.246.40	443	4912	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-02 10:16:41 UTC	581	OUT	GET /shared/edgeweb/1c2ab9a.js HTTP/1.1 Host: edgestatic.azureedge.net Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://www.microsoft.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-10-02 10:16:41 UTC	823	IN	HTTP/1.1 200 OK Date: Wed, 02 Oct 2024 10:16:41 GMT Content-Type: application/javascript; charset=UTF-8 Content-Length: 1786354 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Access-Control-Allow-Origin: * Cache-Control: public, max-age=31536000, immutable ETag: W/"1b41f2-19245e6b9d7" Last-Modified: Tue, 01 Oct 2024 02:26:41 GMT Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Origin-Agent-Cluster: ?1 X-Content-Type-Options: nosniff X-Download-Options: noopen X-Frame-Options: SAMEORIGIN X-Permitted-Cross-Domain-Policies: none X-XSS-Protection: 0 x-azure-ref: 20241002T101641Z-15767c5fc55472x4k7dmphmadg000000095g000000000hvv x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-02 10:16:41 UTC	15561	IN	Data Raw: 2f 2a 21 20 46 6f 72 20 6c 69 63 65 6e 73 65 20 69 6e 66 6f 72 6d 61 74 69 6f 6e 20 70 6c 65 61 73 65 20 73 65 65 20 4c 49 43 45 4e 53 45 53 20 2a 2f 0a 28 77 69 6e 64 6f 77 2e 77 65 62 70 61 63 6b 4a 73 6f 6e 70 3d 77 69 6e 64 6f 77 2e 77 65 62 70 61 63 6b 4a 73 6f 6e 70 7c 7c 5b 5d 29 2e 70 75 73 68 28 5b 5b 39 30 5d 2c 5b 2c 2c 2c 2c 2c 2c 2c 66 75 6e 63 74 69 6f 6e 28 65 2c 74 2c 72 29 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 76 61 72 20 6e 3d 72 28 31 36 29 2c 6f 3d 28 72 28 31 33 29 2c 72 28 38 29 2c 72 28 33 33 29 2c 72 28 35 30 29 2c 72 28 31 37 29 2c 72 28 33 32 29 2c 72 28 31 29 2c 72 28 31 32 29 2c 72 28 32 39 29 2c 72 28 39 33 29 2c 72 28 35 38 29 2c 72 28 32 33 29 29 2c 6c 3d 5b 22 62 75 74 74 6f 6e 22 2c 22 6c 69 6e 6b 22 2c 22 6e 61 76 22 Data Ascii: /! For license information please see LICENSES /(window.webpackJsonp=window.webpackJsonp\|\|[]).push([[90],[,,,,,,,function(e,t,r){"use strict";var n=r(16),o=(r(13),r(8),r(33),r(50),r(17),r(32),r(1),r(12),r(29),r(93),r(58),r(23)),l=["button","link","nav"
2024-10-02 10:16:42 UTC	16384	IN	Data Raw: 6e 28 65 2c 74 29 7b 72 65 74 75 72 6e 20 65 26 26 28 72 65 5b 65 5d 3d 74 29 26 26 6e 65 26 26 28 6e 65 5b 65 5d 3d 74 29 7c 7c 72 65 7d 2c 6c 65 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 30 7d 2c 75 65 3d 7b 73 75 70 70 72 65 73 73 45 76 65 6e 74 73 3a 21 30 2c 69 73 53 74 61 72 74 3a 21 30 2c 6b 69 6c 6c 3a 21 31 7d 2c 63 65 3d 7b 73 75 70 70 72 65 73 73 45 76 65 6e 74 73 3a 21 30 2c 6b 69 6c 6c 3a 21 31 7d 2c 64 65 3d 7b 73 75 70 70 72 65 73 73 45 76 65 6e 74 73 3a 21 30 7d 2c 70 65 3d 7b 7d 2c 68 65 3d 5b 5d 2c 6d 65 3d 7b 7d 2c 66 65 3d 7b 7d 2c 67 65 3d 7b 7d 2c 76 65 3d 33 30 2c 62 65 3d 5b 5d 2c 79 65 3d 22 22 2c 6b 65 3d 66 75 6e 63 74 69 6f 6e 28 65 29 7b 76 61 72 20 74 2c 69 2c 72 3d 65 5b 30 5d 3b 69 66 28 24 28 72 29 7c 7c 46 Data Ascii: n(e,t){return e&&(re[e]=t)&&ne&&(ne[e]=t)\|\|re},le=function(){return 0},ue={suppressEvents:!0,isStart:!0,kill:!1},ce={suppressEvents:!0,kill:!1},de={suppressEvents:!0},pe={},he=[],me={},fe={},ge={},ve=30,be=[],ye="",ke=function(e){var t,i,r=e[0];if($(r)\|\|F
2024-10-02 10:16:42 UTC	16384	IN	Data Raw: 74 68 29 72 65 74 75 72 6e 20 74 68 69 73 2e 5f 74 54 69 6d 65 3b 76 61 72 20 72 3d 74 68 69 73 2e 5f 64 70 3b 69 66 28 72 26 26 72 2e 73 6d 6f 6f 74 68 43 68 69 6c 64 54 69 6d 69 6e 67 26 26 74 68 69 73 2e 5f 74 73 29 7b 66 6f 72 28 47 65 28 74 68 69 73 2c 65 29 2c 21 72 2e 5f 64 70 7c 7c 72 2e 70 61 72 65 6e 74 7c 7c 4b 65 28 72 2c 74 68 69 73 29 3b 72 26 26 72 2e 70 61 72 65 6e 74 3b 29 72 2e 70 61 72 65 6e 74 2e 5f 74 69 6d 65 21 3d 3d 72 2e 5f 73 74 61 72 74 2b 28 72 2e 5f 74 73 3e 3d 30 3f 72 2e 5f 74 54 69 6d 65 2f 72 2e 5f 74 73 3a 28 72 2e 74 6f 74 61 6c 44 75 72 61 74 69 6f 6e 28 29 2d 72 2e 5f 74 54 69 6d 65 29 2f 2d 72 2e 5f 74 73 29 26 26 72 2e 74 6f 74 61 6c 54 69 6d 65 28 72 2e 5f 74 54 69 6d 65 2c 21 30 29 2c 72 3d 72 2e 70 61 72 65 6e 74 Data Ascii: th)return this._tTime;var r=this._dp;if(r&&r.smoothChildTiming&&this._ts){for(Ge(this,e),!r._dp\|\|r.parent\|\|Ke(r,this);r&&r.parent;)r.parent._time!==r._start+(r._ts>=0?r._tTime/r._ts:(r.totalDuration()-r._tTime)/-r._ts)&&r.totalTime(r._tTime,!0),r=r.parent
2024-10-02 10:16:42 UTC	16384	IN	Data Raw: 74 2e 65 61 73 65 7c 7c 6e 7c 7c 22 70 6f 77 65 72 31 2e 69 6e 4f 75 74 22 3b 69 66 28 4b 28 74 29 29 61 3d 72 5b 65 5d 7c 7c 28 72 5b 65 5d 3d 5b 5d 29 2c 74 2e 66 6f 72 45 61 63 68 28 28 66 75 6e 63 74 69 6f 6e 28 65 2c 69 29 7b 72 65 74 75 72 6e 20 61 2e 70 75 73 68 28 7b 74 3a 69 2f 28 74 2e 6c 65 6e 67 74 68 2d 31 29 2a 31 30 30 2c 76 3a 65 2c 65 3a 6f 7d 29 7d 29 29 3b 65 6c 73 65 20 66 6f 72 28 70 20 69 6e 20 74 29 61 3d 72 5b 70 5d 7c 7c 28 72 5b 70 5d 3d 5b 5d 29 2c 22 65 61 73 65 22 3d 3d 3d 70 7c 7c 61 2e 70 75 73 68 28 7b 74 3a 70 61 72 73 65 46 6c 6f 61 74 28 65 29 2c 76 3a 74 5b 70 5d 2c 65 3a 6f 7d 29 7d 2c 73 72 3d 66 75 6e 63 74 69 6f 6e 28 65 2c 74 2c 69 2c 72 2c 6e 29 7b 72 65 74 75 72 6e 20 46 28 65 29 3f 65 2e 63 61 6c 6c 28 74 2c 69 Data Ascii: t.ease\|\|n\|\|"power1.inOut";if(K(t))a=r[e]\|\|(r[e]=[]),t.forEach((function(e,i){return a.push({t:i/(t.length-1)*100,v:e,e:o})}));else for(p in t)a=r[p]\|\|(r[p]=[]),"ease"===p\|\|a.push({t:parseFloat(e),v:t[p],e:o})},sr=function(e,t,i,r,n){return F(e)?e.call(t,i
2024-10-02 10:16:42 UTC	16384	IN	Data Raw: 63 2c 74 68 69 73 2e 5f 70 72 6f 70 73 2e 70 75 73 68 28 70 29 7d 2c 72 65 6e 64 65 72 3a 66 75 6e 63 74 69 6f 6e 28 65 2c 64 61 74 61 29 7b 66 6f 72 28 76 61 72 20 74 3d 64 61 74 61 2e 5f 70 74 3b 74 3b 29 64 3f 74 2e 73 65 74 28 74 2e 74 2c 74 2e 70 2c 74 2e 62 2c 74 29 3a 74 2e 72 28 65 2c 74 2e 64 29 2c 74 3d 74 2e 5f 6e 65 78 74 7d 7d 2c 7b 6e 61 6d 65 3a 22 65 6e 64 41 72 72 61 79 22 2c 69 6e 69 74 3a 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 66 6f 72 28 76 61 72 20 69 3d 74 2e 6c 65 6e 67 74 68 3b 69 2d 2d 3b 29 74 68 69 73 2e 61 64 64 28 65 2c 69 2c 65 5b 69 5d 7c 7c 30 2c 74 5b 69 5d 2c 30 2c 30 2c 30 2c 30 2c 30 2c 31 29 7d 7d 2c 4c 72 28 22 72 6f 75 6e 64 50 72 6f 70 73 22 2c 76 74 29 2c 4c 72 28 22 6d 6f 64 69 66 69 65 72 73 22 29 2c 4c 72 28 Data Ascii: c,this._props.push(p)},render:function(e,data){for(var t=data._pt;t;)d?t.set(t.t,t.p,t.b,t):t.r(e,t.d),t=t._next}},{name:"endArray",init:function(e,t){for(var i=t.length;i--;)this.add(e,i,e[i]\|\|0,t[i],0,0,0,0,0,1)}},Lr("roundProps",vt),Lr("modifiers"),Lr(
2024-10-02 10:16:42 UTC	16384	IN	Data Raw: 72 65 6e 64 65 72 54 72 61 6e 73 66 6f 72 6d 26 26 21 74 2e 70 61 72 73 65 54 72 61 6e 73 66 6f 72 6d 7c 7c 71 6e 28 65 2c 74 2e 70 61 72 73 65 54 72 61 6e 73 66 6f 72 6d 29 2c 6a 3d 21 31 21 3d 3d 74 2e 73 6d 6f 6f 74 68 4f 72 69 67 69 6e 26 26 4d 2e 73 6d 6f 6f 74 68 2c 28 78 3d 74 68 69 73 2e 5f 70 74 3d 6e 65 77 20 41 72 28 74 68 69 73 2e 5f 70 74 2c 73 74 79 6c 65 2c 66 6e 2c 30 2c 31 2c 4d 2e 72 65 6e 64 65 72 54 72 61 6e 73 66 6f 72 6d 2c 4d 2c 30 2c 2d 31 29 29 2e 64 65 70 3d 31 29 2c 22 73 63 61 6c 65 22 3d 3d 3d 70 29 74 68 69 73 2e 5f 70 74 3d 6e 65 77 20 41 72 28 74 68 69 73 2e 5f 70 74 2c 4d 2c 22 73 63 61 6c 65 59 22 2c 4d 2e 73 63 61 6c 65 59 2c 28 77 3f 41 65 28 4d 2e 73 63 61 6c 65 59 2c 77 2b 68 29 3a 68 29 2d 4d 2e 73 63 61 6c 65 59 7c Data Ascii: renderTransform&&!t.parseTransform\|\|qn(e,t.parseTransform),j=!1!==t.smoothOrigin&&M.smooth,(x=this._pt=new Ar(this._pt,style,fn,0,1,M.renderTransform,M,0,-1)).dep=1),"scale"===p)this._pt=new Ar(this._pt,M,"scaleY",M.scaleY,(w?Ae(M.scaleY,w+h):h)-M.scaleY\|
2024-10-02 10:16:42 UTC	16384	IN	Data Raw: 28 22 45 72 72 6f 72 20 73 68 61 72 69 6e 67 3a 22 2c 65 29 2c 65 7d 29 29 29 3b 63 61 73 65 20 31 3a 63 61 73 65 22 65 6e 64 22 3a 72 65 74 75 72 6e 20 74 2e 73 74 6f 70 28 29 7d 7d 29 2c 74 29 7d 29 29 29 28 29 7d 7d 7d 2c 4b 3d 4f 62 6a 65 63 74 28 78 2e 61 29 28 47 2c 75 6e 64 65 66 69 6e 65 64 2c 75 6e 64 65 66 69 6e 65 64 2c 21 31 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 29 2e 65 78 70 6f 72 74 73 2c 59 3d 72 28 37 30 36 29 2c 51 3d 7b 63 6f 6d 70 6f 6e 65 6e 74 73 3a 7b 43 6f 6d 6d 6f 6e 42 75 74 74 6f 6e 3a 64 2e 61 7d 2c 6e 61 6d 65 3a 22 61 63 74 69 6f 6e 2d 63 68 61 74 2d 63 6f 6e 74 69 6e 75 65 22 2c 6d 69 78 69 6e 73 3a 5b 6f 2e 61 5d 2c 69 6e 6a 65 63 74 3a 7b 63 68 61 74 49 64 3a 7b 64 65 66 61 75 6c 74 3a 6e 75 6c 6c 7d 7d 2c 70 72 6f Data Ascii: ("Error sharing:",e),e})));case 1:case"end":return t.stop()}}),t)})))()}}},K=Object(x.a)(G,undefined,undefined,!1,null,null,null).exports,Y=r(706),Q={components:{CommonButton:d.a},name:"action-chat-continue",mixins:[o.a],inject:{chatId:{default:null}},pro
2024-10-02 10:16:42 UTC	16384	IN	Data Raw: 65 65 28 65 6c 65 6d 65 6e 74 29 3b 72 65 74 75 72 6e 7b 77 69 64 74 68 3a 65 2c 68 65 69 67 68 74 3a 74 7d 7d 2c 67 65 74 53 63 61 6c 65 3a 72 65 2c 69 73 45 6c 65 6d 65 6e 74 3a 56 2c 69 73 52 54 4c 3a 66 75 6e 63 74 69 6f 6e 28 65 6c 65 6d 65 6e 74 29 7b 72 65 74 75 72 6e 22 72 74 6c 22 3d 3d 3d 59 28 65 6c 65 6d 65 6e 74 29 2e 64 69 72 65 63 74 69 6f 6e 7d 7d 3b 66 75 6e 63 74 69 6f 6e 20 66 65 28 65 2c 74 2c 72 2c 6e 29 7b 76 6f 69 64 20 30 3d 3d 3d 6e 26 26 28 6e 3d 7b 7d 29 3b 63 6f 6e 73 74 7b 61 6e 63 65 73 74 6f 72 53 63 72 6f 6c 6c 3a 6f 3d 21 30 2c 61 6e 63 65 73 74 6f 72 52 65 73 69 7a 65 3a 6c 3d 21 30 2c 65 6c 65 6d 65 6e 74 52 65 73 69 7a 65 3a 68 3d 22 66 75 6e 63 74 69 6f 6e 22 3d 3d 74 79 70 65 6f 66 20 52 65 73 69 7a 65 4f 62 73 65 72 Data Ascii: ee(element);return{width:e,height:t}},getScale:re,isElement:V,isRTL:function(element){return"rtl"===Y(element).direction}};function fe(e,t,r,n){void 0===n&&(n={});const{ancestorScroll:o=!0,ancestorResize:l=!0,elementResize:h="function"==typeof ResizeObser
2024-10-02 10:16:42 UTC	16384	IN	Data Raw: 3d 3d 3d 28 65 3d 74 68 69 73 2e 24 72 65 66 73 2e 74 69 74 6c 65 29 7c 7c 76 6f 69 64 20 30 3d 3d 3d 65 3f 76 6f 69 64 20 30 3a 65 2e 24 65 6c 7d 2c 24 64 65 73 63 72 69 70 74 69 6f 6e 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 65 3b 72 65 74 75 72 6e 20 6e 75 6c 6c 3d 3d 3d 28 65 3d 74 68 69 73 2e 24 72 65 66 73 2e 64 65 73 63 72 69 70 74 69 6f 6e 29 7c 7c 76 6f 69 64 20 30 3d 3d 3d 65 3f 76 6f 69 64 20 30 3a 65 2e 24 65 6c 7d 2c 74 69 74 6c 65 48 65 61 64 69 6e 67 43 6c 61 73 73 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 74 68 69 73 2e 61 70 70 65 61 72 61 6e 63 65 4c 65 76 65 6c 7c 7c 74 68 69 73 2e 6c 65 76 65 6c 3f 22 68 22 2b 28 74 68 69 73 2e 61 70 70 65 61 72 61 6e 63 65 4c 65 76 65 6c 7c 7c 74 68 69 73 2e 6c 65 76 65 6c 7c 7c Data Ascii: ===(e=this.$refs.title)\|\|void 0===e?void 0:e.$el},$description:function(){var e;return null===(e=this.$refs.description)\|\|void 0===e?void 0:e.$el},titleHeadingClass:function(){return this.appearanceLevel\|\|this.level?"h"+(this.appearanceLevel\|\|this.level\|\|
2024-10-02 10:16:42 UTC	16384	IN	Data Raw: 62 2b 28 35 3d 3d 3d 65 2e 6c 65 6e 67 74 68 3f 65 2e 63 68 61 72 41 74 28 34 29 2b 65 2e 63 68 61 72 41 74 28 34 29 3a 22 22 29 29 2c 39 3d 3d 3d 65 2e 6c 65 6e 67 74 68 29 72 65 74 75 72 6e 5b 28 61 3d 70 61 72 73 65 49 6e 74 28 65 2e 73 75 62 73 74 72 28 31 2c 36 29 2c 31 36 29 29 3e 3e 31 36 2c 61 3e 3e 38 26 53 74 2c 61 26 53 74 2c 70 61 72 73 65 49 6e 74 28 65 2e 73 75 62 73 74 72 28 37 29 2c 31 36 29 2f 32 35 35 5d 3b 61 3d 5b 28 65 3d 70 61 72 73 65 49 6e 74 28 65 2e 73 75 62 73 74 72 28 31 29 2c 31 36 29 29 3e 3e 31 36 2c 65 3e 3e 38 26 53 74 2c 65 26 53 74 5d 7d 65 6c 73 65 20 69 66 28 22 68 73 6c 22 3d 3d 3d 65 2e 73 75 62 73 74 72 28 30 2c 33 29 29 69 66 28 61 3d 6d 3d 65 2e 6d 61 74 63 68 28 4b 29 2c 74 29 7b 69 66 28 7e 65 2e 69 6e 64 65 78 Data Ascii: b+(5===e.length?e.charAt(4)+e.charAt(4):"")),9===e.length)return[(a=parseInt(e.substr(1,6),16))>>16,a>>8&St,a&St,parseInt(e.substr(7),16)/255];a=[(e=parseInt(e.substr(1),16))>>16,e>>8&St,e&St]}else if("hsl"===e.substr(0,3))if(a=m=e.match(K),t){if(~e.index

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
38	192.168.2.16	49799	13.107.246.40	443	4912	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-02 10:16:42 UTC	581	OUT	GET /shared/edgeweb/f99a53a.js HTTP/1.1 Host: edgestatic.azureedge.net Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://www.microsoft.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-10-02 10:16:42 UTC	823	IN	HTTP/1.1 200 OK Date: Wed, 02 Oct 2024 10:16:42 GMT Content-Type: application/javascript; charset=UTF-8 Content-Length: 1643523 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Access-Control-Allow-Origin: * Cache-Control: public, max-age=31536000, immutable ETag: W/"191403-192442de12a" Last-Modified: Mon, 30 Sep 2024 18:25:10 GMT Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Origin-Agent-Cluster: ?1 X-Content-Type-Options: nosniff X-Download-Options: noopen X-Frame-Options: SAMEORIGIN X-Permitted-Cross-Domain-Policies: none X-XSS-Protection: 0 x-azure-ref: 20241002T101642Z-15767c5fc554wklc0x4mc5pq0w00000009t0000000003d0k x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-02 10:16:42 UTC	15561	IN	Data Raw: 28 77 69 6e 64 6f 77 2e 77 65 62 70 61 63 6b 4a 73 6f 6e 70 3d 77 69 6e 64 6f 77 2e 77 65 62 70 61 63 6b 4a 73 6f 6e 70 7c 7c 5b 5d 29 2e 70 75 73 68 28 5b 5b 31 5d 2c 7b 31 31 38 33 3a 66 75 6e 63 74 69 6f 6e 28 65 2c 6f 29 7b 7d 2c 31 32 33 35 3a 66 75 6e 63 74 69 6f 6e 28 65 2c 6f 2c 6e 29 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 6e 28 36 30 32 29 7d 2c 31 32 33 36 3a 66 75 6e 63 74 69 6f 6e 28 65 2c 6f 2c 6e 29 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 6e 28 36 30 34 29 7d 2c 31 32 33 37 3a 66 75 6e 63 74 69 6f 6e 28 65 2c 6f 2c 6e 29 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 6e 28 36 30 35 29 7d 2c 31 32 33 38 3a 66 75 6e 63 74 69 6f 6e 28 65 2c 6f 2c 6e 29 7b 65 2e 65 78 70 6f 72 74 73 3d 7b 7d 7d 2c 31 32 33 39 3a 66 75 6e 63 74 69 6f 6e 28 65 2c Data Ascii: (window.webpackJsonp=window.webpackJsonp\|\|[]).push([[1],{1183:function(e,o){},1235:function(e,o,n){"use strict";n(602)},1236:function(e,o,n){"use strict";n(604)},1237:function(e,o,n){"use strict";n(605)},1238:function(e,o,n){e.exports={}},1239:function(e,
2024-10-02 10:16:42 UTC	16384	IN	Data Raw: 2c 6e 28 31 32 29 2c 6e 28 32 39 29 2c 6e 28 34 29 29 2c 64 3d 6e 28 32 36 29 2c 63 3d 6e 28 32 31 39 29 2c 6d 3d 6e 28 33 35 33 29 2c 66 3d 6e 2e 6e 28 6d 29 2c 68 3d 6e 28 31 38 31 29 2c 77 3d 6e 2e 6e 28 68 29 2c 76 3d 28 6e 28 33 37 29 2c 6e 28 34 31 29 2c 6e 28 33 35 34 29 29 2c 79 3d 6e 28 31 32 36 29 2c 6b 3d 6e 28 31 38 29 3b 6e 28 32 38 29 3b 22 73 63 72 6f 6c 6c 52 65 73 74 6f 72 61 74 69 6f 6e 22 69 6e 20 77 69 6e 64 6f 77 2e 68 69 73 74 6f 72 79 26 26 28 4f 62 6a 65 63 74 28 6b 2e 75 29 28 22 6d 61 6e 75 61 6c 22 29 2c 77 69 6e 64 6f 77 2e 61 64 64 45 76 65 6e 74 4c 69 73 74 65 6e 65 72 28 22 62 65 66 6f 72 65 75 6e 6c 6f 61 64 22 2c 28 66 75 6e 63 74 69 6f 6e 28 29 7b 4f 62 6a 65 63 74 28 6b 2e 75 29 28 22 61 75 74 6f 22 29 7d 29 29 2c 77 69 Data Ascii: ,n(12),n(29),n(4)),d=n(26),c=n(219),m=n(353),f=n.n(m),h=n(181),w=n.n(h),v=(n(37),n(41),n(354)),y=n(126),k=n(18);n(28);"scrollRestoration"in window.history&&(Object(k.u)("manual"),window.addEventListener("beforeunload",(function(){Object(k.u)("auto")})),wi
2024-10-02 10:16:42 UTC	16384	IN	Data Raw: 3d 65 2e 64 6f 6e 65 2c 65 7d 2c 65 3a 66 75 6e 63 74 69 6f 6e 28 65 29 7b 75 3d 21 30 2c 6c 3d 65 7d 2c 66 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 74 72 79 7b 61 7c 7c 6e 75 6c 6c 3d 3d 6e 2e 72 65 74 75 72 6e 7c 7c 6e 2e 72 65 74 75 72 6e 28 29 7d 66 69 6e 61 6c 6c 79 7b 69 66 28 75 29 74 68 72 6f 77 20 6c 7d 7d 7d 7d 66 75 6e 63 74 69 6f 6e 20 48 28 65 2c 61 29 7b 28 6e 75 6c 6c 3d 3d 61 7c 7c 61 3e 65 2e 6c 65 6e 67 74 68 29 26 26 28 61 3d 65 2e 6c 65 6e 67 74 68 29 3b 66 6f 72 28 76 61 72 20 6f 3d 30 2c 6e 3d 41 72 72 61 79 28 61 29 3b 6f 3c 61 3b 6f 2b 2b 29 6e 5b 6f 5d 3d 65 5b 6f 5d 3b 72 65 74 75 72 6e 20 6e 7d 76 61 72 20 47 3d 7b 7d 2c 51 3d 7b 5f 66 6c 75 65 6e 74 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 50 72 6f 6d 69 73 65 2e 61 Data Ascii: =e.done,e},e:function(e){u=!0,l=e},f:function(){try{a\|\|null==n.return\|\|n.return()}finally{if(u)throw l}}}}function H(e,a){(null==a\|\|a>e.length)&&(a=e.length);for(var o=0,n=Array(a);o<a;o++)n[o]=e[o];return n}var G={},Q={_fluent:function(){return Promise.a
2024-10-02 10:16:42 UTC	16384	IN	Data Raw: 64 65 2d 64 65 22 2c 74 72 61 6e 73 6c 61 74 69 6f 6e 3a 22 64 65 22 7d 2c 7b 63 6f 64 65 3a 22 65 6c 2d 67 72 22 2c 69 73 6f 3a 22 65 6c 2d 67 72 22 2c 6c 61 6e 67 3a 22 65 6c 22 2c 66 69 6c 65 3a 22 65 6c 2d 67 72 2e 6a 73 6f 6e 22 2c 74 72 61 6e 73 6c 61 74 69 6f 6e 4c 6f 63 61 6c 65 3a 22 65 6c 2d 67 72 22 2c 74 72 61 6e 73 6c 61 74 69 6f 6e 3a 22 65 6c 22 7d 2c 7b 63 6f 64 65 3a 22 65 6e 2d 67 62 22 2c 69 73 6f 3a 22 65 6e 2d 67 62 22 2c 6c 61 6e 67 3a 22 65 6e 22 2c 66 69 6c 65 3a 22 65 6e 2d 67 62 2e 6a 73 6f 6e 22 2c 74 72 61 6e 73 6c 61 74 69 6f 6e 4c 6f 63 61 6c 65 3a 22 65 6e 2d 67 62 22 2c 74 72 61 6e 73 6c 61 74 69 6f 6e 3a 22 65 6e 22 7d 2c 7b 63 6f 64 65 3a 22 65 6e 2d 69 6e 22 2c 69 73 6f 3a 22 65 6e 2d 69 6e 22 2c 6c 61 6e 67 3a 22 65 6e Data Ascii: de-de",translation:"de"},{code:"el-gr",iso:"el-gr",lang:"el",file:"el-gr.json",translationLocale:"el-gr",translation:"el"},{code:"en-gb",iso:"en-gb",lang:"en",file:"en-gb.json",translationLocale:"en-gb",translation:"en"},{code:"en-in",iso:"en-in",lang:"en
2024-10-02 10:16:42 UTC	16384	IN	Data Raw: 74 6f 72 22 5d 3b 69 66 28 21 6e 29 7b 69 66 28 41 72 72 61 79 2e 69 73 41 72 72 61 79 28 65 29 7c 7c 28 6e 3d 66 75 6e 63 74 69 6f 6e 28 65 2c 61 29 7b 69 66 28 65 29 7b 69 66 28 22 73 74 72 69 6e 67 22 3d 3d 74 79 70 65 6f 66 20 65 29 72 65 74 75 72 6e 20 53 65 28 65 2c 61 29 3b 76 61 72 20 6f 3d 7b 7d 2e 74 6f 53 74 72 69 6e 67 2e 63 61 6c 6c 28 65 29 2e 73 6c 69 63 65 28 38 2c 2d 31 29 3b 72 65 74 75 72 6e 22 4f 62 6a 65 63 74 22 3d 3d 3d 6f 26 26 65 2e 63 6f 6e 73 74 72 75 63 74 6f 72 26 26 28 6f 3d 65 2e 63 6f 6e 73 74 72 75 63 74 6f 72 2e 6e 61 6d 65 29 2c 22 4d 61 70 22 3d 3d 3d 6f 7c 7c 22 53 65 74 22 3d 3d 3d 6f 3f 41 72 72 61 79 2e 66 72 6f 6d 28 65 29 3a 22 41 72 67 75 6d 65 6e 74 73 22 3d 3d 3d 6f 7c 7c 2f 5e 28 3f 3a 55 69 7c 49 29 6e 74 28 Data Ascii: tor"];if(!n){if(Array.isArray(e)\|\|(n=function(e,a){if(e){if("string"==typeof e)return Se(e,a);var o={}.toString.call(e).slice(8,-1);return"Object"===o&&e.constructor&&(o=e.constructor.name),"Map"===o\|\|"Set"===o?Array.from(e):"Arguments"===o\|\|/^(?:Ui\|I)nt(
2024-10-02 10:16:42 UTC	16384	IN	Data Raw: 38 6e 2e 6f 6e 4c 61 6e 67 75 61 67 65 53 77 69 74 63 68 65 64 28 63 2c 74 29 2c 4f 26 26 6d 28 4f 29 29 3b 63 61 73 65 20 34 30 3a 63 61 73 65 22 65 6e 64 22 3a 72 65 74 75 72 6e 20 65 2e 73 74 6f 70 28 29 7d 7d 29 2c 65 29 7d 29 29 29 3b 72 65 74 75 72 6e 20 66 75 6e 63 74 69 6f 6e 28 6f 29 7b 72 65 74 75 72 6e 20 65 2e 61 70 70 6c 79 28 74 68 69 73 2c 61 72 67 75 6d 65 6e 74 73 29 7d 7d 28 29 2c 50 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 65 3d 4f 62 6a 65 63 74 28 74 2e 61 29 28 72 65 67 65 6e 65 72 61 74 6f 72 52 75 6e 74 69 6d 65 2e 6d 61 72 6b 28 28 66 75 6e 63 74 69 6f 6e 20 65 28 74 29 7b 76 61 72 20 72 2c 70 61 74 68 2c 6c 2c 64 2c 63 3b 72 65 74 75 72 6e 20 72 65 67 65 6e 65 72 61 74 6f 72 52 75 6e 74 69 6d 65 2e 77 72 61 70 28 28 66 75 Data Ascii: 8n.onLanguageSwitched(c,t),O&&m(O));case 40:case"end":return e.stop()}}),e)})));return function(o){return e.apply(this,arguments)}}(),P=function(){var e=Object(t.a)(regeneratorRuntime.mark((function e(t){var r,path,l,d,c;return regeneratorRuntime.wrap((fu
2024-10-02 10:16:42 UTC	16384	IN	Data Raw: 6c 61 62 65 6c 32 4f 76 65 72 72 69 64 65 3f 74 68 69 73 2e 73 75 62 6c 61 62 65 6c 32 4f 76 65 72 72 69 64 65 3a 74 68 69 73 2e 69 73 4f 6e 48 6f 6d 65 50 61 67 65 26 26 74 68 69 73 2e 69 73 4c 69 6e 75 78 7c 7c 74 68 69 73 2e 6e 6f 74 53 75 70 70 6f 72 74 65 64 3f 22 22 3a 74 68 69 73 2e 66 65 61 74 75 72 65 64 50 6c 61 74 66 6f 72 6d 2e 6e 61 6d 65 4c 69 6e 65 32 7d 2c 69 73 4c 69 6e 75 78 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 65 3d 5b 22 6c 69 6e 75 78 2d 72 70 6d 22 2c 22 6c 69 6e 75 78 2d 64 65 62 22 5d 2e 69 6e 63 6c 75 64 65 73 28 74 68 69 73 2e 66 65 61 74 75 72 65 64 50 6c 61 74 66 6f 72 6d 2e 69 64 29 3b 72 65 74 75 72 6e 20 65 7d 7d 29 2c 6d 65 74 68 6f 64 73 3a 55 61 28 55 61 28 7b 7d 2c 4f 62 6a 65 63 74 28 64 2e 62 29 28 7b 6f 70 Data Ascii: label2Override?this.sublabel2Override:this.isOnHomePage&&this.isLinux\|\|this.notSupported?"":this.featuredPlatform.nameLine2},isLinux:function(){var e=["linux-rpm","linux-deb"].includes(this.featuredPlatform.id);return e}}),methods:Ua(Ua({},Object(d.b)({op
2024-10-02 10:16:42 UTC	16384	IN	Data Raw: 69 6f 6e 28 29 7b 72 65 74 75 72 6e 5b 5d 7d 7d 7d 2c 69 31 38 6e 3a 7b 6d 65 73 73 61 67 65 73 3a 79 6f 2e 61 7d 2c 64 61 74 61 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 7b 73 65 6c 65 63 74 65 64 56 65 72 73 69 6f 6e 49 64 3a 6e 75 6c 6c 2c 73 65 6c 65 63 74 65 64 42 75 69 6c 64 49 64 3a 6e 75 6c 6c 2c 73 65 6c 65 63 74 65 64 50 6c 61 74 66 6f 72 6d 49 64 3a 6e 75 6c 6c 7d 7d 2c 63 6f 6d 70 75 74 65 64 3a 7b 76 65 72 73 69 6f 6e 73 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 65 3d 74 68 69 73 2c 6f 3d 74 68 69 73 2e 6d 61 6a 6f 72 52 65 6c 65 61 73 65 73 2e 6d 61 70 28 28 66 75 6e 63 74 69 6f 6e 28 6f 2c 6e 29 7b 72 65 74 75 72 6e 7b 69 64 3a 6f 2e 63 68 61 6e 6e 65 6c 49 64 2b 22 2d 22 2b 6f 2e 6d 61 6a 6f 72 56 65 72 73 69 6f 6e 2c 6c Data Ascii: ion(){return[]}}},i18n:{messages:yo.a},data:function(){return{selectedVersionId:null,selectedBuildId:null,selectedPlatformId:null}},computed:{versions:function(){var e=this,o=this.majorReleases.map((function(o,n){return{id:o.channelId+"-"+o.majorVersion,l
2024-10-02 10:16:42 UTC	16384	IN	Data Raw: 6e 28 22 6c 61 62 65 6c 22 2c 7b 6b 65 79 3a 71 2e 69 64 2c 73 74 61 74 69 63 43 6c 61 73 73 3a 22 63 2d 6c 61 62 65 6c 22 2c 61 74 74 72 73 3a 7b 66 6f 72 3a 71 2e 69 64 7d 7d 2c 5b 6e 28 22 69 6e 70 75 74 22 2c 7b 64 69 72 65 63 74 69 76 65 73 3a 5b 7b 6e 61 6d 65 3a 22 6d 6f 64 65 6c 22 2c 72 61 77 4e 61 6d 65 3a 22 76 2d 6d 6f 64 65 6c 22 2c 76 61 6c 75 65 3a 65 2e 75 6e 69 6e 73 74 61 6c 6c 52 65 61 73 6f 6e 2c 65 78 70 72 65 73 73 69 6f 6e 3a 22 75 6e 69 6e 73 74 61 6c 6c 52 65 61 73 6f 6e 22 7d 5d 2c 61 74 74 72 73 3a 7b 22 61 72 69 61 2d 73 65 74 73 69 7a 65 22 3a 22 37 22 2c 69 64 3a 71 2e 69 64 2c 6e 61 6d 65 3a 22 75 6e 69 6e 73 74 61 6c 6c 2d 72 65 61 73 6f 6e 30 22 2c 74 79 70 65 3a 22 72 61 64 69 6f 22 7d 2c 64 6f 6d 50 72 6f 70 73 3a 7b 76 Data Ascii: n("label",{key:q.id,staticClass:"c-label",attrs:{for:q.id}},[n("input",{directives:[{name:"model",rawName:"v-model",value:e.uninstallReason,expression:"uninstallReason"}],attrs:{"aria-setsize":"7",id:q.id,name:"uninstall-reason0",type:"radio"},domProps:{v
2024-10-02 10:16:42 UTC	16384	IN	Data Raw: 7b 63 6c 69 63 6b 3a 66 75 6e 63 74 69 6f 6e 28 6f 29 7b 72 65 74 75 72 6e 20 65 2e 68 69 64 65 4d 6f 64 61 6c 28 22 63 6f 6e 66 69 72 6d 2d 63 6c 6f 73 65 22 29 7d 7d 7d 2c 5b 65 2e 5f 76 28 22 5c 6e 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 2b 65 2e 5f 73 28 65 2e 73 74 72 69 6e 67 73 2e 63 6c 6f 73 65 29 2b 22 5c 6e 20 20 20 20 20 20 20 20 20 20 20 20 22 29 5d 29 5d 29 5d 29 5d 2c 31 29 7d 29 2c 5b 5d 2c 21 31 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 29 2e 65 78 70 6f 72 74 73 29 2c 62 6e 3d 6e 28 37 35 37 29 2c 68 6e 3d 7b 6e 61 6d 65 3a 22 62 6c 6f 63 6b 2d 77 65 62 76 69 65 77 32 22 2c 63 6f 6d 70 6f 6e 65 6e 74 73 3a 7b 43 6f 6d 6d 6f 6e 48 65 61 64 69 6e 67 3a 69 6f 2e 61 2c 43 6f 6d 6d 6f 6e 43 61 72 64 3a 75 6f 2e 61 2c 43 6f 6d 6d Data Ascii: {click:function(o){return e.hideModal("confirm-close")}}},[e._v("\n "+e._s(e.strings.close)+"\n ")])])])],1)}),[],!1,null,null,null).exports),bn=n(757),hn={name:"block-webview2",components:{CommonHeading:io.a,CommonCard:uo.a,Comm

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
39	192.168.2.16	49800	77.75.76.70	443	3540	C:\Users\user\AppData\Roaming\Seznam.cz\sznsetup.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-02 10:16:42 UTC	121	OUT	GET /update/cz.seznam.software.szndesktop-2.0.32-win32.zip HTTP/1.1 Host: download.seznam.cz Connection: Keep-Alive
2024-10-02 10:16:42 UTC	269	IN	HTTP/1.1 200 OK server: envoy date: Wed, 02 Oct 2024 10:16:42 GMT content-type: application/zip content-length: 48179 last-modified: Fri, 27 Sep 2024 10:06:27 GMT etag: "66f683a3-bc33" accept-ranges: bytes x-envoy-upstream-service-time: 0 connection: close
2024-10-02 10:16:42 UTC	13633	IN	Data Raw: 50 4b 03 04 14 00 02 00 08 00 3d 7c 7b 4c bf 7e 68 91 d6 00 00 00 4e 01 00 00 0b 00 00 00 63 6f 6e 74 72 6f 6c 2e 69 6e 69 85 4f bd 0a c2 30 10 de 03 79 87 8c ba 04 5b 71 cc e6 e0 a0 22 e8 a4 38 5c db b3 c6 c6 34 24 a9 42 f1 4d 9c 1c 1c 7d 0a f5 bd 8c 58 75 11 9c ee e3 ee fb b9 6f 61 20 2d 20 c7 25 25 1a b6 28 d2 9a 3b ac 03 e4 ae 5c f9 3d 58 e4 ae d6 19 ba c2 97 86 92 1d 5a 27 4b 2d 62 de e1 dd 98 12 a9 9d 07 a5 44 33 79 02 9e 92 4a bf d7 1f f4 3a 18 05 7e 55 da ad d8 4b fd 54 67 68 50 67 ee 57 a8 92 c9 37 97 b5 62 1e f1 6e a7 4d 89 b7 32 cf c3 13 7f 35 94 80 31 e3 67 a5 7e 63 32 98 cd 26 6c 8a 36 74 60 2d 30 4a 16 90 62 fb 30 87 8d bc 9f ee e7 6a 83 2c b9 1d d7 81 37 1a f6 58 43 b8 5e 98 06 d6 78 56 a1 b0 0b 29 c2 db 0a 3f e5 d1 8a 28 bc 17 f5 28 79 00 Data Ascii: PK=\|{L~hNcontrol.iniO0y[q"8\4$BM}Xuoa - %%(;\=XZ'K-bD3yJ:~UKTghPgW7bnM251g~c2&l6t`-0Jb0j,7XC^xV)?((y
2024-10-02 10:16:42 UTC	6940	IN	Data Raw: 19 82 0d ec 55 a7 0d 3d ec 3c 33 96 bd 3d 3a f3 dc ef 7e 73 8d 20 10 58 af bb 1f 71 6a 11 b6 b8 00 ab 1c 00 96 6b aa 96 27 e1 70 0e 38 23 ae c5 07 81 a1 05 c1 a3 3d 08 0c f6 b1 f8 a5 4d 2e b4 8d 2f cd 77 24 02 a7 9f 24 bb ef b3 88 23 86 5c f9 69 d8 a5 02 ad 89 40 c7 93 74 18 7f 10 3f 65 00 5d 67 5f 87 a1 d4 9a 88 ee 03 a7 90 a8 80 02 0d 31 b1 b3 b8 d5 c0 73 6f 6a 39 08 2f 0a c0 ee 82 fc 12 e8 4e 38 f0 92 98 a3 8f 11 35 ad 1f 1a 49 24 18 94 40 b4 9b 02 3f 88 b4 ef d1 81 f6 b9 0d cb 28 28 fb a9 d6 8f 9d 2c 70 6a 4e 33 36 69 44 cb 2c c3 5f b4 23 c3 8a 18 fc 76 06 8a 70 e4 a1 23 ed cf 20 5b 78 16 f4 50 a0 c9 0a b7 81 b1 8b be 65 2e fe 9b af c6 04 84 ef 2d b0 05 38 6f d8 4a 88 af c5 47 ea 9b f0 8b ad 95 77 f9 6e 46 18 e8 bc 46 22 67 cf da d8 eb be 19 38 62 91 Data Ascii: U=<3=:~s Xqjk'p8#=M./w$$#\i@t?e]g_1soj9/N85I$@?((,pjN36iD,_#vp# [xPe.-8oJGwnFF"g8b
2024-10-02 10:16:42 UTC	6940	IN	Data Raw: a7 b8 88 7d 0a b5 1a ee cf a3 e0 cf dd 29 9b 9d 69 e7 11 8c 3d 70 25 b4 08 4e dd 4f 5f d4 b2 0e e1 ba cd fe 97 c0 60 8b af 6b fb 60 82 ff de 18 29 b9 c8 df c1 92 b9 d3 af 34 3a 4f 92 3e 7e 8f 21 64 a3 63 80 d6 9b f5 41 16 53 fc 8f bb 30 a0 89 0e 7a 3d 06 2a fc 5d de fb 4d f5 c6 db 3f f6 b2 55 7b 36 25 0c be 9f d1 69 f1 52 28 c0 4b 42 0b 2d f9 df 00 0f 36 55 8c 89 b8 00 33 77 00 d1 e2 44 f8 d3 cd 1b 8b d8 87 e1 a4 fe 6e ca 6e 37 cb 0e 4a cd 37 d5 67 f9 f2 0d b7 e7 1b bd f9 06 62 fc 1e 85 b7 b9 03 a0 f5 21 c2 e8 f7 e5 f6 1f cc 2c ad db d3 ef 9e 28 2e a8 e2 cb bd 78 d6 ff 23 fa 86 c2 e1 97 b2 b7 f3 9c 61 1f 0d d0 4e 47 fe 57 04 a1 7c 31 4a 6c 11 dc 34 2b c5 7c 5f 6c 0e 8e 0f 9e a6 14 5b ae 20 78 de ed 98 a8 23 9c 83 89 48 f1 5c cc e8 6c 3c ed c6 51 dc bd e3 Data Ascii: })i=p%NO_`k`)4:O>~!dcAS0z=*]M?U{6%iR(KB-6U3wDnn7J7gb!,(.x#aNGW\|1Jl4+\|_l[ x#H\l<Q
2024-10-02 10:16:42 UTC	1388	IN	Data Raw: 2b db a0 5d d7 e6 e9 d6 70 b9 49 17 bd d3 94 fc 0c 28 bf 25 51 99 96 8e 7c 7b 11 bb 64 6e e0 fa 56 97 b7 1d ba 69 10 f3 4b 90 5d 5b 4e ba 4d 50 f2 b2 40 de 26 94 2f af 48 5b be 0b d0 89 7b a3 76 bd da a8 0e a0 bb 43 80 6e e8 eb 12 78 9f 53 e9 83 b6 a3 e0 9d 2e 96 2b 51 d4 5d 13 6c a5 09 bc 2f a1 6c cf 80 2e 0f c7 16 e0 5c 9a ac a4 27 1d b6 23 de 0f 82 c7 04 0d 19 dc 93 94 b6 93 0a 7e 79 24 0b ea eb 28 64 d9 0f e8 9c 42 31 2f ea 15 d7 0c a6 91 69 47 45 5b ea 2d d4 d6 41 ea ac 48 7d d2 a4 29 36 c8 d8 0a 59 fb 12 69 c5 85 08 8d 54 df ce 1b 95 32 0d a0 6c 7a e0 27 23 bf 42 d3 48 fd ac 43 fb 3a 17 c7 ed 4e ce b3 61 14 9b a1 3a 4c 17 db 9a 5e 75 cd 10 cf 69 4c e2 b5 a1 02 d8 02 78 16 8f 52 87 2b e3 bf 98 ae d4 9b 73 33 8d ab 95 e9 24 37 c9 48 2b 26 44 69 e4 19 Data Ascii: +]pI(%Q\|{dnViK][NMP@&/H[{vCnxS.+Q]l/l.\'#~y$(dB1/iGE[-AH})6YiT2lz'#BHC:Na:L^uiLxR+s3$7H+&Di
2024-10-02 10:16:42 UTC	5552	IN	Data Raw: 52 e9 86 ee 89 d0 fd 8f fa bb b5 db 5c 9f ca 4e 9b 50 47 2b 21 7f 61 ca 48 bb f0 ab 6c 25 47 cc ab b0 44 9b 77 da 4d 91 32 52 1d 3c 03 da 1e b2 19 0d fd f8 35 7c cd fc d9 4a bf 98 78 53 44 0f a6 31 f4 40 1b e9 92 f4 96 36 4a b9 d3 70 8d 6c 49 4b a7 72 fb a2 7c 1b 6e 56 96 a3 5d 65 13 64 57 64 43 5a e5 a2 8d ec 5e ab 6f a2 b6 40 fa d6 bc 67 a5 d2 bd 7c 23 db 23 3b 93 da f9 12 61 ec 76 4e f1 02 c5 06 d4 66 b5 6c 96 da 31 b5 35 2d 19 07 64 fe 86 b6 63 a3 e8 6c 58 e5 33 48 ef 69 b2 34 ca d7 25 d3 eb f8 f3 68 5b 2f c0 fe 00 93 7f 0d 3f 00 a8 01 1c 05 74 03 c6 ff 46 10 d6 00 bc 80 1e 40 42 0f fc 15 7d 3c 04 e8 a4 a9 bd 7f 2b 08 0e c0 31 c0 1b 80 19 2f 0a c2 dd 80 27 00 03 00 c3 4b c0 07 1c 01 9c 05 f8 01 89 bd e8 23 01 df 04 9c 05 f8 01 89 2f 0b 42 1e a0 1e f0 Data Ascii: R\NPG+!aHl%GDwM2R<5\|JxSD1@6JplIKr\|nV]edWdCZ^o@g\|##;avNfl15-dclX3Hi4%h[/?tF@B}<+1/'K#/B
2024-10-02 10:16:42 UTC	1388	IN	Data Raw: 4d f5 30 47 87 28 dd ac c9 8b 3e 1f 57 d1 3e 82 b8 c8 0d 37 d6 9c e7 b2 54 a2 8f 90 65 ac 7b 68 50 38 4c be d5 43 82 e4 b0 95 ac 55 66 c5 7f 93 a3 8c ee 6c ee be be 2b 4a e6 b5 a4 9a f0 cd f4 e4 a8 52 a3 d5 cd 46 c9 66 f0 93 cc 08 3d 4b d2 8c 00 99 92 66 0c 29 87 cd 36 c3 6f 37 d4 19 cd 82 fa e9 22 97 94 9c 93 92 e4 19 f2 12 79 b9 dc 27 7f 56 fe a2 bc 55 7e 51 5e ab 68 54 b4 29 c6 2b 27 29 63 94 26 e5 0a 65 ad f2 0d 65 b3 b2 5d 79 50 79 52 79 5a f9 85 32 42 95 a3 9a af aa 52 b5 a9 0e aa 6e aa e6 a8 17 aa cd ea a7 d5 cf a8 6b d5 4d ea 4e b5 26 2e 3d ee f1 b8 9e b8 ef e2 6e d3 c4 68 94 1a 46 33 5f 63 d2 2c d7 ac d1 bc a1 79 47 33 a0 19 1f 3f 39 5e 11 9f 16 bf 22 7e 77 fc d9 f8 cb f1 e3 b5 13 b5 53 b4 51 5a b5 f6 69 ad 57 bb 5a db a0 7d 47 fb 81 76 bf f6 a4 Data Ascii: M0G(>W>7Te{hP8LCUfl+JRFf=Kf)6o7"y'VU~Q^hT)+')c&ee]yPyRyZ2BRnkMN&.=nhF3_c,yG3?9^"~wSQZiWZ}Gv
2024-10-02 10:16:42 UTC	8328	IN	Data Raw: 25 8f c1 8c 5c 22 eb c8 cf a4 1c 30 69 10 65 46 8d a2 3c a9 05 d4 0e e0 d1 31 ea 0c d5 48 b5 51 1c 60 50 15 bb 99 3d 05 28 73 90 73 91 73 9f d3 c1 2b e6 5f e2 6f e9 d1 11 3c 44 84 b8 bf a5 8d 40 5c 91 30 64 11 92 8e 6c 40 ee 21 2f 90 77 c8 17 c4 0d 4d 47 b3 d0 6d 40 d7 db 68 3d d0 41 34 63 e6 18 86 d9 60 14 3e 11 0f c4 17 e2 4b f1 d5 78 2e be 13 2f c6 d5 89 dd c4 51 a2 9c b8 48 dc 21 5e 10 8a 4c 16 53 08 5a da 0d 4f f7 9a d9 01 cf 26 cf 1a c4 62 b1 46 b1 22 c4 aa b2 25 dd c8 4d e4 6e f2 28 79 9a ec 22 c7 51 d3 a9 79 c0 d1 0f 94 14 db 94 4d 01 3d 1b d8 4d 70 d7 2d 6c 39 8e 36 67 22 37 90 9b c2 cd e3 5e e2 de e2 3e e4 8e e2 4d e4 45 f2 b2 79 5b c1 15 47 78 d2 7c 4d e0 21 8f 3f 9a 3f 95 1f ca 5f cc 5f c9 5f cf bf c6 bf cf 57 10 68 0b 8c 05 e6 02 9e 40 d4 89 Data Ascii: %\"0ieF<1HQ`P=(sss+_o<D@\0dl@!/wMGm@h=A4c`>Kx./QH!^LSZO&bF"%Mn(y"QyM=Mp-l96g"7^>MEy[Gx\|M!??___Wh@
2024-10-02 10:16:42 UTC	2776	IN	Data Raw: 01 43 3c 9f a7 19 0e 3a f5 a1 72 ff 87 53 cb 8a fb f7 5f 33 c8 70 77 74 f0 99 e8 23 41 4b 76 2d 44 3a 02 fe 28 7e 46 09 5a ef 9c e9 1c d0 15 e5 a1 c9 f4 58 56 ef ba 42 aa 7d fa 95 4b 73 16 aa 55 dd 55 9e ad d7 e0 7f f1 b8 66 fb 8d 63 0d 69 37 2d 4c ab 06 33 94 6c 8f 2a 3c b5 3e 9b d4 98 36 cf 2d e4 9c 9d 7f f2 82 20 fb f4 61 e6 d7 bc 5b d3 1d fd 8e 07 2f fe 32 8b 16 d7 cf 24 58 0d 49 a2 5c fe f0 9a 70 b1 c2 f5 ce 1e 6a a9 fd 08 9f 2e e7 a8 1d 8e 15 6b 82 bb 62 b3 37 1c 78 9f ae ec 71 1c bf a7 7c 61 f8 2d a9 d8 f3 27 d8 fb 56 77 bc ff 98 ed c3 09 d8 f9 66 a8 c7 99 26 9b f7 6e 7f 9e 32 23 ba a6 76 f4 46 33 4d 18 11 b5 ef f1 05 d2 88 11 32 f8 d7 69 04 fb 1e 36 7e b9 ea 85 75 87 b2 61 88 19 32 34 6f 48 9e 51 ea e0 de 77 a2 7d 62 ca 8f 6b 5e ff b0 5e f5 f3 92 Data Ascii: C<:rS_3pwt#AKv-D:(~FZXVB}KsUUfci7-L3l*<>6- a[/2$XI\pj.kb7xq\|a-'Vwf&n2#vF3M2i6~ua24oHQw}bk^^
2024-10-02 10:16:42 UTC	1234	IN	Data Raw: 0a 99 e0 e7 71 e3 0f 49 8b f3 87 f7 fe 19 62 74 73 8b 92 8a 76 c8 be c5 d3 82 bf b8 2c 3e b3 6c 3c ba d7 bb f6 62 f4 f8 67 1e 21 86 a7 27 2c 08 bf 24 bd 57 38 fa a8 e1 9c c0 e6 66 d6 9f d9 6b 93 4d 2c be 9c c8 d9 23 41 dd 3a 30 c4 66 a3 9c 5b 8b 99 c7 62 cf 29 af 16 3b d8 0e 5e f2 fc 61 c9 2d 93 83 f3 6c dc 3c e7 ae 1c 8f 4a 3b 67 49 8d 3c 7f 95 27 d5 7c 94 f6 27 c7 b0 a2 24 fc f9 bb a2 65 1b 7b f1 57 09 23 72 ee a7 af 18 fc df 02 9d 4d 37 b8 d8 08 89 30 f3 f0 3c 34 d5 fa ef bf 2d 10 15 e4 07 73 6e d9 fd a5 01 31 c2 fe dd 2f 43 c4 f6 41 ea 2c 24 f8 bf f4 65 08 6e 9f 26 cc fa ef bf 0c f1 d3 0d 06 46 fe db 38 65 f5 c1 e9 0e 35 89 dd 5b 16 57 eb 84 69 e8 4f e5 a2 7b e6 b2 68 f3 f4 7e c0 e9 2f 79 fb 0b 9c 8e da 7c a0 a5 74 db d4 6d eb 1d ae 15 0c 1d 33 f8 ca Data Ascii: qIbtsv,>l<bg!',$W8fkM,#A:0f[b);^a-l<J;gI<'\|'$e{W#rM70<4-sn1/CA,$en&F8e5[WiO{h~/y\|tm3

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
40	192.168.2.16	49801	13.107.246.40	443	4912	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-02 10:16:42 UTC	581	OUT	GET /shared/edgeweb/6e93679.js HTTP/1.1 Host: edgestatic.azureedge.net Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://www.microsoft.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-10-02 10:16:42 UTC	821	IN	HTTP/1.1 200 OK Date: Wed, 02 Oct 2024 10:16:42 GMT Content-Type: application/javascript; charset=UTF-8 Content-Length: 101554 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Access-Control-Allow-Origin: * Cache-Control: public, max-age=31536000, immutable ETag: W/"18cb2-19245e6bb8c" Last-Modified: Tue, 01 Oct 2024 02:26:42 GMT Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Origin-Agent-Cluster: ?1 X-Content-Type-Options: nosniff X-Download-Options: noopen X-Frame-Options: SAMEORIGIN X-Permitted-Cross-Domain-Policies: none X-XSS-Protection: 0 x-azure-ref: 20241002T101642Z-15767c5fc55xsgnlxyxy40f4m0000000095g00000000ev6z x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-02 10:16:42 UTC	15563	IN	Data Raw: 28 77 69 6e 64 6f 77 2e 77 65 62 70 61 63 6b 4a 73 6f 6e 70 3d 77 69 6e 64 6f 77 2e 77 65 62 70 61 63 6b 4a 73 6f 6e 70 7c 7c 5b 5d 29 2e 70 75 73 68 28 5b 5b 39 31 5d 2c 7b 31 33 39 37 3a 66 75 6e 63 74 69 6f 6e 28 65 2c 74 2c 6e 29 7b 65 2e 65 78 70 6f 72 74 73 3d 7b 7d 7d 2c 31 34 30 35 3a 66 75 6e 63 74 69 6f 6e 28 65 2c 74 2c 6e 29 7b 65 2e 65 78 70 6f 72 74 73 3d 6e 2e 70 2b 22 69 6d 67 2f 61 72 72 6f 77 2d 6c 65 66 74 2e 30 61 66 30 35 39 64 2e 73 76 67 22 7d 2c 31 34 30 36 3a 66 75 6e 63 74 69 6f 6e 28 65 2c 74 2c 6e 29 7b 65 2e 65 78 70 6f 72 74 73 3d 6e 2e 70 2b 22 69 6d 67 2f 61 72 72 6f 77 2d 72 69 67 68 74 2e 39 36 62 35 36 34 64 2e 73 76 67 22 7d 2c 31 34 30 37 3a 66 75 6e 63 74 69 6f 6e 28 65 29 7b 65 2e 65 78 70 6f 72 74 73 3d 4a 53 4f 4e Data Ascii: (window.webpackJsonp=window.webpackJsonp\|\|[]).push([[91],{1397:function(e,t,n){e.exports={}},1405:function(e,t,n){e.exports=n.p+"img/arrow-left.0af059d.svg"},1406:function(e,t,n){e.exports=n.p+"img/arrow-right.96b564d.svg"},1407:function(e){e.exports=JSON
2024-10-02 10:16:42 UTC	16384	IN	Data Raw: 20 d0 90 d0 ba d0 be 20 d0 bf d1 80 d0 b5 d0 b4 d0 bf d0 be d1 87 d0 b8 d1 82 d0 b0 d1 82 d0 b5 20 d0 b4 d0 b0 20 d0 b2 d0 b8 d0 b4 d0 b8 d1 82 d0 b5 20 d1 82 d0 be d0 b2 d0 b0 20 d1 81 d1 8a d0 b4 d1 8a d1 80 d0 b6 d0 b0 d0 bd d0 b8 d0 b5 20 d0 bd d0 b0 20 d0 b0 d0 bd d0 b3 d0 bb d0 b8 d0 b9 d1 81 d0 ba d0 b8 20 d0 b5 d0 b7 d0 b8 d0 ba 2c 20 d0 bc d0 be d0 b6 d0 b5 d1 82 d0 b5 20 d0 b4 d0 b0 20 d1 81 d0 ba d1 80 d0 b8 d0 b5 d1 82 d0 b5 20 d0 bf d1 80 d0 b5 d0 b2 d0 be d0 b4 d0 b8 d1 82 d0 b5 20 d1 81 20 d0 bf d0 be d0 bc d0 be d1 89 d1 82 d0 b0 20 d0 bd d0 b0 20 d1 82 d0 be d0 b7 d0 b8 20 d0 bf d1 80 d0 b5 d0 b2 d0 ba d0 bb d1 8e d1 87 d0 b2 d0 b0 d1 82 d0 b5 d0 bb 2e 22 7d 2c 22 62 6e 2d 69 6e 22 3a 7b 22 68 69 64 65 2d 74 72 61 6e 73 6c 61 74 69 6f 6e Data Ascii: , ."},"bn-in":{"hide-translation
2024-10-02 10:16:42 UTC	16384	IN	Data Raw: 2d 74 72 61 6e 73 6c 61 74 69 6f 6e 22 3a 22 eb b2 88 ec 97 ad 20 ed 91 9c ec 8b 9c 22 2c 22 77 65 2d 68 61 76 65 2d 75 73 65 64 2d 61 75 74 6f 6d 61 74 69 63 2d 74 72 61 6e 73 6c 61 74 69 6f 6e 22 3a 22 ec 9d b4 20 ed 8e 98 ec 9d b4 ec a7 80 ec 9d 98 20 ec 9d bc eb b6 80 20 ec a0 95 eb b3 b4 ec 97 90 20 eb 8c 80 ed 95 b4 20 ec 9e 90 eb 8f 99 20 eb b2 88 ec 97 ad ec 9d 84 20 ec 82 ac ec 9a a9 ed 96 88 ec 8a b5 eb 8b 88 eb 8b a4 2e 20 ec 9d b4 20 ec bd 98 ed 85 90 ec b8 a0 eb a5 bc 20 ec 98 81 ec 96 b4 eb a1 9c 20 eb b3 b4 eb a0 a4 eb a9 b4 20 ec 9d b4 20 ed 86 a0 ea b8 80 ec 9d 84 20 ec 82 ac ec 9a a9 ed 95 98 ec 97 ac 20 eb b2 88 ec 97 ad ec 9d 84 20 ec 88 a8 ea b8 b8 20 ec 88 98 20 ec 9e 88 ec 8a b5 eb 8b 88 eb 8b a4 2e 22 7d 2c 22 6c 62 2d 6c 75 22 3a Data Ascii: -translation":" ","we-have-used-automatic-translation":" . ."},"lb-lu":
2024-10-02 10:16:42 UTC	16384	IN	Data Raw: 2c 20 e0 b0 ae e0 b1 80 e0 b0 b0 e0 b1 81 20 e0 b0 88 20 e0 b0 9f e0 b1 8b e0 b0 97 e0 b0 bf e0 b0 b2 e0 b1 8d 20 e0 b0 89 e0 b0 aa e0 b0 af e0 b1 8b e0 b0 97 e0 b0 bf e0 b0 82 e0 b0 9a e0 b0 bf 20 e0 b0 85 e0 b0 a8 e0 b1 81 e0 b0 b5 e0 b0 be e0 b0 a6 e0 b0 be e0 b0 b2 e0 b0 a8 e0 b1 81 20 e0 b0 a6 e0 b0 be e0 b0 9a e0 b0 b5 e0 b0 9a e0 b1 8d e0 b0 9a e0 b1 81 2e 22 7d 2c 22 74 68 2d 74 68 22 3a 7b 22 68 69 64 65 2d 74 72 61 6e 73 6c 61 74 69 6f 6e 73 22 3a 22 e0 b8 8b e0 b9 88 e0 b8 ad e0 b8 99 e0 b8 84 e0 b9 8d e0 b8 b2 e0 b9 81 e0 b8 9b e0 b8 a5 22 2c 22 73 65 65 2d 74 68 69 73 2d 70 61 67 65 2d 69 6e 2d 65 6e 67 6c 69 73 68 22 3a 22 e0 b8 94 e0 b8 b9 e0 b8 ab e0 b8 99 e0 b9 89 e0 b8 b2 e0 b8 99 e0 b8 b5 e0 b9 89 e0 b9 80 e0 b8 9b e0 b9 87 e0 b8 99 e0 Data Ascii: , ."},"th-th":{"hide-translations":"","see-this-page-in-english":"
2024-10-02 10:16:42 UTC	16384	IN	Data Raw: 6e 28 65 2c 74 2c 6e 29 7b 65 2e 65 78 70 6f 72 74 73 3d 6e 2e 70 2b 22 69 6d 67 2f 70 68 6f 6e 65 2d 6f 75 74 67 6f 69 6e 67 2e 61 35 38 38 62 66 31 2e 73 76 67 22 7d 2c 31 38 34 36 3a 66 75 6e 63 74 69 6f 6e 28 65 2c 74 2c 6e 29 7b 65 2e 65 78 70 6f 72 74 73 3d 6e 2e 70 2b 22 69 6d 67 2f 70 68 6f 6e 65 2e 63 30 32 65 34 35 61 2e 73 76 67 22 7d 2c 31 38 34 37 3a 66 75 6e 63 74 69 6f 6e 28 65 2c 74 2c 6e 29 7b 65 2e 65 78 70 6f 72 74 73 3d 6e 2e 70 2b 22 69 6d 67 2f 70 69 65 2d 63 68 61 72 74 2e 63 39 61 30 39 66 39 2e 73 76 67 22 7d 2c 31 38 34 38 3a 66 75 6e 63 74 69 6f 6e 28 65 2c 74 2c 6e 29 7b 65 2e 65 78 70 6f 72 74 73 3d 6e 2e 70 2b 22 69 6d 67 2f 70 6c 61 79 2e 62 63 37 61 65 61 31 2e 73 76 67 22 7d 2c 31 38 34 39 3a 66 75 6e 63 74 69 6f 6e 28 65 Data Ascii: n(e,t,n){e.exports=n.p+"img/phone-outgoing.a588bf1.svg"},1846:function(e,t,n){e.exports=n.p+"img/phone.c02e45a.svg"},1847:function(e,t,n){e.exports=n.p+"img/pie-chart.c9a09f9.svg"},1848:function(e,t,n){e.exports=n.p+"img/play.bc7aea1.svg"},1849:function(e
2024-10-02 10:16:42 UTC	16384	IN	Data Raw: 6e 28 65 2c 74 2c 6e 29 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 6e 28 35 35 29 2c 6e 28 31 37 29 2c 6e 28 39 31 29 2c 6e 28 31 35 31 39 29 2c 6e 28 31 29 2c 6e 28 35 38 29 3b 76 61 72 20 6f 3d 6e 28 32 33 29 2c 72 3d 6e 28 37 29 2c 63 3d 6e 28 33 36 32 29 2c 6c 3d 5b 33 32 30 2c 33 37 35 2c 34 31 34 2c 37 36 38 2c 31 30 32 34 2c 31 32 38 30 2c 31 34 34 30 2c 31 36 30 30 2c 31 37 38 30 2c 31 39 32 30 2c 32 35 36 30 2c 33 38 34 30 5d 2c 64 3d 5b 34 34 30 2c 35 32 30 2c 36 34 30 2c 37 33 36 2c 31 30 32 34 2c 37 36 38 2c 38 34 30 2c 39 32 30 2c 31 30 38 30 2c 31 34 34 30 2c 32 31 36 30 5d 2c 68 3d 5b 31 2c 31 2e 35 2c 31 2e 37 35 2c 32 2c 32 2e 31 2c 32 2e 32 2c 32 2e 33 2c 32 2e 34 2c 32 2e 35 2c 32 2e 37 35 2c 33 5d 2c 6d 3d 7b 6e 61 6d 65 3a 22 72 65 73 Data Ascii: n(e,t,n){"use strict";n(55),n(17),n(91),n(1519),n(1),n(58);var o=n(23),r=n(7),c=n(362),l=[320,375,414,768,1024,1280,1440,1600,1780,1920,2560,3840],d=[440,520,640,736,1024,768,840,920,1080,1440,2160],h=[1,1.5,1.75,2,2.1,2.2,2.3,2.4,2.5,2.75,3],m={name:"res
2024-10-02 10:16:42 UTC	4071	IN	Data Raw: 6f 2e 61 29 28 65 2c 74 2c 6e 5b 74 5d 29 7d 29 29 3a 4f 62 6a 65 63 74 2e 67 65 74 4f 77 6e 50 72 6f 70 65 72 74 79 44 65 73 63 72 69 70 74 6f 72 73 3f 4f 62 6a 65 63 74 2e 64 65 66 69 6e 65 50 72 6f 70 65 72 74 69 65 73 28 65 2c 4f 62 6a 65 63 74 2e 67 65 74 4f 77 6e 50 72 6f 70 65 72 74 79 44 65 73 63 72 69 70 74 6f 72 73 28 6e 29 29 3a 63 28 4f 62 6a 65 63 74 28 6e 29 29 2e 66 6f 72 45 61 63 68 28 28 66 75 6e 63 74 69 6f 6e 28 74 29 7b 4f 62 6a 65 63 74 2e 64 65 66 69 6e 65 50 72 6f 70 65 72 74 79 28 65 2c 74 2c 4f 62 6a 65 63 74 2e 67 65 74 4f 77 6e 50 72 6f 70 65 72 74 79 44 65 73 63 72 69 70 74 6f 72 28 6e 2c 74 29 29 7d 29 29 7d 72 65 74 75 72 6e 20 65 7d 28 7b 7d 2c 4f 62 6a 65 63 74 28 72 2e 64 29 28 7b 77 63 70 43 6f 6e 73 65 6e 74 3a 22 77 63 Data Ascii: o.a)(e,t,n[t])})):Object.getOwnPropertyDescriptors?Object.defineProperties(e,Object.getOwnPropertyDescriptors(n)):c(Object(n)).forEach((function(t){Object.defineProperty(e,t,Object.getOwnPropertyDescriptor(n,t))}))}return e}({},Object(r.d)({wcpConsent:"wc

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
41	192.168.2.16	49802	13.107.246.40	443	4912	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-02 10:16:42 UTC	581	OUT	GET /shared/edgeweb/76250cb.js HTTP/1.1 Host: edgestatic.azureedge.net Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://www.microsoft.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-10-02 10:16:42 UTC	819	IN	HTTP/1.1 200 OK Date: Wed, 02 Oct 2024 10:16:42 GMT Content-Type: application/javascript; charset=UTF-8 Content-Length: 39540 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Access-Control-Allow-Origin: * Cache-Control: public, max-age=31536000, immutable ETag: W/"9a74-19245e6bb7d" Last-Modified: Tue, 01 Oct 2024 02:26:42 GMT Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Origin-Agent-Cluster: ?1 X-Content-Type-Options: nosniff X-Download-Options: noopen X-Frame-Options: SAMEORIGIN X-Permitted-Cross-Domain-Policies: none X-XSS-Protection: 0 x-azure-ref: 20241002T101642Z-15767c5fc55gs96cphvgp5f5vc000000097g00000000be9n x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-02 10:16:42 UTC	15565	IN	Data Raw: 28 77 69 6e 64 6f 77 2e 77 65 62 70 61 63 6b 4a 73 6f 6e 70 3d 77 69 6e 64 6f 77 2e 77 65 62 70 61 63 6b 4a 73 6f 6e 70 7c 7c 5b 5d 29 2e 70 75 73 68 28 5b 5b 38 32 5d 2c 7b 31 34 31 31 3a 66 75 6e 63 74 69 6f 6e 28 65 2c 74 2c 6f 29 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 76 61 72 20 6e 3d 6f 28 31 35 29 2c 72 3d 28 6f 28 31 33 29 2c 6f 28 38 29 2c 6f 28 31 37 29 2c 6f 28 31 31 29 2c 6f 28 31 29 2c 6f 28 36 29 2c 6f 28 31 34 31 32 29 29 2c 6c 3d 66 75 6e 63 74 69 6f 6e 28 65 29 7b 72 65 74 75 72 6e 20 72 2e 61 2e 69 73 41 63 74 69 76 65 28 65 2c 22 65 35 34 32 22 29 3f 7b 74 79 70 65 3a 22 63 75 73 74 6f 6d 22 2c 6c 61 62 65 6c 3a 22 44 6f 77 6e 6c 6f 61 64 20 45 64 67 65 22 2c 61 63 74 69 6f 6e 49 64 3a 22 64 6f 77 6e 6c 6f 61 64 22 2c 69 63 6f 6e 3a Data Ascii: (window.webpackJsonp=window.webpackJsonp\|\|[]).push([[82],{1411:function(e,t,o){"use strict";var n=o(15),r=(o(13),o(8),o(17),o(11),o(1),o(6),o(1412)),l=function(e){return r.a.isActive(e,"e542")?{type:"custom",label:"Download Edge",actionId:"download",icon:
2024-10-02 10:16:42 UTC	16384	IN	Data Raw: 73 76 67 22 3a 31 36 39 39 2c 22 2e 2f 63 61 6d 65 72 61 2e 73 76 67 22 3a 31 37 30 30 2c 22 2e 2f 63 61 73 74 2e 73 76 67 22 3a 31 37 30 31 2c 22 2e 2f 63 68 65 63 6b 2d 63 69 72 63 6c 65 2e 73 76 67 22 3a 31 37 30 32 2c 22 2e 2f 63 68 65 63 6b 2d 73 71 75 61 72 65 2e 73 76 67 22 3a 31 37 30 33 2c 22 2e 2f 63 68 65 63 6b 2e 73 76 67 22 3a 31 37 30 34 2c 22 2e 2f 63 68 65 76 72 6f 6e 2d 64 6f 77 6e 2e 73 76 67 22 3a 31 37 30 35 2c 22 2e 2f 63 68 65 76 72 6f 6e 2d 6c 65 66 74 2e 73 76 67 22 3a 31 37 30 36 2c 22 2e 2f 63 68 65 76 72 6f 6e 2d 72 69 67 68 74 2e 73 76 67 22 3a 31 37 30 37 2c 22 2e 2f 63 68 65 76 72 6f 6e 2d 75 70 2e 73 76 67 22 3a 31 37 30 38 2c 22 2e 2f 63 68 65 76 72 6f 6e 73 2d 64 6f 77 6e 2e 73 76 67 22 3a 31 37 30 39 2c 22 2e 2f 63 68 65 Data Ascii: svg":1699,"./camera.svg":1700,"./cast.svg":1701,"./check-circle.svg":1702,"./check-square.svg":1703,"./check.svg":1704,"./chevron-down.svg":1705,"./chevron-left.svg":1706,"./chevron-right.svg":1707,"./chevron-up.svg":1708,"./chevrons-down.svg":1709,"./che
2024-10-02 10:16:42 UTC	7591	IN	Data Raw: 2d 74 68 65 6d 65 2d 6c 69 6e 6b 2d 6c 69 67 68 74 65 72 22 2c 22 2d 2d 74 68 65 6d 65 2d 6c 69 6e 6b 2d 64 61 72 6b 65 72 22 2c 22 2d 2d 74 68 65 6d 65 2d 6c 69 6e 6b 2d 68 6f 76 65 72 22 2c 22 2d 2d 74 68 65 6d 65 2d 6c 69 6e 6b 2d 68 6f 76 65 72 2d 72 67 62 22 2c 22 2d 2d 74 68 65 6d 65 2d 6c 69 6e 6b 2d 68 6f 76 65 72 2d 6c 69 67 68 74 65 72 22 2c 22 2d 2d 74 68 65 6d 65 2d 6c 69 6e 6b 2d 68 6f 76 65 72 2d 64 61 72 6b 65 72 22 2c 22 2d 2d 74 68 65 6d 65 2d 6c 69 6e 6b 2d 61 63 74 69 76 65 22 2c 22 2d 2d 74 68 65 6d 65 2d 6c 69 6e 6b 2d 61 63 74 69 76 65 2d 72 67 62 22 2c 22 2d 2d 74 68 65 6d 65 2d 6c 69 6e 6b 2d 61 63 74 69 76 65 2d 6c 69 67 68 74 65 72 22 2c 22 2d 2d 74 68 65 6d 65 2d 6c 69 6e 6b 2d 61 63 74 69 76 65 2d 64 61 72 6b 65 72 22 2c 22 2d Data Ascii: -theme-link-lighter","--theme-link-darker","--theme-link-hover","--theme-link-hover-rgb","--theme-link-hover-lighter","--theme-link-hover-darker","--theme-link-active","--theme-link-active-rgb","--theme-link-active-lighter","--theme-link-active-darker","-

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
42	192.168.2.16	49803	13.107.246.40	443	4912	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-02 10:16:42 UTC	581	OUT	GET /shared/edgeweb/9f3b99e.js HTTP/1.1 Host: edgestatic.azureedge.net Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://www.microsoft.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-10-02 10:16:43 UTC	819	IN	HTTP/1.1 200 OK Date: Wed, 02 Oct 2024 10:16:42 GMT Content-Type: application/javascript; charset=UTF-8 Content-Length: 19889 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Access-Control-Allow-Origin: * Cache-Control: public, max-age=31536000, immutable ETag: W/"4db1-192442de2b5" Last-Modified: Mon, 30 Sep 2024 18:25:10 GMT Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Origin-Agent-Cluster: ?1 X-Content-Type-Options: nosniff X-Download-Options: noopen X-Frame-Options: SAMEORIGIN X-Permitted-Cross-Domain-Policies: none X-XSS-Protection: 0 x-azure-ref: 20241002T101642Z-15767c5fc55rg5b7sh1vuv8t7n00000009n000000000c35g x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-02 10:16:43 UTC	15565	IN	Data Raw: 28 77 69 6e 64 6f 77 2e 77 65 62 70 61 63 6b 4a 73 6f 6e 70 3d 77 69 6e 64 6f 77 2e 77 65 62 70 61 63 6b 4a 73 6f 6e 70 7c 7c 5b 5d 29 2e 70 75 73 68 28 5b 5b 38 34 5d 2c 7b 31 34 31 31 3a 66 75 6e 63 74 69 6f 6e 28 65 2c 74 2c 6f 29 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 76 61 72 20 6e 3d 6f 28 31 35 29 2c 72 3d 28 6f 28 31 33 29 2c 6f 28 38 29 2c 6f 28 31 37 29 2c 6f 28 31 31 29 2c 6f 28 31 29 2c 6f 28 36 29 2c 6f 28 31 34 31 32 29 29 2c 63 3d 66 75 6e 63 74 69 6f 6e 28 65 29 7b 72 65 74 75 72 6e 20 72 2e 61 2e 69 73 41 63 74 69 76 65 28 65 2c 22 65 35 34 32 22 29 3f 7b 74 79 70 65 3a 22 63 75 73 74 6f 6d 22 2c 6c 61 62 65 6c 3a 22 44 6f 77 6e 6c 6f 61 64 20 45 64 67 65 22 2c 61 63 74 69 6f 6e 49 64 3a 22 64 6f 77 6e 6c 6f 61 64 22 2c 69 63 6f 6e 3a Data Ascii: (window.webpackJsonp=window.webpackJsonp\|\|[]).push([[84],{1411:function(e,t,o){"use strict";var n=o(15),r=(o(13),o(8),o(17),o(11),o(1),o(6),o(1412)),c=function(e){return r.a.isActive(e,"e542")?{type:"custom",label:"Download Edge",actionId:"download",icon:
2024-10-02 10:16:43 UTC	4324	IN	Data Raw: 6e 65 6c 7d 2c 70 6f 70 75 70 50 6c 61 74 66 6f 72 6d 3a 66 75 6e 63 74 69 6f 6e 28 65 29 7b 72 65 74 75 72 6e 20 65 2e 70 6f 70 75 70 73 2e 70 6f 70 75 70 50 6c 61 74 66 6f 72 6d 7d 7d 29 29 2c 7b 7d 2c 7b 65 75 6c 61 56 69 73 69 62 6c 65 3a 7b 67 65 74 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 74 68 69 73 2e 24 73 74 6f 72 65 2e 73 74 61 74 65 2e 70 6f 70 75 70 73 2e 73 68 6f 77 45 75 6c 61 7d 2c 73 65 74 3a 66 75 6e 63 74 69 6f 6e 28 65 29 7b 65 7c 7c 74 68 69 73 2e 68 69 64 65 45 75 6c 61 28 29 7d 7d 7d 29 2c 6d 65 74 68 6f 64 73 3a 66 28 66 28 7b 7d 2c 4f 62 6a 65 63 74 28 63 2e 62 29 28 7b 6f 70 65 6e 45 75 6c 61 3a 22 70 6f 70 75 70 73 2f 6f 70 65 6e 45 75 6c 61 22 2c 68 69 64 65 45 75 6c 61 3a 22 70 6f 70 75 70 73 2f 68 69 64 65 45 Data Ascii: nel},popupPlatform:function(e){return e.popups.popupPlatform}})),{},{eulaVisible:{get:function(){return this.$store.state.popups.showEula},set:function(e){e\|\|this.hideEula()}}}),methods:f(f({},Object(c.b)({openEula:"popups/openEula",hideEula:"popups/hideE

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
43	192.168.2.16	49804	13.107.246.40	443	4912	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-02 10:16:43 UTC	581	OUT	GET /shared/edgeweb/dd71a23.js HTTP/1.1 Host: edgestatic.azureedge.net Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://www.microsoft.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-10-02 10:16:43 UTC	798	IN	HTTP/1.1 200 OK Date: Wed, 02 Oct 2024 10:16:43 GMT Content-Type: application/javascript; charset=UTF-8 Content-Length: 21778 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Access-Control-Allow-Origin: * Cache-Control: public, max-age=31536000, immutable ETag: W/"5512-192442de285" Last-Modified: Mon, 30 Sep 2024 18:25:10 GMT Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Origin-Agent-Cluster: ?1 X-Content-Type-Options: nosniff X-Download-Options: noopen X-Frame-Options: SAMEORIGIN X-Permitted-Cross-Domain-Policies: none X-XSS-Protection: 0 x-azure-ref: 20241002T101643Z-15767c5fc55whfstvfw43u8fp400000009dg00000000cqns x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-02 10:16:43 UTC	15586	IN	Data Raw: 28 77 69 6e 64 6f 77 2e 77 65 62 70 61 63 6b 4a 73 6f 6e 70 3d 77 69 6e 64 6f 77 2e 77 65 62 70 61 63 6b 4a 73 6f 6e 70 7c 7c 5b 5d 29 2e 70 75 73 68 28 5b 5b 30 5d 2c 7b 31 33 39 33 3a 66 75 6e 63 74 69 6f 6e 28 74 2c 65 2c 6e 29 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 6e 28 35 29 2c 6e 28 38 29 2c 6e 28 31 39 29 2c 6e 28 32 30 29 2c 6e 28 31 31 29 2c 6e 28 36 29 3b 76 61 72 20 6f 3d 6e 28 31 35 29 2c 6c 3d 6e 28 33 29 2c 72 3d 28 6e 28 31 33 29 2c 6e 28 35 35 29 2c 6e 28 32 38 29 2c 6e 28 31 29 2c 6e 28 32 31 29 2c 6e 28 32 32 29 29 2c 63 3d 6e 28 37 31 33 29 2c 64 3d 6e 28 31 35 34 34 29 3b 66 75 6e 63 74 69 6f 6e 20 68 28 74 2c 65 29 7b 76 61 72 20 6e 3d 4f 62 6a 65 63 74 2e 6b 65 79 73 28 74 29 3b 69 66 28 4f 62 6a 65 63 74 2e 67 65 74 4f 77 6e 50 Data Ascii: (window.webpackJsonp=window.webpackJsonp\|\|[]).push([[0],{1393:function(t,e,n){"use strict";n(5),n(8),n(19),n(20),n(11),n(6);var o=n(15),l=n(3),r=(n(13),n(55),n(28),n(1),n(21),n(22)),c=n(713),d=n(1544);function h(t,e){var n=Object.keys(t);if(Object.getOwnP
2024-10-02 10:16:43 UTC	6192	IN	Data Raw: 74 68 65 6f 22 7d 2c 22 7a 68 2d 63 6e 22 3a 7b 22 6e 65 78 74 22 3a 22 e4 b8 8b e4 b8 80 e6 9d a1 22 7d 2c 22 7a 68 2d 74 77 22 3a 7b 22 6e 65 78 74 22 3a 22 e4 b8 8b e4 b8 80 e6 ad a5 22 7d 7d 7d 27 29 7d 2c 31 35 34 35 3a 66 75 6e 63 74 69 6f 6e 28 74 2c 65 2c 6e 29 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 6e 28 31 34 32 32 29 7d 2c 31 35 34 36 3a 66 75 6e 63 74 69 6f 6e 28 74 2c 65 2c 6e 29 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 6e 28 31 34 32 33 29 7d 2c 31 35 34 37 3a 66 75 6e 63 74 69 6f 6e 28 74 2c 65 2c 6e 29 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 6e 28 31 34 32 34 29 7d 2c 31 35 34 38 3a 66 75 6e 63 74 69 6f 6e 28 74 2c 65 2c 6e 29 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 6e 28 31 34 32 35 29 7d 2c 31 35 34 39 3a 66 75 6e 63 74 69 6f 6e Data Ascii: theo"},"zh-cn":{"next":""},"zh-tw":{"next":""}}}')},1545:function(t,e,n){"use strict";n(1422)},1546:function(t,e,n){"use strict";n(1423)},1547:function(t,e,n){"use strict";n(1424)},1548:function(t,e,n){"use strict";n(1425)},1549:function

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
44	192.168.2.16	49805	13.107.246.40	443	4912	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-02 10:16:43 UTC	581	OUT	GET /shared/edgeweb/03948fb.js HTTP/1.1 Host: edgestatic.azureedge.net Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://www.microsoft.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-10-02 10:16:43 UTC	821	IN	HTTP/1.1 200 OK Date: Wed, 02 Oct 2024 10:16:43 GMT Content-Type: application/javascript; charset=UTF-8 Content-Length: 539908 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Access-Control-Allow-Origin: * Cache-Control: public, max-age=31536000, immutable ETag: W/"83d04-19245e6bbcc" Last-Modified: Tue, 01 Oct 2024 02:26:42 GMT Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Origin-Agent-Cluster: ?1 X-Content-Type-Options: nosniff X-Download-Options: noopen X-Frame-Options: SAMEORIGIN X-Permitted-Cross-Domain-Policies: none X-XSS-Protection: 0 x-azure-ref: 20241002T101643Z-15767c5fc55472x4k7dmphmadg0000000940000000003bsf x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-02 10:16:43 UTC	15563	IN	Data Raw: 2f 2a 21 20 46 6f 72 20 6c 69 63 65 6e 73 65 20 69 6e 66 6f 72 6d 61 74 69 6f 6e 20 70 6c 65 61 73 65 20 73 65 65 20 4c 49 43 45 4e 53 45 53 20 2a 2f 0a 28 77 69 6e 64 6f 77 2e 77 65 62 70 61 63 6b 4a 73 6f 6e 70 3d 77 69 6e 64 6f 77 2e 77 65 62 70 61 63 6b 4a 73 6f 6e 70 7c 7c 5b 5d 29 2e 70 75 73 68 28 5b 5b 39 32 2c 39 33 5d 2c 7b 31 33 39 34 3a 66 75 6e 63 74 69 6f 6e 28 65 2c 74 2c 6e 29 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 76 61 72 20 6f 3d 6e 28 33 31 29 2c 72 3d 6e 28 33 37 33 29 2c 6c 3d 6e 28 32 36 33 29 2c 63 3d 6e 28 33 37 34 29 2c 64 3d 6e 28 33 36 38 29 2c 66 3d 6e 28 32 33 30 29 2c 68 3d 6e 28 33 37 35 29 2c 6d 3d 6e 28 33 37 36 29 2c 76 3d 6e 28 33 37 37 29 2c 79 3d 6e 28 33 36 39 29 2c 6b 3d 6e 28 33 36 36 29 2c 77 3d 6e 28 33 37 30 Data Ascii: /! For license information please see LICENSES /(window.webpackJsonp=window.webpackJsonp\|\|[]).push([[92,93],{1394:function(e,t,n){"use strict";var o=n(31),r=n(373),l=n(263),c=n(374),d=n(368),f=n(230),h=n(375),m=n(376),v=n(377),y=n(369),k=n(366),w=n(370
2024-10-02 10:16:43 UTC	16384	IN	Data Raw: 61 74 75 72 65 73 2d 31 2d 74 69 70 22 3a 22 31 20 d7 98 d7 99 d7 a4 22 2c 22 66 65 61 74 75 72 65 73 2d 66 65 61 74 75 72 65 22 3a 22 d7 aa d7 9b d7 95 d7 a0 d7 94 22 2c 22 66 65 61 74 75 72 65 73 2d 66 72 65 71 75 65 6e 74 6c 79 2d 61 73 6b 65 64 2d 71 75 65 73 74 69 6f 6e 73 22 3a 22 d7 a9 d7 90 d7 9c d7 95 d7 aa 20 d7 a0 d7 a4 d7 95 d7 a6 d7 95 d7 aa 22 2c 22 66 65 61 74 75 72 65 73 2d 6c 65 61 72 6e 2d 6d 6f 72 65 22 3a 22 d7 9c d7 9e d7 93 20 d7 a2 d7 95 d7 93 22 2c 22 66 65 61 74 75 72 65 73 2d 6d 6f 72 65 2d 71 75 65 73 74 69 6f 6e 73 22 3a 22 d7 a9 d7 90 d7 9c d7 95 d7 aa 20 d7 a0 d7 95 d7 a1 d7 a4 d7 95 d7 aa 2e 2e 2e 22 2c 22 66 65 61 74 75 72 65 73 2d 6e 2d 66 65 61 74 75 72 65 73 22 3a 22 d7 aa d7 9b d7 95 d7 a0 d7 95 d7 aa 20 7b 30 7d 22 2c Data Ascii: atures-1-tip":"1 ","features-feature":"","features-frequently-asked-questions":" ","features-learn-more":" ","features-more-questions":" ...","features-n-features":" {0}",
2024-10-02 10:16:43 UTC	16384	IN	Data Raw: 72 75 63 75 72 69 22 7d 2c 22 72 75 2d 72 75 22 3a 7b 22 66 65 61 74 75 72 65 73 2d 31 2d 66 65 61 74 75 72 65 22 3a 22 31 20 d1 84 d1 83 d0 bd d0 ba d1 86 d0 b8 d1 8f 22 2c 22 66 65 61 74 75 72 65 73 2d 31 2d 74 69 70 22 3a 22 31 20 d1 81 d0 be d0 b2 d0 b5 d1 82 22 2c 22 66 65 61 74 75 72 65 73 2d 66 65 61 74 75 72 65 22 3a 22 d0 9e d1 81 d0 be d0 b1 d0 b5 d0 bd d0 bd d0 be d1 81 d1 82 d1 8c 22 2c 22 66 65 61 74 75 72 65 73 2d 66 72 65 71 75 65 6e 74 6c 79 2d 61 73 6b 65 64 2d 71 75 65 73 74 69 6f 6e 73 22 3a 22 d0 a7 d0 b0 d1 81 d1 82 d0 be 20 d0 b7 d0 b0 d0 b4 d0 b0 d0 b2 d0 b0 d0 b5 d0 bc d1 8b d0 b5 20 d0 b2 d0 be d0 bf d1 80 d0 be d1 81 d1 8b 22 2c 22 66 65 61 74 75 72 65 73 2d 6c 65 61 72 6e 2d 6d 6f 72 65 22 3a 22 d0 9f d0 be d0 b4 d1 80 d0 be d0 Data Ascii: rucuri"},"ru-ru":{"features-1-feature":"1 ","features-1-tip":"1 ","features-feature":"","features-frequently-asked-questions":" ","features-learn-more":"
2024-10-02 10:16:43 UTC	16384	IN	Data Raw: 69 2d 6c 6b 22 3a 7b 22 6d 61 6e 61 67 65 2d 63 6f 6f 6b 69 65 73 22 3a 22 e0 b6 9a e0 b7 94 e0 b6 9a e0 b7 93 e0 b7 83 e0 b7 8a 20 e0 b6 9a e0 b7 85 e0 b6 b8 e0 b6 b1 e0 b7 8f e0 b6 9a e0 b6 bb e0 b6 ab e0 b6 ba 20 e0 b6 9a e0 b6 bb e0 b6 b1 e0 b7 8a e0 b6 b1 22 7d 2c 22 73 6b 2d 73 6b 22 3a 7b 22 6d 61 6e 61 67 65 2d 63 6f 6f 6b 69 65 73 22 3a 22 53 70 72 c3 a1 76 61 20 73 c3 ba 62 6f 72 6f 76 20 63 6f 6f 6b 69 65 22 7d 2c 22 73 6c 2d 73 69 22 3a 7b 22 6d 61 6e 61 67 65 2d 63 6f 6f 6b 69 65 73 22 3a 22 55 70 72 61 76 6c 6a 61 6e 6a 65 20 70 69 c5 a1 6b 6f 74 6b 6f 76 22 7d 2c 22 73 71 2d 61 6c 22 3a 7b 22 6d 61 6e 61 67 65 2d 63 6f 6f 6b 69 65 73 22 3a 22 4d 65 6e 61 78 68 6f 20 6b 75 6b 69 74 22 7d 2c 22 73 72 2d 63 79 72 6c 2d 62 61 22 3a 7b 22 6d 61 Data Ascii: i-lk":{"manage-cookies":" "},"sk-sk":{"manage-cookies":"Sprva sborov cookie"},"sl-si":{"manage-cookies":"Upravljanje pikotkov"},"sq-al":{"manage-cookies":"Menaxho kukit"},"sr-cyrl-ba":{"ma
2024-10-02 10:16:43 UTC	16384	IN	Data Raw: 72 45 61 63 68 28 28 66 75 6e 63 74 69 6f 6e 28 74 29 7b 4f 62 6a 65 63 74 2e 64 65 66 69 6e 65 50 72 6f 70 65 72 74 79 28 65 2c 74 2c 4f 62 6a 65 63 74 2e 67 65 74 4f 77 6e 50 72 6f 70 65 72 74 79 44 65 73 63 72 69 70 74 6f 72 28 6e 2c 74 29 29 7d 29 29 7d 72 65 74 75 72 6e 20 65 7d 28 7b 7d 2c 4f 62 6a 65 63 74 28 72 2e 64 29 28 7b 77 63 70 49 73 43 6f 6e 73 65 6e 74 52 65 71 75 69 72 65 64 3a 22 77 63 70 49 73 43 6f 6e 73 65 6e 74 52 65 71 75 69 72 65 64 22 7d 29 29 2c 6d 65 74 68 6f 64 73 3a 7b 6f 6e 4d 61 6e 61 67 65 43 6c 69 63 6b 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 77 69 6e 64 6f 77 2e 77 63 70 43 6c 69 63 6b 4d 61 6e 61 67 65 43 6f 6e 73 65 6e 74 26 26 77 69 6e 64 6f 77 2e 77 63 70 43 6c 69 63 6b 4d 61 6e 61 67 65 43 6f 6e 73 65 6e 74 28 29 7d 7d Data Ascii: rEach((function(t){Object.defineProperty(e,t,Object.getOwnPropertyDescriptor(n,t))}))}return e}({},Object(r.d)({wcpIsConsentRequired:"wcpIsConsentRequired"})),methods:{onManageClick:function(){window.wcpClickManageConsent&&window.wcpClickManageConsent()}}
2024-10-02 10:16:43 UTC	16384	IN	Data Raw: 74 5b 69 5d 29 3b 21 74 5b 74 2e 69 6e 64 65 78 4f 66 28 22 74 72 61 6e 73 66 6f 72 6d 22 29 2b 31 5d 26 26 73 74 79 6c 65 2e 74 72 61 6e 73 6c 61 74 65 26 26 28 73 74 79 6c 65 2e 72 65 6d 6f 76 65 50 72 6f 70 65 72 74 79 28 22 74 72 61 6e 73 6c 61 74 65 22 29 2c 73 74 79 6c 65 2e 72 65 6d 6f 76 65 50 72 6f 70 65 72 74 79 28 22 73 63 61 6c 65 22 29 2c 73 74 79 6c 65 2e 72 65 6d 6f 76 65 50 72 6f 70 65 72 74 79 28 22 72 6f 74 61 74 65 22 29 29 7d 2c 66 65 3d 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 65 2e 66 6f 72 45 61 63 68 28 28 66 75 6e 63 74 69 6f 6e 28 65 29 7b 72 65 74 75 72 6e 20 65 2e 61 2e 63 61 63 68 65 2e 75 6e 63 61 63 68 65 3d 31 7d 29 29 2c 74 7c 7c 65 2e 66 69 6e 61 6c 53 74 61 74 65 73 2e 66 6f 72 45 61 63 68 28 64 65 29 7d 2c 70 65 3d 22 Data Ascii: t[i]);!t[t.indexOf("transform")+1]&&style.translate&&(style.removeProperty("translate"),style.removeProperty("scale"),style.removeProperty("rotate"))},fe=function(e,t){e.forEach((function(e){return e.a.cache.uncache=1})),t\|\|e.finalStates.forEach(de)},pe="
2024-10-02 10:16:43 UTC	16384	IN	Data Raw: 6f 6e 43 6f 6d 70 6c 65 74 65 2c 76 3d 72 2e 73 69 6d 70 6c 65 2c 79 3d 6e 26 26 6e 2e 66 69 74 43 68 69 6c 64 26 26 5a 28 6e 2e 66 69 74 43 68 69 6c 64 29 2c 6b 3d 62 65 28 74 2c 66 2c 76 2c 65 29 2c 77 3d 62 65 28 65 2c 30 2c 76 2c 6b 29 2c 78 3d 66 3f 58 5b 66 5d 3a 4a 3b 72 65 74 75 72 6e 20 66 26 26 79 65 28 6f 2c 6b 2e 70 72 6f 70 73 29 2c 68 26 26 28 75 65 28 77 2c 78 29 2c 22 69 6d 6d 65 64 69 61 74 65 52 65 6e 64 65 72 22 69 6e 20 6f 7c 7c 28 6f 2e 69 6d 6d 65 64 69 61 74 65 52 65 6e 64 65 72 3d 21 30 29 2c 6f 2e 6f 6e 43 6f 6d 70 6c 65 74 65 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 64 65 28 77 29 2c 6d 26 26 6d 2e 61 70 70 6c 79 28 74 68 69 73 2c 61 72 67 75 6d 65 6e 74 73 29 7d 29 2c 6c 26 26 68 65 28 77 2c 6b 29 2c 6f 3d 78 65 28 77 2c 6b 2c 63 7c Data Ascii: onComplete,v=r.simple,y=n&&n.fitChild&&Z(n.fitChild),k=be(t,f,v,e),w=be(e,0,v,k),x=f?X[f]:J;return f&&ye(o,k.props),h&&(ue(w,x),"immediateRender"in o\|\|(o.immediateRender=!0),o.onComplete=function(){de(w),m&&m.apply(this,arguments)}),l&&he(w,k),o=xe(w,k,c\|
2024-10-02 10:16:44 UTC	16384	IN	Data Raw: 28 66 75 6e 63 74 69 6f 6e 28 74 29 7b 4f 62 6a 65 63 74 28 4f 2e 61 29 28 65 2c 74 2c 6e 5b 74 5d 29 7d 29 29 3a 4f 62 6a 65 63 74 2e 67 65 74 4f 77 6e 50 72 6f 70 65 72 74 79 44 65 73 63 72 69 70 74 6f 72 73 3f 4f 62 6a 65 63 74 2e 64 65 66 69 6e 65 50 72 6f 70 65 72 74 69 65 73 28 65 2c 4f 62 6a 65 63 74 2e 67 65 74 4f 77 6e 50 72 6f 70 65 72 74 79 44 65 73 63 72 69 70 74 6f 72 73 28 6e 29 29 3a 4e 28 4f 62 6a 65 63 74 28 6e 29 29 2e 66 6f 72 45 61 63 68 28 28 66 75 6e 63 74 69 6f 6e 28 74 29 7b 4f 62 6a 65 63 74 2e 64 65 66 69 6e 65 50 72 6f 70 65 72 74 79 28 65 2c 74 2c 4f 62 6a 65 63 74 2e 67 65 74 4f 77 6e 50 72 6f 70 65 72 74 79 44 65 73 63 72 69 70 74 6f 72 28 6e 2c 74 29 29 7d 29 29 7d 72 65 74 75 72 6e 20 65 7d 76 61 72 20 52 3d 7b 6e 61 6d 65 Data Ascii: (function(t){Object(O.a)(e,t,n[t])})):Object.getOwnPropertyDescriptors?Object.defineProperties(e,Object.getOwnPropertyDescriptors(n)):N(Object(n)).forEach((function(t){Object.defineProperty(e,t,Object.getOwnPropertyDescriptor(n,t))}))}return e}var R={name
2024-10-02 10:16:44 UTC	16384	IN	Data Raw: 7d 2c 63 6f 6c 6f 72 53 63 68 65 6d 65 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 65 3b 72 65 74 75 72 6e 20 6e 75 6c 6c 3d 3d 3d 28 65 3d 74 68 69 73 2e 74 61 72 67 65 74 29 7c 7c 76 6f 69 64 20 30 3d 3d 3d 65 3f 76 6f 69 64 20 30 3a 65 2e 63 6f 6c 6f 72 53 63 68 65 6d 65 7d 2c 68 69 64 65 44 65 66 61 75 6c 74 54 65 78 74 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 65 3b 72 65 74 75 72 6e 20 6e 75 6c 6c 3d 3d 3d 28 65 3d 74 68 69 73 2e 74 61 72 67 65 74 29 7c 7c 76 6f 69 64 20 30 3d 3d 3d 65 3f 76 6f 69 64 20 30 3a 65 2e 68 69 64 65 44 65 66 61 75 6c 74 54 65 78 74 7d 2c 74 65 78 74 42 6c 6f 63 6b 73 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 65 3b 72 65 74 75 72 6e 28 6e 75 6c 6c 3d 3d 3d 28 65 3d 74 68 69 73 2e 74 61 72 67 65 74 29 7c 7c Data Ascii: },colorScheme:function(){var e;return null===(e=this.target)\|\|void 0===e?void 0:e.colorScheme},hideDefaultText:function(){var e;return null===(e=this.target)\|\|void 0===e?void 0:e.hideDefaultText},textBlocks:function(){var e;return(null===(e=this.target)\|\|
2024-10-02 10:16:44 UTC	16384	IN	Data Raw: b8 d0 bc 20 d0 b7 d0 b0 20 d0 be d0 b1 d1 80 d0 b0 d1 82 d0 bd d0 b0 d1 82 d0 b0 20 d0 b2 d1 80 d1 8a d0 b7 d0 ba d0 b0 21 22 7d 2c 22 62 6e 2d 69 6e 22 3a 7b 22 74 68 61 6e 6b 73 2d 66 6f 72 2d 79 6f 75 72 2d 66 65 65 64 62 61 63 6b 22 3a 22 e0 a6 86 e0 a6 aa e0 a6 a8 e0 a6 be e0 a6 b0 20 e0 a6 ae e0 a6 a4 e0 a6 be e0 a6 ae e0 a6 a4 e0 a7 87 e0 a6 b0 20 e0 a6 9c e0 a6 a8 e0 a7 8d e0 a6 af 20 e0 a6 a7 e0 a6 a8 e0 a7 8d e0 a6 af e0 a6 ac e0 a6 be e0 a6 a6 21 22 7d 2c 22 62 73 2d 6c 61 74 6e 2d 62 61 22 3a 7b 22 74 68 61 6e 6b 73 2d 66 6f 72 2d 79 6f 75 72 2d 66 65 65 64 62 61 63 6b 22 3a 22 44 61 6e 6b 20 6a 65 20 76 6f 6f 72 20 6a 65 20 66 65 65 64 62 61 63 6b 21 22 7d 2c 22 63 61 2d 65 73 22 3a 7b 22 74 68 61 6e 6b 73 2d 66 6f 72 2d 79 6f 75 72 2d 66 65 Data Ascii: !"},"bn-in":{"thanks-for-your-feedback":" !"},"bs-latn-ba":{"thanks-for-your-feedback":"Dank je voor je feedback!"},"ca-es":{"thanks-for-your-fe

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
45	192.168.2.16	49806	77.75.76.70	443	3540	C:\Users\user\AppData\Roaming\Seznam.cz\sznsetup.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-02 10:16:43 UTC	119	OUT	GET /update/cz.seznam.software.libfoxcub-3.3.8-win32.zip HTTP/1.1 Host: download.seznam.cz Connection: Keep-Alive
2024-10-02 10:16:44 UTC	273	IN	HTTP/1.1 200 OK server: envoy date: Wed, 02 Oct 2024 10:16:44 GMT content-type: application/zip content-length: 2230734 last-modified: Tue, 30 Apr 2024 09:02:56 GMT etag: "6630b3c0-2209ce" accept-ranges: bytes x-envoy-upstream-service-time: 0 connection: close
2024-10-02 10:16:44 UTC	13629	IN	Data Raw: 50 4b 03 04 14 00 02 00 08 00 9c 70 54 4c ce 0c 2d 57 16 01 00 00 e9 01 00 00 0b 00 00 00 63 6f 6e 74 72 6f 6c 2e 69 6e 69 85 51 31 6e c3 30 0c dc 05 e8 0f 1a 93 c1 84 65 2f 59 3c 16 68 81 a2 43 d7 a2 83 6c 33 8e 10 59 12 44 d9 69 82 7e 21 8f c8 03 fa 8a a4 ff aa d2 34 69 0b 14 cd 42 12 bc 3b 92 38 3e 79 d5 2c 55 87 cf 9c 59 d5 63 d5 6c 80 70 93 4a 20 37 8f 2b 15 10 8c ae e7 ee a5 19 6a ce 46 0c a4 9d ad 4a 28 61 c6 99 b6 14 95 31 d5 57 86 5a 45 ce 06 7b 6e 5f aa 13 e0 8d 8a 73 17 fa 6a a5 6d 59 70 d6 a2 47 db d2 5f 2b 69 63 5b a4 65 74 5e 4c 0a c8 a1 94 d3 6f 7e 02 b3 33 33 ab 15 e1 8f 51 ae 87 5e 37 c1 1d 71 e8 a9 b5 29 8c 4d 90 32 ff 77 9f d1 dd 22 92 47 6c 33 59 c8 5c 4c 64 01 32 07 39 9b 5e 91 d5 bf 2f 95 50 e6 49 12 83 ee ba 64 d5 55 0d 67 ca fb 87 Data Ascii: PKpTL-Wcontrol.iniQ1n0e/Y<hCl3YDi~!4iB;8>y,UYclpJ 7+jFJ(a1WZE{n_sjmYpG_+ic[et^Lo~33Q^7q)M2w"Gl3Y\Ld29^/PIdUg
2024-10-02 10:16:44 UTC	4164	IN	Data Raw: b1 2e 31 ec 00 f2 40 88 97 9f 4d 8b 78 31 e2 39 cc 47 0d 62 a3 43 ba 6b 8b d9 2a c3 e6 e7 e0 9a 39 c8 0b 9f 27 be f2 85 3d e6 f8 ca 78 66 f8 b4 fa 1e 98 5b 7c 65 d0 fe b2 e2 65 53 fc 20 ce 75 a7 18 98 8e a2 06 68 aa 21 23 d8 1a f5 35 2b db c7 30 5e aa 30 6d 88 44 84 87 be ce 3d 13 6a b9 67 c2 1f 33 0f 6e 56 5e 85 f2 5f d2 cb 3b ba 6a a6 c7 53 d2 e4 ac b6 a6 0b db f7 12 ce b3 25 ed f7 58 07 f0 77 35 2c 1f 8a ee b2 6e 5c b2 fe 81 fa 3a 2c 0a 79 87 9d 6c 81 d5 4c 0e 98 c6 c0 5c 5b 99 ae f6 10 d8 73 ed 00 34 12 a3 fa e9 ce 03 d5 1e c4 7a 6e dd a2 d4 7a ee 67 0e 04 d8 f4 1a 13 08 5f ae b2 6e 80 0f 70 b7 a4 83 63 bc 49 69 7f d9 38 b5 28 38 ce 61 ca fe 3b c7 94 fa ab 6a 25 36 a9 f7 2a 29 d0 c1 ab 33 28 d0 06 fc f4 ef 7f 9a cf 9d 61 ab 7c 6a 0b 6f 0f e1 4b fd 4a Data Ascii: .1@Mx19GbCk9'=xf[\|eeS uh!#5+0^0mD=jg3nV^_;jS%Xw5,n\:,ylL\[s4znzg_npcIi8(8a;j%6)3(a\|joKJ
2024-10-02 10:16:44 UTC	16384	IN	Data Raw: b7 7c e1 2e 7b 5b 85 78 1d ef b6 8d 63 d0 6b 1e 9d ca 06 c6 40 6b cc 68 89 38 c3 2e 21 dd d8 3b 6e 8d d9 31 c5 f2 1f 0a 86 4a 9d 65 74 cf a7 8f 65 e6 d7 b8 99 5e 36 65 4d af 36 bd 51 7d bd 6d a0 a7 44 71 4e 05 dd 4a 2f 6d 0d c1 0a cc 97 7e 05 8f c3 c8 8f cc cc 88 1f 69 ee b0 69 40 96 2f 9e 2e 30 ef 42 f5 f1 34 6b 6e d4 1b e0 d8 c4 b7 9e 5a 71 01 c3 5c 14 81 7e bb 75 79 4e 17 e6 70 ea f1 f9 18 a1 49 ca 19 5f 13 89 38 37 96 d1 cc 76 f3 da 7c 39 b5 79 66 ad 8d cf ee 26 92 03 5e fd 7a 66 9d b8 68 4e 76 d2 9c 74 1f a1 39 d9 c9 b7 c3 66 cd 62 08 7d d0 96 4f b0 81 f1 e9 c3 f0 ab a0 fa c6 6e 44 e5 44 db 05 a4 71 90 f2 40 03 a7 04 05 76 f5 70 6c d5 cf 3b 8f 2d 71 a9 65 d5 e4 50 18 91 17 60 14 78 d0 f4 9b bb 84 4e d4 f9 a8 cc 09 a2 c5 71 dc 98 b3 eb 8a 1f 73 eb b3 Data Ascii: \|.{[xck@kh8.!;n1Jete^6eM6Q}mDqNJ/m~ii@/.0B4knZq\~uyNpI_87v\|9yf&^zfhNvt9fb}OnDDq@vpl;-qeP`xNqs
2024-10-02 10:16:44 UTC	7212	IN	Data Raw: 8a fe ab 15 fa af 26 a3 ff 2a 73 f4 df 1b 57 e6 ea bf f9 5f a8 fe bb a5 80 fe fb 6d 99 c4 2b a5 7c 42 c5 63 8c 6f 3e 3b de 99 eb 8f 9c c6 7b 43 4b 70 54 bc 37 68 6c c7 70 2a 95 b8 af 5a ce 5c d9 1a 4e d2 13 1f 16 f8 65 99 62 23 54 6c 6d 3f 36 c6 f6 03 17 a9 7d 29 39 b6 ed 7f f0 69 ba 7d 59 6c 84 8a d1 f5 34 56 9a 5e f5 a9 a0 49 f6 a5 a6 a1 22 49 d7 87 c6 be 03 01 aa 51 07 c0 7c e3 a1 95 ad 42 9f 5a 6c 13 58 28 b0 7b 1e b5 3e 47 7b dc b1 0f 4f 7b e8 2e e8 5d 94 9d b8 3a 7d 4f d7 be 11 97 97 ed b0 be 9c 4a 90 72 53 ed 21 e5 3a 77 39 ba f6 89 47 f4 d3 c2 af 9b 08 88 ce 61 fb d6 be cb 66 4f 1f ff 81 d5 9e c6 2b 7e d7 47 17 6d ec e9 ab 8c cf 64 4f cb f1 9c 8d 37 50 10 8f 57 c2 96 99 53 a2 b9 f1 79 ed 54 9c 15 b5 1c 40 01 71 ec 6a 9d 3f 9d 7c b8 92 72 4e 27 22 Data Ascii: &sW_m+\|Bco>;{CKpT7hlpZ\Neb#Tlm?6})9i}Yl4V^I"IQ\|BZlX({>G{O{.]:}OJrS!:w9GafO+~GmdO7PWSyT@qj?\|rN'"
2024-10-02 10:16:44 UTC	4164	IN	Data Raw: e0 17 4b 68 5c 16 c2 b8 64 43 32 bd 4c d5 ef 8a 92 73 4e 9b 2f 52 ea a4 08 66 cc 35 89 af 5e b6 69 85 2f 4c c7 b1 39 1d 9c ae 0a d7 fb aa fc 5a fe 0b d1 81 89 2b ae 78 06 64 9b bc c5 29 2f 77 84 75 9c 06 83 39 6d f5 b2 b0 7c 34 8b 8d 98 7f c9 51 a7 d8 6c 98 62 b5 da 7a f8 9a d3 e6 8e 5c df b6 e2 42 2f 51 41 13 48 c8 e0 03 d0 ca fa a5 d5 ca 72 87 fb b2 bd e8 3f 70 8a b9 94 e9 72 05 62 3a 03 61 f5 d7 68 bb 7f 80 c1 8c 25 00 d7 6f 42 13 20 e4 88 22 7c ee c8 43 b1 9a 61 be da f9 7c 4d 51 ee 42 04 6c f1 4d 8f a4 3f e5 13 da 0a ac 74 86 2f 46 a9 dd dd bb ee 2e f6 4a b4 a5 94 3a 54 a1 c8 dd d1 30 c7 94 07 78 56 56 ef b1 cb d5 35 4a 8f 96 0d 22 8e 6d 46 43 8f 48 a3 f6 c7 b5 9c e4 56 7e 0e da 95 1e 5c c3 e9 6c 3a d1 d9 1f 93 d3 99 18 47 67 c0 51 7a a0 e4 74 a4 b3 Data Ascii: Kh\dC2LsN/Rf5^i/L9Z+xd)/wu9m\|4Qlbz\B/QAHr?prb:ah%oB "\|Ca\|MQBlM?t/F.J:T0xVV5J"mFCHV~\l:GgQzt
2024-10-02 10:16:44 UTC	5552	IN	Data Raw: 69 0b 43 2a ee 32 e0 14 65 0b 17 c7 0f 42 60 2b a5 06 03 c2 ac 06 61 a2 ff 46 75 e6 03 50 0e b0 85 bc 68 89 57 ef 93 0f e8 fe 1a 8c 3f f7 9f 58 4d be 39 82 2e 1e 1f f6 2f df 4a 7c 9c 2f 87 40 bb 1b 74 9e 5d 3f 5c da dc 80 49 d8 0e 04 32 e1 fd 16 4b b3 55 6b c2 00 33 cd 4e 87 75 af 7c c6 48 b3 c3 ab 38 ac db b8 b1 84 fb 17 18 f5 f9 74 3c 2f 1a 2f e5 90 58 af 61 b2 b5 35 fa a0 9f ad 08 3b e9 55 18 91 32 d1 a9 40 88 fe 34 e6 ee 12 9d 0b c2 1a a8 5e 9d 24 d7 89 66 92 4b ed 7c c6 48 f5 3a f4 07 1a 2c e9 c0 bf a9 29 dd 0b 90 29 bd 56 04 2d 3a 2d a3 81 e5 27 ef 4a f2 13 d6 f2 6a 97 c5 32 53 4d b9 00 3d 40 88 fa e3 b9 b8 95 c6 60 ca 81 eb 59 63 0e f0 2a 9e 83 47 5e fc e6 39 48 9a 7f 9b e1 56 a3 21 0b 58 c0 3e 12 a3 bb 9c f9 0a f8 9e 35 82 ad 64 b4 48 f0 35 83 45 Data Ascii: iC2eB`+aFuPhW?XM9./J\|/@t]?\I2KUk3Nu\|H8t<//Xa5;U2@4^$fK\|H:,))V-:-'Jj2SM=@`YcG^9HV!X>5dH5E
2024-10-02 10:16:44 UTC	16384	IN	Data Raw: 34 e1 f7 7c 1c b1 e8 56 9e 22 4d fb 64 44 3a 0f 9b d4 c2 93 c6 c5 c2 17 f8 65 94 34 68 23 e8 46 3c 84 09 20 51 1b 92 d1 09 4f 91 b6 bd f3 43 3c 9b 8e ab d9 9b 96 a7 f8 a1 3a d9 82 49 5c c4 44 a5 b3 28 d1 1c c6 e5 d4 6e db 98 7e a7 77 36 24 38 a6 a6 2a ce c5 0d 09 f7 71 c2 0a 66 c6 2b 3c 7a 4e 35 f0 0a 8d c9 e7 87 63 1d bd 4f d3 8f 0f 8b 91 82 ee ba 6b 1c 20 92 eb 2e c7 28 f4 c6 cf 10 b9 fe be 7d 10 e3 81 c5 35 f6 90 8d 34 76 68 74 d0 6f d4 83 de 38 ae 1a 9e 0d 20 b8 cf 00 56 e7 83 6a e6 55 50 41 f3 82 a6 92 cf 81 a2 4b e9 52 2d 8c 82 47 d8 2f 2f 6a c6 1c 2c 7a 70 02 81 45 09 04 ed 31 c0 d5 37 9e 27 b6 2d c0 a2 3c 76 19 41 a1 41 6d 29 b8 c9 74 90 cb e7 4f e4 53 53 3c 9d 7c cb fb 4b 2e e9 36 31 18 a0 d7 9a cd 4f 82 ae 26 dc 84 76 1b 72 f7 4b b0 79 39 d4 d3 Data Ascii: 4\|V"MdD:e4h#F< QOC<:I\D(n~w6$8*qf+<zN5cOk .(}54vhto8 VjUPAKR-G//j,zpE17'-<vAAm)tOSS<\|K.61O&vrKy9
2024-10-02 10:16:44 UTC	16384	IN	Data Raw: 0d 8b 1d 74 43 01 3b c5 14 b0 53 ec a6 9b 2c ba 21 51 5f 0d 1d c5 1e dc a1 d3 db 8b e9 6c f7 62 4a ce 29 26 5a 74 a0 38 97 93 f6 be 4b 83 ab 5c a0 e5 76 b5 53 f2 67 49 73 c2 c5 63 71 37 25 a8 1e a7 c1 a1 f4 57 b6 fe cb ab 91 7d fc 34 47 3f cd 9f b2 7c 0e f8 3d 9c 7e 65 1e 63 f9 1c f0 5f af 1d ac 3f e0 cf e5 18 ca a7 ee 5d f6 3e f4 8a 3d ad ec 0d 00 55 0f e3 68 1d 4e ce 2c f5 66 1f 80 c7 77 b7 8d 22 8e 67 d9 c8 ca f3 79 70 7c 1a 4e 84 80 ad 17 df 97 a0 50 dd 0e db 99 18 f8 d6 20 3c 52 ea 9d ad c5 be 69 81 6f 60 38 95 7a cb c9 5f 3c 37 93 2a 94 77 39 db ae 48 a1 db 55 a9 74 1b 62 c7 57 db e9 76 0d db 0f b3 fd 56 b6 5d 4f 8e d3 09 42 2c e9 34 a4 c5 ab 9d f9 17 0a 22 ce 8d 37 80 3d 0e 82 65 05 b5 3f 79 20 22 1f fa 1f 72 09 3c 8f f9 b8 2e f9 fa 3f 6f 5a ef 9d Data Ascii: tC;S,!Q_lbJ)&Zt8K\vSgIscq7%W}4G?\|=~ec_?]>=UhN,fw"gyp\|NP <Rio`8z_<7*w9HUtbWvV]OB,4"7=e?y "r<.?oZ
2024-10-02 10:16:44 UTC	13036	IN	Data Raw: c7 65 fc d7 fa 5a eb 81 d0 2b bf 96 6e 30 86 84 1b 0c 5c 49 af 80 bb b3 ef 01 6c 3e 67 3f ad 41 fc ed 7c 90 c8 7a 99 5d 75 87 50 8e a7 00 60 97 4d 30 87 29 cf 0e 65 cd 4e e9 92 02 b2 66 47 e4 bb 1d 18 96 88 fb ff 91 92 67 32 4f ef f8 cf 3d fd fc f4 3c 3c 49 dd 4b fb fb bd fa e9 f3 59 fc f5 79 84 8a 4e d6 48 a1 87 74 97 17 71 8e 41 05 8c f4 49 0e 7f 5a 7c 32 83 35 86 c4 27 a1 c4 9f b4 e9 9f 5c ce eb e6 c9 19 d2 d8 86 4e 23 45 ec 4e f4 7c 61 3a 7b 55 12 7a 5c a7 3e d9 cb ff 6b ae de 27 1d d4 27 68 cf 95 31 61 9f 74 e8 7d a2 1b 2f 66 c6 f4 49 0f 5f ff a0 b4 e1 f2 f4 24 ec 93 50 f1 18 b1 90 d8 27 3d 3a b4 76 fe 9d 62 11 64 9c 35 f6 88 06 f6 24 6e 60 87 fe 89 83 6f 11 9f a4 b3 c6 0e f1 49 47 e2 4f f6 ea 9f 4c e7 8b 8a f5 3e d9 8b 7d 72 bd 39 62 b4 76 36 03 ee Data Ascii: eZ+n0\Il>g?A\|z]uP`M0)eNfGg2O=<<IKYyNHtqAIZ\|25'\N#EN\|a:{Uz\>k''h1at}/fI_$P'=:vbd5$n`oIGOL>}r9bv6
2024-10-02 10:16:44 UTC	13880	IN	Data Raw: e7 ef 8f 9e 7d d4 7f 4c 49 e4 22 ea 8b 30 57 fc e7 f3 a0 d4 b3 68 66 02 66 e5 44 39 5e 4c ed 74 89 b9 fc 96 c4 9e de 52 6b 87 8b 95 08 98 1f 66 52 93 9b 65 57 a5 85 7f fe 62 88 21 ba 7e ae 14 05 89 21 36 9a 8b d0 05 1d 7f 9e f2 d7 c8 fc 5b 44 fe 3b 91 be 80 b5 54 8e 76 2e 46 f9 e3 94 47 91 79 d6 88 3c 27 ed 52 4b 29 26 75 0b f3 b3 e6 50 fa c9 29 b7 3e 7b 51 73 63 ca 9b ce 4e 09 35 7a 47 88 7a 30 94 dc 25 97 22 9a 20 38 e4 84 df 4b 6d 45 64 cd 53 da 34 f8 73 1e 1b 7e 7a da 7a 8c 30 52 5c e6 1f d1 3e 2d 24 d0 bd f7 2e a0 b3 88 d4 63 f0 b9 85 6a 6b 90 b5 3d 25 6a 6b 86 04 73 8a 46 22 a9 38 47 e2 21 01 dd 6e bb fd 36 11 33 30 ae 24 27 65 0f 1f 41 93 13 27 65 e0 01 0c 1c 92 81 25 6e 65 da 7d 28 3d 7f 51 f9 ed 94 80 f2 80 ff 97 0d 57 86 1b 4e 5d 39 84 bb 4d 9f Data Ascii: }LI"0WhffD9^LtRkfReWb!~!6[D;Tv.FGy<'RK)&uP)>{QscN5zGz0%" 8KmEdS4s~zz0R\>-$.cjk=%jksF"8G!n630$'eA'e%ne}(=QWN]9M

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
46	192.168.2.16	49798	13.107.246.40	443	4912	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-02 10:16:44 UTC	669	OUT	GET /shared/cms/lrs1c69a1j/logos/5a74283229e24d0ca59fb94ed941c3a0.png HTTP/1.1 Host: edgestatic.azureedge.net Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://www.microsoft.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-10-02 10:16:44 UTC	700	IN	HTTP/1.1 200 OK Date: Wed, 02 Oct 2024 10:16:44 GMT Content-Type: image/png Content-Length: 71803 Connection: close Access-Control-Allow-Origin: * Cache-Control: public, max-age=31536000, immutable ETag: W/"1187b-18c5b630cdd" Last-Modified: Tue, 12 Dec 2023 00:17:47 GMT Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Origin-Agent-Cluster: ?1 X-Content-Type-Options: nosniff X-Download-Options: noopen X-Frame-Options: SAMEORIGIN X-Permitted-Cross-Domain-Policies: none X-XSS-Protection: 0 x-azure-ref: 20241002T101644Z-15767c5fc55qkvj6vefppu9qh4000000093g00000000bds3 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-02 10:16:44 UTC	15684	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 01 2d 00 00 01 36 08 06 00 00 00 34 f2 c4 b6 00 00 00 09 70 48 59 73 00 00 21 38 00 00 21 38 01 45 96 31 60 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 01 18 10 49 44 41 54 78 01 ec fd 6b d0 66 d9 75 1e 86 ad 75 be ee c1 95 e4 0c 2d c9 a6 c4 08 0d 55 e4 88 64 64 0c 24 52 b6 64 27 1c e8 47 ec 24 95 00 72 9c 44 fe 11 03 60 e5 52 89 92 f0 52 65 97 e4 2a 6b 66 5c 95 8a 93 b8 44 f0 47 7e a5 ca 18 a8 92 92 92 aa 48 64 e2 1f 94 64 b1 07 24 2d c9 14 45 0c 44 82 00 01 12 d3 83 fb 65 80 e9 01 e6 d2 d3 fd 7d 67 f9 9c bd 9e e7 59 6b 9f f7 1b 60 70 9f 01 fa cc 7c fd be ef b9 ec fb 7a d6 b3 d6 5e 7b 1f b7 bb c7 dd e3 70 5c bb fe be 7b 5f 77 d5 ae ad 77 ec da 95 33 bb 37 Data Ascii: PNGIHDR-64pHYs!8!8E1`sRGBgAMAaIDATxkfuu-Udd$Rd'G$rD`RRe*kf\DG~Hdd$-EDe}gYk`p\|z^{p\{_ww37
2024-10-02 10:16:44 UTC	16384	IN	Data Raw: 04 0b 87 d9 08 17 9e 57 3e e3 79 39 db 0b 68 57 eb 11 23 36 81 f0 3a 01 33 51 2e 4d cf 40 1d e6 3e 29 76 96 4d 57 ec cd 26 93 93 b7 b8 bf 58 ff 8e e3 a9 e5 f6 37 c6 b6 be e9 4c eb ca 15 7b 7b 5c ac d7 ec 04 92 cc 1a 7d 3f ba 55 27 38 d0 33 39 f2 a1 d0 6c 9a d5 1a c7 57 00 2c 3b 9c ef a6 1e af ac 60 52 cf 7c f2 d3 f6 e5 4f 7c 66 07 a9 52 cb bb 07 e1 ec 2a f2 1b e1 bd 55 ba b1 d3 9b 61 a1 ea f0 52 10 c0 40 05 86 f5 0f 60 c6 e9 c8 e7 b0 17 14 aa 71 35 85 47 29 13 d0 57 ba 75 03 03 0e 63 64 1d 39 66 08 80 99 dc c9 63 ac a5 a0 dc fa c2 97 ec d6 93 4f 87 7d e4 13 fb 39 bf e7 de d7 db d5 1f f8 3e 7b ed 1f fb c3 1b a0 fd 0b e6 f7 5c 51 6b f8 a1 a5 66 1f 1d 95 8d 09 84 6c 6e fa 0e 35 a7 df ba 03 f7 92 67 2e 33 6d 23 65 d8 71 03 04 b4 ee 1d 2d 9b 28 5a 7e ab a9 6c Data Ascii: W>y9hW#6:3Q.M@>)vMW&X7L{{\}?U'839lW,;`R\|O\|fR*UaR@`q5G)Wucd9fcO}9>{\Qkfln5g.3m#eq-(Z~l
2024-10-02 10:16:44 UTC	16384	IN	Data Raw: c7 ed 70 d9 a3 ef c4 30 b5 4c 31 f4 de a8 f2 a7 69 08 d0 35 d4 1a 4c a0 19 42 2c d1 2e 0e 33 de d3 60 ba 00 45 7e b7 3e be 91 07 ed d2 69 e8 57 4e 61 72 56 d6 f2 07 d3 00 9c 52 63 63 1c 00 eb fc c3 8f d9 0b ff e0 6f c7 fa 85 4f ef b9 bd f3 d9 5f 7b d7 23 f6 5d 70 7c fe e1 b7 6c 95 bd fa ee ad b6 3f 45 45 34 5a 34 6d 35 7f e1 73 79 5f 1f bd f5 d7 d6 26 ea a6 10 98 8c 1e 58 57 f8 a3 02 23 44 20 18 14 5a 1a a0 41 b7 56 c8 b5 55 df 47 c1 68 90 45 5a 7a 4e 23 2f 8c d3 34 41 b2 e4 a5 93 ac 93 b4 5c 59 3f 46 dc 8a f5 13 2a 71 b0 12 75 60 7a d2 ba 4f 09 65 48 9f d3 89 c2 33 b5 a1 be 77 a5 6a 97 83 9a 4b 35 cc 62 57 4c 2a 04 6c bc 2e 23 a7 db ad 1d 70 a3 ca 42 c0 45 59 66 d0 da aa 32 36 d9 7a fe f3 7b 90 de 59 70 01 b2 51 93 f5 b0 06 ab d0 bd 14 e7 02 32 6b 66 a4 Data Ascii: p0L1i5LB,.3`E~>iWNarVRccoO_{#]p\|l?EE4Z4m5sy_&XW#D ZAVUGhEZzN#/4A\Y?Fqu`zOeH3wjK5bWLl.#pBEYf26z{YpQ2kf
2024-10-02 10:16:44 UTC	16384	IN	Data Raw: 30 86 ba 26 84 9d 22 2a 0b 0a 66 e3 6a 23 bb 71 5d fc d9 ac fd 11 e1 16 61 03 73 66 95 bd 9d e9 f9 18 10 08 6b 08 07 42 02 5f 03 ce 56 7e 09 25 d0 c2 17 b0 c3 05 44 19 7b d0 b3 b1 34 e2 ac 1e 86 6a 98 9e 22 63 98 8f dd 53 69 4c cd ae 6b 95 3c b9 cb e7 df fe db df ff 8f 4f d0 25 4a 55 3d 9c 96 f3 30 3d ac 3f 2c 76 ca 9c 08 92 a6 7d 30 05 04 3a 0a b9 bb 0c 64 33 31 ae 7e 57 5f 9e 9e 98 55 cc d2 c4 0b 12 ab a1 a4 73 53 4c 5a 45 42 96 82 1c 66 4f 23 a7 d0 8e 9b 2b 54 c3 64 2a 32 ed dd af 44 a9 0a db 93 0a 60 94 71 d6 c0 ef d9 27 d1 30 c9 9a 97 8d e6 59 3f f6 66 74 95 91 11 42 92 b0 4c cc cb 6a 08 28 b8 54 a8 42 54 6a ac 54 b0 d9 f7 ab 90 6d dd f8 86 37 4c 06 c8 a3 84 a0 d2 32 99 67 bb 8c f6 84 41 16 93 7d 79 2d 60 80 93 6f 0c e8 56 90 ae 36 1a b2 89 c7 4d f5 Data Ascii: 0&"fj#q]asfkB_V~%D{4j"cSiLk<O%JU=0=?,v}0:d31~W_UsSLZEBfO#+Td2D`q'0Y?ftBLj(TBTjTm7L2gA}y-`oV6M
2024-10-02 10:16:44 UTC	6967	IN	Data Raw: cd 77 ed fc da 7b 7f 8e ae d0 c4 74 25 a7 1f 7f f8 10 6f 6e 7d b2 49 8d d7 4d 6e fe 98 77 f8 9f 98 d2 1b 3b 99 6d 1b a7 e0 35 d0 17 6d 62 26 89 19 7a 00 cd c7 09 e9 ed b8 14 6e 4a 22 d8 7b 6d 17 96 72 39 cf 6e 8c f9 db 6f de fc ea 17 69 f3 cb 9f eb b7 f3 80 6b 06 82 df 9f 22 6a 91 82 9d 0c 36 97 19 d7 11 26 54 bd 9e fc 9c cc aa 90 18 8f 01 b1 79 e5 b2 81 3a 29 53 99 89 39 46 99 27 57 db 02 98 1b 7b 72 cd 92 4b 19 91 4c 6a 29 30 cf 5b 48 c8 db d2 45 81 85 d0 99 1a 9b 5b 93 cb 37 1f 04 a9 5f 29 5d 9d 9e 23 b4 d4 f7 e8 f3 65 1a 94 8a e7 c6 f7 22 28 a3 1d 4b db 82 11 fa aa f0 60 6a a5 5d 21 16 24 57 66 f5 e3 09 63 54 66 55 c2 fb d5 46 b7 5d 80 5e b5 62 34 a3 fb 4f 5e 51 36 ac 79 ba 32 99 16 d2 64 9c df 9b b6 b4 e1 53 31 80 bc ff 30 08 59 a5 99 8a 98 90 be 2a Data Ascii: w{t%on}IMnw;m5mb&znJ"{mr9noik"j6&Ty:)S9F'W{rKLj)0[HE[7_)]#e"(K`j]!$WfcTfUF]^b4O^Q6y2dS10Y*

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
47	192.168.2.16	49808	13.107.246.40	443	4912	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-02 10:16:44 UTC	676	OUT	GET /shared/edgeweb/fonts/segoeui-vf-display.5c8aa5a.woff2 HTTP/1.1 Host: edgestatic.azureedge.net Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" Origin: https://www.microsoft.com sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: font Referer: https://edgestatic.azureedge.net/shared/edgeweb/css/105d560.css Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-10-02 10:16:44 UTC	681	IN	HTTP/1.1 200 OK Date: Wed, 02 Oct 2024 10:16:44 GMT Content-Type: font/woff2 Content-Length: 121824 Connection: close Access-Control-Allow-Origin: * Cache-Control: public, max-age=31536000, immutable ETag: W/"1dbe0-18c5b54b2c9" Last-Modified: Tue, 12 Dec 2023 00:02:06 GMT Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Origin-Agent-Cluster: ?1 X-Content-Type-Options: nosniff X-Download-Options: noopen X-Frame-Options: SAMEORIGIN X-Permitted-Cross-Domain-Policies: none X-XSS-Protection: 0 x-azure-ref: 20241002T101644Z-15767c5fc55dtdv4d4saq7t47n000000092g00000000c2dy x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-02 10:16:44 UTC	15703	IN	Data Raw: 77 4f 46 32 00 01 00 00 00 01 db e0 00 12 00 00 00 05 1d 78 00 01 db 73 00 02 05 1f 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 3f 46 46 54 4d 1c 1a 86 4a 1b 83 eb 42 1c 8a 58 06 60 00 98 7a 08 81 6a 09 9f 03 11 10 0a 8d 8b 38 8b 8a 09 0b cf 18 00 01 36 02 24 03 cf 10 04 20 05 97 29 07 81 ba 19 0c 84 48 5b f3 73 b4 07 a2 c9 d8 dd c3 36 65 4f 36 ab c0 20 a9 42 28 28 1d c3 24 4e b8 d2 17 4b 01 5c 2f 09 44 31 8e 66 ab f0 e4 f0 76 0c e9 e9 40 a9 ed 69 73 af a0 db 36 d1 87 44 e9 b9 cd 34 4a 95 bb d2 cd fe ff ff ff ff ff ff ff ff ff bb 4a 7e 3c ea f4 dd c9 7a f7 ef 7f c9 92 3c 16 d8 a6 98 61 0c 0e 33 61 84 60 c8 a4 4d 9a 34 69 3a 41 23 02 dc 03 3c 1a 52 11 c1 c2 19 84 95 21 ba 34 07 8d 44 6c 5b 20 48 57 58 85 50 d3 1a eb 74 7b 65 df c4 a0 2f 86 Data Ascii: wOF2xs?FFTMJBX`zj86$ )H[s6eO6 B(($NK\/D1fv@is6D4JJ~<z<a3a`M4i:A#<R!4Dl[ HWXPt{e/
2024-10-02 10:16:44 UTC	16384	IN	Data Raw: c3 52 3d 20 2c 6c ae 93 c6 5b de 28 8c c8 c8 ac 20 f6 15 5f 5d 3c 7c ce 1a ef 5c 6e d3 c4 7a 78 a5 02 7e 67 bc 6b 03 36 75 12 bc 35 fc 65 c4 2a bd fb 92 98 8d 9c 10 a1 49 8a 20 40 30 92 40 fa 31 06 5d db ed a4 25 5e 92 ab 12 24 4f 71 57 a3 a3 2f f0 59 08 02 87 ef 66 e5 55 dc 62 b2 25 a8 c7 9a 6f 60 7f c3 80 77 da 15 a7 15 53 c3 56 88 f5 a6 7d 17 23 cc 11 87 33 d7 c2 b5 44 6f a9 bc a7 7c f9 9e 29 10 e0 3c 3c 0f c1 3c 55 6b 57 a3 c6 ab d4 f6 3a 81 2f e7 b3 18 b8 0e 5d ce e2 12 37 19 9f f0 c2 83 cf f8 f8 f2 e4 cb 77 db 5d 77 4d f9 ee bb 69 b3 df 39 cb 94 6f 28 96 a3 65 78 2e 71 19 ae 26 65 29 4b 5e 28 57 2e 51 a4 48 b1 82 a6 a0 ab 41 e6 97 f4 19 81 69 82 02 65 c1 42 9c b3 9d b6 3d ae 4b ac 1b d7 a3 d3 6f 73 fc 9e 6c 7a a1 4c ae 47 ef 97 71 b0 6c 5b ca e9 89 Data Ascii: R= ,l[( _]<\|\nzx~gk6u5e*I @0@1]%^$OqW/YfUb%o`wSV}#3Do\|)<<<UkW:/]7w]wMi9o(ex.q&e)K^(W.QHAieB=KoslzLGql[
2024-10-02 10:16:44 UTC	16384	IN	Data Raw: e2 fa 4a f8 fd aa 30 6d 8e a2 ac 0d 2d e9 79 7a 05 04 70 ea 65 ec 2b 46 71 ed 1b 64 93 51 a8 3a fa 93 90 5f b8 96 46 67 81 83 26 b1 ee 41 5d d9 01 6b 42 36 1e 6c 12 10 a6 c8 c2 56 d7 ac 53 1e c0 33 7a 19 b8 50 40 ef 80 dd bc 5d 2a 92 d3 8c 02 f3 db 99 61 60 8c 06 b2 e8 29 fc 93 ba 08 40 f9 f4 9c d1 f3 c9 c1 3b 8b 33 80 4a 5b e7 27 af 19 5d c4 61 e9 4c f6 a6 fe 68 a2 fe f7 28 16 7b f2 e1 dc 06 00 c7 98 16 53 d3 b3 11 61 14 ca 65 2c b5 3b 4b 0b bf a6 82 8b f3 ae 99 e0 60 bf 46 6e fb c3 a8 2f 9f ea c0 20 7d 89 c9 61 e1 5f 28 91 76 c7 4b 6a e4 dd 14 3c 6d 2b e5 29 ae e4 55 9e a8 9b 1d 95 fa 9a 4b 2e 9c 2f b0 61 06 89 1d 78 83 b2 ad f2 e1 d6 ad 07 31 6b 53 39 5e 1b ea 94 ad db 5a 42 e1 aa 55 cb dd d6 b2 64 ca a6 a5 03 8f 7a c7 bc 14 8c cf 9c c3 61 d5 b7 ff f6 Data Ascii: J0m-yzpe+FqdQ:_Fg&A]kB6lVS3zP@]*a`)@;3J[']aLh({Sae,;K`Fn/ }a_(vKj<m+)UK./ax1kS9^ZBUdza
2024-10-02 10:16:44 UTC	16384	IN	Data Raw: 54 79 98 ab e4 d7 b0 f0 ca 03 b6 8e 71 ff c4 97 bf d0 92 ff 77 fe 04 af b9 ef ff d2 03 ee 70 d3 3c 53 27 0f c1 da bf 04 46 f2 8c 97 da 9d 3c 71 fd 89 45 a6 1c 77 a4 a3 90 b4 c9 b3 a8 83 d0 39 9c 93 2b d2 57 ca 10 54 af ab 3f 79 03 00 12 ce ca cc 9d 70 66 44 9a 02 1d 28 84 21 c8 21 b0 2b 4b c9 62 bd 14 c0 bf 2e de e3 c6 6b da 37 ae 3e 2a 03 ec d8 bd 24 7b 94 c8 2f 31 a8 e2 d2 57 38 35 0b 3f 34 d2 39 f7 55 23 07 31 8d ce 04 7d cc d0 ea 9b 50 f5 4e dc 5d d4 a7 8f d5 c3 a1 10 f8 af c8 54 aa 5d 13 b2 f4 6a b5 dc bc 83 43 c8 55 77 f3 8f b3 5f 76 7d 81 6c 1f fd c8 6f cb 44 47 32 bf 4e f1 0b bd e0 7e 69 1c fd ce 74 79 ae e5 ef de 6e 5e b7 93 03 25 f1 73 72 ba 9c 48 a3 eb 0b c1 1a ce 5d 7e bd d1 9b ba f3 05 5b a8 97 7e 01 9d 24 60 a8 7e 08 70 9b 75 8c 6e 08 c8 f0 Data Ascii: Tyqwp<S'F<qEw9+WT?ypfD(!!+Kb.k7>*${/1W85?49U#1}PN]T]jCUw_v}loDG2N~ityn^%srH]~[~$`~pun
2024-10-02 10:16:44 UTC	16384	IN	Data Raw: f7 df a6 43 16 41 f5 a0 16 dd 4e 22 b9 bc a1 b9 02 5e e5 6f d7 92 ec 2d bf e2 01 73 98 74 ce a8 ca 10 e3 80 f4 9c 23 16 ab a8 26 82 68 9a 91 c5 8b ef c6 0e 6c 61 5d e1 b2 d8 13 b6 95 72 83 bc 73 8b 58 00 45 5d d5 6d 9c 33 f4 98 78 4c bc 9a cd b7 0a 4f 64 36 5b 7a 12 fc 85 28 3c 98 bc e4 48 d3 52 02 2c d2 b5 35 af 6c 2e ae 89 c8 14 df b4 98 a3 f0 ea 4b 76 45 69 6e d2 3d b7 a5 98 3f 34 84 2f 87 18 24 5c cc 8b 73 2a c1 8a d1 b0 46 40 47 15 60 9b 72 6f ba df 7f 38 9a 5c 73 c1 3e 8e 9b ae 1d 9c 35 c6 66 3e 3e 4a 87 b6 1d 16 7e 92 67 13 d7 cb 76 52 bc b0 30 79 44 d5 38 64 5d 1f 26 3d e7 74 7c 1a 5a d1 e9 25 63 a3 93 50 a1 6d 87 ce a7 a7 0e b9 e8 08 88 71 83 ba bb 0a 34 3b cc f1 f5 37 9c 07 f8 21 49 31 19 d0 ba 6a de 73 4b c7 14 8b 73 0c 6f 26 37 be 65 cd 9e d1 Data Ascii: CAN"^o-st#&hla]rsXE]m3xLOd6[z(<HR,5l.KvEin=?4/$\s*F@G`ro8\s>5f>>J~gvR0yD8d]&=t\|Z%cPmq4;7!I1jsKso&7e
2024-10-02 10:16:44 UTC	16384	IN	Data Raw: b9 7a 79 57 0d a0 4b 36 7a 69 aa 90 08 ad 9e e3 32 51 1d a9 c6 40 fa 42 ec 7c b2 a7 06 c8 30 e3 40 e7 7a e0 c1 a1 ce 99 5b 59 76 42 f3 2a d5 79 6e 79 c1 dd 74 ed 6e e3 ee 3f f9 aa 1c 78 75 48 f0 84 52 48 55 70 c8 e4 dd 60 f8 24 0d c6 1a fb 2a 15 7e 10 69 73 f6 19 7c 5c 29 a4 c3 45 1d a0 87 8c 67 c8 fd d2 29 79 21 13 15 a8 bc 4d ce 4e d5 8b 20 2c a7 c5 fc 8f 08 e5 a3 2a e9 18 cb de c1 ef 50 c3 6c c7 2b 4f 89 86 ca 9e fd bb 7f ee 9b 2f 6c fd ef f1 e3 6d 77 6c cb 96 5f 07 1a 1b 8d a5 ad 59 2e fc b5 37 c3 0f 28 c1 3b 95 76 1b da 74 22 95 34 df 40 94 55 5d b3 d7 f1 da 5d b2 77 4c 6e 72 c6 da a3 7e 20 a7 1d 9b 28 d8 f2 56 12 48 32 c1 f2 e8 af fe 04 28 53 cd d2 bb 7b fe 2c 56 31 c1 d2 f7 a5 81 20 22 70 39 62 c2 5a 02 d8 c1 22 8f df f0 f5 ee ef d6 86 35 04 31 81 Data Ascii: zyWK6zi2Q@B\|0@z[YvBynytn?xuHRHUp`$~is\|\)Eg)y!MN ,*Pl+O/lmwl_Y.7(;vt"4@U]]wLnr~ (VH2(S{,V1 "p9bZ"51
2024-10-02 10:16:44 UTC	16384	IN	Data Raw: 1b 59 47 3f 63 e6 ac b2 3c f6 84 c5 37 ec 04 8b db f4 dc 04 31 96 eb 74 85 f3 63 49 49 09 1e 27 86 01 8f 35 ea fc 6f 04 91 65 cc 09 13 82 82 f5 f7 1f 06 83 fd 97 9e 82 2c 49 19 4e 4c 0f d2 59 de 6a b5 6d cb 3a 00 10 12 82 06 dd eb 00 98 b5 28 9d 80 55 82 17 5e ec c9 30 d7 b3 9c 5d 99 4b 56 d3 a7 4a b0 6c 14 2b 67 40 41 df 82 4b f7 04 07 0d 90 00 4d 1b f1 85 5d a5 c9 d2 f5 29 58 30 a7 6e ce 8c e6 22 1d c2 a7 24 26 a8 55 1b 45 47 b9 b1 20 67 42 b7 45 73 45 cd 31 e6 de dc e9 51 a7 8e 3f 96 76 67 77 05 a6 f7 7c 04 10 c7 c0 03 aa 20 31 00 8a 38 f7 ac dc ba 46 32 2c a4 b7 53 37 19 92 92 42 2e 34 62 e7 c6 6a 36 e3 d5 fc d9 1a 5e 82 fb d3 bf 47 c7 3e 26 99 65 ff 5f 34 e3 cf 7b b6 c6 06 af 69 39 09 57 82 be f3 70 4f ad e0 84 5e 44 c6 f2 e9 db 53 07 64 a6 1d c3 64 Data Ascii: YG?c<71tcII'5oe,INLYjm:(U^0]KVJl+g@AKM])X0n"$&UEG gBEsE1Q?vgw\| 18F2,S7B.4bj6^G>&e_4{i9WpO^DSdd
2024-10-02 10:16:44 UTC	7817	IN	Data Raw: 4f 96 4f 54 ea b9 cb 7a 46 4e c0 b6 06 6c 39 37 cb 49 be 14 65 3e 12 27 85 dc ba 66 0c 1e 9e 46 02 42 0e ad da 5c 81 5b ad 23 a8 09 36 27 70 49 7f 4e 98 4b b0 ed e6 df cf 1d da 19 97 7b 37 52 90 60 ac 99 92 be 48 46 b1 48 94 13 ea 8a 34 0c 75 af 68 59 d3 47 8a f6 c3 0f 51 5c 04 92 4d 6c b1 9d 34 27 12 2e fd 3f 82 9b e1 0f 6a 55 33 4e ea 69 32 09 23 c7 7d 65 a1 74 08 d7 47 0f 69 3a 89 35 12 aa 92 a7 29 52 e5 20 77 3d ee b1 c3 53 72 87 6b 4e 48 97 fd 09 9d de de 3a 13 e6 5f bc 46 3c 92 21 6b 47 97 53 1d 0a 76 c7 cc 3d 1a 7d 06 46 02 d4 8c 02 69 5a c8 e2 61 b2 53 fd 4e 66 4a 13 d0 1e a8 07 6b 02 f4 49 dd ad 5e 61 0d 81 8a b0 2e fd 75 6f 36 22 cf ab 71 8b f6 4a 4d 4c a3 d4 4b f0 2d c5 f5 40 6b e9 2a 8e 62 77 c0 72 86 4d a1 f9 03 65 e4 47 bb 62 f8 a8 f2 61 a1 Data Ascii: OOTzFNl97Ie>'fFB\[#6'pINK{7R`HFH4uhYGQ\Ml4'.?jU3Ni2#}etGi:5)R w=SrkNH:_F<!kGSv=}FiZaSNfJkI^a.uo6"qJMLK-@k*bwrMeGba

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
48	192.168.2.16	49807	13.107.246.40	443	4912	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-02 10:16:44 UTC	685	OUT	GET /shared/edgeweb/fonts/segoeui-vf-display-semibold.b7bb141.woff2 HTTP/1.1 Host: edgestatic.azureedge.net Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" Origin: https://www.microsoft.com sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: font Referer: https://edgestatic.azureedge.net/shared/edgeweb/css/105d560.css Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-10-02 10:16:44 UTC	681	IN	HTTP/1.1 200 OK Date: Wed, 02 Oct 2024 10:16:44 GMT Content-Type: font/woff2 Content-Length: 129152 Connection: close Access-Control-Allow-Origin: * Cache-Control: public, max-age=31536000, immutable ETag: W/"1f880-18c5b69cfb1" Last-Modified: Tue, 12 Dec 2023 00:25:10 GMT Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Origin-Agent-Cluster: ?1 X-Content-Type-Options: nosniff X-Download-Options: noopen X-Frame-Options: SAMEORIGIN X-Permitted-Cross-Domain-Policies: none X-XSS-Protection: 0 x-azure-ref: 20241002T101644Z-15767c5fc55472x4k7dmphmadg00000008z000000000b9w2 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-02 10:16:44 UTC	15703	IN	Data Raw: 77 4f 46 32 00 01 00 00 00 01 f8 80 00 12 00 00 00 05 29 dc 00 01 f8 14 00 02 05 1f 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 3f 46 46 54 4d 1c 1a 86 4a 1b 84 82 2c 1c 8a 58 06 60 00 98 7a 08 81 6a 09 9f 03 11 10 0a 8d 8b 68 8b 8a 0a 0b cf 18 00 01 36 02 24 03 cf 10 04 20 05 98 75 07 81 ba 19 0c 84 48 5b 2a 80 b4 13 fe 7f b2 df 3d 6b b8 3d 7d 4e 28 cd 28 0a b1 40 ec 47 11 e9 1c 62 f2 ef da 22 38 04 d1 ab ce 01 91 31 b6 d9 91 73 23 91 ca 8e 21 7d 1c 50 5a d5 f6 b6 1b e8 b6 cd e0 a9 a5 e7 d6 1a b9 95 00 46 f6 ff ff ff ff ff ff ff ff ff ff ff ff df 5a f2 9f a7 b6 fd b9 77 98 bb bc 59 98 61 58 45 41 53 10 49 05 cd dc 50 d4 d4 d4 9f e5 2f eb d7 df 21 2a 30 71 d1 90 a8 a5 59 0e 33 d4 0b 38 ca d0 40 d5 0c 68 b5 3b 4e 1c 42 ba e8 ad f4 e9 2a d6 Data Ascii: wOF2)?FFTMJ,X`zjh6$ uH[=k=}N((@Gb"81s#!}PZFZwYaXEASIP/!0qY38@h;NB*
2024-10-02 10:16:44 UTC	16384	IN	Data Raw: b1 94 54 92 1e a1 98 59 3c 9c 5c 3e 7e 01 43 51 31 13 69 19 73 45 25 2b 75 0d db b7 5d d6 f7 7d f6 06 4e 1b bd 9f d0 7e cd 7e 75 23 a2 18 96 54 19 bc de 9d 58 b2 d4 bb 38 b2 dd c1 3b d1 ad c7 6e d2 3f 77 d9 ba 94 30 a5 e6 a6 25 bd 7c c5 72 d9 25 84 27 9f 0c 8a 14 97 49 99 72 b2 a0 5c 4d 36 e1 f5 e4 d0 a4 b9 fc b5 ad 0f 45 50 6a 2a 4a 34 15 61 f6 54 95 fb 10 57 75 12 26 56 86 3c 85 42 60 3a f5 8c 39 ab 72 70 05 2b bf 50 51 85 48 85 2a 4c b1 8a aa 6b d5 51 7d a3 a6 6a 61 b9 36 9a 38 f4 83 53 6f 69 0f a3 3d 5d ec 4d 9f 74 2b 41 87 fa c2 69 e7 fa a4 ee 5a 3f 62 ec 4e 7f e1 cc ad bd 02 85 75 4c a2 b4 ce ca 57 d2 55 8d da ba 6b d0 58 cf d4 d8 7f eb 5b 86 c0 29 28 ab aa a5 b4 75 b2 86 46 21 0f cd e2 d6 36 69 47 a7 ac 3b 24 8c 44 c5 f0 84 24 95 96 61 5f 8e 64 f2 Data Ascii: TY<\>~CQ1isE%+u]}N~~u#TX8;n?w0%\|r%'Ir\M6EPjJ4aTWu&V<B`:9rp+PQHLkQ}ja68Soi=]Mt+AiZ?bNuLWUkX[)(uF!6iG;$D$a_d
2024-10-02 10:16:44 UTC	16384	IN	Data Raw: db 28 85 89 82 5b 55 24 bd d1 25 16 93 7e 7b 0f 0d a4 50 60 84 a6 95 9c ab 91 c0 75 66 cb 58 26 dc b2 36 52 53 c1 a3 c9 c5 f6 da ec 39 d5 3d f9 72 d8 14 dc fc c1 44 86 ee 89 ec de e0 9d f1 78 da 8b f2 f8 22 4b 6f 9c be b5 b1 1e 2d c3 d6 96 47 3c 04 44 eb 5c ac 9b da b3 3b 4c 57 cb c7 d3 ee 87 60 91 67 4e 33 ef f8 43 a8 c9 49 1d 38 ce e3 bc 2d 13 dc b1 70 ea 5b 50 c7 ca 02 da 24 6e d3 b5 a2 fb e8 30 31 7a 4a 7e 65 b1 9d 98 80 ed 2b 67 f2 13 2f ab e7 42 d6 99 63 04 e6 3d 3e 4a 4d 1c 1a 05 20 1e ea 6a 34 48 29 98 30 0b 34 c7 b3 aa 56 7d 2a 22 15 81 01 81 10 1c e1 e6 e1 42 85 f0 52 bc dd 36 55 a4 bb 12 20 21 41 48 ac 00 ce 0b dc 5a e3 ee 2e 3f 9a fa 47 cd ac ee 36 8e 2b 4d 8c 96 4a bb 49 10 a9 16 f0 6f da 5a 5f 69 bc 22 90 3e d7 60 d5 4c 2f c3 54 27 7a 55 84 Data Ascii: ([U$%~{P`ufX&6RS9=rDx"Ko-G<D\;LW`gN3CI8-p[P$n01zJ~e+g/Bc=>JM j4H)04V}*"BR6U !AHZ.?G6+MJIoZ_i">`L/T'zU
2024-10-02 10:16:44 UTC	16384	IN	Data Raw: b6 80 57 94 d5 a7 c8 9d 00 d2 72 a0 65 ac 2f 4d 45 56 7d f4 50 0b 53 db a9 79 a9 e1 20 a4 88 4e cd 86 66 54 5b 8c 40 22 d3 bf b0 c3 e0 4a 86 a1 d9 fd 8d 97 61 aa 33 98 6d 65 48 51 91 b5 8e 98 0d 13 45 11 c3 51 a8 18 31 5f 89 32 6f 4a 6a 5f 05 ca 99 97 32 84 47 97 a6 e7 2a 1a 12 47 55 1a d7 62 7d 3e 6c 97 28 eb 37 b5 0c 0d be e4 7d 36 8e a9 d5 0f 3f d7 22 aa 6f b8 64 02 eb 74 53 42 b7 f0 52 00 9c 58 7a 8b cb fb f7 a5 ae 79 a1 5a ce 97 a1 04 b1 0c dd d7 f0 f2 42 c5 13 ca b5 97 ae 0f c2 3f 2b 7f 4f 2a cf 08 07 f5 49 ed 48 89 ca f7 37 db 3e 18 76 de 20 c5 4a d2 ad 82 dd 46 ab 9c 9e 30 69 cf 6b e6 ff 9b 11 51 1c 52 f3 77 d5 0f c5 6b da 55 81 47 ed 40 64 0c 5f 8f 40 6c 11 a0 7f 12 b0 c4 f7 16 8b 5f 8b 1b 38 0d e5 af cb eb cd 30 bf d8 b4 59 f9 4b 58 ff f2 fb 1e Data Ascii: Wre/MEV}PSy NfT[@"Ja3meHQEQ1_2oJj_2GGUb}>l(7}6?"odtSBRXzyZB?+OIH7>v JF0ikQRwkUG@d_@l_80YKX
2024-10-02 10:16:44 UTC	16384	IN	Data Raw: 54 66 30 7b 8f 3b 54 61 26 4c e7 5d fb 2c 32 2d b1 63 33 43 d0 95 41 ae 7c 9b 82 77 4f 0d e1 ec b6 9d dd db c6 ce c4 75 3f 70 3c 83 c4 34 bd 04 fe d8 06 6c ff 06 c6 2d 63 1e 7f f3 f2 19 b1 73 23 0d 47 c2 47 e1 59 49 db fb 77 e3 7f 64 11 78 eb c6 06 a4 ae 9e 33 59 89 24 47 aa b3 da 01 5f be ee fe 99 ba 23 fa a5 ea bb d0 47 25 91 39 7f 2a 05 8e 52 29 ca 3d f4 86 14 1c 0b 97 f6 32 f2 51 ed 14 1c 18 4f 39 b5 1c 1d 4d 1c 75 ff 9f d2 f7 94 56 f7 70 c0 30 41 33 a2 6d 9f e5 60 35 1f ca 84 0a d7 85 67 17 f1 12 ef 4b 8b a8 ba 4d e7 8e d7 b8 09 18 1d 18 df 3a 69 79 f0 0d 73 4b 1d 08 ad 29 c5 4e c0 3f 87 1e 31 90 6a de 05 fe 40 7b 5c 25 af 90 57 43 f7 ab 86 e4 70 75 3f f3 d5 f8 88 7b 56 7e a2 ad 57 b0 6e fd 11 2e da f4 1d 43 6f bc 1a 98 7c 9f 30 51 c5 38 c1 3c 69 1b Data Ascii: Tf0{;Ta&L],2-c3CA\|wOu?p<4l-cs#GGYIwdx3Y$G_#G%9*R)=2QO9MuVp0A3m`5gKM:iysK)N?1j@{\%WCpu?{V~Wn.Co\|0Q8<i
2024-10-02 10:16:44 UTC	16384	IN	Data Raw: 86 39 37 48 0d c3 1e 5b 27 d9 9b 19 b6 e6 73 b2 62 53 3e 42 d9 75 a6 38 d5 ba d2 ba 6c a2 67 19 36 6a e7 db aa 8b 86 58 f0 f8 31 2e c8 22 3b 2b 6a 27 c4 19 a0 d8 5e 39 8c 8c f2 44 2a 89 29 a3 8a d9 c5 34 b2 53 a6 eb b8 dd bb 08 46 87 32 00 ca 8f 3b b8 6e b1 04 91 35 dd cc 0b ed ae d1 b5 66 11 4b 56 c5 2a a4 3d 16 6e 23 d3 7f 24 3b 18 4b 26 94 41 9e 97 48 57 b1 17 8f 97 be b3 70 28 62 07 f8 50 b0 13 1e d4 9e 6e 4d b3 d4 56 c5 d6 63 ad 42 dd 2d 46 7d af a6 cb 72 e3 fc a5 4e 57 1a 83 cb a4 e7 58 48 89 79 0d 28 da 01 8a 08 70 1e 7a db 54 95 d7 b2 6c 4a 9d 93 0c 5d 3f 50 76 57 e5 8b 88 d8 5b e3 e4 00 09 34 ea f1 dd db db e5 62 5a e8 65 79 43 96 c5 da 43 7c 7d 9f 27 8d 51 2f a4 e7 27 90 db f3 62 f0 b4 e3 54 d5 99 27 12 56 52 eb 05 49 a2 73 2a 3a af bf 70 d6 97 Data Ascii: 97H['sbS>Bu8lg6jX1.";+j'^9D)4SF2;n5fKV=n#$;K&AHWp(bPnMVcB-F}rNWXHy(pzTlJ]?PvW[4bZeyCC\|}'Q/'bT'VRIs*:p
2024-10-02 10:16:44 UTC	16384	IN	Data Raw: eb 91 ed 96 dc da b6 34 b1 f7 d1 89 13 eb fd bd eb d7 b4 2e 39 60 34 75 a9 fa 69 1a 47 11 4f bb 27 94 b2 83 c7 f0 f4 3c 0f 6b ba c6 e1 e5 70 e7 ed cf c1 c3 c8 45 db a6 94 6e cc 23 79 00 b3 a4 23 d5 95 3c bb c2 7c aa ef 56 87 f9 11 db 01 db a5 66 d0 02 c1 9e 45 1c ab ef 31 7d 3f e4 47 5b 14 36 6e 8c 34 f8 63 3b ee a8 db c6 df fd 4b de de 1b 5a fa 53 ac 2a ab 7e 81 ca df 9b 8f 68 4a ab a0 cf e8 e9 cb b7 30 3b 87 60 f7 70 7e af 09 05 af 64 b6 54 4b c3 2c 24 97 5d 50 51 14 97 1b cb 7c 52 5b 77 c9 3c 0a c2 2c 47 05 b7 61 1a 15 df c9 8f 42 b6 d6 fc a6 80 f4 a4 73 0d 40 61 8d 47 03 09 b5 65 d0 e2 e0 50 0a 02 3f 53 19 cf 09 a9 0c b8 02 b5 25 b7 5e 2d c0 35 2c cf 1b 56 eb a4 37 97 d6 de 85 29 42 c8 65 4f 48 21 5c 99 4f 37 b8 eb bd 88 70 ce bd b0 5e 2d 3c 7b 1a 0b Data Ascii: 4.9`4uiGO'<kpEn#y#<\|VfE1}?G[6n4c;KZS*~hJ0;`p~dTK,$]PQ\|R[w<,GaBs@aGeP?S%^-5,V7)BeOH!\O7p^-<{
2024-10-02 10:16:45 UTC	15145	IN	Data Raw: 6b 46 aa 9f ff b5 11 9e 43 fe fd c0 50 18 18 0f 72 22 9f 9d dc 1f 6c 79 99 96 f6 a1 d3 97 36 b1 ea fc 05 87 52 35 a1 9d 78 cb 54 bc 66 5f 7c 59 82 2e 6d 5a 41 69 e8 87 87 fc 48 00 b8 ef f2 fa 5d 4f 24 af ea c3 c6 e8 49 50 15 90 88 52 1c d1 8f 3b 0a fe b3 ce c3 2f d7 d8 10 ab 5a a9 e3 3e 16 54 ee b7 24 35 d9 3a 65 ab a2 22 a9 30 93 55 0b 55 a2 8d ab 46 d2 b0 5f 20 a8 c4 0b de c7 a3 f7 b7 eb a1 78 5c d9 07 fe e1 1b 89 9b a3 ee 4b d6 c6 22 38 a7 11 e5 f6 a8 b7 8b bf 1c b5 e8 5e 41 c4 5b fd 31 bd fb d2 8d 90 1f 9f 61 38 17 28 fe 52 37 4b a3 cb e4 77 25 bd 3a c2 fa 19 f4 fa 34 77 7e 05 4d a7 59 b3 0b f7 93 6e 25 ce 9c e2 a9 f1 c3 e8 02 76 c1 5b e7 78 23 73 0d ab d3 ed b3 be c9 aa eb d0 4e ae c6 85 3b e1 8b 81 00 2e e2 aa dc 31 2c 8e 42 2c 41 3e 6c 9d 48 a7 46 Data Ascii: kFCPr"ly6R5xTf_\|Y.mZAiH]O$IPR;/Z>T$5:e"0UUF_ x\K"8^A[1a8(R7Kw%:4w~MYn%v[x#sN;.1,B,A>lHF

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
49	192.168.2.16	49810	13.107.246.40	443	4912	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-02 10:16:45 UTC	628	OUT	GET /shared/edgeweb/img/arrow-left.0af059d.svg HTTP/1.1 Host: edgestatic.azureedge.net Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: / Origin: https://www.microsoft.com Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://www.microsoft.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-10-02 10:16:45 UTC	700	IN	HTTP/1.1 200 OK Date: Wed, 02 Oct 2024 10:16:45 GMT Content-Type: image/svg+xml Content-Length: 314 Connection: close Access-Control-Allow-Origin: * Cache-Control: public, max-age=31536000, immutable ETag: W/"13a-18c5b5c66b1" Last-Modified: Tue, 12 Dec 2023 00:10:31 GMT Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Origin-Agent-Cluster: ?1 X-Content-Type-Options: nosniff X-Download-Options: noopen X-Frame-Options: SAMEORIGIN X-Permitted-Cross-Domain-Policies: none X-XSS-Protection: 0 x-azure-ref: 20241002T101645Z-15767c5fc55jdxmppy6cmd24bn00000001h000000000b9ye x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-02 10:16:45 UTC	314	IN	Data Raw: 3c 73 76 67 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 30 2f 73 76 67 22 20 77 69 64 74 68 3d 22 31 36 22 20 68 65 69 67 68 74 3d 22 31 36 22 20 76 69 65 77 42 6f 78 3d 22 30 20 30 20 32 34 20 32 34 22 20 66 69 6c 6c 3d 22 6e 6f 6e 65 22 20 73 74 72 6f 6b 65 3d 22 63 75 72 72 65 6e 74 43 6f 6c 6f 72 22 20 73 74 72 6f 6b 65 2d 77 69 64 74 68 3d 22 32 2e 35 22 20 73 74 72 6f 6b 65 2d 6c 69 6e 65 63 61 70 3d 22 72 6f 75 6e 64 22 20 73 74 72 6f 6b 65 2d 6c 69 6e 65 6a 6f 69 6e 3d 22 72 6f 75 6e 64 22 20 63 6c 61 73 73 3d 22 66 65 61 74 68 65 72 20 66 65 61 74 68 65 72 2d 61 72 72 6f 77 2d 6c 65 66 74 22 3e 3c 6c 69 6e 65 20 78 31 3d 22 31 39 22 20 79 31 3d 22 31 32 22 20 78 32 3d 22 35 22 20 79 32 3d 22 31 32 22 3e Data Ascii: <svg xmlns="http://www.w3.org/2000/svg" width="16" height="16" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2.5" stroke-linecap="round" stroke-linejoin="round" class="feather feather-arrow-left"><line x1="19" y1="12" x2="5" y2="12">

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
50	192.168.2.16	49809	13.107.246.40	443	4912	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-02 10:16:45 UTC	629	OUT	GET /shared/edgeweb/img/arrow-right.96b564d.svg HTTP/1.1 Host: edgestatic.azureedge.net Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: / Origin: https://www.microsoft.com Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://www.microsoft.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-10-02 10:16:45 UTC	700	IN	HTTP/1.1 200 OK Date: Wed, 02 Oct 2024 10:16:45 GMT Content-Type: image/svg+xml Content-Length: 316 Connection: close Access-Control-Allow-Origin: * Cache-Control: public, max-age=31536000, immutable ETag: W/"13c-18c5b5c6672" Last-Modified: Tue, 12 Dec 2023 00:10:31 GMT Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Origin-Agent-Cluster: ?1 X-Content-Type-Options: nosniff X-Download-Options: noopen X-Frame-Options: SAMEORIGIN X-Permitted-Cross-Domain-Policies: none X-XSS-Protection: 0 x-azure-ref: 20241002T101645Z-15767c5fc55lghvzbxktxfqntw000000091g00000000871b x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-02 10:16:45 UTC	316	IN	Data Raw: 3c 73 76 67 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 30 2f 73 76 67 22 20 77 69 64 74 68 3d 22 31 36 22 20 68 65 69 67 68 74 3d 22 31 36 22 20 76 69 65 77 42 6f 78 3d 22 30 20 30 20 32 34 20 32 34 22 20 66 69 6c 6c 3d 22 6e 6f 6e 65 22 20 73 74 72 6f 6b 65 3d 22 63 75 72 72 65 6e 74 43 6f 6c 6f 72 22 20 73 74 72 6f 6b 65 2d 77 69 64 74 68 3d 22 32 2e 35 22 20 73 74 72 6f 6b 65 2d 6c 69 6e 65 63 61 70 3d 22 72 6f 75 6e 64 22 20 73 74 72 6f 6b 65 2d 6c 69 6e 65 6a 6f 69 6e 3d 22 72 6f 75 6e 64 22 20 63 6c 61 73 73 3d 22 66 65 61 74 68 65 72 20 66 65 61 74 68 65 72 2d 61 72 72 6f 77 2d 72 69 67 68 74 22 3e 3c 6c 69 6e 65 20 78 31 3d 22 35 22 20 79 31 3d 22 31 32 22 20 78 32 3d 22 31 39 22 20 79 32 3d 22 31 32 22 Data Ascii: <svg xmlns="http://www.w3.org/2000/svg" width="16" height="16" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2.5" stroke-linecap="round" stroke-linejoin="round" class="feather feather-arrow-right"><line x1="5" y1="12" x2="19" y2="12"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
51	192.168.2.16	49811	13.107.246.40	443	4912	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-02 10:16:45 UTC	580	OUT	GET /mscc/lib/v2/wcp-consent.js HTTP/1.1 Host: wcpstatic.microsoft.com Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: same-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://www.microsoft.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-10-02 10:16:45 UTC	713	IN	HTTP/1.1 200 OK Date: Wed, 02 Oct 2024 10:16:45 GMT Content-Type: application/javascript Content-Length: 52717 Connection: close Access-Control-Allow-Origin: * Access-Control-Expose-Headers: x-ms-request-id,Server,x-ms-version,Content-Length,Date,Transfer-Encoding Age: 11471 Cache-Control: max-age=43200 Content-MD5: QT/MdZzBmCG2G2lBgIsptQ== Etag: 0x8DA85F6F74C6D08 Last-Modified: Wed, 24 Aug 2022 17:34:58 GMT Vary: Accept-Encoding X-Cache: CONFIG_NOCACHE x-ms-blob-type: BlockBlob x-ms-lease-status: unlocked x-ms-request-id: c5f5201c-501e-00df-0c99-148be5000000 x-ms-version: 2009-09-19 x-azure-ref: 20241002T101645Z-15767c5fc55ncqdn59ub6rndq000000008zg00000000b7n7 Accept-Ranges: bytes
2024-10-02 10:16:45 UTC	15671	IN	Data Raw: 76 61 72 20 57 63 70 43 6f 6e 73 65 6e 74 3b 21 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 65 3d 7b 32 32 39 3a 66 75 6e 63 74 69 6f 6e 28 65 29 7b 77 69 6e 64 6f 77 2c 65 2e 65 78 70 6f 72 74 73 3d 66 75 6e 63 74 69 6f 6e 28 65 29 7b 76 61 72 20 74 3d 7b 7d 3b 66 75 6e 63 74 69 6f 6e 20 6f 28 6e 29 7b 69 66 28 74 5b 6e 5d 29 72 65 74 75 72 6e 20 74 5b 6e 5d 2e 65 78 70 6f 72 74 73 3b 76 61 72 20 72 3d 74 5b 6e 5d 3d 7b 69 3a 6e 2c 6c 3a 21 31 2c 65 78 70 6f 72 74 73 3a 7b 7d 7d 3b 72 65 74 75 72 6e 20 65 5b 6e 5d 2e 63 61 6c 6c 28 72 2e 65 78 70 6f 72 74 73 2c 72 2c 72 2e 65 78 70 6f 72 74 73 2c 6f 29 2c 72 2e 6c 3d 21 30 2c 72 2e 65 78 70 6f 72 74 73 7d 72 65 74 75 72 6e 20 6f 2e 6d 3d 65 2c 6f 2e 63 3d 74 2c 6f 2e 64 3d 66 75 6e 63 74 69 6f 6e 28 65 Data Ascii: var WcpConsent;!function(){var e={229:function(e){window,e.exports=function(e){var t={};function o(n){if(t[n])return t[n].exports;var r=t[n]={i:n,l:!1,exports:{}};return e[n].call(r.exports,r,r.exports,o),r.l=!0,r.exports}return o.m=e,o.c=t,o.d=function(e
2024-10-02 10:16:45 UTC	16384	IN	Data Raw: 29 7b 72 65 74 75 72 6e 20 65 3f 65 2e 72 65 70 6c 61 63 65 28 2f 26 2f 67 2c 22 26 61 6d 70 3b 22 29 2e 72 65 70 6c 61 63 65 28 2f 3c 2f 67 2c 22 26 6c 74 3b 22 29 2e 72 65 70 6c 61 63 65 28 2f 3e 2f 67 2c 22 26 67 74 3b 22 29 2e 72 65 70 6c 61 63 65 28 2f 22 2f 67 2c 22 26 71 75 6f 74 3b 22 29 2e 72 65 70 6c 61 63 65 28 2f 27 2f 67 2c 22 26 23 30 33 39 3b 22 29 3a 22 22 7d 2c 65 7d 28 29 2c 61 3d 6e 2e 6c 6f 63 61 6c 73 2c 6c 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 66 75 6e 63 74 69 6f 6e 20 65 28 65 2c 74 2c 6f 2c 6e 2c 72 2c 69 2c 61 29 7b 74 68 69 73 2e 64 69 72 65 63 74 69 6f 6e 3d 22 6c 74 72 22 2c 74 68 69 73 2e 70 72 65 76 69 6f 75 73 46 6f 63 75 73 45 6c 65 6d 65 6e 74 42 65 66 6f 72 65 50 6f 70 75 70 3d 6e 75 6c 6c 2c 74 68 69 73 2e 63 6f 6f 6b 69 Data Ascii: ){return e?e.replace(/&/g,"&").replace(/</g,"<").replace(/>/g,">").replace(/"/g,""").replace(/'/g,"'"):""},e}(),a=n.locals,l=function(){function e(e,t,o,n,r,i,a){this.direction="ltr",this.previousFocusElementBeforePopup=null,this.cooki
2024-10-02 10:16:45 UTC	82	IN	Data Raw: 6f 72 22 5d 2b 22 20 21 69 6d 70 6f 72 74 61 6e 74 3b 5c 6e 20 20 20 20 20 20 20 20 7d 22 2c 74 2b 3d 27 69 6e 70 75 74 5b 74 79 70 65 3d 22 72 61 64 69 6f 22 5d 2e 27 2b 63 2e 63 6f 6f 6b 69 65 49 74 65 6d 52 61 64 69 6f 42 74 6e 2b 22 20 2b 20 Data Ascii: or"]+" !important;\n }",t+='input[type="radio"].'+c.cookieItemRadioBtn+" +
2024-10-02 10:16:45 UTC	16384	IN	Data Raw: 6c 61 62 65 6c 3a 68 6f 76 65 72 3a 3a 61 66 74 65 72 20 7b 5c 6e 20 20 20 20 20 20 20 20 20 20 20 20 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 22 2b 65 5b 22 72 61 64 69 6f 2d 62 75 74 74 6f 6e 2d 68 6f 76 65 72 2d 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 22 5d 2b 22 20 21 69 6d 70 6f 72 74 61 6e 74 3b 5c 6e 20 20 20 20 20 20 20 20 7d 22 2c 74 2b 3d 27 69 6e 70 75 74 5b 74 79 70 65 3d 22 72 61 64 69 6f 22 5d 2e 27 2b 63 2e 63 6f 6f 6b 69 65 49 74 65 6d 52 61 64 69 6f 42 74 6e 2b 22 20 2b 20 6c 61 62 65 6c 3a 66 6f 63 75 73 3a 3a 62 65 66 6f 72 65 20 7b 5c 6e 20 20 20 20 20 20 20 20 20 20 20 20 62 6f 72 64 65 72 3a 20 31 70 78 20 73 6f 6c 69 64 20 22 2b 65 5b 22 72 61 64 69 6f 2d 62 75 74 74 6f 6e 2d 68 6f 76 65 72 2d 62 6f 72 64 65 72 Data Ascii: label:hover::after {\n background-color: "+e["radio-button-hover-background-color"]+" !important;\n }",t+='input[type="radio"].'+c.cookieItemRadioBtn+" + label:focus::before {\n border: 1px solid "+e["radio-button-hover-border
2024-10-02 10:16:45 UTC	4196	IN	Data Raw: 2e 6c 65 6e 67 74 68 3b 6f 2b 2b 29 74 5b 6f 2d 31 5d 3d 61 72 67 75 6d 65 6e 74 73 5b 6f 5d 3b 76 61 72 20 6e 3d 74 68 69 73 2e 65 76 65 6e 74 73 5b 65 5d 3b 6e 26 26 6e 2e 66 6f 72 45 61 63 68 28 28 66 75 6e 63 74 69 6f 6e 28 65 29 7b 65 2e 61 70 70 6c 79 28 6e 75 6c 6c 2c 74 29 7d 29 29 7d 2c 65 2e 70 72 6f 74 6f 74 79 70 65 2e 61 64 64 45 76 65 6e 74 4c 69 73 74 65 6e 65 72 3d 66 75 6e 63 74 69 6f 6e 28 65 2c 74 2c 6f 29 7b 65 2e 61 64 64 45 76 65 6e 74 4c 69 73 74 65 6e 65 72 3f 65 2e 61 64 64 45 76 65 6e 74 4c 69 73 74 65 6e 65 72 28 74 2c 6f 29 3a 65 2e 61 74 74 61 63 68 45 76 65 6e 74 28 22 6f 6e 22 2b 74 2c 28 66 75 6e 63 74 69 6f 6e 28 29 7b 6f 2e 63 61 6c 6c 28 65 29 7d 29 29 7d 2c 65 2e 63 6f 6f 6b 69 65 4e 61 6d 65 3d 22 4d 53 43 43 22 2c 65 Data Ascii: .length;o++)t[o-1]=arguments[o];var n=this.events[e];n&&n.forEach((function(e){e.apply(null,t)}))},e.prototype.addEventListener=function(e,t,o){e.addEventListener?e.addEventListener(t,o):e.attachEvent("on"+t,(function(){o.call(e)}))},e.cookieName="MSCC",e

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
52	192.168.2.16	49812	13.107.246.40	443	4912	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-02 10:16:45 UTC	678	OUT	GET /shared/cms/lrs1c69a1j/section-images/f1415474cbbc413bbbf3c9fc3fd1b3d0.png HTTP/1.1 Host: edgestatic.azureedge.net Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://www.microsoft.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-10-02 10:16:45 UTC	700	IN	HTTP/1.1 200 OK Date: Wed, 02 Oct 2024 10:16:45 GMT Content-Type: image/png Content-Length: 99531 Connection: close Access-Control-Allow-Origin: * Cache-Control: public, max-age=31536000, immutable ETag: W/"184cb-18c5b5723b8" Last-Modified: Tue, 12 Dec 2023 00:04:46 GMT Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Origin-Agent-Cluster: ?1 X-Content-Type-Options: nosniff X-Download-Options: noopen X-Frame-Options: SAMEORIGIN X-Permitted-Cross-Domain-Policies: none X-XSS-Protection: 0 x-azure-ref: 20241002T101645Z-15767c5fc55852fxfeh7csa2dn00000009ag000000004v1r x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-02 10:16:45 UTC	15684	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 02 96 00 00 01 e2 08 06 00 00 00 52 a9 8c 40 00 00 00 09 70 48 59 73 00 00 21 38 00 00 21 38 01 45 96 31 60 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 01 84 60 49 44 41 54 78 01 ec fd 09 a0 26 c7 55 1f 8a 9f ea fe be bb cc be 6a b4 8c a4 91 2c 79 13 d8 b2 65 1b b0 31 b6 c1 10 36 1b 99 80 71 02 c4 f6 e3 25 7f 42 f2 88 49 c8 02 ff 97 d8 ca 83 90 f7 78 f1 f2 cf 0b c9 e3 c5 d8 fe 3f 08 6b 6c 63 83 e1 01 de c0 8b bc c8 96 6c 49 96 ac 91 34 92 46 1a cd 7a 67 ee fe 2d dd f5 ea 54 d5 a9 3e 55 5d dd df 77 b7 d1 cc bd f5 9b e9 db dd d5 b5 75 75 7d 5d bf 3e e7 d4 29 80 84 84 84 84 84 84 84 84 84 84 84 84 84 84 84 84 84 84 84 84 84 84 84 84 84 84 84 84 84 84 84 84 84 Data Ascii: PNGIHDRR@pHYs!8!8E1`sRGBgAMAa`IDATx&Uj,ye16q%BIx?klclI4Fzg-T>U]wuu}]>)
2024-10-02 10:16:45 UTC	16384	IN	Data Raw: 1e 7d 18 b4 a5 1c c7 76 51 08 4f 70 28 84 a8 b1 3f 59 65 e7 a4 94 8e b8 aa 6d c7 60 00 13 9d 0c 3a 6a cb 6c fa f8 f7 83 8c 56 37 71 cb 84 84 84 84 95 c1 19 b5 05 f6 ec 68 63 89 12 4b 04 ed ad 4a 5c 70 89 25 39 4d 07 26 59 44 a9 25 cd 12 e7 4e d3 81 d9 57 82 2f 7a d0 85 ab 38 9a 58 70 49 a6 57 57 39 be 53 b9 cd 23 b1 cc e5 84 6e 9f 6e 07 c8 5a b0 da 64 25 ad 44 a9 0c 6e 24 b5 94 56 25 5e 1a a9 a5 47 2a 1d c9 94 15 a1 b4 33 ab 05 23 85 22 20 89 22 b8 ee 93 4c a8 36 ca 8b 85 0b 4e 4a 29 ac 00 4b 4c ab db 95 f4 97 93 b7 c6 c1 bd 12 57 c9 62 08 e2 f4 29 c8 e6 66 35 71 bd f9 de 07 e0 a5 0f 3c 0c 5d 25 b5 2a ec 4c 71 ad 62 95 3c 7f 3a 96 91 6c 65 fd 5c c5 bb 71 a2 0b 1d 47 70 1a 2a 36 0e 69 6a bf a3 15 5f 5b 71 bc 31 33 5b e9 7d 48 59 bd 54 56 0f 4c 2f ea e6 02 Data Ascii: }vQOp(?Yem`:jlV7qhcKJ\p%9M&YD%NW/z8XpIWW9S#nnZd%Dn$V%^G3#" "L6NJ)KLWb)f5q<]%Lqb<:le\qGp*6ij_[q13[}HYTVL/
2024-10-02 10:16:45 UTC	16384	IN	Data Raw: 5c 0a c5 ee 2b 4e e0 fc 18 75 e2 38 8a 36 c6 cb 18 67 a6 b3 6f 19 d9 4c 78 9b e9 6b dc b6 12 ac 77 09 22 8c 5a b8 48 06 af bc fd 04 54 13 70 50 b2 a8 49 bb fa 61 77 04 cc 76 96 e0 ec c4 59 78 5c a9 10 fb e8 54 5e 13 cb 42 93 4c 92 3e 52 0d dc 04 1c a8 d4 e3 e4 86 c8 cc d6 27 06 1d da a0 d2 64 9e 44 30 13 12 12 12 56 82 ea b5 29 cc 48 50 9a b7 ab 1a 4b 51 4a 49 03 35 cc cc cc 08 9a b8 a3 d4 e1 6e f4 c4 59 e1 a8 06 a7 4c 68 ad 70 74 35 44 81 6c f2 0e ae 17 ae c3 ef ba eb 2e 22 94 55 05 c0 7b a9 0b 4b 2c 9b ac c8 28 5e 14 89 58 5e 66 40 5a 19 9b e8 2f e8 8f f0 94 9d 7e 24 19 9e 08 17 2b 53 c4 e3 e4 73 9e 0b 9f 7f d3 8f 41 7e 60 af 95 98 b1 b9 cf a1 da 9d d2 7a ee 84 38 a9 34 84 b2 52 7d db 8d d4 e5 60 ea 49 ea d7 2f cb 09 38 63 67 80 5b 81 59 4d a2 18 13 b8 Data Ascii: \+Nu86goLxkw"ZHTpPIawvYx\T^BL>R'dD0V)HPKQJI5nYLhpt5Dl."U{K,(^X^f@Z/~$+SsA~`z84R}`I/8cg[YM
2024-10-02 10:16:45 UTC	16384	IN	Data Raw: c9 86 09 64 e9 4d 2b cd 68 68 da 79 a7 f8 a6 ae 12 cb 53 0c 2d b4 b3 a4 a7 f8 b4 cc 26 7b ea 0b 6c 02 78 72 7f f6 5d 5b f4 e9 7f 72 8b 7e a7 71 13 96 1b 63 55 fa ae ba 87 1f 20 fa db 6f 0a 24 eb 5b 14 e5 a2 fb 22 b5 a4 5c ad ed 86 da 3c d1 80 d2 e5 69 95 fc cb 37 e8 f9 57 6e d2 27 7e e7 1a 7d e2 c2 36 dd 7f e9 0c 3d f2 d6 2d fa fe ef 39 43 3f f2 c6 15 bd f9 f5 5b 74 ef d9 05 9d dd 76 e2 9c 9f 48 9c a8 cd 5b 8f ef d6 11 67 77 7f 1d 8a dc a3 6f bf 78 8b 7e ef 6b af d1 6f fc da cb f4 1b bf f5 2a 5d fd fd 5d 7a ed e5 70 6d bb a1 80 35 93 72 09 06 1f 08 ea e5 ef d9 a2 3f f5 93 97 d9 34 b4 e9 84 8c ae 7f 8d 5e 4b 9f 15 47 4f 5e e9 1c 31 c0 76 61 45 45 45 45 c5 d1 e0 cd f6 82 7c 1c d0 e1 bc 23 21 7f 44 6a c9 0e 3c 71 38 56 a4 32 42 48 a5 10 4a 91 54 82 54 b2 57 Data Ascii: dM+hhyS-&{lxr][r~qcU o$["\<i7Wn'~}6=-9C?[tvH[gwox~ko*]]zpm5r?4^KGO^1vaEEEE\|#!Dj<q8V2BHJTTW
2024-10-02 10:16:45 UTC	16384	IN	Data Raw: 6e d1 e5 3e b3 bd a4 07 ef db a2 6b af de a4 bd bd 26 11 cb ee 47 e6 d3 19 b1 65 7e a8 2c d7 23 80 92 00 a1 1c ea 39 b7 b3 4d ab d5 56 6e df c8 85 de 15 c8 e5 0f be 61 41 df 7e f9 06 ed ed 33 5b 72 9c 61 e0 a7 e8 53 01 5d 76 af 39 9a c9 bd 0c e4 12 44 0e 04 f7 4c 10 91 b6 52 cb 5c ec f7 ba bb 97 f4 07 df b8 a6 97 ae dd a2 fd 46 5d 9b cf 7f cb 42 18 b5 07 b8 25 9e dd be 4f 7d 87 a4 2d b7 0e 4b 43 cb e5 82 b6 43 bf 20 20 7a e7 a0 c3 67 70 f9 19 b9 f4 ba 6b fb e3 49 36 26 56 54 54 54 54 1c 08 be b7 11 b0 df ae c2 78 ec 65 f6 1d 15 6a 08 24 73 b1 5c 2e 9b 40 30 bd 90 4a 1d 6e 08 50 92 ca 28 cd 08 92 4a 4c e7 e8 cc 94 8e 71 50 67 e7 1d 91 56 0a a9 2c b5 2c 3b 8f 06 50 89 e5 69 45 66 9b db 11 b9 96 53 99 d8 86 bc 9e fc 4c 99 80 4b 7f 88 ee da d9 a2 ad 20 c1 6b Data Ascii: n>k&Ge~,#9MVnaA~3[raS]v9DLR\F]B%O}-KCC zgpkI6&VTTTTxej$s\.@0JnP(JLqPgV,,;PiEfSLK k
2024-10-02 10:16:45 UTC	16384	IN	Data Raw: 19 8f 2d fe dc 2f ff 79 77 d7 bd ff 16 89 3a 5c 07 b2 08 78 f4 fb 2e d2 bf fa 47 df 4c df 73 df 0e dd b3 b3 a2 8a 8a 8a 8a d3 8c 2f 07 22 f9 54 d0 ea fc 3b 9f fb 0a 7d fb c6 3e be d8 5b 75 4f 58 b7 c3 67 54 83 7f a5 f9 2b 7f fc 11 52 24 2e 8c bf 5e 07 45 a7 d6 81 47 47 f0 48 e9 61 7c 87 fa 1b c5 35 3c d6 67 ef 0f 25 b1 f4 03 f6 f8 66 24 1f 94 4c 8e 4a 2c 2b b1 ac a8 38 b9 48 46 d6 23 69 f6 58 ef 37 ad c8 25 ec 2d fd ee ee 2e 06 1c a7 82 a5 c7 d0 43 ec 1d ee 10 76 08 f1 d1 f8 f4 48 36 95 3a dc c1 f6 27 aa c4 ff 0f ff e5 df a0 c5 ea c7 b2 56 8c 0e 37 fd ab e3 71 75 de 79 fa ca 4d 7e db 49 c5 f3 0e 0b c7 7f bc 1f cd 13 af 85 4e 00 4a d7 7b d4 3e b8 5d 65 cd 28 7f f4 de 8e 96 33 7c cf 52 99 aa ae b1 7a 3c 75 cf e9 a1 db 73 3b 60 ef 45 e9 7a 86 ee d7 41 ee e3 Data Ascii: -/yw:\x.GLs/"T;}>[uOXgT+R$.^EGGHa\|5<g%f$LJ,+8HF#iX7%-.CvH6:'V7quyM~INJ{>]e(3\|Rz<us;`EzA
2024-10-02 10:16:45 UTC	1927	IN	Data Raw: 0f c1 4a b6 44 67 2b c0 62 e5 a4 f2 03 40 15 d5 25 a6 73 26 e9 85 e5 54 f1 ef 69 03 49 fd c8 fa f2 65 47 de f0 62 6b 03 30 03 83 91 a9 3c 00 7a 16 b9 fa 34 40 a6 b4 ad 66 fd 08 65 8d 5b 53 48 db 59 da a8 6a 77 51 9e ac 0e 19 1f d8 16 31 ed 9f a0 ff 47 ae 0c 18 c9 e9 6f 06 20 8f ec 83 16 45 d7 d4 d4 d4 f4 71 04 d7 11 8d df ca 4c a5 0a 3b cd 76 8e fb 2f ad a0 4c 8d cf 6c 46 b3 9d 14 1c b0 d9 01 33 0e 70 2c 31 18 23 3d 36 13 a9 f2 76 00 80 cd c6 aa b4 4f 8a 5f 7c ef 8d bc 5f 62 53 7b 5a 41 8e 72 59 0e dc 91 81 81 00 e8 1e 15 bf 51 5d 45 ff 99 ff 28 23 f1 9b 78 f7 b2 f2 7e 2c 0f 22 43 96 b7 1a 30 9c a3 ba 8a ca f1 c6 db b1 12 5e f1 ad ea 28 68 c3 53 7a 95 03 76 a2 bd 1c 15 8f be 6f 30 1e b3 b2 3e e2 be b2 ff 8f d9 46 9c 89 54 fa 8f ed 9b 34 a2 13 e1 fd b4 dd Data Ascii: JDg+b@%s&TiIeGbk0<z4@fe[SHYjwQ1Go EqL;v/LlF3p,1#=6vO_\|_bS{ZArYQ]E(#x~,"C0^(hSzvo0>FT4

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
53	192.168.2.16	49813	13.107.246.40	443	4912	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-02 10:16:45 UTC	678	OUT	GET /shared/cms/lrs1c69a1j/section-images/1c237bd147234b5b8b5ea2624c7de744.png HTTP/1.1 Host: edgestatic.azureedge.net Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://www.microsoft.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-10-02 10:16:45 UTC	701	IN	HTTP/1.1 200 OK Date: Wed, 02 Oct 2024 10:16:45 GMT Content-Type: image/png Content-Length: 107356 Connection: close Access-Control-Allow-Origin: * Cache-Control: public, max-age=31536000, immutable ETag: W/"1a35c-18c5b87906a" Last-Modified: Tue, 12 Dec 2023 00:57:40 GMT Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Origin-Agent-Cluster: ?1 X-Content-Type-Options: nosniff X-Download-Options: noopen X-Frame-Options: SAMEORIGIN X-Permitted-Cross-Domain-Policies: none X-XSS-Protection: 0 x-azure-ref: 20241002T101645Z-15767c5fc55tsfp92w7yna557w000000099g00000000cm5d x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-02 10:16:45 UTC	15683	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 01 ff 00 00 01 6f 08 06 00 00 00 44 97 c2 fd 00 00 00 09 70 48 59 73 00 00 21 38 00 00 21 38 01 45 96 31 60 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 01 a2 f1 49 44 41 54 78 01 ec bd 07 a0 1d d7 59 20 fc 9d 99 b9 ed f5 a6 f7 9e ba 64 49 b6 25 59 ee dd 71 1c a7 77 52 9d 04 08 84 16 f8 21 b0 4b 5b d8 05 76 c3 2e 6d 17 58 ea 12 c2 6e 48 08 81 80 03 e9 85 90 62 3b b1 9d c4 76 dc 25 5b b2 ac f6 d4 5e 2f b7 df 29 e7 ff 4e 9b 39 67 ee dc f7 9e 1c 4b 8e ad f3 49 f7 dd b9 33 67 4e 3f 5f 3f df 01 b0 60 c1 82 05 0b 16 2c 58 b0 60 c1 82 05 0b 16 2c 58 b0 60 c1 82 05 0b 16 2c 58 b0 60 c1 82 05 0b 16 2c 58 b0 60 c1 82 05 0b 16 2c 58 b0 60 c1 82 05 0b 16 2c 58 b0 60 c1 Data Ascii: PNGIHDRoDpHYs!8!8E1`sRGBgAMAaIDATxY dI%YqwR!K[v.mXnHb;v%[^/)N9gKI3gN?_?`,X`,X`,X`,X`,X`,X`
2024-10-02 10:16:45 UTC	16384	IN	Data Raw: e7 40 13 fb 36 77 5c 57 04 5e 3d 96 17 39 76 56 40 96 a4 2c df 95 db 05 89 b2 d5 33 c6 80 99 15 38 73 e0 73 c6 00 24 73 c0 4d 0a 7e 20 35 07 81 f4 13 c0 51 e8 2d 81 b3 50 d6 b6 0f 4a 46 01 35 35 e1 4b ae 01 ca 88 ff dd 0f 26 db 09 79 ba 50 33 45 84 f1 37 95 cf 62 66 45 31 14 b7 bc 14 82 f9 53 e0 3d fa 68 c2 34 40 3a 7a 21 a4 be 23 d3 5c 40 b4 60 3f ec b0 21 46 fc 99 a7 3f a0 a9 29 1f 41 61 c3 7a 80 0b af 84 16 f3 f4 77 3d ae f6 8f bc 7c a3 31 b4 79 cb 05 d7 5f 3f 09 16 2c 9c 43 b0 c4 df c2 59 07 44 c2 f9 c5 6a f3 96 5a bd f6 73 13 27 4e be f8 9e ef dc 3f 78 e7 9d 77 42 13 25 eb c9 53 27 39 92 1e 1a 1e 81 6b af bb 0e 6e ba f1 7a 6e 63 3f 3d 39 dd 42 75 fb 03 a7 27 a7 be 32 71 e4 f8 27 5b c5 f0 e0 67 3f f8 c1 ba 4e e8 99 f6 e0 b7 51 fe db 7c e4 88 d7 7d ea Data Ascii: @6w\W^=9vV@,38ss$sM~ 5Q-PJF55K&yP3E7bfE1S=h4@:z!#\@`?!F?)Aazw=\|1y_?,CYDjZs'N?xwB%S'9knznc?=9Bu'2q'[g?NQ\|}
2024-10-02 10:16:45 UTC	16384	IN	Data Raw: 42 53 3c 17 69 1b 4e bd 4e 89 a6 d0 64 07 8d 39 93 b5 e8 3b 2f 5f 58 96 39 a0 2b 3c 5f e1 55 46 cf 50 fa 7f 0b da fe ff 08 7f ee 83 f3 00 56 4d fc cb 73 f5 4b fd a6 7f 8b 98 54 9a bd 8b c2 39 83 2c a1 0f f4 5b 74 99 df 69 55 5d 64 26 50 73 27 73 e3 42 3a 33 63 86 b6 2d f9 b6 54 fa 41 97 b4 3d e3 cc 7b ed bf c4 d5 62 b9 2c d4 fc 05 17 2a 68 f3 6f 36 eb 3c bc af 83 12 5c e0 07 28 c9 b9 30 3c 3c 02 a1 8c 72 46 09 31 cb a5 5a 99 7c 9b 26 23 f0 34 fe ad 08 47 84 2f 39 2c 22 96 24 f6 9c f0 b3 b4 04 b8 46 c1 14 3e da 07 84 66 b5 52 99 1d 52 29 4d 12 49 0d 42 6a f4 b4 42 68 31 72 a2 46 1e 7a 5f 77 82 ac 67 06 0f 18 23 48 d9 7f 7a d5 b4 4c a8 56 c7 36 02 22 5f a0 1d 24 7a a3 32 31 f6 34 69 61 db 3b d4 9c 86 a6 79 22 41 f8 7a c7 51 63 8a 8a d0 cf 6c 9e 84 f2 a4 cd Data Ascii: BS<iNNd9;/_X9+<_UFPVMsKT9,[tiU]d&Ps'sB:3c-TA={b,*ho6<\(0<<rF1Z\|&#4G/9,"$F>fRR)MIBjBh1rFz_wg#HzLV6"_$z214ia;y"AzQcl
2024-10-02 10:16:45 UTC	16384	IN	Data Raw: b5 00 93 ca 1a f3 2e 59 af ed 33 38 63 be 6b 4f 75 02 17 fb 21 69 f5 4a b2 36 e7 5e ac 91 48 63 27 d5 77 da a8 aa da 64 8d 49 1a 37 a8 9c 88 f1 b6 d9 ff 7a 05 c5 fa d6 c6 5e ab 26 31 f2 17 38 c2 38 77 25 5d 01 48 2d 37 03 f4 9a 65 b1 3f cb dd d3 31 ab 34 ad 30 d3 48 ce bb 03 2f e7 d3 25 b1 c3 75 ea b3 87 df da 6c 9d 7a 77 ad 51 be d1 41 1b 89 9b 73 f8 46 57 b6 ed 4e 34 03 4d 27 14 89 7c 54 86 92 53 81 a5 4a 1d 8e cd 06 b0 b1 07 19 8b 10 d5 fe 21 3e 77 f3 c0 63 24 a0 8a ff 82 9e 10 ee 3b ba 08 57 0d a2 fd be b2 08 c5 be 0d 30 b4 ed 12 b1 8d 8f d7 4e f8 6b 0c 15 1c 18 ea ef 83 a9 aa 0f 33 75 1f d6 f7 e4 ab dd 85 fe 3b e0 7b 80 55 11 ff 9e c1 fc b1 d6 4c eb 3b 48 58 5e 2a 54 ff 89 cd f6 6c 42 7a d9 a4 a6 db b2 ef b5 dd 53 0c 92 81 20 93 89 a9 f0 6d 36 37 de Data Ascii: .Y38ckOu!iJ6^Hc'wdI7z^&188w%]H-7e?140H/%ulzwQAsFWN4M'\|TSJ!>wc$;W0Nk3u;{UL;HX^*TlBzS m67
2024-10-02 10:16:45 UTC	16384	IN	Data Raw: 50 24 3b c5 5a 16 86 e2 39 5c ae 72 d9 5c f6 3d 1a 3d 84 64 9d c4 d8 bd 85 ef 3b 3b cc 3a bc 4f 08 00 59 fb b8 ee 03 b3 45 d8 99 16 0c e5 7b e1 0b 9d 67 40 cd 7f ee 9f 29 c3 9e 9e 30 87 0f 28 5b 9f a0 7b 7d b6 5c ef ff e0 2c a1 03 82 3b f4 71 e5 00 27 fd a1 52 ae da 50 ad 54 d1 83 b7 a0 82 ae cd 9e 81 2e 98 7c c5 9b 21 d6 d5 a1 31 15 81 31 7e 09 f3 79 0b 7a 31 c6 4f 2d 84 5d 0e 7e 42 3b 18 f8 c3 63 50 a9 e2 99 6c 19 e2 a8 d4 3b f1 7a ab eb 05 48 ee 18 d0 5c 04 8e b2 19 70 3b 22 fc 99 c3 f5 ba 99 f7 20 ac 51 94 c0 7c df fe 1f 1b 7b 21 12 fd 5c 31 a1 2d 2f 5b f9 ab 3f fb 93 af ae e7 f2 c3 68 7d 1e 12 ac 64 54 df 05 e2 02 a0 01 d5 85 0f ff d8 8e 09 b8 ef be 6f c3 da ca 32 4c 9f 9e 0a ec 9d 9c 08 86 3b 3b 2d 47 c7 f3 09 cd 55 1e ad 0a 40 28 ff 16 14 da ce cb Data Ascii: P$;Z9\r\==d;;:OYE{g@)0([{}\,;q'RPT.\|!11~yz1O-]~B;cPl;zH\p;" Q\|{!\1-/[?h}dTo2L;;-GU@(
2024-10-02 10:16:45 UTC	16384	IN	Data Raw: de 96 ef bd 10 37 c1 d4 dc e2 5a 3a 99 0c d3 84 43 cc 7f f9 52 09 8e 1c 3f 0d 5f ba eb eb 90 d9 58 67 4f 2f 1c 8e 40 32 99 82 ee ee 2e 18 e8 ed 81 13 cf 3c c5 39 00 ab ab 6b f2 c6 eb ae 7b c7 fb de fb ee 76 f2 df 36 93 fc cc 43 87 37 e6 bf 78 77 25 bf 98 78 f4 4c 0e fa 11 c2 a7 97 6a b6 03 75 6a 5a ce 15 a8 c2 52 ce 82 3d bd 41 50 49 8a 02 5c 4e 7e 92 53 08 fd 53 b7 bf 9d e8 c9 73 e2 9f af 46 91 3c f1 27 67 8b d0 15 0f c0 50 67 90 bd 6f ab a6 48 84 48 91 53 72 de 77 4e 15 a0 17 15 df ce de 20 b8 dd e9 a4 0e 8b 50 2e c1 29 34 10 68 4e 1b 4e 29 e3 80 b3 fa 45 dd 50 38 b5 56 83 52 d5 81 3d 5d 3a 16 af 3b fe 71 c9 a3 4d cb ab 88 70 39 30 de 65 aa 73 a2 04 3c 9b 28 83 3b 61 fc ca 37 41 c7 68 3f 5e af e6 e1 c0 eb a6 e5 b3 d9 22 58 f8 4e 14 bc 91 a0 c9 d7 ec f2 Data Ascii: 7Z:CR?_XgO/@2.<9k{v6C7xw%xLjujZR=API\N~SSsF<'gPgoHHSrwN P.)4hNN)EP8VR=]:;qMp90es<(;a7Ah?^"XN
2024-10-02 10:16:45 UTC	9753	IN	Data Raw: f0 7d ca de b1 f5 cb a9 7b fe ae e2 77 b4 c7 ef 26 fc 71 a2 9f 8e fd bb 28 80 a3 13 ff 4c b7 f1 84 97 a1 aa 14 3f 37 29 e4 a6 1c a2 25 5b e1 31 cb ba 45 6a 8a 62 b7 5d 20 ed 2a 2a 54 f2 e0 b6 eb 4e d1 16 78 e7 1b 6e bf 1f 95 ff 37 e3 f1 04 43 ff 8a f9 2f c0 19 cd c1 b0 9b 08 58 67 fd 73 6c 47 97 fc d9 fc 99 5b fe 96 cb 90 cf 66 61 71 69 a9 67 a5 90 fb 8f d0 96 6d 25 e9 d1 eb d6 92 43 87 7e 36 de 33 b1 4e 04 37 41 9c 60 f6 f7 99 f0 f8 92 05 d1 81 7d 08 f9 f7 ce 04 a2 5d ef 8c f7 8e 6d 8b 0c 77 62 21 4c 8f 1c fc e1 70 6c e7 87 4c 33 6d 09 8e eb eb c6 40 0a 0e 80 08 c2 aa 3b 3a a3 9c e5 bf 5a d4 64 3f 66 f8 ef e1 65 22 db 42 f9 3f 31 6b f4 a3 8e ab e9 f9 4d b5 c6 f5 0a e7 e9 6f ab dc 6a bb d1 21 33 a2 d2 e8 55 32 14 27 fb e9 a0 3b 27 d7 51 29 5f 8d 92 08 55 Data Ascii: }{w&q(L?7)%[1Ejb] **TNxn7C/XgslG[faqigm%C~63N7A`}]mwb!LplL3m@;:Zd?fe"B?1kMoj!3U2';'Q)_U

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
54	192.168.2.16	49816	13.107.246.40	443	4912	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-02 10:16:45 UTC	627	OUT	GET /shared/edgeweb/img/fluent-qr.44414bd.svg HTTP/1.1 Host: edgestatic.azureedge.net Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: / Origin: https://www.microsoft.com Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://www.microsoft.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-10-02 10:16:45 UTC	700	IN	HTTP/1.1 200 OK Date: Wed, 02 Oct 2024 10:16:45 GMT Content-Type: image/svg+xml Content-Length: 825 Connection: close Access-Control-Allow-Origin: * Cache-Control: public, max-age=31536000, immutable ETag: W/"339-18c5bb87a9e" Last-Modified: Tue, 12 Dec 2023 01:51:05 GMT Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Origin-Agent-Cluster: ?1 X-Content-Type-Options: nosniff X-Download-Options: noopen X-Frame-Options: SAMEORIGIN X-Permitted-Cross-Domain-Policies: none X-XSS-Protection: 0 x-azure-ref: 20241002T101645Z-15767c5fc55gq5fmm10nm5qqr800000009f0000000007tv4 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-02 10:16:45 UTC	825	IN	Data Raw: 3c 73 76 67 20 77 69 64 74 68 3d 22 34 38 22 20 68 65 69 67 68 74 3d 22 34 38 22 20 76 69 65 77 42 6f 78 3d 22 30 20 30 20 34 38 20 34 38 22 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 30 2f 73 76 67 22 3e 3c 67 20 66 69 6c 6c 3d 22 23 30 30 30 22 20 66 69 6c 6c 2d 72 75 6c 65 3d 22 65 76 65 6e 6f 64 64 22 3e 3c 70 61 74 68 20 64 3d 22 4d 31 36 20 30 61 33 20 33 20 30 20 30 20 31 20 32 2e 39 39 35 20 32 2e 38 32 34 4c 31 39 20 33 76 31 33 61 33 20 33 20 30 20 30 20 31 2d 32 2e 38 32 34 20 32 2e 39 39 35 4c 31 36 20 31 39 48 33 61 33 20 33 20 30 20 30 20 31 2d 32 2e 39 39 35 2d 32 2e 38 32 34 4c 30 20 31 36 56 33 41 33 20 33 20 30 20 30 20 31 20 32 2e 38 32 34 2e 30 30 35 4c 33 20 30 68 31 33 5a 6d 2d 33 20 36 48 Data Ascii: <svg width="48" height="48" viewBox="0 0 48 48" xmlns="http://www.w3.org/2000/svg"><g fill="#000" fill-rule="evenodd"><path d="M16 0a3 3 0 0 1 2.995 2.824L19 3v13a3 3 0 0 1-2.824 2.995L16 19H3a3 3 0 0 1-2.995-2.824L0 16V3A3 3 0 0 1 2.824.005L3 0h13Zm-3 6H

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
55	192.168.2.16	49815	13.107.246.40	443	4912	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-02 10:16:45 UTC	629	OUT	GET /shared/edgeweb/img/fluent-link.baf5bd6.svg HTTP/1.1 Host: edgestatic.azureedge.net Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: / Origin: https://www.microsoft.com Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://www.microsoft.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-10-02 10:16:45 UTC	700	IN	HTTP/1.1 200 OK Date: Wed, 02 Oct 2024 10:16:45 GMT Content-Type: image/svg+xml Content-Length: 476 Connection: close Access-Control-Allow-Origin: * Cache-Control: public, max-age=31536000, immutable ETag: W/"1dc-18c5b69cf34" Last-Modified: Tue, 12 Dec 2023 00:25:10 GMT Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Origin-Agent-Cluster: ?1 X-Content-Type-Options: nosniff X-Download-Options: noopen X-Frame-Options: SAMEORIGIN X-Permitted-Cross-Domain-Policies: none X-XSS-Protection: 0 x-azure-ref: 20241002T101645Z-15767c5fc55gq5fmm10nm5qqr800000009e0000000009z46 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-02 10:16:45 UTC	476	IN	Data Raw: 3c 73 76 67 20 77 69 64 74 68 3d 22 32 34 22 20 68 65 69 67 68 74 3d 22 32 34 22 20 76 69 65 77 42 6f 78 3d 22 30 20 30 20 32 34 20 32 34 22 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 30 2f 73 76 67 22 3e 3c 70 61 74 68 20 64 3d 22 4d 35 2e 35 20 33 41 32 2e 35 20 32 2e 35 20 30 20 30 20 30 20 33 20 35 2e 35 76 31 33 41 32 2e 35 20 32 2e 35 20 30 20 30 20 30 20 35 2e 35 20 32 31 68 31 33 61 32 2e 35 20 32 2e 35 20 30 20 30 20 30 20 32 2e 35 2d 32 2e 35 76 2d 33 61 31 2e 35 20 31 2e 35 20 30 20 30 20 31 20 33 20 30 76 33 61 35 2e 35 20 35 2e 35 20 30 20 30 20 31 2d 35 2e 35 20 35 2e 35 68 2d 31 33 41 35 2e 35 20 35 2e 35 20 30 20 30 20 31 20 30 20 31 38 2e 35 76 2d 31 33 41 35 2e 35 20 35 2e 35 20 30 20 30 20 31 Data Ascii: <svg width="24" height="24" viewBox="0 0 24 24" xmlns="http://www.w3.org/2000/svg"><path d="M5.5 3A2.5 2.5 0 0 0 3 5.5v13A2.5 2.5 0 0 0 5.5 21h13a2.5 2.5 0 0 0 2.5-2.5v-3a1.5 1.5 0 0 1 3 0v3a5.5 5.5 0 0 1-5.5 5.5h-13A5.5 5.5 0 0 1 0 18.5v-13A5.5 5.5 0 0 1

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
56	192.168.2.16	49814	13.107.246.40	443	4912	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-02 10:16:45 UTC	678	OUT	GET /shared/cms/lrs1c69a1j/section-images/2b2884022b26457e9368c34b176c570c.png HTTP/1.1 Host: edgestatic.azureedge.net Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://www.microsoft.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-10-02 10:16:45 UTC	701	IN	HTTP/1.1 200 OK Date: Wed, 02 Oct 2024 10:16:45 GMT Content-Type: image/png Content-Length: 162139 Connection: close Access-Control-Allow-Origin: * Cache-Control: public, max-age=31536000, immutable ETag: W/"2795b-18c5b6259be" Last-Modified: Tue, 12 Dec 2023 00:17:01 GMT Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Origin-Agent-Cluster: ?1 X-Content-Type-Options: nosniff X-Download-Options: noopen X-Frame-Options: SAMEORIGIN X-Permitted-Cross-Domain-Policies: none X-XSS-Protection: 0 x-azure-ref: 20241002T101645Z-15767c5fc55dtdv4d4saq7t47n000000094000000000955z x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-02 10:16:45 UTC	15683	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 02 1d 00 00 01 78 08 06 00 00 00 f0 b1 4b 93 00 00 00 09 70 48 59 73 00 00 21 38 00 00 21 38 01 45 96 31 60 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 02 78 f0 49 44 41 54 78 01 ec fd 77 d0 6d 59 76 1f 86 ad bd cf 0d 5f 7a f9 75 9c ee 9e 4e d3 93 31 83 44 00 83 20 13 96 49 81 20 64 51 82 ab 28 d1 2e db c5 b2 cb 36 ff 93 ab 5c b4 6c 9a 2e 53 fe c3 12 25 99 65 15 65 9b 2c 89 55 92 15 ca a6 19 64 9a 41 a0 00 01 33 43 a4 49 c0 84 9e d4 3d 1d 5f bf 1c be 78 ef 3d 67 2f ef 95 f7 f9 de c0 d2 70 1e d1 af c1 b3 bb bf 77 d3 09 fb ec b0 d6 6f ff 56 d8 00 53 99 ca 54 a6 32 95 a9 4c 65 2a 53 99 ca 54 a6 32 95 a9 4c 65 2a 53 99 ca 54 a6 32 95 a9 4c 65 2a 53 99 ca 54 a6 Data Ascii: PNGIHDRxKpHYs!8!8E1`sRGBgAMAaxIDATxwmYv_zuN1D I dQ(.6\l.S%ee,UdA3CI=_x=g/pwoVST2LeST2LeST2Le*ST
2024-10-02 10:16:45 UTC	16384	IN	Data Raw: 3c 69 34 f9 ca 7f 4f 21 04 55 e0 26 08 b0 e1 c7 8c c2 4b 4d 8c a9 92 24 a0 07 89 4d 55 24 d8 a9 fd 69 25 49 6e f1 ab 7a de 71 a5 ac e7 b3 19 2b 09 50 c1 2d e0 20 b0 51 bb ab 2b 2a 30 04 33 e7 40 00 09 16 a4 dc 16 12 8a 84 8d 52 1d 95 64 cf 96 a1 9d 77 e2 a4 0d aa 38 0c 2c 84 32 96 cf 21 ea 0b b4 8a da ba d1 14 ad b6 42 52 e8 a0 7e 47 3c 2f 29 4a c2 ae df 28 2a bb 46 b1 e3 01 1d 9c d2 ef 25 19 3b 21 b5 22 30 7c bb 2c e1 76 3e 07 87 8b 4b 50 b6 2f 43 5a 9e e5 84 5a cc 0a 00 fa ba 44 de 8b 52 22 1f 84 c1 39 00 b9 df 60 cf 4a 63 17 8b 3f 57 cf 91 6a 45 e7 f3 20 0e dd 28 f2 a0 bc f8 63 50 7e f1 df 81 61 fb 91 7a bd 6a 4e a1 44 5e b5 2f 67 cf ff 24 c0 f2 0c 78 44 85 d6 bd a8 59 82 9e 71 28 b1 39 9c 5c 3b f1 02 86 e4 c9 6a ef 59 38 f9 67 ff 02 0c 17 9f e4 7a 96 Data Ascii: <i4O!U&KM$MU$i%Inzq+P- Q+03@Rdw8,2!BR~G</)J(F%;!"0\|,v>KP/CZZDR"9`Jc?WjE (cP~azjND^/g$xDYq(9\;jY8gz
2024-10-02 10:16:45 UTC	16384	IN	Data Raw: b8 4f 2b 59 43 db 00 cd ca 11 d4 b4 10 26 1e af 9e 69 47 bb a7 7e ef 73 1e 45 70 18 65 8f 2d f0 b0 99 9c 73 3c 97 d6 d5 eb e5 6d 60 cf d0 d6 1b e3 f0 82 d1 7a 6a 0a f0 a5 6c 72 e9 dd b4 ac b4 87 ad a6 a0 ed bb 9c 01 da 3e 82 e0 41 dc 24 a3 75 0b fa 5d 28 d9 17 ab 1d fc 10 23 dc 35 2a 28 ec 84 47 08 00 84 20 4c 12 9e 6a a0 d0 32 39 9e 6e 2a 01 14 c9 4d 37 d6 f4 e2 1c 2a a6 0f de 41 56 85 6e d0 b3 f2 20 96 02 c9 76 ed 1c a0 8c 14 5f 72 18 63 ae 7d 62 2b 27 de 82 f3 41 a0 b4 c4 a6 69 ae 95 52 da f4 c5 6b c3 21 6c 34 c3 2e 80 39 51 5a 58 75 9c e4 4c 03 e8 f8 70 a6 4c db 52 3b 04 55 98 32 c8 43 5f 4b 43 78 9f 18 88 42 3f 5e 87 82 be cf 0d 18 b1 56 c8 23 e0 1a 99 41 9b 2c 98 60 c6 40 da e5 19 e0 d7 5f 5b 40 ae 2c 1d 01 0e 62 04 22 c1 1e b8 02 3a ac 8d f3 8d 0a Data Ascii: O+YC&iG~sEpe-s<m`zjlr>A$u](#5(G Lj29nM7*AVn v_rc}b+'AiRk!l4.9QZXuLpLR;U2C_KCxB?^V#A,`@_[@,b":
2024-10-02 10:16:45 UTC	16384	IN	Data Raw: 1b f4 3c 55 ed f9 cb 03 3c ff 3a 99 52 26 e2 34 5a 34 e3 a8 be a0 16 03 14 4d c3 0f 9b 97 69 d1 10 86 89 4b 1a 6b 6b d9 0f 3e ba 09 bf 4e da 0d 53 b5 e7 ba 68 59 94 54 cc 7e 53 aa 6f da 79 d5 8e 95 0a a8 55 0d 8a b7 be 48 8a 43 a7 65 01 60 52 ee 07 4e cf e0 69 34 05 d9 5e 91 83 7d 01 08 5a b7 23 09 96 df bd be f0 ca 0a bb b1 be 73 83 ab 1f 16 f6 4b 75 fa 7d 0f 6d c1 2b 28 bc 5e bf b3 8a bb d4 7c 50 53 fd bd ed 25 9c c2 0d a0 ac dc a4 d0 7c 7e 38 98 c2 cf ef 7d 68 03 be 86 6d ba 7a 38 30 68 a0 30 d7 55 15 ad cc 02 91 e2 3f 7c 65 8f fd 3c e6 13 89 70 b1 10 5e 0a b5 3d 3f 9f c1 8f 4d df 01 9f ab 57 e1 f5 61 57 f8 98 b3 5a f3 2a 91 81 33 93 4f cb 2c d5 16 1d 50 75 bc 7b 9d 83 16 c4 0e c1 9f 41 d2 f3 f5 25 8f 1b 38 1a 29 10 73 df 68 31 b4 42 e0 7c b9 2a a0 31 Data Ascii: <U<:R&4Z4MiKkk>NShYT~SoyUHCe`RNi4^}Z#sKu}m+(^\|PS%\|~8}hmz80h0U?\|e<p^=?MWaWZ3O,Pu{A%8)sh1B\|1
2024-10-02 10:16:45 UTC	16384	IN	Data Raw: 39 12 60 87 07 b7 51 15 7a bb ff e1 1f 91 15 1f 8c c1 85 d9 ee 7c 29 54 4a 4c f4 d6 02 9c b0 20 e8 20 36 74 53 e4 ab fe 1b b6 be 91 c9 39 84 8d 0f 74 c2 f5 a2 a2 8b 3d 50 40 26 84 03 90 c2 11 05 47 bf fa 2b 30 fc f6 6f 42 3f 2c b1 ba 53 de 37 b9 bc fc 22 74 5f fa 3c 0c bf e7 7b 51 3f fb dd 1a 4b 87 8f 6c 6e 3a 80 8e 3a 8a f6 a5 76 16 f7 5d 79 37 d1 ca e0 02 34 2a 87 6c 25 bd 03 0b 63 54 ae e9 a4 ba 0c 52 af a9 6e d6 14 3e 17 e0 ab 1d f3 df 88 a4 5e 99 87 34 9f e3 55 79 47 5e 2d f1 ef 12 e7 41 85 9b a8 bc a5 40 59 4d 69 ee 02 ee 47 cb 1d 21 ed 35 90 51 5b c0 01 f3 0f 11 a1 65 da 5b 13 20 b2 8a ea 96 1b 58 c8 4d 1c 93 2d 67 b0 24 84 4c fb 02 36 c6 b1 44 e1 f7 4c c0 a2 6e c6 7e 29 2a d9 79 f5 05 b3 4d 61 a8 cb 7d 08 a5 b6 86 2f 33 30 e9 13 08 29 01 26 3a dd Data Ascii: 9`Qz\|)TJL 6tS9t=P@&G+0oB?,S7"t_<{Q?Kln::v]y74l%cTRn>^4UyG^-A@YMiG!5Q[e[ XM-g$L6DLn~)yMa}/30)&:
2024-10-02 10:16:45 UTC	16384	IN	Data Raw: a7 2a 40 2d dc d5 04 5e b6 79 0b 88 b0 8d 8c c0 81 87 55 db ef 6d 10 4e 5f 0a 10 24 b3 71 13 1b fe 8d 9b 60 2b 1b 33 83 44 36 c0 a8 cf 68 22 18 08 32 30 c0 d9 44 ab 04 59 98 d9 a5 8a 4a d7 1c 23 19 3c 75 e5 ee 72 5c 80 9a b9 48 35 47 26 f8 cf 9c e1 8d f8 a6 dd 46 84 e2 ba 79 06 20 fb b0 58 b1 0e ca b4 3f 82 37 14 88 7d 05 8a 21 b3 c4 13 3a 18 39 66 ea d8 11 00 6a 0d de f4 98 6e 6f c1 64 63 0e c7 b7 6e c3 fb 5f fc 6d 78 e2 d2 33 f0 cb df fe 53 f0 e2 a9 87 a5 1e 1a 2d 60 eb 18 48 58 2e cc 6a e6 cb 13 d7 cd 71 39 a5 67 11 80 91 c6 a6 69 04 91 95 2b 20 a5 2a 86 6b 66 96 77 b3 8c b4 b5 2a 86 34 eb 79 8b 67 8b e4 ef d8 3c 9c b1 7a 18 38 03 49 6e b8 31 d3 92 de 99 9c 45 a3 20 67 98 3e 8d 2c 93 28 96 4f 4a b5 3f bb f7 39 f8 bb 8b 17 e1 bb a7 0f 30 5d 5c c2 15 e4 Data Ascii: @-^yUmN_$q`+3D6h"20DYJ#<ur\H5G&Fy X?7}!:9fjnodcn_mx3S-`HX.jq9gi+ kfw*4yg<z8In1E g>,(OJ?90]\
2024-10-02 10:16:45 UTC	16384	IN	Data Raw: 45 89 d8 44 cc 4d 82 01 0e b7 df 03 14 73 a0 81 07 f9 97 49 c4 f4 e4 4e 90 c9 c1 8e 79 1d d3 34 10 73 1f 20 14 b4 fe ad 0b cf 15 b3 27 95 8a a9 8d ca 3a 60 00 10 7f 97 9b 24 d2 07 a3 5e 71 bc ba bd 1c 81 62 d2 56 25 eb 32 2b 2e cf a1 e1 4a 0f 1c 04 90 ac 8f 56 6d ce fa 8d 9e 9e 8b 69 1e 71 59 ff 48 87 5c 28 7d 60 2b 27 5a b0 12 78 b0 16 0a 04 09 1c 56 32 d0 c0 0e d7 83 cf 31 f1 70 b1 da 7f f6 13 0a 00 73 c5 ef b9 50 28 e0 11 d8 82 b6 b6 b4 6a f6 41 15 76 3d 77 51 58 04 67 24 48 33 90 16 e1 c6 2e 48 8a 4c 8b a4 60 fe 7c 55 de 21 dc 30 00 ab 9b 6a c2 f1 58 63 5a cd 3c a3 c0 00 6d f7 15 b2 0e e0 da 7b 9f 7a cf bb e1 d6 d3 4f c2 97 3e f1 09 f8 fd 1f ff 1b f0 ed 1c e1 f2 6d 7f 04 3e fa e4 3b 6c 7c 21 14 93 25 bb 35 07 df f1 cb 7e 80 8d e3 1b 00 db 3b 6b 25 10 Data Ascii: EDMsINy4s ':`$^qbV%2+.JVmiqYH\(}`+'ZxV21psP(jAv=wQXg$H3.HL`\|U!0jXcZ<m{zO>m>;l\|!%5~;k%
2024-10-02 10:16:46 UTC	16384	IN	Data Raw: 4a c0 a2 49 02 84 b9 0e f3 f7 92 81 29 01 1f 3e 57 72 8d 6a b7 da fb 83 71 c8 b2 7c 3a 05 68 74 50 e9 73 cf 00 a7 7c 16 7d 09 f1 bd 8f b1 ac 57 63 90 a0 b6 9b 62 e2 c7 b8 f8 3f cf 8c ff f0 08 10 8e d2 5e 07 6e a7 87 de 1d bb 61 2b 54 f6 c3 e6 96 24 9d 1e 14 93 e4 e0 70 99 4d f6 9c 65 7e 8d f5 23 0c b9 bd a2 2b c8 69 47 77 bc 86 48 9f ee 8b c7 c3 eb 05 37 78 34 8a cb 52 06 24 57 07 6d c0 5e 01 1b da a6 48 5a ea 72 cc e5 a1 eb 2b 6b 0f 39 90 1b 3a 20 d6 b3 cd cd 57 5e 79 e5 69 b8 b9 be ea f5 3b 06 3a f8 3a fb ee ef fd d9 e5 99 e7 fe 65 d8 6c 1e 6a ba 6c 17 3c 58 26 8b d1 f4 0e 3e 56 ca cf 16 56 d9 6d c5 39 15 fc 2f f2 dc d6 b7 fa 32 d6 f2 e3 2b db 69 fa c1 6a bd 2c 74 5c 29 37 f7 91 50 01 e8 bb 5d 39 54 8e 72 e7 68 18 3b 76 99 0e 9e fc 85 fe 9e aa 70 7c 51 Data Ascii: JI)>Wrjq\|:htPs\|}Wcb?^na+T$pMe~#+iGwH7x4R$Wm^HZr+k9: W^yi;::eljl<X&>VVm9/2+ij,t\)7P]9Trh;vp\|Q
2024-10-02 10:16:46 UTC	16384	IN	Data Raw: 00 5b 7f 92 8f 9f d5 5f ee 21 75 42 b5 a4 db e0 07 e3 49 5a 7b 63 58 1a a8 0f 04 cf 19 49 d2 3d c0 cd 16 55 a9 f3 f8 8a 8e 62 a5 cd e9 b7 67 3d 51 f6 5c 00 39 c2 86 13 ca f1 4e 9d 7f 1f 0a 7e 33 1a c9 07 a4 f1 7d 7c ea 2b e7 0c e1 06 6f b8 da e3 3f 9c d6 8f 9d 2a 77 5d e9 fc 79 e6 f7 4e b0 1d 1b 92 69 98 07 26 b0 dc 11 6c d6 1b 72 60 da 5f 8a c3 26 5f 9b 61 aa 38 9e 9f 49 9d 39 a9 16 3b 3e ee 3f b5 c0 f6 9d 3c ff b5 d7 a7 fd 60 04 66 cd a2 2b 26 5a 4f db 3a 94 b0 9c 49 c9 0c 83 64 ed 3c 08 63 41 5d 0f 8b a4 f3 8d dc df 18 54 5c b1 0f d8 46 4c 1f 34 64 d3 c4 d1 28 67 5b f1 d1 e4 7e 5a 1e 8c 3e b8 4d 9c 0e c3 4e 6c dd a9 39 97 07 8e 3b 8d 0f 5c 43 dd 68 11 b3 06 bc 49 da d8 89 da 64 be 15 66 2a 41 76 1a e5 64 87 8a be 64 5c 24 fd fd a8 9f e6 19 9c a4 9e e2 Data Ascii: [_!uBIZ{cXI=Ubg=Q\9N~3}\|+o?w]yNi&lr`_&_a8I9;>?<`f+&ZO:Id<cA]T\FL4d(g[~Z>MNl9;\ChIdfAvdd\$
2024-10-02 10:16:46 UTC	15384	IN	Data Raw: a9 5c c1 9a 3f 8f 41 88 85 8a 2c 39 68 e6 62 64 b9 8d 63 07 ca b6 97 37 a2 65 ef 11 50 50 e8 63 71 80 c9 68 aa 29 5c 15 b5 fe 46 05 17 40 37 72 49 e4 6d f1 f8 82 64 cd b9 8d c1 24 54 64 ec 8b 11 06 38 ef c6 b7 48 26 07 8f 2a d7 b1 bc 63 f8 9f 9f f5 7c 10 2a 7a 8e 54 51 11 6a 65 ad 40 b5 c2 06 92 5b 45 5e d7 bd 52 67 5c e1 73 a9 09 bd a0 78 79 98 e0 58 9e 82 d8 fa ef 6d d3 f3 58 a6 6c 2e 6d ab 45 88 a3 c2 52 86 f9 41 bc df ad ab 0b e7 bf fa fe e3 fe 91 2c 6c 64 24 8b 18 0c 82 71 30 d7 a5 b5 ef d3 c1 83 68 6b fd 0e f2 a7 b2 10 31 7c 4e 41 a3 09 27 e4 36 8f 7e 43 37 72 3f 18 38 5c 7c 1c 58 e7 46 f3 36 70 c8 99 91 87 0e 3f 09 68 e4 3b 58 24 6a 46 cf 69 95 de e0 6a aa d4 5c a3 9e f9 83 d7 62 0c f3 4b db 17 43 b7 dd 7a d0 f1 16 d9 78 7d f5 fe e5 d5 6b fd 63 15 Data Ascii: \?A,9hbdc7ePPcqh)\F@7rImd$Td8H&c\|zTQje@[E^Rg\sxyXmXl.mERA,ld$q0hk1\|NA'6~C7r?8\\|XF6p?h;X$jFij\bKCzx}kc

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
57	192.168.2.16	49817	13.107.246.40	443	4912	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-02 10:16:45 UTC	633	OUT	GET /shared/edgeweb/img/fluent-dropdown.8618950.svg HTTP/1.1 Host: edgestatic.azureedge.net Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: / Origin: https://www.microsoft.com Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://www.microsoft.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-10-02 10:16:46 UTC	680	IN	HTTP/1.1 200 OK Date: Wed, 02 Oct 2024 10:16:46 GMT Content-Type: image/svg+xml Content-Length: 503 Connection: close Access-Control-Allow-Origin: * Cache-Control: public, max-age=31536000, immutable ETag: W/"1f7-18c5b5bbef8" Last-Modified: Tue, 12 Dec 2023 00:09:48 GMT Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Origin-Agent-Cluster: ?1 X-Content-Type-Options: nosniff X-Download-Options: noopen X-Frame-Options: SAMEORIGIN X-Permitted-Cross-Domain-Policies: none X-XSS-Protection: 0 x-azure-ref: 20241002T101645Z-15767c5fc55dtdv4d4saq7t47n000000096g0000000058dn x-fd-int-roxy-purgeid: 0 X-Cache: TCP_MISS Accept-Ranges: bytes
2024-10-02 10:16:46 UTC	503	IN	Data Raw: 3c 73 76 67 20 77 69 64 74 68 3d 22 32 34 22 20 68 65 69 67 68 74 3d 22 32 34 22 20 76 69 65 77 42 6f 78 3d 22 30 20 30 20 32 34 20 32 34 22 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 30 2f 73 76 67 22 3e 3c 70 61 74 68 20 64 3d 22 4d 32 32 2e 32 32 31 20 35 61 31 2e 36 20 31 2e 36 20 30 20 30 20 31 20 2e 36 37 32 2e 31 34 34 20 31 2e 39 33 33 20 31 2e 39 33 33 20 30 20 30 20 31 20 2e 39 36 33 2e 39 36 33 20 31 2e 36 20 31 2e 36 20 30 20 30 20 31 20 2e 31 34 34 2e 36 37 32 63 30 20 2e 34 39 32 2d 2e 31 37 37 2e 39 31 33 2d 2e 35 33 20 31 2e 32 36 36 6c 2d 31 30 2e 32 32 20 31 30 2e 32 32 63 2d 2e 31 36 38 2e 31 36 38 2d 2e 33 36 2e 32 39 38 2d 2e 35 38 2e 33 39 31 61 31 2e 37 33 36 20 31 2e 37 33 36 20 30 20 30 Data Ascii: <svg width="24" height="24" viewBox="0 0 24 24" xmlns="http://www.w3.org/2000/svg"><path d="M22.221 5a1.6 1.6 0 0 1 .672.144 1.933 1.933 0 0 1 .963.963 1.6 1.6 0 0 1 .144.672c0 .492-.177.913-.53 1.266l-10.22 10.22c-.168.168-.36.298-.58.391a1.736 1.736 0 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
58	192.168.2.16	49818	13.107.246.40	443	4912	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-02 10:16:45 UTC	678	OUT	GET /shared/cms/lrs1c69a1j/section-images/a06eb816e83b48758a42ca5dbddb2e67.png HTTP/1.1 Host: edgestatic.azureedge.net Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://www.microsoft.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-10-02 10:16:45 UTC	710	IN	HTTP/1.1 200 OK Date: Wed, 02 Oct 2024 10:16:45 GMT Content-Type: image/png Content-Length: 1350100 Connection: close Access-Control-Allow-Origin: * Cache-Control: public, max-age=31536000, immutable ETag: W/"1499d4-191ebf0fb36" Last-Modified: Fri, 13 Sep 2024 15:12:04 GMT Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Origin-Agent-Cluster: ?1 X-Content-Type-Options: nosniff X-Download-Options: noopen X-Frame-Options: SAMEORIGIN X-Permitted-Cross-Domain-Policies: none X-XSS-Protection: 0 x-azure-ref: 20241002T101645Z-15767c5fc55xsgnlxyxy40f4m00000000990000000007ce2 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L2_T2 X-Cache: TCP_REMOTE_HIT Accept-Ranges: bytes
2024-10-02 10:16:45 UTC	15674	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 0b 75 00 00 07 af 08 03 00 00 00 12 f9 d8 0d 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 03 00 50 4c 54 45 47 70 4c ff ff ff 60 ff f6 57 80 d3 43 af d6 35 9a ce 2c 84 d0 2c cd dc 1f 8c d9 29 70 d6 27 a4 e1 20 b2 d9 15 ad e6 00 ff ff 20 bc d6 1f be ca 22 91 e5 13 b0 e4 1f 82 e0 10 ae e6 1c 8a e2 08 00 b0 1c 8d e3 1a 81 dc 1c 6f c0 13 a7 e3 10 af e6 1b 8f e4 11 ad e4 1c 84 da 11 a6 e4 1c 88 da 11 ac e7 1e 87 e1 19 6f b0 1d 8e e8 27 c5 b6 1d 8b e5 26 c6 b6 1d 8c e5 1f 8a e3 14 6f b2 2b c9 b2 1d be be 16 78 c7 17 a8 f1 1b bd bf 13 af eb 25 c4 b7 19 98 e7 11 73 b5 1d 8e e6 21 c2 ba 3c cd bd 21 c2 bb 19 bb c1 15 ac ee 1f 7a d8 18 a7 f1 1c 8f e7 17 aa f1 1e 7b Data Ascii: PNGIHDRugAMAasRGBPLTEGpL`WC5,,)p' "oo'&o+x%s!<!z{
2024-10-02 10:16:46 UTC	16384	IN	Data Raw: b6 f4 df 4c 95 bc e9 92 db 76 1e ed 06 7d 26 ea b5 b5 05 f1 d9 89 fb d1 ed 02 62 75 53 5b f5 d1 70 db cd 33 fe 9f 37 7e 56 75 d3 6f f3 57 86 df 4d 1e e0 0d e7 9d 2e 1b c0 95 dd 86 9d e3 06 5c 6b 25 61 7d 02 1b ef 1d 05 9a 1f 5c 74 78 13 0d 7f a4 af 02 c7 aa e1 f6 eb 78 e3 c6 eb 91 3c 8c c8 bd 04 b5 a8 52 68 82 ea 39 60 40 80 3c cf 7f 63 cc 21 02 6c 11 85 0c 29 83 94 6a c7 61 e4 b4 2a c5 fd 15 16 9d d0 c4 fa a2 47 7c f4 e0 04 4e a5 38 64 79 51 0f 64 0a 7d 24 d1 b6 e9 59 64 1f 6b a3 44 8c fc 18 b6 70 f9 e8 4b 9e f6 b4 a7 3d ed 67 21 65 81 cb 9a 43 cc a6 b0 1e 1e ac 66 24 d5 0d 49 2c eb c6 2d 02 6d f7 54 f6 ae 39 0c 6c 3c a5 e5 ef 73 d8 04 2f 2e 26 65 0c c6 d5 34 ad cf 11 29 94 9c cb 8e cc 3b 33 97 0c 91 da 0e 7e e7 72 6b 11 a7 a4 55 63 c2 35 8e dd a0 b4 77 Data Ascii: Lv}&buS[p37~VuoWM.\k%a}\txx<Rh9`@<c!l)ja*G\|N8dyQd}$YdkDpK=g!eCf$I,-mT9l<s/.&e4);3~rkUc5w
2024-10-02 10:16:46 UTC	16384	IN	Data Raw: bb bc cb 6f 53 f7 30 8c 8d cb cd bc 70 36 35 29 89 7d 5c 89 a0 53 94 83 46 90 ac d2 4e 70 bd 84 26 61 56 08 06 eb 2e 41 ae 03 86 d8 a7 75 c7 c0 f9 68 06 ed 71 18 35 b1 44 80 9a 0f e1 c2 df 93 16 53 5a 1e 77 75 78 4f 62 e1 56 e1 1b 86 14 96 43 48 e7 e6 e1 c8 20 a3 f7 01 ea ce 28 c9 7f 63 c3 da 7b 37 7c d4 39 1d 4b b0 72 9c c9 51 f7 13 74 b7 f5 ef ce 85 cd 8d d1 d0 bb 43 93 f1 17 ec f1 b9 e7 eb 70 53 b8 3b 7d bb 56 f1 d5 eb de 3e 77 c4 d7 b6 2f 35 0f cd 21 84 5f 21 3e 16 dd d4 ac 07 27 2d c6 ae f6 db e3 0c 56 d8 c4 7e ad 62 f5 22 5f 44 ea de 20 60 f3 d7 2c 73 94 1b 87 5e 03 a8 b7 0d 79 d1 d7 2b f2 26 f7 36 0b 91 de d4 cd 9d 21 d4 32 b1 0a a3 46 7c ad b8 ab ba b4 3e 13 ab b6 ad 66 92 5c 49 da 7f db 14 b3 53 d5 8e 8d ba 53 fd 01 f5 c5 c0 59 bf 11 bf e5 04 d1 Data Ascii: oS0p65)}\SFNp&aV.Auhq5DSZwuxObVCH (c{7\|9KrQtCpS;}V>w/5!_!>'-V~b"_D `,s^y+&6!2F\|>f\ISSY
2024-10-02 10:16:46 UTC	16384	IN	Data Raw: a6 76 5b 8d 17 b1 db 0b ec 04 14 f5 4e 62 5e 23 b9 5b 9b 28 31 26 49 ac 89 b4 51 72 2a 20 a7 af c2 d4 a6 c2 df 09 19 dd 13 24 36 4a 75 a8 2a 87 9a 7f 4b 11 dc 10 de 75 59 d5 ce e3 76 ce b7 59 de ef f9 ee 26 8b df b6 f0 ed 2a b9 de 5a 85 23 a4 f7 81 28 a9 52 94 49 d3 38 a8 44 b2 b9 5d f7 a4 17 e2 af 35 16 ad a1 da b7 54 47 97 e8 ed 96 27 28 ef 1c 57 72 67 98 7b 00 6b c2 4d ed ad 99 d9 3c 13 d6 da cf 14 d0 9d 31 dd 5d ae b7 3b 1d 95 cc 9a 22 d3 fb 61 94 0c 93 2e 35 c5 48 1a 37 86 dd b8 ea 71 78 db c9 de e5 b3 87 1e 1a 31 88 24 71 df ff 6e b9 fd 2d 13 d3 df 4e 04 f6 fc a2 b6 e7 13 91 3d 27 11 9c 1d 9f 4f ae d0 f3 e1 64 43 1a ff 97 bd b3 db 75 53 59 82 30 30 d8 1e b0 40 73 83 c4 75 de c1 2f 80 2c 14 f9 fd 1f e8 d0 5d dd 3d 3d 80 93 95 73 72 a4 68 c9 c4 b1 f9 Data Ascii: v[Nb^#[(1&IQr* $6JuKuYvY&Z#(RI8D]5TG'(Wrg{kM<1];"a.5H7qx1$qn-N='OdCuSY00@su/,]==srh
2024-10-02 10:16:46 UTC	16384	IN	Data Raw: 97 bb 84 db 5d c9 bd 89 7f 37 36 24 32 4e eb fc 3e dd 5a f4 ee f5 c2 a1 7a 37 b8 dd ba 02 b6 29 6b 8b 80 2d d4 2c 2e 92 2e 0e b8 00 86 63 63 c4 bd 88 95 83 90 76 1c f4 31 7c 7a a1 73 d1 ca a3 b8 4e 02 1f 82 97 26 40 ae be 95 a0 0e 96 31 7d f5 48 5f 43 46 d9 1a 17 3c 8f 03 b4 75 01 6f c1 eb 2e 9a ed 44 c8 3c 80 c2 c5 5c 8e 5b 60 f1 18 22 7f 82 ea e1 43 54 d9 bb cf 80 4d 1c 0f 31 66 6d 3b 09 df 83 ed 98 ef f4 66 fb ee 53 bc 60 ef 4d e0 2b 23 b8 bf 71 d1 8a cb 14 2f a8 25 f5 7a 5f 33 06 4d f6 ee ad 22 fe f2 a5 1e f0 e5 72 d4 b2 4a f0 36 2d 26 f4 9d 44 cb 41 51 8f 37 a4 f1 9b fe bc 95 b9 e3 ed af 2c b9 29 3e 85 7c 7f bf 2c fe e0 32 05 0f a9 b7 52 f1 9b 6e 93 fd a1 1c 1c 4f 6a 77 f6 9a 1c f6 29 4a b5 b0 9a 80 b2 25 c2 44 ae 6c a0 12 6f bf d0 b6 69 df 46 8f 0e Data Ascii: ]76$2N>Zz7)k-,..ccv1\|zsN&@1}H_CF<uo.D<\[`"CTM1fm;fS`M+#q/%z_3M"rJ6-&DAQ7,)>\|,2RnOjw)J%DloiF
2024-10-02 10:16:46 UTC	16384	IN	Data Raw: 9a 56 f0 33 80 5c b1 27 c8 43 39 7b da b7 b9 b9 a9 68 03 c1 99 81 52 eb ae 86 a7 9b 26 70 20 f7 59 e8 7d 76 fe 16 84 ff a9 65 9d ee 0f 64 f0 b5 a8 5a f6 6e 56 52 e6 fe 12 af e5 61 82 20 12 4f d6 99 0c 7e 67 35 39 7f c3 f8 ed 7e 93 8d 5a 74 60 3a d9 4c aa 73 4e 9f 4f 57 ae 36 53 7b f7 68 ba b2 ef 57 99 ef 6f e9 ad 65 31 c7 a4 f7 d6 1c 7f e7 ef fb 65 bf f0 2c 6f 90 75 0f fe 86 da dd 6b 80 b2 97 cc 3d 0e 31 c9 6c 26 fd 38 b9 e4 78 6f e6 2e 46 53 95 93 2e 4b 28 de 97 d2 fb 29 d1 92 53 c2 62 c2 59 ca d2 74 6c 8b 31 b9 c1 76 32 8b 1f 48 1f 6f 33 79 51 06 52 cf 52 4c dc 2d 9a 5a 2b 91 d6 2d bb c9 33 39 f0 b9 3c 97 df c9 dc 0a c6 97 e4 2d f8 f6 00 21 fc f5 7b d4 d6 31 a6 7d ce 19 d6 7d c5 22 7e 46 1b ad a9 d2 fe e7 32 7d 22 ca ec 2e 05 e1 85 3b be 01 d1 3e 73 39 Data Ascii: V3\'C9{hR&p Y}vedZnVRa O~g59~Zt`:LsNOW6S{hWoe1e,ouk=1l&8xo.FS.K()SbYtl1v2Ho3yQRRL-Z+-39<-!{1}}"~F2}".;>s9
2024-10-02 10:16:46 UTC	16384	IN	Data Raw: 70 ad ea d5 82 d0 ed ff d8 3b bf dd 54 b9 20 8a 0b a8 ad b6 b4 f2 25 14 49 b8 32 84 04 2f 77 d2 17 30 8d 17 7d ff 07 fa 9c 59 33 b3 67 23 fd 7b ce b9 93 9e 02 02 da 9e 0b eb 72 f9 9b b5 a2 bb 2d bb ea 64 b7 ea 74 b7 38 1b dd 6e 71 ca cd e6 96 fb c2 36 1f 02 ef f0 da 90 71 f0 e0 6a 6f b3 1b 8e c7 91 87 6e 83 52 e0 97 ef 46 52 09 45 38 57 fc dd 34 8d 4a e9 06 ba dc 6d e8 2b 74 63 d0 f1 4c 02 4b 60 6a e3 2e 2c b5 a1 c1 e5 e2 9e 0c 6b 16 e0 0d f3 26 0d 94 72 f4 ba 83 99 db 63 87 98 14 3e d6 34 92 6f 12 24 e9 04 fe 76 82 77 07 d5 d6 c1 97 c8 a7 33 98 73 60 89 8b f7 3e 5e 71 26 d0 d3 c7 84 ee 3e c4 31 4b 1b b0 3c 4c e7 2c 0f 66 7b c7 a4 ef ff ae a8 ee 39 d1 9d 76 e8 1c 53 c2 fb 8b e2 f8 fb 14 31 51 a8 fb 5e 6a 2a 67 dd ee bd d5 e9 f8 12 9d 7d e2 79 1f be 11 65 Data Ascii: p;T %I2/w0}Y3g#{r-dt8nq6qjonRFRE8W4Jm+tcLK`j.,k&rc>4o$vw3s`>^q&>1K<L,f{9vS1Q^j*g}ye
2024-10-02 10:16:46 UTC	16384	IN	Data Raw: 1e 2f b0 04 26 53 7a eb 70 33 88 bb ed 8d 87 8d 46 74 c0 f3 de da dc 21 13 eb 1e dd e9 1d 8a 67 2f fa 9a e5 36 d8 df 8e af 0c 04 96 04 ff 4a 97 bc ea 83 b0 67 ee 11 46 a1 23 8e 76 51 11 f3 14 26 d1 23 42 92 f0 3d 28 e2 1b ef 83 61 26 2d 31 26 31 79 85 62 09 05 3a 01 ff 9b 07 28 51 88 cb 00 a6 57 5a db 73 2b 3d c8 6f 47 90 b7 e7 53 e0 96 fb 56 c4 39 8a 6a 9f 89 ec 1a c5 fa 40 7a bb 8b fc c9 21 6d 95 97 f8 40 c9 34 51 8d dd 0e 00 14 53 b1 73 48 a3 bd db 1c 36 39 18 ee 44 d2 07 7f 91 e3 ad 28 77 e2 75 4f 24 99 64 58 f7 90 38 39 5e cd 33 f9 c3 8c c9 06 49 93 6b 9d f0 26 ce 64 90 65 f2 90 f4 e5 e4 69 82 64 75 6f 64 a8 72 63 48 93 f1 8a 4a 32 bc 0d da dd 71 3f bc 7a 3c b0 d1 a9 c5 1d b3 4c 3a 78 45 ea 28 b4 5b 8d 6e 74 b6 71 65 7b 2a 9b aa 4b 22 4a b8 0f 7e 48 Data Ascii: /&Szp3Ft!g/6JgF#vQ&#B=(a&-1&1yb:(QWZs+=oGSV9j@z!m@4QSsH69D(wuO$dX89^3Ik&deiduodrcHJ2q?z<L:xE([ntqe{*K"J~H
2024-10-02 10:16:46 UTC	16384	IN	Data Raw: f2 07 ee 3b b5 94 38 21 74 b7 73 e2 31 89 5e 6f a6 74 02 ea b8 23 e7 6a 50 71 f1 4e b6 12 e5 70 dc e4 1d 04 6f 3a 21 31 bc 75 e2 3e f1 6a 43 d1 4d 45 6f 16 c4 51 ec 26 d1 dc 22 37 63 b8 e3 60 70 36 9d d0 9e ce 60 96 42 06 c3 7f 73 78 5b 49 3b ab d9 89 ae 13 eb 3b e1 60 93 dc d5 5d 3c 31 cc dd 2f 57 70 53 ec d3 49 23 04 4b ec bd 35 d0 7d 92 e4 bd bd c8 65 52 e6 ed 42 5d 7c c6 dd df cf 55 c6 9a f8 78 fc a7 03 bd d3 03 d3 54 79 12 64 72 92 21 a8 72 f7 cb 79 b5 5b 9a e2 a9 af f2 00 dc 7d 90 c2 ca c3 e8 e6 00 9f 57 87 51 a1 1d fe c6 8e 34 b1 b9 bb 81 f4 ee 86 9a e2 05 c0 eb 64 80 b2 06 4f 76 53 24 ed 7d e6 32 89 ca d9 24 46 07 72 79 25 e2 f4 9e 3a 71 22 5e 03 75 0f 9a b9 88 dc e8 e1 1e 50 4b 25 d5 55 f2 24 25 aa 7d f3 6b 60 f7 75 fd 5a ad 1b a3 b7 25 40 90 da Data Ascii: ;8!ts1^ot#jPqNpo:!1u>jCMEoQ&"7c`p6`Bsx[I;;`]<1/WpSI#K5}eRB]\|UxTydr!ry[}WQ4dOvS$}2$Fry%:q"^uPK%U$%}k`uZ%@
2024-10-02 10:16:46 UTC	16384	IN	Data Raw: 4d 68 1f a5 be 83 ee a6 41 cb f6 56 01 df 44 3e 19 52 e0 3d 5d fe d4 8a ff 8d 08 93 f6 46 84 37 b9 e0 54 aa 43 fb 98 7a 62 8a bb fd 04 ca fb a5 8f 14 4c 52 26 2f 9e 68 22 52 fb cd f1 ca 44 70 07 f3 7b 47 c4 db 1c ef 3d 52 de 77 7e b0 b2 ef 75 07 f5 dd 43 9a f8 d7 06 75 f7 37 eb ca 49 a9 dd 77 e9 78 65 5f 70 9f 26 73 95 b1 2d e7 94 27 2a b1 b9 f2 5d a0 60 42 ee 9e ea 3d 45 ea 1e 83 d1 bd a1 78 c9 d4 57 5f b8 3f b2 18 eb 06 96 09 56 55 4e 32 2a ae 24 8c c9 06 65 f6 38 db c5 30 c9 71 0f 80 4a 2c 77 c2 5c 41 68 b3 46 75 3e c2 02 f8 6e 8d 5c 41 54 1c eb 0c 2c ef 7c 36 83 5e 78 a1 70 33 15 50 bd 40 4a 79 6b 1c 36 27 82 60 ae 00 ef a3 03 c4 e4 b0 fc 1f 38 dd 94 ea c6 d8 94 5c c8 c9 05 7b d9 fd 30 67 70 e1 67 b6 86 9a 9c 19 f1 36 a5 0e 9e 3e b2 22 b9 64 c6 ef c0 Data Ascii: MhAVD>R=]F7TCzbLR&/h"RDp{G=Rw~uCu7Iwxe_p&s-']`B=ExW_?VUN2$e80qJ,w\AhFu>n\AT,\|6^xp3P@Jyk6'`8\{0gpg6>"d

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
59	192.168.2.16	49822	104.70.121.218	443	4912	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-02 10:16:46 UTC	435	OUT	GET /bloomfilterfiles/ExpandedDomainsFilterGlobal.json HTTP/1.1 Host: www.bing.com Connection: keep-alive Cookie: ANON=; MUID=;_RwBf=; Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-10-02 10:16:46 UTC	704	IN	HTTP/1.1 200 OK Content-Length: 637659 Content-Type: application/json Last-Modified: Wed, 02 Oct 2024 01:01:26 GMT ETag: 0x8DCE27DBDFCEF80 x-ms-request-id: 13680550-b01e-00dd-39b4-14e9e2000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version X-MSEdge-Ref: Ref A: FEC8DA5E2D0A4816BF3FBE9A41D839F9 Ref B: EWR311000107019 Ref C: 2024-10-02T10:16:46Z Date: Wed, 02 Oct 2024 10:16:46 GMT Connection: close Alt-Svc: h3=":443"; ma=93600 X-CDN-TraceID: 0.ad794668.1727864206.171f2421
2024-10-02 10:16:46 UTC	16384	IN	Data Raw: 7b 22 6e 75 6d 62 65 72 4f 66 48 61 73 68 46 75 6e 63 74 69 6f 6e 73 22 3a 38 2c 22 73 68 69 66 74 42 61 73 65 22 3a 38 2c 22 62 6c 6f 6f 6d 46 69 6c 74 65 72 41 72 72 61 79 53 69 7a 65 22 3a 33 37 37 35 37 39 32 2c 22 70 72 69 6d 65 42 61 73 65 73 22 3a 5b 35 33 38 31 2c 35 33 38 31 2c 35 33 38 31 2c 35 33 38 31 5d 2c 22 73 75 70 70 6f 72 74 65 64 44 6f 6d 61 69 6e 73 22 3a 22 6d 54 61 79 2f 57 6b 6b 6c 36 6e 44 47 43 63 36 42 4c 77 4e 59 70 6d 74 48 4e 42 67 67 62 51 42 37 58 37 33 59 4e 32 56 77 32 73 52 33 6b 55 68 67 6d 70 78 2b 56 46 41 65 4c 4c 33 4f 2b 44 41 49 4f 66 43 59 43 44 75 4c 74 75 68 4b 54 6b 6f 76 41 77 64 38 74 64 57 36 78 49 76 2f 75 45 54 59 53 63 71 32 67 47 66 6b 31 77 77 4a 6a 43 64 56 62 43 31 51 55 79 38 45 5a 73 62 6b 51 38 59 Data Ascii: {"numberOfHashFunctions":8,"shiftBase":8,"bloomFilterArraySize":3775792,"primeBases":[5381,5381,5381,5381],"supportedDomains":"mTay/Wkkl6nDGCc6BLwNYpmtHNBggbQB7X73YN2Vw2sR3kUhgmpx+VFAeLL3O+DAIOfCYCDuLtuhKTkovAwd8tdW6xIv/uETYScq2gGfk1wwJjCdVbC1QUy8EZsbkQ8Y
2024-10-02 10:16:46 UTC	8192	IN	Data Raw: 57 41 32 41 4a 79 33 5a 48 62 72 61 73 33 48 6e 6c 53 70 6b 6d 67 42 42 41 79 65 67 37 54 76 39 6a 59 69 45 47 4a 54 72 6f 79 58 6c 71 65 49 42 32 64 54 7a 52 33 45 48 62 43 4a 75 37 74 4e 6a 47 6b 41 61 79 46 44 77 51 4a 44 54 64 2f 34 74 49 39 4e 39 46 6a 74 51 7a 71 48 70 34 38 61 53 46 6d 30 4b 49 72 5a 46 67 54 66 48 72 4f 74 6f 42 58 51 4e 70 53 48 4e 37 5a 65 57 55 61 45 77 50 6f 57 52 6a 41 54 6e 47 6a 74 45 47 4c 32 7a 5a 2b 4e 61 35 41 34 34 79 6f 57 73 4c 49 4d 39 58 59 62 61 6c 4b 4a 4f 46 75 32 68 44 77 6b 51 2b 44 36 72 53 69 78 6c 70 6c 61 56 64 51 67 31 4c 78 47 43 69 4c 67 4d 79 37 4b 76 52 62 6c 30 4c 5a 6f 4c 6e 76 30 30 4b 67 66 32 68 49 50 4f 44 65 49 79 4b 6d 36 45 42 30 53 59 39 30 43 44 6c 67 49 36 68 66 4d 68 36 54 4b 47 4c 4e 6b Data Ascii: WA2AJy3ZHbras3HnlSpkmgBBAyeg7Tv9jYiEGJTroyXlqeIB2dTzR3EHbCJu7tNjGkAayFDwQJDTd/4tI9N9FjtQzqHp48aSFm0KIrZFgTfHrOtoBXQNpSHN7ZeWUaEwPoWRjATnGjtEGL2zZ+Na5A44yoWsLIM9XYbalKJOFu2hDwkQ+D6rSixlplaVdQg1LxGCiLgMy7KvRbl0LZoLnv00Kgf2hIPODeIyKm6EB0SY90CDlgI6hfMh6TKGLNk
2024-10-02 10:16:46 UTC	16384	IN	Data Raw: 46 32 7a 4a 31 72 39 53 2b 65 74 36 35 63 52 6f 2f 31 76 48 59 55 46 45 76 47 4b 38 52 68 4b 71 77 54 62 51 34 48 31 6d 68 6b 42 49 57 56 54 2f 67 2b 6a 7a 2f 49 7a 68 65 4a 48 2f 45 59 4f 68 2b 44 75 38 7a 73 78 36 34 39 4b 49 48 49 75 6d 49 67 34 77 47 41 5a 59 37 63 53 6a 4f 69 71 76 71 34 44 56 52 63 50 54 62 73 77 46 41 6a 59 41 70 6f 42 56 6e 53 77 62 50 2f 41 79 68 71 72 6e 65 41 53 38 7a 56 73 69 34 7a 4b 52 73 33 65 43 39 43 2f 78 41 46 6a 36 2f 39 78 57 4b 77 68 65 44 45 38 51 4a 62 42 42 41 44 49 30 6a 46 4d 31 46 6b 64 50 56 43 6b 75 51 2f 73 4c 55 78 41 69 4d 5a 42 69 51 46 78 63 70 52 35 36 70 6e 67 33 50 2b 56 64 46 6d 32 35 34 74 36 30 74 61 35 42 4c 62 30 49 69 74 77 77 42 39 44 5a 54 42 57 51 6d 53 4c 56 6f 30 37 6b 75 42 42 6a 49 4a 41 Data Ascii: F2zJ1r9S+et65cRo/1vHYUFEvGK8RhKqwTbQ4H1mhkBIWVT/g+jz/IzheJH/EYOh+Du8zsx649KIHIumIg4wGAZY7cSjOiqvq4DVRcPTbswFAjYApoBVnSwbP/AyhqrneAS8zVsi4zKRs3eC9C/xAFj6/9xWKwheDE8QJbBBADI0jFM1FkdPVCkuQ/sLUxAiMZBiQFxcpR56png3P+VdFm254t60ta5BLb0IitwwB9DZTBWQmSLVo07kuBBjIJA
2024-10-02 10:16:46 UTC	7565	IN	Data Raw: 70 2b 79 30 76 50 51 38 46 67 55 4d 4d 4a 48 51 62 31 51 37 46 62 79 4d 64 35 4b 4f 42 44 4e 33 39 49 64 69 64 47 70 4d 56 56 6c 45 52 51 59 54 58 61 6c 44 33 76 34 4c 41 6e 51 68 58 7a 72 57 57 65 31 6a 37 75 74 67 35 77 7a 61 74 6a 53 71 56 41 4c 75 54 4f 75 50 70 44 4c 6e 5a 4e 7a 4c 43 35 6f 57 54 34 41 33 45 77 53 45 64 56 4f 63 73 52 75 34 4b 54 7a 72 62 71 31 37 4e 75 54 4b 48 66 6c 37 69 4c 4b 62 31 4a 32 38 34 6d 46 50 5a 4f 54 30 57 59 6b 68 53 70 6c 51 46 47 4c 6f 6f 2f 45 4a 77 70 41 48 57 4b 56 75 45 56 52 4f 66 4f 51 30 33 69 36 55 68 72 37 6d 4b 33 30 4a 63 38 34 41 7a 44 45 70 52 6b 47 55 54 34 35 79 32 57 49 70 32 6b 6e 52 71 56 44 61 54 71 42 74 41 6d 52 58 45 62 4b 42 55 72 4a 56 4d 53 30 66 69 34 68 76 59 6c 65 6f 5a 31 6e 4d 36 30 61 Data Ascii: p+y0vPQ8FgUMMJHQb1Q7FbyMd5KOBDN39IdidGpMVVlERQYTXalD3v4LAnQhXzrWWe1j7utg5wzatjSqVALuTOuPpDLnZNzLC5oWT4A3EwSEdVOcsRu4KTzrbq17NuTKHfl7iLKb1J284mFPZOT0WYkhSplQFGLoo/EJwpAHWKVuEVROfOQ03i6Uhr7mK30Jc84AzDEpRkGUT45y2WIp2knRqVDaTqBtAmRXEbKBUrJVMS0fi4hvYleoZ1nM60a
2024-10-02 10:16:46 UTC	6838	IN	Data Raw: 35 51 42 4c 53 76 43 4f 2f 54 53 62 54 49 37 53 74 2b 45 33 62 38 4b 68 66 4d 35 4c 51 48 70 4b 6d 6b 49 31 76 39 49 4d 69 41 5a 53 6b 62 61 53 71 49 42 46 34 30 44 4b 4c 55 46 73 49 47 78 74 4f 35 6e 67 51 65 31 70 68 36 32 72 6a 46 73 69 4b 4a 45 46 45 43 7a 39 37 59 64 39 69 6b 79 71 6d 49 30 71 43 37 37 35 37 4d 55 61 4d 55 43 36 33 59 6e 47 49 6f 2b 54 6a 57 63 36 5a 71 42 54 58 37 57 66 33 61 69 4d 6c 58 79 41 51 4a 71 53 41 6e 46 48 63 79 31 7a 37 6e 36 72 48 77 4e 78 67 75 4a 68 67 73 6f 63 5a 67 6f 73 56 61 61 74 63 32 79 30 31 48 2b 62 2f 47 66 78 53 47 33 42 45 4a 77 68 4e 4d 70 6c 2f 39 61 2f 6e 73 44 30 37 44 55 42 73 6a 36 2f 4e 6d 4a 7a 30 50 6d 2f 4d 77 70 5a 75 68 74 63 6b 39 51 6b 55 70 68 35 41 4b 4e 34 33 77 7a 4b 42 39 46 58 2b 36 56 Data Ascii: 5QBLSvCO/TSbTI7St+E3b8KhfM5LQHpKmkI1v9IMiAZSkbaSqIBF40DKLUFsIGxtO5ngQe1ph62rjFsiKJEFECz97Yd9ikyqmI0qC7757MUaMUC63YnGIo+TjWc6ZqBTX7Wf3aiMlXyAQJqSAnFHcy1z7n6rHwNxguJhgsocZgosVaatc2y01H+b/GfxSG3BEJwhNMpl/9a/nsD07DUBsj6/NmJz0Pm/MwpZuhtck9QkUph5AKN43wzKB9FX+6V
2024-10-02 10:16:46 UTC	16384	IN	Data Raw: 36 78 77 45 6b 52 6d 52 62 4b 79 76 71 4b 6f 6c 75 2f 6a 74 2f 6e 2f 72 6a 6d 49 30 77 67 52 68 6d 62 73 35 6a 52 69 64 4f 61 6e 61 37 33 37 7a 34 50 53 44 63 36 64 52 6e 41 51 39 42 73 50 6d 75 6e 55 5a 64 2f 6e 76 72 35 61 6d 50 4c 71 49 47 77 33 64 4d 6a 33 2b 50 76 70 53 37 62 31 50 31 6f 77 49 39 6d 42 67 4f 54 37 51 69 69 76 7a 66 79 35 2f 37 31 2f 6c 38 6e 50 76 4f 30 75 70 6c 51 61 5a 35 4d 51 38 77 46 4a 36 37 38 6c 36 30 4c 51 70 76 43 43 64 64 47 46 43 4f 77 39 69 69 65 4b 4e 50 73 76 54 67 46 67 6f 48 31 42 55 76 78 5a 6d 33 36 2b 31 71 67 2b 59 78 64 30 31 55 51 69 66 72 38 55 6d 47 43 61 6d 4b 73 46 51 30 56 66 4b 34 53 51 68 65 61 52 42 4b 73 4c 68 46 56 43 4f 74 56 2f 57 46 58 49 58 43 72 77 53 2b 68 6f 67 2f 4e 52 59 56 6b 66 4b 66 59 63 Data Ascii: 6xwEkRmRbKyvqKolu/jt/n/rjmI0wgRhmbs5jRidOana737z4PSDc6dRnAQ9BsPmunUZd/nvr5amPLqIGw3dMj3+PvpS7b1P1owI9mBgOT7Qiivzfy5/71/l8nPvO0uplQaZ5MQ8wFJ678l60LQpvCCddGFCOw9iieKNPsvTgFgoH1BUvxZm36+1qg+Yxd01UQifr8UmGCamKsFQ0VfK4SQheaRBKsLhFVCOtV/WFXIXCrwS+hog/NRYVkfKfYc
2024-10-02 10:16:46 UTC	8192	IN	Data Raw: 6d 2f 76 65 39 49 58 6d 4a 63 67 6e 6d 31 36 39 75 6d 66 65 50 2f 66 57 68 47 62 46 2b 79 7a 35 4f 75 74 66 48 68 33 35 32 42 5a 2b 65 72 71 2f 31 73 2f 7a 76 32 70 48 77 4b 54 4b 64 66 49 56 74 6a 63 35 2f 46 63 4b 37 6b 6c 55 45 4a 68 50 77 37 33 50 2f 58 76 35 75 39 6c 63 31 6d 66 4e 57 46 6c 57 50 49 79 57 68 75 58 44 44 45 36 68 70 72 39 76 7a 41 31 33 69 38 41 33 41 52 4c 49 51 49 74 42 52 35 2f 76 35 41 54 58 35 6f 78 4a 4a 46 75 6a 74 47 2b 6c 51 44 6b 4f 37 72 64 79 46 48 6f 65 6f 77 43 69 42 4e 61 36 32 69 6e 57 6e 73 74 6d 42 5a 50 33 38 50 59 4d 75 4f 2b 52 46 34 48 75 38 77 52 49 39 77 33 52 4b 52 59 61 67 78 6d 45 37 69 6e 30 71 64 4d 70 42 47 73 64 58 6e 63 73 6d 6d 38 54 2f 75 79 68 6e 7a 47 45 4a 30 31 63 51 4c 62 36 68 78 73 39 4c 52 53 Data Ascii: m/ve9IXmJcgnm169umfeP/fWhGbF+yz5OutfHh352BZ+erq/1s/zv2pHwKTKdfIVtjc5/FcK7klUEJhPw73P/Xv5u9lc1mfNWFlWPIyWhuXDDE6hpr9vzA13i8A3ARLIQItBR5/v5ATX5oxJJFujtG+lQDkO7rdyFHoeowCiBNa62inWnstmBZP38PYMuO+RF4Hu8wRI9w3RKRYagxmE7in0qdMpBGsdXncsmm8T/uyhnzGEJ01cQLb6hxs9LRS
2024-10-02 10:16:46 UTC	16384	IN	Data Raw: 45 56 6b 2f 42 49 31 51 36 6c 31 4a 4f 74 48 72 59 69 6f 49 66 43 32 30 36 64 73 50 71 38 57 58 59 6b 4c 38 61 45 4d 43 7a 45 6a 63 30 37 73 61 39 61 6f 4a 50 58 35 71 54 74 37 55 32 74 73 56 54 4f 59 78 6d 32 4a 65 47 72 56 49 6e 74 56 47 55 37 68 79 30 30 69 30 76 31 48 71 31 30 43 74 30 66 79 37 71 37 50 79 79 59 50 61 73 6d 77 55 33 4f 5a 49 53 55 79 56 36 7a 72 53 56 45 6f 4e 68 68 4b 5a 42 75 49 55 59 63 74 35 47 54 6a 37 4a 76 6c 43 42 41 4a 75 31 38 51 6c 45 49 57 61 49 6f 31 49 46 42 55 6a 48 65 49 30 56 41 70 43 57 5a 46 49 78 51 74 51 57 4d 61 59 33 61 45 78 4b 71 2f 49 38 54 63 43 55 31 49 33 6c 71 46 38 6b 79 4a 45 64 53 51 77 53 55 75 68 6b 39 6a 4a 48 47 37 34 2f 6e 31 4f 56 44 65 33 77 4e 6b 7a 43 77 65 42 65 4c 2b 4e 64 72 67 6d 5a 57 70 Data Ascii: EVk/BI1Q6l1JOtHrYioIfC206dsPq8WXYkL8aEMCzEjc07sa9aoJPX5qTt7U2tsVTOYxm2JeGrVIntVGU7hy00i0v1Hq10Ct0fy7q7PyyYPasmwU3OZISUyV6zrSVEoNhhKZBuIUYct5GTj7JvlCBAJu18QlEIWaIo1IFBUjHeI0VApCWZFIxQtQWMaY3aExKq/I8TcCU1I3lqF8kyJEdSQwSUuhk9jJHG74/n1OVDe3wNkzCweBeL+NdrgmZWp
2024-10-02 10:16:46 UTC	8192	IN	Data Raw: 42 5a 43 64 42 6d 72 6d 74 34 68 63 79 4c 37 38 77 71 4c 61 50 5a 49 72 53 67 63 48 43 68 35 4f 31 45 49 6c 64 7a 57 63 73 68 54 79 43 50 6e 30 76 58 64 4a 58 51 65 68 31 36 69 2f 72 66 62 5a 35 6b 36 69 6f 55 4a 67 72 38 38 74 48 4a 41 65 46 4c 73 43 79 4f 62 45 43 67 4c 67 49 5a 5a 35 77 33 7a 50 75 4f 79 4d 32 49 4a 66 45 41 75 5a 44 76 38 44 62 4c 41 4c 56 77 2f 56 73 65 69 55 38 49 37 45 68 76 44 67 30 65 4f 49 4d 4b 55 73 47 32 65 45 4c 45 70 41 58 71 4b 65 4a 77 6e 4c 59 2b 56 72 42 33 47 35 69 41 6d 42 6d 42 38 67 73 31 58 62 76 30 61 6a 37 46 67 4a 30 2b 4d 58 64 68 6a 51 63 71 68 51 59 69 46 55 63 79 70 70 6a 34 62 61 52 47 56 44 63 35 6b 59 33 42 64 45 38 57 6c 53 39 70 53 54 69 6f 59 33 75 73 52 31 6d 36 59 78 6b 50 63 58 4d 32 72 4b 64 67 43 Data Ascii: BZCdBmrmt4hcyL78wqLaPZIrSgcHCh5O1EIldzWcshTyCPn0vXdJXQeh16i/rfbZ5k6ioUJgr88tHJAeFLsCyObECgLgIZZ5w3zPuOyM2IJfEAuZDv8DbLALVw/VseiU8I7EhvDg0eOIMKUsG2eELEpAXqKeJwnLY+VrB3G5iAmBmB8gs1Xbv0aj7FgJ0+MXdhjQcqhQYiFUcyppj4baRGVDc5kY3BdE8WlS9pSTioY3usR1m6YxkPcXM2rKdgC
2024-10-02 10:16:46 UTC	16384	IN	Data Raw: 71 53 79 38 4d 4e 56 33 2f 46 53 51 6c 4b 37 66 37 35 2f 2f 2b 2f 6a 74 5a 4b 6b 50 47 4a 57 69 56 72 42 71 4b 51 6c 45 52 69 6e 75 5a 38 2f 33 76 76 74 6e 74 6c 64 68 6b 73 36 42 4c 35 71 35 4f 6c 6e 64 61 75 76 2f 39 71 35 7a 68 2b 67 37 34 39 2b 30 76 33 73 7a 65 37 72 2f 41 57 31 7a 45 4c 69 62 6f 59 36 46 49 59 41 6d 63 58 6a 67 64 65 37 2f 76 2f 44 32 61 67 66 57 32 72 70 53 41 70 55 68 34 4c 65 50 62 54 35 2b 35 38 6b 4d 6f 6c 41 45 41 79 39 77 55 51 4d 34 55 30 43 32 37 63 6e 43 6f 6c 71 52 53 57 31 34 39 45 34 36 63 51 6b 43 59 4c 36 57 6a 33 4e 77 5a 69 31 2b 74 6e 77 32 76 55 68 32 52 70 57 6f 54 63 45 33 4e 47 78 32 76 53 51 4b 69 77 71 45 68 4c 44 74 7a 39 55 31 73 67 31 31 6c 59 5a 63 6c 45 69 5a 6f 35 57 6f 67 79 52 6d 76 4e 61 6a 51 36 76 Data Ascii: qSy8MNV3/FSQlK7f75//+/jtZKkPGJWiVrBqKQlERinuZ8/3vvtntldhks6BL5q5Olndauv/9q5zh+g749+0v3sze7r/AW1zELiboY6FIYAmcXjgde7/v/D2agfW2rpSApUh4LePbT5+58kMolAEAy9wUQM4U0C27cnColqRSW149E46cQkCYL6Wj3NwZi1+tnw2vUh2RpWoTcE3NGx2vSQKiwqEhLDtz9U1sg11lYZclEiZo5WogyRmvNajQ6v

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
60	192.168.2.16	49819	13.107.246.40	443	4912	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-02 10:16:46 UTC	649	OUT	GET /shared/edgeweb/img/win11-explore.553240e.svg HTTP/1.1 Host: edgestatic.azureedge.net Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://www.microsoft.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-10-02 10:16:46 UTC	794	IN	HTTP/1.1 200 OK Date: Wed, 02 Oct 2024 10:16:46 GMT Content-Type: image/svg+xml Content-Length: 4254 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Access-Control-Allow-Origin: * Cache-Control: public, max-age=31536000, immutable ETag: W/"109e-19180c4d9d2" Last-Modified: Fri, 23 Aug 2024 19:44:30 GMT Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Origin-Agent-Cluster: ?1 X-Content-Type-Options: nosniff X-Download-Options: noopen X-Frame-Options: SAMEORIGIN X-Permitted-Cross-Domain-Policies: none X-XSS-Protection: 0 x-azure-ref: 20241002T101646Z-15767c5fc554wklc0x4mc5pq0w00000009ug000000000bqh x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-02 10:16:46 UTC	4254	IN	Data Raw: 3c 73 76 67 20 77 69 64 74 68 3d 22 32 35 30 22 20 68 65 69 67 68 74 3d 22 32 32 35 22 20 76 69 65 77 42 6f 78 3d 22 30 20 30 20 32 35 30 20 32 32 35 22 20 66 69 6c 6c 3d 22 6e 6f 6e 65 22 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 30 2f 73 76 67 22 3e 3c 67 20 63 6c 69 70 2d 70 61 74 68 3d 22 75 72 6c 28 23 61 29 22 3e 3c 70 61 74 68 20 64 3d 22 4d 30 20 31 32 2e 34 30 38 43 30 20 35 2e 35 35 35 20 35 2e 34 37 32 20 30 20 31 32 2e 32 32 32 20 30 48 37 33 2e 39 38 43 38 33 2e 32 20 30 20 39 31 2e 39 34 37 20 34 2e 31 35 33 20 39 37 2e 38 35 38 20 31 31 2e 33 33 38 6c 39 2e 32 37 39 20 31 31 2e 32 38 61 31 32 2e 31 35 32 20 31 32 2e 31 35 32 20 30 20 30 20 30 20 39 2e 33 38 31 20 34 2e 34 35 34 68 31 32 31 2e 32 Data Ascii: <svg width="250" height="225" viewBox="0 0 250 225" fill="none" xmlns="http://www.w3.org/2000/svg"><g clip-path="url(#a)"><path d="M0 12.408C0 5.555 5.472 0 12.222 0H73.98C83.2 0 91.947 4.153 97.858 11.338l9.279 11.28a12.152 12.152 0 0 0 9.381 4.454h121.2

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
61	192.168.2.16	49820	13.107.246.40	443	4912	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-02 10:16:46 UTC	647	OUT	GET /shared/edgeweb/img/win11-start.415d423.svg HTTP/1.1 Host: edgestatic.azureedge.net Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://www.microsoft.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-10-02 10:16:46 UTC	700	IN	HTTP/1.1 200 OK Date: Wed, 02 Oct 2024 10:16:46 GMT Content-Type: image/svg+xml Content-Length: 598 Connection: close Access-Control-Allow-Origin: * Cache-Control: public, max-age=31536000, immutable ETag: W/"256-19180c4d9c3" Last-Modified: Fri, 23 Aug 2024 19:44:30 GMT Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Origin-Agent-Cluster: ?1 X-Content-Type-Options: nosniff X-Download-Options: noopen X-Frame-Options: SAMEORIGIN X-Permitted-Cross-Domain-Policies: none X-XSS-Protection: 0 x-azure-ref: 20241002T101646Z-15767c5fc55xsgnlxyxy40f4m00000000980000000009feh x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-02 10:16:46 UTC	598	IN	Data Raw: 3c 73 76 67 20 77 69 64 74 68 3d 22 31 30 30 30 22 20 68 65 69 67 68 74 3d 22 31 30 30 30 22 20 76 69 65 77 42 6f 78 3d 22 30 20 30 20 31 30 30 30 20 31 30 30 30 22 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 30 2f 73 76 67 22 3e 3c 64 65 66 73 3e 3c 6c 69 6e 65 61 72 47 72 61 64 69 65 6e 74 20 78 31 3d 22 31 2e 35 32 37 25 22 20 79 31 3d 22 30 25 22 20 78 32 3d 22 31 30 30 25 22 20 79 32 3d 22 39 38 2e 37 39 34 25 22 20 69 64 3d 22 61 22 3e 3c 73 74 6f 70 20 73 74 6f 70 2d 63 6f 6c 6f 72 3d 22 23 30 30 44 33 46 46 22 20 6f 66 66 73 65 74 3d 22 30 25 22 2f 3e 3c 73 74 6f 70 20 73 74 6f 70 2d 63 6f 6c 6f 72 3d 22 23 30 30 43 32 46 38 22 20 6f 66 66 73 65 74 3d 22 32 30 2e 33 34 33 25 22 2f 3e 3c 73 74 6f 70 20 73 Data Ascii: <svg width="1000" height="1000" viewBox="0 0 1000 1000" xmlns="http://www.w3.org/2000/svg"><defs><linearGradient x1="1.527%" y1="0%" x2="100%" y2="98.794%" id="a"><stop stop-color="#00D3FF" offset="0%"/><stop stop-color="#00C2F8" offset="20.343%"/><stop s

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
62	192.168.2.16	49821	13.107.246.40	443	4912	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-02 10:16:46 UTC	635	OUT	GET /shared/edgeweb/img/fluent-check-bold.0ced02b.svg HTTP/1.1 Host: edgestatic.azureedge.net Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: / Origin: https://www.microsoft.com Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://www.microsoft.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-10-02 10:16:46 UTC	700	IN	HTTP/1.1 200 OK Date: Wed, 02 Oct 2024 10:16:46 GMT Content-Type: image/svg+xml Content-Length: 650 Connection: close Access-Control-Allow-Origin: * Cache-Control: public, max-age=31536000, immutable ETag: W/"28a-18c5c63b940" Last-Modified: Tue, 12 Dec 2023 04:58:08 GMT Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Origin-Agent-Cluster: ?1 X-Content-Type-Options: nosniff X-Download-Options: noopen X-Frame-Options: SAMEORIGIN X-Permitted-Cross-Domain-Policies: none X-XSS-Protection: 0 x-azure-ref: 20241002T101646Z-15767c5fc55jdxmppy6cmd24bn00000001p0000000004fnv x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-02 10:16:46 UTC	650	IN	Data Raw: 3c 73 76 67 20 77 69 64 74 68 3d 22 31 35 35 22 20 68 65 69 67 68 74 3d 22 31 34 36 22 20 76 69 65 77 42 6f 78 3d 22 30 20 30 20 31 35 35 20 31 34 36 22 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 30 2f 73 76 67 22 3e 3c 70 61 74 68 20 64 3d 22 4d 30 20 37 39 2e 34 35 63 30 2d 31 2e 34 33 33 2e 32 37 37 2d 32 2e 37 38 34 2e 38 33 2d 34 2e 30 35 34 61 31 30 2e 36 38 31 20 31 30 2e 36 38 31 20 30 20 30 20 31 20 32 2e 32 34 36 2d 33 2e 33 32 20 31 30 2e 36 38 31 20 31 30 2e 36 38 31 20 30 20 30 20 31 20 33 2e 33 32 2d 32 2e 32 34 36 63 31 2e 32 37 2d 2e 35 35 33 20 32 2e 36 32 2d 2e 38 33 20 34 2e 30 35 33 2d 2e 38 33 20 32 2e 38 20 30 20 35 2e 32 34 31 20 31 2e 30 34 32 20 37 2e 33 32 34 20 33 2e 31 32 35 6c 33 34 Data Ascii: <svg width="155" height="146" viewBox="0 0 155 146" xmlns="http://www.w3.org/2000/svg"><path d="M0 79.45c0-1.433.277-2.784.83-4.054a10.681 10.681 0 0 1 2.246-3.32 10.681 10.681 0 0 1 3.32-2.246c1.27-.553 2.62-.83 4.053-.83 2.8 0 5.241 1.042 7.324 3.125l34

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
63	192.168.2.16	49823	13.107.246.40	443	4912	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-02 10:16:46 UTC	716	OUT	GET /apppack/edgefre HTTP/1.1 Host: apps.microsoft.com Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: same-site Sec-Fetch-Mode: navigate Sec-Fetch-Dest: iframe Referer: https://www.microsoft.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-10-02 10:16:46 UTC	1087	IN	HTTP/1.1 302 Found Date: Wed, 02 Oct 2024 10:16:46 GMT Content-Length: 0 Connection: close Cache-Control: no-cache Location: /apppack/edgefre?hl=en-us&gl=US Strict-Transport-Security: max-age=2592000 Request-Context: appId=cid-v1:04e455f9-321c-49bf-8d2c-d79fbf5e8cde MS-CV: KxRGSSub1UCb5QX6.0 X-Content-Type-Options: nosniff Permissions-Policy: unload=() Content-Security-Policy: default-src 'self' data: https://.clarity.ms https://c.bing.com;script-src 'self' wcpstatic.microsoft.com js.monitor.azure.com www.microsoft.com www.clarity.ms get.microsoft.com xvsec.video.microsoft.com bat.bing.com 'unsafe-inline';style-src 'unsafe-inline';connect-src * data: ms-windows-store:;font-src ;img-src data: blob:;media-src 'self' blob: https://sfds-production.azurefd.net https://canvasstorageprodtorus.blob.core.windows.net;frame-src * ms-windows-store:;report-uri https://csp.microsoft.com/report/app-store-web-prod X-Powered-By: ASP.NET x-azure-ref: 20241002T101646Z-15767c5fc55fdfx81a30vtr1fw00000009tg000000002p26 x-fd-int-roxy-purgeid: 66820190 X-Cache: TCP_MISS

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
64	192.168.2.16	49824	13.107.246.40	443	4912	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-02 10:16:46 UTC	646	OUT	GET /shared/edgeweb/img/win11-edge.c5cce66.png HTTP/1.1 Host: edgestatic.azureedge.net Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://www.microsoft.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-10-02 10:16:46 UTC	699	IN	HTTP/1.1 200 OK Date: Wed, 02 Oct 2024 10:16:46 GMT Content-Type: image/png Content-Length: 11019 Connection: close Access-Control-Allow-Origin: * Cache-Control: public, max-age=31536000, immutable ETag: W/"2b0b-19180c4d9a3" Last-Modified: Fri, 23 Aug 2024 19:44:30 GMT Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Origin-Agent-Cluster: ?1 X-Content-Type-Options: nosniff X-Download-Options: noopen X-Frame-Options: SAMEORIGIN X-Permitted-Cross-Domain-Policies: none X-XSS-Protection: 0 x-azure-ref: 20241002T101646Z-15767c5fc55rg5b7sh1vuv8t7n00000009sg00000000404s x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-02 10:16:46 UTC	11019	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 01 09 00 00 01 09 08 03 00 00 00 b0 b6 22 56 00 00 03 00 50 4c 54 45 47 70 4c 25 9f 9f 2e bd d9 2f c3 cb 30 c1 e2 2b bf cd 2a c0 cd 2a be b7 2e c2 dd 2b c3 d3 2c c3 c5 2c c4 c8 30 c6 c3 2b c1 bc 2c c4 b8 25 b0 c7 21 96 a9 2b c3 ce 2b c3 d2 2b c3 d1 2c c3 cb 2c c4 c1 2d c4 be 2c c3 d5 2b c3 d3 2d c5 ba 33 c8 a8 2c c3 d7 2d c3 d8 2d c2 da 2d c5 b6 2e c2 dc 2f c5 b1 31 c1 e6 2e c2 dd 2e c4 ac 32 c1 e9 32 c1 e9 2f c2 df 0f 89 d4 30 c2 e1 32 c8 ac 2f c5 a6 36 ca a4 36 c9 96 30 c2 e3 36 ca a9 31 c2 e5 38 cb 9e 3f d0 93 3b cc 79 32 c1 e9 3a cd a3 3d ce 69 35 ca b3 3d cf 9d 32 c1 e6 32 c1 e8 34 c9 b6 39 cc 97 32 c6 91 3b cc 69 3f d0 97 33 c8 ba 32 c1 e9 37 cb af 33 c1 eb 42 d2 93 3e d0 8f 34 c1 ed 31 c7 be 3b Data Ascii: PNGIHDR"VPLTEGpL%./0+**.+,,0+,%!+++,,-,+-3,---./1..22/02/660618?;y2:=i5=22492;i?3273B>41;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
65	192.168.2.16	49825	13.107.246.40	443	4912	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-02 10:16:46 UTC	678	OUT	GET /shared/cms/lrs1c69a1j/section-images/94713cf7bc7c406d83691315feaf82dd.jpg HTTP/1.1 Host: edgestatic.azureedge.net Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://www.microsoft.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-10-02 10:16:46 UTC	702	IN	HTTP/1.1 200 OK Date: Wed, 02 Oct 2024 10:16:46 GMT Content-Type: image/jpeg Content-Length: 263113 Connection: close Access-Control-Allow-Origin: * Cache-Control: public, max-age=31536000, immutable ETag: W/"403c9-18c5b723eec" Last-Modified: Tue, 12 Dec 2023 00:34:23 GMT Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Origin-Agent-Cluster: ?1 X-Content-Type-Options: nosniff X-Download-Options: noopen X-Frame-Options: SAMEORIGIN X-Permitted-Cross-Domain-Policies: none X-XSS-Protection: 0 x-azure-ref: 20241002T101646Z-15767c5fc55v7j95gq2uzq37a000000009q0000000002g9e x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-02 10:16:46 UTC	15682	IN	Data Raw: ff d8 ff e1 00 18 45 78 69 66 00 00 49 49 2a 00 08 00 00 00 00 00 00 00 00 00 00 00 ff ec 00 11 44 75 63 6b 79 00 01 00 04 00 00 00 50 00 00 ff e1 03 4c 68 74 74 70 3a 2f 2f 6e 73 2e 61 64 6f 62 65 2e 63 6f 6d 2f 78 61 70 2f 31 2e 30 2f 00 3c 3f 78 70 61 63 6b 65 74 20 62 65 67 69 6e 3d 22 ef bb bf 22 20 69 64 3d 22 57 35 4d 30 4d 70 43 65 68 69 48 7a 72 65 53 7a 4e 54 63 7a 6b 63 39 64 22 3f 3e 20 3c 78 3a 78 6d 70 6d 65 74 61 20 78 6d 6c 6e 73 3a 78 3d 22 61 64 6f 62 65 3a 6e 73 3a 6d 65 74 61 2f 22 20 78 3a 78 6d 70 74 6b 3d 22 41 64 6f 62 65 20 58 4d 50 20 43 6f 72 65 20 39 2e 31 2d 63 30 30 31 20 37 39 2e 61 38 64 34 37 35 33 34 39 2c 20 32 30 32 33 2f 30 33 2f 32 33 2d 31 33 3a 30 35 3a 34 35 20 20 20 20 20 20 20 20 22 3e 20 3c 72 64 66 3a 52 44 46 Data Ascii: ExifII*DuckyPLhttp://ns.adobe.com/xap/1.0/<?xpacket begin="" id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 9.1-c001 79.a8d475349, 2023/03/23-13:05:45 "> <rdf:RDF
2024-10-02 10:16:46 UTC	16384	IN	Data Raw: d4 05 91 59 8a 0c c7 62 0c c7 62 02 db 50 a1 64 56 64 46 64 01 90 a6 64 28 59 0a 02 32 40 5b 7a 28 32 25 33 21 4c db d1 69 99 10 18 a0 cc 50 66 28 33 20 08 8c 83 31 28 a2 c7 04 40 65 4a 06 1b 10 a6 e1 1b 14 2a 01 82 14 06 25 12 60 a6 2c 8c d3 32 00 db 10 06 44 64 01 82 0c 80 37 42 00 c8 30 dc 80 34 76 20 06 20 e0 11 0a 62 81 48 40 86 2a a5 03 6e 42 8a 63 83 06 44 98 2b 1d 88 80 83 22 03 04 01 90 a6 e1 de 88 5e 1d c8 51 0c 76 2a 94 1c 27 62 14 06 38 a2 03 6f 40 9c 21 02 98 3e 4e 81 4c 1b 26 44 98 21 8f e8 56 d2 91 31 28 cd 07 0d 36 04 28 a7 1a e6 81 65 d5 44 49 2e 4d de 88 43 46 0d 45 50 87 7a 13 05 a6 07 1d a8 cc c1 48 dc ab 24 21 10 08 ec 42 88 df a1 54 2a a1 48 15 38 a0 00 22 01 0e 81 48 64 12 90 dc aa 07 08 3d 2a 94 9f 0e 68 94 99 89 73 80 1b 55 b6 68 Data Ascii: YbbPdVdFdd(Y2@[z(2%3!LiPf(3 1(@eJ%`,2Dd7B04v bH@nBcD+"^Qv'b8o@!>NL&D!V1(6(eDI.MCFEPzH$!BTH8"Hd=*hsUh
2024-10-02 10:16:46 UTC	16384	IN	Data Raw: c5 91 4c 06 2e a2 c4 18 74 d5 14 ca 83 45 14 c0 2a 2a 23 90 ae f4 45 38 40 a9 45 32 03 d4 a0 2c 33 45 37 52 20 b3 e4 8a 61 1d a8 09 6c b1 50 88 2e f4 68 c0 3e 28 87 88 a6 0a 94 76 1b 51 75 16 03 7a 2c 40 91 4c 3b 94 95 81 03 33 45 14 40 6a a0 64 41 62 50 a3 05 01 45 16 54 1e 12 8b 46 11 50 30 8a 0d c3 db 9a a0 f0 85 06 11 1b 10 31 8e e4 1b 87 a1 06 e1 dd d4 8a 0c 88 cc a8 cc a0 2d b5 14 78 50 0e 13 b5 06 e1 3b 50 16 db da 8a 3c 23 14 56 60 85 33 0d a8 53 30 42 99 87 d8 85 37 08 41 b8 42 1c 03 84 1c 11 1b 87 68 40 38 7a 11 04 44 0c 90 6e 1f b1 06 6d 88 07 0b 20 04 6e 7e a4 19 b7 76 85 46 6d c8 33 28 33 6d 08 85 20 0e b4 01 95 00 83 f6 22 15 86 c4 19 82 00 46 c5 00 6d a8 03 0d 88 8c c1 00 6a 2a 07 09 fb 10 21 8f 51 64 b4 98 29 8e f5 6d 28 a8 8d 8f 5b 22 b5 Data Ascii: L.tE*#E8@E2,3E7R alP.h>(vQuz,@L;3E@jdAbPETFP01-xP;P<#V`3S0B7ABh@8zDnm n~vFm3(3m "Fmj!Qd)m(["
2024-10-02 10:16:46 UTC	16384	IN	Data Raw: 20 e0 0d 95 41 41 10 30 ed 45 a5 00 6c ba 51 a3 46 24 32 8b 4a 81 bb a9 14 d9 a0 20 1e c4 20 e0 20 71 14 55 04 7b 54 58 85 00 dd 8e 28 a7 08 a2 ca 29 c0 40 f1 c9 c5 09 51 61 40 37 0a bf 7a 2d 1c 28 a2 07 72 06 6c f3 40 e0 3e 48 a6 65 4a 30 0f 96 68 44 1b 85 91 a8 85 04 7d 0e a2 d1 84 4b 75 e6 a8 a1 8f 62 81 80 46 8f 10 e8 2c 07 d6 aa 28 22 ca 35 47 01 4b 6a 8e ca ad 19 b6 a9 6b 42 8b 47 eb 40 c1 b3 ed 45 6c 30 a2 2b 00 f8 be f5 45 40 1b 30 51 4e 06 ca a2 d1 a3 93 ed c1 05 80 ee c1 14 ec 81 99 14 d1 15 45 74 04 53 70 ef 40 40 40 fc 2a 2d 0a 0c 83 20 c8 ac 88 60 11 45 24 65 85 65 7c 01 0a 02 83 51 50 58 33 ac c4 dc 8c c1 49 ca a4 1c 16 27 8a 81 39 a8 14 ca 88 14 9c c1 eb 41 03 23 29 c6 dc 47 14 a6 5a 31 18 92 f4 65 68 7f 21 ff 00 ad cf ea 2b 9f f9 7b e7 0f Data Ascii: AA0ElQF$2J qU{TX()@Qa@7z-(rl@>HeJ0hD}KubF,("5GKjkBG@El0+E@0QNEtSp@@@*- `E$ee\|QPX3I'9A#)GZ1eh!+{
2024-10-02 10:16:46 UTC	16384	IN	Data Raw: d4 0e f5 ae dc 11 44 10 ff 00 4d c8 87 04 1c 7e d4 29 8e 20 8e 95 59 30 7c 77 f6 aa 1c c8 0a 10 a0 23 06 40 db 51 4c 03 20 39 ed 54 57 20 83 22 b3 ac d8 c3 a1 2c 30 c0 24 ca 8a 83 20 c1 03 20 19 a0 3b 50 30 f5 ac 67 e2 32 c2 9d 02 9a 3e 48 04 24 21 76 dc e5 1e 38 c2 43 8a d9 c2 51 18 c4 ee 22 88 3f cf b7 f5 09 f2 87 cf 7a 2f 99 3f 33 34 57 6d f3 2e 53 f2 9f e5 e7 3b e6 50 f2 27 3e e7 7c be ee 87 95 dd bf cc e4 75 83 95 72 2b 76 61 31 74 dd b8 25 18 78 6d 6a 31 81 bb 70 db 72 fd 2e e5 f9 4f 77 ec 73 c6 72 b9 fc 91 e1 f7 cf 83 e2 1f 2e 3e 5d 5b f9 8d f3 0f 94 79 4a 1a b9 5a e4 5a 7b 97 f5 fe 67 e6 d1 b5 2b f3 b5 cb b4 31 37 af 42 cd 9b 52 1e 2d eb d0 89 84 2c c2 7c 53 32 f6 5c 85 2e 5e 5f db fd bc 75 7a 9c 7c 23 8f c5 fa 7b e6 2f c9 cf 97 10 f2 77 93 2d f9 Data Ascii: DM~) Y0\|w#@QL 9TW ",0$ ;P0g2>H$!v8CQ"?z/?34Wm.S;P'>\|ur+va1t%xmj1pr.Owsr.>][yJZZ{g+17BR-,\|S2\.^_uz\|#{/w-
2024-10-02 10:16:46 UTC	16384	IN	Data Raw: ff 00 db fd df fd 7f c1 19 72 6f 39 65 e6 83 20 70 26 dc 7e a5 3b dd 1f d0 4f b0 f7 b1 ff 00 e3 7e 05 1c a3 ce 81 8f fc cd 99 c6 dc 55 ef 74 7f 4a 7d 0f be ff 00 ad f8 01 e5 1e 76 60 47 99 c0 62 df b2 1f 52 77 ba 3f a0 9f 65 ef bf eb 7e 09 cb 94 f9 e0 87 1e 66 88 2e df b2 1f 52 77 ba 3f a5 3e 87 df 7f d6 fc 00 f2 9f 3b 54 ff 00 cc c0 31 6a 5b 1f 52 77 ba 3f a0 fa 1f 7d ff 00 5b f0 2c b9 4f 9d cb 9f f9 9e 20 c7 13 e1 05 7b fd 1f d3 f8 a7 d0 7b ef fa df 80 7f 2a f3 c3 11 ff 00 33 46 98 7e 58 aa 9d fe 8f e8 fc 4f a0 f7 bf f5 bf 06 1c ab ce ff 00 fd cf 0a 0e 2f d9 05 7b fd 1f d0 9f 43 ef bf eb 7e 08 5d e4 fe 7c 91 68 79 a6 30 06 bf b2 1e b0 9d fe 8f e8 49 fd bf df 7f d6 8f 92 23 94 79 fb 2f 36 c0 13 50 7c 10 c3 a7 d9 4e ff 00 43 f4 27 d0 7e e1 1f fe 3c 7c 93 Data Ascii: ro9e p&~;O~UtJ}v`GbRw?e~f.Rw?>;T1j[Rw?}[,O {{*3F~XO/{C~]\|hy0I#y/6P\|NC'~<\|
2024-10-02 10:16:46 UTC	16384	IN	Data Raw: e4 5d 04 c9 6c 29 93 22 11 dd 06 c1 02 bd 0a 05 27 b4 a2 15 ce 26 ad 8a 85 87 13 e2 81 49 ec 49 2c 10 62 96 50 12 10 23 a5 a5 14 9d a9 69 44 2a 00 e7 b3 34 42 13 f6 a0 49 4b 1d bb d0 44 b0 28 84 3d a8 01 3e d0 df 8a 05 76 27 63 b2 21 4c 9c 56 a8 14 92 e8 01 28 59 49 08 85 25 d0 21 34 76 c5 10 84 b4 50 4c ca ad b5 11 32 7a f2 3d 2a a0 13 93 a0 99 3f 6a a1 71 41 32 6a c8 96 42 40 38 aa 85 27 27 44 48 94 24 84 a2 10 9c 36 a0 9c 88 2d bf 6a 25 a6 aa 58 12 81 09 28 84 27 b9 09 21 26 9b d1 9b 21 1b f0 45 b4 f7 8a 04 49 29 55 2d 33 9a 16 99 14 27 07 aa 12 5a e3 83 a2 4c a5 b7 d2 ab 24 3e 85 44 dd 02 3e dc 50 2a 25 92 81 ea e5 11 37 6c fa 91 2d 22 4e 6e db 10 b4 c9 e2 25 c3 03 82 25 d9 1c b8 1b 4a 25 bd 6a 64 f1 cf 12 e5 76 78 26 78 88 91 a6 d5 28 b3 89 77 aa 59 Data Ascii: ]l)"'&II,bP#iD4BIKD(=>v'c!LV(YI%!4vPL2z=?jqA2jB@8''DH$6-j%X('!&!EI)U-3'ZL$>D>P*%7l-"Nn%%J%jdvx&x(wY
2024-10-02 10:16:46 UTC	16384	IN	Data Raw: cd f3 59 97 48 4c cc 35 31 52 d6 a4 bc 6f 95 76 a9 6b 45 c5 45 60 03 39 28 08 6e 8a 20 a4 44 78 65 29 10 e0 f0 c6 de 65 c1 a8 e8 54 f2 b2 db 9c a1 2e 28 12 25 1a b8 59 9e 3c 17 8c 71 87 4d ab da cb 36 ae 4b 4f 72 fd ab 26 5c 17 6e 40 ca 31 e2 90 3e cc a4 28 09 00 d0 9a 85 26 31 9e 13 56 d4 4f 53 18 be 34 a6 97 45 cc 79 8c e5 1d 1e 8b 51 ae b9 06 8c 85 a8 19 b1 3f 74 7d 41 32 ea 63 87 8f 03 0e 96 7d 5f 08 99 79 38 79 57 cd 17 65 c3 0f 2d 73 69 cb 82 53 e1 b7 a4 b9 22 63 08 f1 48 86 15 60 1d 73 fa be 97 ea 87 68 f6 1d 7f 2c 50 d7 f2 3e 6b c9 cc 2d f3 8e 5f a9 e5 1a 89 c7 c4 b5 a6 d6 c0 d9 b8 63 c3 19 71 70 4b da 0e 27 12 1c 55 d6 fa 7d 7c 33 ff 00 19 b7 3e b7 b5 ea 74 bf ce 2a dd 7f c9 f9 44 67 08 ea 3c dd cb b4 fe 25 9f 14 cb c3 bf 38 c4 b8 f6 38 a3 12 0c Data Ascii: YHL51RovkEE`9(n Dxe)eT.(%Y<qM6KOr&\n@1>(&1VOS4EyQ?t}A2c}_y8yWe-siS"cH`sh,P>k-_cqpK'U}\|3>t*Dg<%88
2024-10-02 10:16:46 UTC	16384	IN	Data Raw: 5b 86 81 7b ba 38 fe 47 9f a9 3c 6d fa c2 c6 93 4f 1b 30 b7 08 dc b4 20 41 8b 31 e1 e1 d8 67 23 4d 8b ad 33 1e 0e a9 58 26 32 91 d4 5f 9b c8 18 db 9c 2c 48 0e da a3 5c 08 74 c2 25 c4 e2 73 00 da b4 94 0f 05 d6 35 b6 db 04 62 3d 05 46 c0 d9 b9 b0 9a fb 40 46 32 f4 c9 03 9b 56 e4 1a 56 43 67 c5 6a 05 fd 29 4a 4f 84 d0 fe 2d 25 82 77 e9 ed 9f 52 46 2b 32 9c b9 77 2d 91 61 cb b4 a4 e6 7c 08 0f 40 53 48 e4 bb 2d 1d 25 98 44 46 16 84 62 28 23 17 03 b0 26 90 9b 48 fc 2d af 70 f5 4c ab ac 17 27 8e 96 d0 23 d8 3d 1c 45 4d 61 5d 11 b3 18 e0 3a 95 a5 5c 40 0c 50 38 0a 87 03 7a 02 80 3a 25 8b 84 2d 8c 95 64 10 66 eb 40 2a a0 de d5 18 b2 a5 37 b6 3f 12 59 38 95 a7 94 d5 b2 81 a7 ef 57 78 52 ca 02 27 87 13 83 d8 96 50 31 18 8e b5 6d 28 0f 11 fc 21 ba 55 62 43 da 3b 06 Data Ascii: [{8G<mO0 A1g#M3X&2_,H\t%s5b=F@F2VVCgj)JO-%wRF+2w-a\|@SH-%DFb(#&H-pL'#=EMa]:\@P8z:%-df@*7?Y8WxR'P1m(!UbC;
2024-10-02 10:16:46 UTC	16384	IN	Data Raw: 29 52 de d1 cc e2 51 1f bc 83 74 a9 52 6d 8f 33 71 c3 f8 91 ed 56 a4 8c e3 99 b8 c0 fd e4 7b 42 54 b5 b4 73 30 b8 33 b9 1e d0 a6 b2 6d 1c cf c7 13 fb c1 da 14 d6 57 68 e6 71 70 7f 16 3d a1 5d 7d 0d a3 99 c4 a0 df b6 04 74 a9 4b b4 73 38 31 c7 8c 37 f6 92 8d bd 4a 4d b2 5f c4 8f f8 d5 88 98 f2 49 98 e6 d2 16 ce 33 03 a0 fd a9 72 70 e6 e5 b9 c1 28 ca 22 e9 2e 31 07 04 89 9e 49 94 44 c5 5b c1 dc b1 74 19 1f 8b 94 c1 a4 63 20 ec 7a 41 0b ac 67 1c 9e 2c ba 13 e5 95 bc 25 fd 2c e4 40 32 0e 4e 20 4f b7 ef 15 a8 ea 44 3c f9 fb 69 97 29 d1 6b 61 22 21 74 98 fb c2 64 6f cc 24 f5 b1 66 3d 9f 56 f8 4f e2 f0 da cd 1f 30 1f b7 e2 98 b6 ef 01 74 60 77 2d 63 d5 c6 3c 1c 3a be d7 ad fe eb 78 ef 81 bb 21 53 28 89 fe b8 3e b5 7b ae 51 ed 32 9e 7f 30 1a 11 17 ac a4 5f 1f 64 Data Ascii: )RQtRm3qV{BTs03mWhqp=]}tKs817JM_I3rp(".1ID[tc zAg,%,@2N OD<i)ka"!tdo$f=VO0t`w-c<:x!S(>{Q20_d

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
66	192.168.2.16	49826	13.107.246.40	443	4912	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-02 10:16:46 UTC	651	OUT	GET /shared/edgeweb/img/pinning-browser.b02edf1.svg HTTP/1.1 Host: edgestatic.azureedge.net Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://www.microsoft.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-10-02 10:16:46 UTC	793	IN	HTTP/1.1 200 OK Date: Wed, 02 Oct 2024 10:16:46 GMT Content-Type: image/svg+xml Content-Length: 1379 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Access-Control-Allow-Origin: * Cache-Control: public, max-age=31536000, immutable ETag: W/"563-19180c4539f" Last-Modified: Fri, 23 Aug 2024 19:43:55 GMT Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Origin-Agent-Cluster: ?1 X-Content-Type-Options: nosniff X-Download-Options: noopen X-Frame-Options: SAMEORIGIN X-Permitted-Cross-Domain-Policies: none X-XSS-Protection: 0 x-azure-ref: 20241002T101646Z-15767c5fc554w2fgapsyvy8ua000000008t000000000cugs x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-02 10:16:46 UTC	1379	IN	Data Raw: 3c 73 76 67 20 77 69 64 74 68 3d 22 31 37 39 32 22 20 68 65 69 67 68 74 3d 22 36 30 30 22 20 76 69 65 77 42 6f 78 3d 22 30 20 30 20 31 37 39 32 20 36 30 30 22 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 30 2f 73 76 67 22 20 78 6d 6c 6e 73 3a 78 6c 69 6e 6b 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 31 39 39 39 2f 78 6c 69 6e 6b 22 3e 3c 64 65 66 73 3e 3c 66 69 6c 74 65 72 20 78 3d 22 2d 31 2e 36 25 22 20 79 3d 22 2d 33 25 22 20 77 69 64 74 68 3d 22 31 30 33 2e 31 25 22 20 68 65 69 67 68 74 3d 22 31 30 39 2e 34 25 22 20 66 69 6c 74 65 72 55 6e 69 74 73 3d 22 6f 62 6a 65 63 74 42 6f 75 6e 64 69 6e 67 42 6f 78 22 20 69 64 3d 22 61 22 3e 3c 66 65 4f 66 66 73 65 74 20 64 79 3d 22 31 30 22 20 69 6e 3d Data Ascii: <svg width="1792" height="600" viewBox="0 0 1792 600" xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink"><defs><filter x="-1.6%" y="-3%" width="103.1%" height="109.4%" filterUnits="objectBoundingBox" id="a"><feOffset dy="10" in=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
67	192.168.2.16	49827	13.107.246.40	443	4912	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-02 10:16:46 UTC	649	OUT	GET /shared/edgeweb/img/pinning-arrow.e9317cd.svg HTTP/1.1 Host: edgestatic.azureedge.net Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://www.microsoft.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-10-02 10:16:46 UTC	700	IN	HTTP/1.1 200 OK Date: Wed, 02 Oct 2024 10:16:46 GMT Content-Type: image/svg+xml Content-Length: 457 Connection: close Access-Control-Allow-Origin: * Cache-Control: public, max-age=31536000, immutable ETag: W/"1c9-19180c453fd" Last-Modified: Fri, 23 Aug 2024 19:43:55 GMT Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Origin-Agent-Cluster: ?1 X-Content-Type-Options: nosniff X-Download-Options: noopen X-Frame-Options: SAMEORIGIN X-Permitted-Cross-Domain-Policies: none X-XSS-Protection: 0 x-azure-ref: 20241002T101646Z-15767c5fc55gs96cphvgp5f5vc00000009b00000000040zb x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-02 10:16:46 UTC	457	IN	Data Raw: 3c 73 76 67 20 77 69 64 74 68 3d 22 32 33 22 20 68 65 69 67 68 74 3d 22 34 30 22 20 76 69 65 77 42 6f 78 3d 22 30 20 30 20 32 33 20 34 30 22 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 30 2f 73 76 67 22 3e 3c 64 65 66 73 3e 3c 6c 69 6e 65 61 72 47 72 61 64 69 65 6e 74 20 78 31 3d 22 35 30 25 22 20 79 31 3d 22 30 25 22 20 78 32 3d 22 35 30 25 22 20 79 32 3d 22 31 30 30 25 22 20 69 64 3d 22 61 22 3e 3c 73 74 6f 70 20 73 74 6f 70 2d 63 6f 6c 6f 72 3d 22 23 33 30 43 32 45 32 22 20 6f 66 66 73 65 74 3d 22 30 25 22 2f 3e 3c 73 74 6f 70 20 73 74 6f 70 2d 63 6f 6c 6f 72 3d 22 23 30 37 37 46 44 38 22 20 6f 66 66 73 65 74 3d 22 35 33 2e 32 33 32 25 22 2f 3e 3c 73 74 6f 70 20 73 74 6f 70 2d 63 6f 6c 6f 72 3d 22 23 30 46 35 Data Ascii: <svg width="23" height="40" viewBox="0 0 23 40" xmlns="http://www.w3.org/2000/svg"><defs><linearGradient x1="50%" y1="0%" x2="50%" y2="100%" id="a"><stop stop-color="#30C2E2" offset="0%"/><stop stop-color="#077FD8" offset="53.232%"/><stop stop-color="#0F5

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
68	192.168.2.16	49828	13.107.246.40	443	4912	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-02 10:16:46 UTC	679	OUT	GET /shared/cms/lrs1c69a1j/section-images/89ff15806b9e4b09b2fb21673a1c7094.webp HTTP/1.1 Host: edgestatic.azureedge.net Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://www.microsoft.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-10-02 10:16:46 UTC	702	IN	HTTP/1.1 200 OK Date: Wed, 02 Oct 2024 10:16:46 GMT Content-Type: image/webp Content-Length: 225666 Connection: close Access-Control-Allow-Origin: * Cache-Control: public, max-age=31536000, immutable ETag: W/"37182-18c5b623236" Last-Modified: Tue, 12 Dec 2023 00:16:51 GMT Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Origin-Agent-Cluster: ?1 X-Content-Type-Options: nosniff X-Download-Options: noopen X-Frame-Options: SAMEORIGIN X-Permitted-Cross-Domain-Policies: none X-XSS-Protection: 0 x-azure-ref: 20241002T101646Z-15767c5fc55dtdv4d4saq7t47n000000096g0000000058e6 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-02 10:16:46 UTC	15682	IN	Data Raw: 52 49 46 46 7a 71 03 00 57 45 42 50 56 50 38 58 0a 00 00 00 10 00 00 00 83 03 00 f2 04 00 41 4c 50 48 a5 7a 01 00 01 19 88 91 24 c7 6d 6a 87 77 b7 10 00 e6 1f f0 07 b0 ec 00 22 fa 3f 01 fa 3f 89 2f 00 fe 8a 26 c5 42 1c 52 55 49 87 a4 79 2e 59 76 55 ce 4b 6b 2b 60 d9 9c 20 89 be d4 5a 0f 9b 3b 56 5a f3 55 d7 39 96 24 77 0d dd a2 58 53 37 77 52 c4 9a f8 e8 78 12 6c e0 0b 8e 6f 78 d5 bf a9 88 85 06 f1 a4 2a b7 77 82 e0 29 aa aa af cc 17 44 55 d9 ef 18 77 01 50 55 af 46 c0 1d 01 50 55 ed 85 34 1e 44 44 00 7a cf 8b c6 75 db fd c2 78 33 37 00 02 89 c7 15 89 9b df 9e 21 01 e2 71 45 08 f4 01 17 6d 21 a5 39 61 93 7d 7a 02 f2 dc 92 99 a4 ed fc 6d 71 7a da a7 7f 5b 7a 3a d3 ce dc 63 fb 4c db 3e 8e 1d 69 8f 4c 3b df 71 1c b6 6d 1b 48 b1 65 ef 3f f4 df b5 39 e0 07 88 Data Ascii: RIFFzqWEBPVP8XALPHz$mjw"??/&BRUIy.YvUKk+` Z;VZU9$wXS7wRxlox*w)DUwPUFPU4DDzux37!qEm!9a}zmqz[z:cL>iL;qmHe?9
2024-10-02 10:16:47 UTC	16384	IN	Data Raw: 4a 90 5e a7 f0 50 ea 79 9c 0c 75 e2 49 7e f3 7e 95 fd ae 4c cc 0b c8 ee 00 90 a1 00 08 85 0a 2a a0 17 a0 da 1d b5 d4 ad 5b dd 64 f2 07 3f 73 c1 6f 7c 70 b6 d3 2d 8e 4f db e9 79 e4 79 29 a5 f4 63 af e8 8b 68 00 c0 3d 01 80 90 46 48 23 cf 9a 99 c2 36 dd 8c ce ed 8f ee 75 7b 0f ca fe 2f 7c 73 b5 1e 42 3a 5f 37 18 42 5d ef e5 b1 76 50 08 d4 d9 83 b7 47 33 dd c0 05 21 0d 9c c2 f3 36 c9 53 35 eb bc 05 b3 8f 9e 41 ba 7d 41 a6 65 92 70 18 5d 81 cc c7 0b da 30 d9 3d 9b fd a6 b7 7f e1 ec 70 a8 ca 4f bf bf 33 9c 8c 27 c3 fa 62 81 e2 a1 9b 0e 9e 56 99 23 e9 f6 31 7c 79 00 10 46 08 a4 0e 19 f7 fa 1b d7 75 ec c9 52 7f 9e b4 f3 cf f2 4e cf 7e 6d b2 5e 83 f9 f9 6a 9c e7 4d 90 cd c6 82 25 4c a0 16 64 43 81 80 53 78 9a 65 0a 4d 9f 86 7d 7b 01 39 28 43 77 94 5d 15 81 52 00 Data Ascii: J^PyuI~~L*[d?so\|p-Oyy)ch=FH#6u{/\|sB:_7B]vPG3!6S5A}Aep]0=pO3'bV#1\|yFuRN~m^jM%LdCSxeM}{9(Cw]R
2024-10-02 10:16:47 UTC	16384	IN	Data Raw: c1 9a 66 23 a3 39 fe f4 c7 68 c7 21 04 7f b6 5b ea a3 a0 92 ae 67 db cd 63 1c 2e b2 1e e2 bc ea 2c cf 6e c4 ba 74 6e 95 ce 74 44 73 f0 98 56 da 12 1b ff d3 9f 16 63 ff d0 ba 6b 70 2a 15 68 ff e1 f9 5b d6 99 48 9f 35 65 75 4e 6a 53 a3 42 31 27 13 b4 83 c0 37 f5 2b 3f eb e9 a7 af 02 44 21 7d eb 0b c9 91 80 c4 4d 0f fd 48 26 50 b1 45 19 b6 af ba 19 cd 4a 10 ff 7e 27 79 1c 64 cd b9 da b1 f0 71 40 69 9a b3 6d ab 97 43 6d 8b 92 46 4a 56 c4 d9 cd d2 c0 4f c7 6d 39 ac 52 d5 b6 24 31 b4 5f 8b 1f 6f bd d3 9a b5 b7 f3 8e 16 86 4a 5b 67 d3 d6 8b 87 b4 f7 d9 08 f8 cb 89 82 8a 97 21 9e 26 b0 e4 a1 a0 8e 56 af fc 12 6f 21 5d 79 10 0d 2f fe 81 e7 93 33 d2 c2 cf 3d 7a 5d 52 69 07 6d 2e c6 85 6b 8e ce 50 72 fa c1 37 2b 4f 00 4a 3f bb a6 33 ff 28 d0 ca ce c9 b5 f5 d6 45 99 Data Ascii: f#9h![gc.,ntntDsVckp*h[H5euNjSB1'7+?D!}MH&PEJ~'ydq@imCmFJVOm9R$1_oJ[g!&Vo!]y/3=z]Rim.kPr7+OJ?3(E
2024-10-02 10:16:47 UTC	16384	IN	Data Raw: f7 26 44 f7 51 6a 53 2a 38 c2 dd 80 98 56 b2 8d c2 a0 71 e6 b6 79 1b e1 b7 68 69 00 f9 e0 bf 3e 8c 05 8b 1c 83 5f c2 e4 cc ce 42 47 18 b1 79 32 5d 57 6d c5 ce 4a 17 0b e8 57 d5 99 7c 7c 4c 7e fa 68 2f 5f d0 a1 49 46 78 9c 47 aa 5b 4f 72 1a fc 2e 65 1a 9f 4c 3a 8a d1 cb aa 6e fe ae a4 2a 4e 48 74 68 33 90 0b e0 64 47 71 e5 32 ce a9 fc 36 05 6b 80 22 52 10 ae ff e9 5b 26 14 4a 13 b8 49 56 b1 ac 00 eb e9 e1 81 4f 2c 54 cf e9 af 1f aa 8a 04 b0 d5 a9 77 06 6b 1a a1 48 6d d3 8d 71 6d ae 9d 50 98 9f 01 d5 9a 04 83 fb f1 34 04 bc 1b dc 43 15 7b 92 e8 65 30 1a 77 f7 56 57 00 06 43 c8 eb 5b 60 4b d1 8a 61 9b 3d 86 12 79 fe e6 dc 27 83 83 0a 07 42 e4 4e c8 0e 33 23 23 28 a7 0e d7 d6 85 47 57 4f ac 96 85 3b 10 98 31 e4 04 1e 37 b1 48 40 29 4a ec 49 1b 10 d3 3e 72 6e Data Ascii: &DQjS8Vqyhi>_BGy2]WmJW\|\|L~h/_IFxG[Or.eL:nNHth3dGq26k"R[&JIVO,TwkHmqmP4C{e0wVWC[`Ka=y'BN3##(GWO;17H@)JI>rn
2024-10-02 10:16:47 UTC	16384	IN	Data Raw: 44 ab 40 46 b4 15 a4 00 b6 a5 70 1b a7 34 96 f0 af 23 76 78 a2 95 ab 17 6e 10 a4 a5 da 2c 84 65 50 e0 48 70 30 01 38 13 f2 90 2e 1e 39 df 2c 9c dd 44 ee 17 4b b9 24 7c 62 79 19 31 be e4 da e7 56 eb d3 bd 95 2c 21 db f0 d8 55 29 a8 ca 24 0a 39 a0 17 6b 93 3c 94 7e 1a 26 86 db 8b 71 60 e1 e9 9f 30 73 a7 48 99 78 72 f5 68 3d b9 58 a5 e9 a2 dd ee 97 f7 bd 74 b0 bd 53 25 97 64 37 2d 9d dd dd 9e 2d cf 2e 5e 89 f2 a1 e6 ad 9d 19 73 69 b0 66 2b 0f 78 fc e8 f5 e8 88 53 bd 55 47 49 80 91 41 16 40 53 a9 4d 12 c8 29 06 3d bc f2 3c 1c e9 57 7f 02 8e 27 8c 5b 3e 7f a5 72 c1 84 ac c0 16 a0 08 ca d0 3b 05 6c 25 b4 10 20 20 e7 aa 1c dc 04 ad 56 3a f7 64 4a b8 e9 a7 25 46 ad 96 aa 48 eb f5 c2 fb 0e df 66 1c 00 0a 4d 3c ba 7d ff 95 57 4a 97 b7 b1 a9 0d eb e3 eb d1 6d 34 c5 Data Ascii: D@Fp4#vxn,ePHp08.9,DK$\|by1V,!U)$9k<~&q`0sHxrh=XtS%d7--.^sif+xSUGIA@SM)=<W'[>r;l% V:dJ%FHfM<}WJm4
2024-10-02 10:16:47 UTC	16384	IN	Data Raw: 11 e9 b1 f1 42 75 1b 53 d4 2e c1 df 04 88 38 54 18 6d 6f 5e b5 40 3b 9a b7 ca a9 a0 f9 8a 10 b1 5c 87 b4 63 ea 86 94 45 5f 93 cb 2f 10 73 00 bd f1 a2 05 33 88 91 36 a5 56 2b 11 a1 35 4d 2b c7 c3 45 62 c0 a6 89 24 ae f8 ac 90 d5 66 37 4b 96 38 bd 61 ab bd 15 fa 20 7a a6 7e 69 53 e7 3f d9 bd e7 58 ba df 2b d6 9d 6e 3a 1d 18 f6 b3 90 4c 26 99 df 1b 4a 73 3b f9 3e 48 44 eb d5 54 7d 60 a0 eb bd 91 fa b7 2f 5c 6c ad 70 68 cf cf ca f3 e2 2f 13 79 2f e8 36 6c 1a a3 5d 50 54 89 6a 80 b4 91 85 ed 42 11 c7 f0 2c e4 09 db 74 55 66 6d 61 11 5c fe 60 5a 35 9e d5 62 80 70 5e 36 8c 37 a6 89 18 df 67 c5 2a 0f 2c 46 25 31 52 e9 21 64 98 34 5b b1 32 0d 5a 65 ee d4 9e 6a 1c a5 ea c0 50 4b de 42 d4 9b 34 bd f6 b3 bf 66 87 a3 fd b3 4b 32 3b 6d 06 61 75 63 67 d0 fb 66 86 e0 8d Data Ascii: BuS.8Tmo^@;\cE_/s36V+5M+Eb$f7K8a z~iS?X+n:L&Js;>HDT}`/\lph/y/6l]PTjB,tUfma\`Z5bp^67g*,F%1R!d4[2ZejPKB4fK2;maucgf
2024-10-02 10:16:47 UTC	16384	IN	Data Raw: 90 80 92 b7 0d 5c 4f c9 03 21 01 25 6e 1a b8 9f 92 06 42 02 4a dc 35 71 3f 24 0c 84 04 95 b8 6a e2 7e 48 19 08 09 2b 70 d5 c4 fc 90 32 10 12 56 e1 ab 89 f9 20 64 20 24 ad c3 57 13 f2 40 c8 40 49 5b 86 ae 27 e4 81 90 80 92 b7 0d 5c 4f c9 03 21 01 25 6e 1a b6 be fa b1 24 ef 42 84 56 35 4f c0 ab 6a 7c a7 ec 14 1d 53 0e 27 e4 81 90 80 92 b7 0d 5c 4f c9 03 21 01 25 6e 1a b8 9f 92 06 42 02 22 fc 83 ba a8 c9 1a 2e b6 36 6d b4 82 78 2a 3f 6d 6b 0e bb e0 d6 16 49 d5 41 10 80 92 b7 0d 5c 4f c9 03 21 01 25 6e 1a b8 9f 92 06 42 02 4a dc 35 71 3b bc 8a ac d0 84 1d ce e8 6b 55 94 fd e7 2b 15 a7 ea 30 d5 94 61 ad e8 7a 18 22 d0 d8 2a f5 3b ba db 0e 47 fe 3a 09 a1 03 21 01 25 6e 1a b8 9f 92 06 42 02 4a dc 35 71 3f 24 0c 84 04 95 b8 62 84 f8 b6 47 21 80 ea d9 0f 53 e6 ae Data Ascii: \O!%nBJ5q?$j~H+p2V d $W@@I['\O!%n$BV5Oj\|S'\O!%nB".6mx?mkIA\O!%nBJ5q;kU+0az";G:!%nBJ5q?$bG!S
2024-10-02 10:16:47 UTC	16384	IN	Data Raw: 90 84 19 7e e6 8f 32 a9 a1 49 44 b0 c8 83 4c be cb 59 bd e3 68 f8 40 72 20 48 d3 bc 8e 41 21 92 9d 63 5c a5 db 81 c2 49 ca 65 b0 1e 4e dc 3a aa aa e3 90 72 c2 47 e5 0f b0 ea d4 dd 0f f9 df 48 c6 60 7d ac ff 39 f1 f7 37 a4 f5 6c 9b f9 90 ba a2 ee be b9 c6 e6 72 70 1f 71 bd ab 7f f8 af 8d f5 92 e9 d5 d7 6a be 74 03 f7 2d 61 90 3e a6 d1 89 cf 00 fc ab 2e e7 8b ed d0 95 28 8d 03 09 30 df e9 2f 7a 16 47 3f f1 0d de a4 80 66 64 84 42 7d f5 5d f2 34 b4 a4 be 8b b6 7a 48 3b 81 c7 e6 bb ff 08 d5 bc c3 bf a9 0e a2 3b b0 fe 5c 8a 9f 6c 5f 61 50 1a 87 8c b0 04 d6 45 58 05 1f 8f f8 e5 22 18 06 bf 97 38 51 ee f0 f1 7b fe e5 a6 97 84 95 39 56 a7 3f 42 24 1c 70 d8 3a 13 31 65 b3 7a b8 a1 11 a6 c5 a8 38 09 b3 6e 25 e8 b2 28 1f 2b c3 c6 64 7f 6c 0b 47 77 e9 c2 98 f6 d5 8f Data Ascii: ~2IDLYh@r HA!c\IeN:rGH`}97lrpqjt-a>.(0/zG?fdB}]4zH;;\l_aPEX"8Q{9V?B$p:1ez8n%(+dlGw
2024-10-02 10:16:47 UTC	16384	IN	Data Raw: 29 80 59 f9 86 f8 30 67 d3 98 82 83 6b 68 cc 4d bf 8c 67 60 3d da 33 79 ed b9 e5 8c 85 ad 37 b1 96 18 89 3a bb 64 13 52 58 02 ee ee ae f6 d4 be 2d 27 9d f3 8c 14 d4 51 80 30 bd 8b 1d 0e 0b ad fc 07 79 b4 4c 1c 04 0f 84 69 e5 e9 49 f6 e6 ca 51 ff e2 6a c2 ca d5 3e a1 90 aa 35 ad 2d 37 55 8e 3a a9 08 94 08 1c 12 24 0d cf 08 a8 6a de ee bb 9c 24 ba e3 9e 56 1b b3 39 49 ad f9 0b 2a 7a 0d e3 d6 a9 2f f8 cb 41 48 5c d4 54 04 af 0a d5 94 e0 60 cf c6 f3 92 26 4a 7f db 4a e9 ca 88 9c b6 c8 2e 96 46 3d ae 16 0a 67 a4 e1 f8 c8 5c 35 67 7e e2 cf 34 02 01 06 35 24 0c 65 6c 96 e1 97 38 b0 3f 9e 0b 1a f0 10 58 b2 71 b7 72 57 2e 2b c8 3e 4f 55 f7 ab 17 21 32 78 1b a3 45 c2 0c fb 93 f9 04 91 88 ad de 3a 28 24 53 ac 04 3f 99 dd a1 23 da 47 c5 cc 91 aa c8 0c 6d ca 65 00 19 Data Ascii: )Y0gkhMg`=3y7:dRX-'Q0yLiIQj>5-7U:$j$V9I*z/AH\T`&JJ.F=g\5g~45$el8?XqrW.+>OU!2xE:($S?#Gme
2024-10-02 10:16:47 UTC	16384	IN	Data Raw: fb e5 84 5a a5 8e 29 50 79 75 91 44 77 22 f6 c8 41 9a 19 95 bf 44 a7 03 89 2c 36 6c 39 4b 70 5e 45 f8 87 6f 31 3b 41 84 f1 48 53 6d 66 de 02 26 12 73 4e 5f 31 cf 29 07 5c a8 1d df 2c 3e 70 97 7b 49 85 d3 33 b5 86 a8 77 31 c3 d9 3b 49 1a 54 c4 1c 15 24 69 fb 0a 22 13 d5 4f 9b 0f 35 42 35 cd d0 7f fe 23 38 7f 8e 07 d1 56 06 a3 85 40 c9 ff d8 d4 48 2e c0 6b 89 7e 64 04 f5 2d c9 29 34 c5 ee db be 0c f8 ec 5e aa 2c 06 3c 8f a1 57 74 10 93 95 bc 84 28 ba 67 59 f1 c3 06 c3 c7 86 8f 02 d1 37 00 20 b5 4f 3c f1 f4 9a ca e4 f7 16 66 9d aa 76 32 35 21 56 30 8d 68 0c fa c6 6c 71 ca b3 ce c8 73 f0 0e f4 ac 70 78 4c bb 41 9d 80 14 4b d5 c5 c0 74 cf 04 9d 4b a4 d2 c6 57 66 6c a7 46 58 ad 3d 27 b6 6d 12 37 75 aa 9e 6a 10 59 8e 03 c4 b5 d3 85 72 f3 5b de 10 8e 89 7e 80 77 Data Ascii: Z)PyuDw"AD,6l9Kp^Eo1;AHSmf&sN_1)\,>p{I3w1;IT$i"O5B5#8V@H.k~d-)4^,<Wt(gY7 O<fv25!V0hlqspxLAKtKWflFX='m7ujYr[~w

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
69	192.168.2.16	49829	77.75.76.70	443	3540	C:\Users\user\AppData\Roaming\Seznam.cz\sznsetup.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-02 10:16:46 UTC	121	OUT	GET /update/cz.seznam.software.libfoxcub64-3.3.8-win32.zip HTTP/1.1 Host: download.seznam.cz Connection: Keep-Alive
2024-10-02 10:16:47 UTC	273	IN	HTTP/1.1 200 OK server: envoy date: Wed, 02 Oct 2024 10:16:47 GMT content-type: application/zip content-length: 1055819 last-modified: Fri, 27 Sep 2024 10:06:26 GMT etag: "66f683a2-101c4b" accept-ranges: bytes x-envoy-upstream-service-time: 0 connection: close
2024-10-02 10:16:47 UTC	16111	IN	Data Raw: 50 4b 03 04 14 00 02 00 08 00 ae 70 54 4c 3f 53 8d fe f1 00 00 00 73 01 00 00 0b 00 00 00 63 6f 6e 74 72 6f 6c 2e 69 6e 69 75 50 31 4e 03 31 10 ec 2d f9 0f 2e 43 11 0b 72 51 a0 f1 0f 10 4d ca 88 62 7d b7 77 b1 ee e2 b5 ec bd 0b 39 f1 05 1e 80 a8 28 79 07 c9 bf 30 84 24 55 aa 1d ed cc 6a 66 67 15 a0 6c a1 c1 67 29 3c 6c d0 94 a3 4e 38 66 a8 13 d5 bc 85 88 ba 73 b6 a6 97 b2 b7 8b b9 14 03 c6 e4 c8 9b 42 17 fa 41 0a e7 13 43 d7 99 ff a9 2d b0 14 bd 3f ad cf e8 48 84 0e b8 a6 b8 31 5b e7 8b 99 14 15 06 f4 55 32 69 f4 d3 93 dd d4 42 c2 0b 75 35 4f 47 50 61 54 93 42 cf f4 fd 8d 14 1c 5d d3 e4 70 57 2e b2 45 85 a9 65 0a 52 40 08 4f bf bf 2e ff 64 ea d1 1d 3e d9 ed df 5a 50 8b b9 75 fc ba a4 de 52 dc a9 40 7c 78 47 eb bf bf 54 88 a4 ec fe 63 7d 11 ef d4 70 94 d3 Data Ascii: PKpTL?Sscontrol.iniuP1N1-.CrQMb}w9(y0$Ujfglg)<lN8fsBAC-?H1[U2iBu5OGPaTB]pW.EeR@O.d>ZPuR@\|xGTc}p
2024-10-02 10:16:47 UTC	16384	IN	Data Raw: dd 4b 6f e3 b9 88 77 9b 84 3e c1 aa ed 40 21 79 db 03 cb b6 0a e8 db 2a 8c f6 50 b3 98 1e 15 c9 ab 4a e0 07 76 ef aa 0a 51 e9 a7 ef a6 0f 6f c0 50 78 d6 cb f4 27 62 e2 db 61 27 7b 77 76 46 5f 4e f6 36 c2 c1 49 91 aa 6e ba 45 77 b2 d7 1f 91 5d c6 54 ab 08 3c 28 46 34 0f 4b 23 c1 18 4c db cc ec 6c a3 93 85 ed 0f fb ff 8d 0b 3b e3 c5 a5 fe 48 f8 f5 78 b2 ff b2 ff df 65 7a 93 99 7d 37 89 56 0a bd 39 01 46 f1 93 71 fd 01 17 9a dc f7 26 98 dc f7 e2 98 43 10 69 d0 39 9b 9e f9 43 7b f3 0f fc e6 cc 7f 4f 03 67 f1 2f 46 92 02 ab be 87 a0 8b e5 97 45 0a 8f 1a 4a 8c 27 f8 27 96 5a 13 b8 ae f4 ef 07 90 79 ee ba 3b 18 a1 0e 23 db 7d da c3 67 d8 ab fe b7 eb 78 c2 76 a0 94 15 92 ef 71 e9 08 3d da 69 38 aa 7f d1 f9 f7 2e fe c0 1a e1 d5 ef 2d ee c1 ab 13 51 36 eb d7 54 9b Data Ascii: Kow>@!y*PJvQoPx'ba'{wvF_N6InEw]T<(F4K#Ll;Hxez}7V9Fq&Ci9C{Og/FEJ''Zy;#}gxvq=i8.-Q6T
2024-10-02 10:16:47 UTC	16384	IN	Data Raw: 59 f1 e7 cd c9 b3 83 27 66 53 d0 b6 71 c8 b1 76 61 1b bf f5 14 56 90 8d 48 1f 06 c7 4d 2c ec c3 d2 1f 12 0c bd 1b a2 10 52 b8 51 bf bc 15 61 0d ce 29 78 44 51 2d ab c4 63 8b f8 51 15 e2 8d 2a 99 57 10 5f c4 16 c9 a4 c0 55 f2 f8 27 96 38 05 af a3 15 b4 aa a2 89 8d b7 da f3 08 53 15 2d 05 b5 c2 87 05 1b 08 dc 29 fb 12 85 47 27 38 5e 63 96 ec 4b 1d 36 5c 67 36 5c 27 8e a9 86 eb cc 86 eb d2 f4 25 6a 56 89 8a 73 54 95 a8 59 25 3a 44 de 2d c1 bb 3a c3 7a e6 a2 eb 43 8e d1 6b a3 9d a8 7c 91 5a 4e b8 57 76 95 a9 eb 09 af 06 72 54 21 b3 0b f9 43 ba 10 ae 11 c3 bb 86 51 88 33 3e 1e 9e fa 9b 4f 89 12 03 ce 33 31 30 80 f3 48 e6 47 60 77 55 b4 28 31 85 88 d1 7c 38 88 44 88 ac 74 81 53 e1 33 a7 2a 87 ce 1c 20 6b 05 7c ac 29 d0 f8 99 96 a8 8c c6 b2 e1 ff 2a de 11 69 ed Data Ascii: Y'fSqvaVHM,RQa)xDQ-cQW_U'8S-)G'8^cK6\g6\'%jVsTY%:D-:zCk\|ZNWvrT!CQ3>O310HG`wU(1\|8DtS3 k\|)*i
2024-10-02 10:16:47 UTC	16384	IN	Data Raw: cc 07 0e 5d db 83 7e 88 af fc 5d 87 15 26 4f 8b 06 13 09 31 fa b7 bc c4 44 93 b2 ac b0 ff b1 b1 84 3c 34 c7 3e 98 87 5b b1 fe 8d 9b 04 e4 e0 54 3c 79 88 a5 6a e6 ae af d0 3f 72 f6 69 6d 08 7e cc 4a a5 dd 8d d6 1e 87 8a 0d e3 7c 6b f9 d8 61 fc e3 24 23 17 32 69 d1 b3 da 14 88 e6 ac 36 79 ac 06 85 b9 77 be e1 cd 10 f5 98 f7 7a 42 1b 7e 65 ef ba 7d 8f 3e 6f 31 3e 3d a2 fb 1e f4 b5 c5 5d 2c 67 41 a3 ac e9 45 cc 86 5e 4f 2c 07 38 b4 3b 4c 20 e0 13 1a 35 87 3e a1 af 6e e0 9f 50 a9 0e e5 9f 15 19 86 f1 ac ac b3 6c 04 ff 84 10 37 4a e3 9b 25 19 f1 b2 d0 3f fc 18 9a db 95 53 24 35 d5 fa f3 4c 44 e2 04 14 3f d3 24 d8 af 85 9e 64 09 e6 e0 6f b3 69 9b 6a 91 6e 26 f1 81 27 d1 c0 c9 23 e2 44 c3 e1 f4 70 2b c7 04 dd a4 ab 93 a5 59 62 d4 ca fa c1 16 ba c3 c4 4d b5 8e 4b Data Ascii: ]~]&O1D<4>[T<yj?rim~J\|ka$#2i6ywzB~e}>o1>=],gAE^O,8;L 5>nPl7J%?S$5LD?$doijn&'#Dp+YbMK
2024-10-02 10:16:47 UTC	16384	IN	Data Raw: 5d a8 c9 ee 7d 1f 97 b7 1a 31 ef 09 a8 a0 f9 0c 8a 69 40 88 53 0e 19 79 77 2d e9 51 96 74 18 b0 06 2b e8 49 18 fe e0 3a 3b 0c e1 c1 76 9f 6c 98 84 27 f4 80 66 c9 78 8c 66 7a 99 05 cf 30 c0 20 17 e9 60 4e 58 4d 1f cf ad c3 cc b1 10 25 ff 7b 68 0d ce 22 42 ea 58 9d c9 71 c7 f6 31 e2 86 aa 24 aa cd 17 15 ca 38 47 14 e0 8f 91 08 19 c1 06 46 81 0c e8 74 c9 7d 79 b2 76 c9 b5 bf d0 b5 25 57 7f 8b 76 c9 4d 7b e1 92 4b ee f6 18 8a bb a9 54 e8 21 51 6b 92 cd fb ab cc 1c c8 56 ca e2 66 d2 42 5b 21 65 71 e4 6e 1b ae b9 b6 cc 0a 55 7c 50 de 4a a2 55 55 88 1c eb 20 af 96 81 ed 8c df e5 4b 79 74 70 5a 98 48 44 c2 6d 88 4b 72 24 91 28 a2 34 14 81 3a 4b 26 45 14 89 12 c6 46 13 89 ee 1e c9 22 d1 2f 75 24 12 39 46 46 12 87 ce c5 68 9b 84 5e 4a 2d 45 e7 fc 7e 14 4b 7c fa 4f Data Ascii: ]}1i@Syw-Qt+I:;vl'fxfz0 `NXM%{h"BXq1$8GFt}yv%WvM{KT!QkVfB[!eqnU\|PJUU KytpZHDmKr$(4:K&EF"/u$9FFh^J-E~K\|O
2024-10-02 10:16:47 UTC	16384	IN	Data Raw: 9e 25 d4 aa 09 fb 31 ad a9 fa ca 4c 58 9f 68 b7 44 92 e6 b4 4c 75 ce 70 82 1e 26 0c 45 aa 01 34 7b 53 32 71 5e ac 6b 14 9e 51 34 de cd d3 de b4 88 6d cf 6b c9 bd 6d 7b e2 e3 1f 49 ec 64 a3 9e 9b 42 81 6a ad c1 6b a8 45 58 19 43 a5 d5 ec a1 f3 e9 2d 09 d0 a6 19 99 be d0 56 94 ca d4 0d 43 f8 ec f6 16 f1 86 7e d0 27 34 65 b1 f5 7b a5 c8 54 3f 7b 9c fa 85 1e cc 75 20 b2 cd 2c e8 5a cb f7 4d 27 a9 6f d0 ca f5 7d f7 ea 53 ad ef 80 21 3a 69 63 90 b6 62 c6 e7 f7 b3 a3 c6 e7 a5 9d 34 3e 4b 3a 63 c7 e7 e0 b4 d8 f1 39 2c 29 de f8 7c e2 59 d3 f8 9c 73 9c 60 85 9b cf d0 c7 e7 55 05 fa f8 44 7d 60 31 45 f0 5c 41 8d 70 d7 47 ab 04 4d b2 b2 0f 4f 7d d9 d1 13 84 e5 75 ea 8a 9f ec ac e4 ac c9 e6 73 72 9b 9f f5 64 6e 8f 56 5c 49 4b 2b 02 02 c2 02 e0 22 e1 d6 c4 f6 b6 d0 2e Data Ascii: %1LXhDLup&E4{S2q^kQ4mkm{IdBjkEXC-VC~'4e{T?{u ,ZM'o}S!:icb4>K:c9,)\|Ys`UD}`1E\ApGMO}usrdnV\IK+".
2024-10-02 10:16:47 UTC	16384	IN	Data Raw: 7d 05 89 86 14 dc 39 87 e2 f9 e6 6d 55 6e 08 16 29 93 80 5d a4 3f e7 07 69 de f9 e1 5f c8 77 3e 38 c2 94 67 bd 95 10 42 30 9f e6 dc 80 19 c2 21 e4 cd a6 2c 1e 65 fa 3c af e2 c1 72 6e a6 72 96 9c a8 1c 37 94 33 9b cb 59 d6 ab 9c b9 a2 9c 33 a8 1c ff c9 ca 19 cd e5 ac e8 55 ce 1c 51 ce b6 a9 58 4e f2 c9 ca f9 f4 45 2a 87 8d b0 36 ac ea 55 dc 83 a2 b8 f9 54 dc ea 17 4f 52 dc 12 2a 2e d5 fc 18 8d fb 44 21 97 53 21 95 27 2b 64 1a d7 69 5d 74 65 d6 2f 8e 14 f4 f5 14 2c e8 fc 93 15 94 c2 05 35 90 88 f4 3a 3b 77 bd be 8f 75 06 bf cf c3 51 11 22 03 aa f0 53 ed 74 d9 c0 40 cc 32 1b 7b 21 6c 0d 7a e6 2b d6 9f 5f ae 7b e5 bb 48 e7 fe 9b c5 b4 88 c8 e4 82 f8 20 dd 84 5f 2f 23 fd c4 eb ec dc f8 3a 9a f1 35 87 d0 8d 11 65 9d 2d a1 25 09 bc 97 87 79 b9 ec 0a 0b 99 cf 8d Data Ascii: }9mUn)]?i_w>8gB0!,e<rnr73Y3UQXNE6UTOR.D!S!'+di]te/,5:;wuQ"St@2{!lz+_{H _/#:5e-%y
2024-10-02 10:16:47 UTC	16384	IN	Data Raw: 3a 84 42 8a 51 63 f0 b8 29 11 01 0b 54 02 54 2d 85 92 c2 d7 f3 75 71 d4 f7 04 ab 4c ee 7d 4d 99 94 73 ab 68 52 02 a8 76 b1 6d 8c 74 02 f3 57 52 ed e5 12 da 2e ad 2a 44 9b 3f 4d 3a f4 39 3d 33 04 89 0e cf a8 a6 e9 32 75 86 79 99 41 f0 62 71 c2 b9 66 2a 1a bd 1b a1 a9 6e 95 45 c7 35 bc 47 ea e7 3d 82 17 4e c1 fc 12 a5 e9 1d 58 ba 79 65 b9 75 95 d1 b5 8f f7 dd 57 18 f5 55 83 e1 78 15 7b 16 a4 d4 72 b4 06 50 5e 14 13 5b 29 ab 87 90 fd dd dc 93 66 94 dd 9e e4 c3 77 54 97 37 7c ee ba d6 5e 8c 11 86 cf b5 10 95 73 a0 09 b7 a5 a5 73 bd 4a 76 29 1c e8 5c 4b 2b 67 55 b5 9e 6b 10 49 cb 77 87 fa 3a ff 36 09 af 4b c5 39 84 73 bd 73 1c 9e c6 9e a5 65 94 31 0f d6 f1 6f d1 43 41 3a ac a5 00 f7 22 59 8e a2 36 4a a9 8c c7 da ed e1 d9 b8 bc e1 86 07 b3 e1 86 7f 81 01 47 e2 Data Ascii: :BQc)TT-uqL}MshRvmtWR.D?M:9=32uyAbqfnE5G=NXyeuWUx{rP^[)fwT7\|^ssJv)\K+gUkIw:6K9sse1oCA:"Y6JG
2024-10-02 10:16:47 UTC	16384	IN	Data Raw: 5b 60 f6 c9 30 bd 8f e8 41 73 6f 6c b2 23 58 24 19 ac c1 31 a7 f7 21 da f6 70 ff 99 cc 37 f6 83 cd cf c0 8a 87 e7 b0 44 b6 b8 26 d7 a2 14 6a d8 5e 77 b7 d6 2a 73 ba ec b8 66 69 81 48 90 27 1b 75 d2 ba 46 67 a1 78 63 6d a8 6c 7e b0 b2 36 74 bf e7 f0 82 e0 e5 c4 29 67 cc 65 f5 da e0 d7 84 09 50 d5 61 62 f1 ef 91 11 e5 a7 a5 4e 7e a6 dc fb dc a2 ed 6c 12 03 4f a0 72 ad a0 0e e5 75 b2 7c b2 4b dc 72 32 02 89 fc 1f a9 1a 95 c4 7d 85 bc b5 49 0a 41 d2 a8 57 cf 2a eb 48 bd c6 e1 c3 57 58 50 71 02 c4 ac d9 67 4b f3 b5 1c e6 81 09 1a 63 b0 d4 09 0e 45 ed c7 55 10 77 ab 85 1f cc 87 02 70 6a be f9 f0 95 70 94 79 9d 97 2b fc 7a 83 f8 58 8a a0 ff 46 e5 f5 58 d9 52 58 f9 6f 38 3f 91 bf 59 e4 31 63 3b c4 2c 62 c9 a0 85 2c c7 65 81 5a 46 52 d7 dc 5b 44 ee b6 ec 12 ac 3e Data Ascii: [`0Asol#X$1!p7D&j^wsfiH'uFgxcml~6t)gePabN~lOru\|Kr2}IAWHWXPqgKcEUwpjpy+zXFXRXo8?Y1c;,b,eZFR[D>
2024-10-02 10:16:47 UTC	16384	IN	Data Raw: 23 27 b2 fc fa 06 cb af bd 34 24 73 85 45 ca af 3d b7 c5 84 37 c4 f1 c9 53 7d 5f c7 62 ff 2f e4 a9 de 21 df 57 9e aa ea 3f be f1 18 5f 8d 18 1f 47 00 9f 19 27 b4 55 3c ba c2 63 8e 0e 23 33 6b f3 c4 32 a5 be 7d fc f2 5c d7 de ef 80 cf ff 85 3c d7 79 1c f2 9c a6 6f d7 dc ad 73 ce 05 32 d6 20 b7 4b 51 27 ec ed 1d 93 f5 cc 1c 5f d8 3a 59 af c8 b1 fb c2 1e 3b e1 a6 43 25 dc fc c8 a7 b7 b4 8b a3 54 f8 f2 f8 6c 78 07 f9 32 42 3d 8e 80 e3 0a 3d 73 18 c9 74 57 e8 15 c3 ec ac b8 68 da 21 de 49 5d 0f de 15 6c e7 dc 06 1c 93 7e 16 fa 6e 98 f6 23 d9 b1 6a 0c 29 55 91 d7 f3 c3 4c 44 d8 b4 4d b6 9b d3 40 71 c6 bd 5c 93 d8 0f 92 0b 61 f9 ca b8 a3 a0 17 de 1d ac e7 4f 71 11 62 a1 40 cf 5a ea 89 b3 8b 96 78 2c 75 84 d6 8c fb 74 3c d9 df a7 c3 95 ea d3 f1 00 3d 9d 6c 8c 2f Data Ascii: #'4$sE=7S}_b/!W?_G'U<c#3k2}\<yos2 KQ'_:Y;C%Tlx2B==stWh!I]l~n#j)ULDM@q\aOqb@Zx,ut<=l/

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
70	192.168.2.16	49830	13.107.246.40	443	4912	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-02 10:16:47 UTC	748	OUT	GET /apppack/edgefre?hl=en-us&gl=US HTTP/1.1 Host: apps.microsoft.com Connection: keep-alive Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: same-site Sec-Fetch-Mode: navigate Sec-Fetch-Dest: iframe sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Referer: https://www.microsoft.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8 Cookie: MSCC=NR
2024-10-02 10:16:47 UTC	1123	IN	HTTP/1.1 200 OK Date: Wed, 02 Oct 2024 10:16:47 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Cache-Control: public, max-age=43200 Strict-Transport-Security: max-age=2592000 Request-Context: appId=cid-v1:04e455f9-321c-49bf-8d2c-d79fbf5e8cde MS-CV: qnbRLVJgtU66BaYi.0 X-Content-Type-Options: nosniff Permissions-Policy: unload=() Content-Security-Policy: default-src 'self' data: https://.clarity.ms https://c.bing.com;script-src 'self' wcpstatic.microsoft.com js.monitor.azure.com www.microsoft.com www.clarity.ms get.microsoft.com xvsec.video.microsoft.com bat.bing.com 'unsafe-inline';style-src 'unsafe-inline';connect-src * data: ms-windows-store:;font-src ;img-src data: blob:;media-src 'self' blob: https://sfds-production.azurefd.net https://canvasstorageprodtorus.blob.core.windows.net;frame-src * ms-windows-store:;report-uri https://csp.microsoft.com/report/app-store-web-prod X-Powered-By: ASP.NET x-azure-ref: 20241002T101647Z-15767c5fc55jdxmppy6cmd24bn00000001rg0000000004m9 x-fd-int-roxy-purgeid: 66820190 X-Cache: TCP_HIT X-Cache-Info: L1_T2
2024-10-02 10:16:47 UTC	15261	IN	Data Raw: 31 62 34 37 0d 0a 0d 0a 0d 0a 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0d 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 2d 75 73 22 20 64 69 72 3d 22 6c 74 72 22 3e 0d 0a 0d 0a 3c 68 65 61 64 3e 0d 0a 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 20 2f 3e 0d 0a 20 20 20 20 3c 74 69 74 6c 65 3e 4d 69 63 72 6f 73 6f 66 74 20 41 70 70 73 3c 2f 74 69 74 6c 65 3e 0d 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 74 68 65 6d 65 2d 63 6f 6c 6f 72 22 20 6d 65 64 69 61 3d 22 28 70 72 65 66 65 72 73 Data Ascii: 1b47<!DOCTYPE html><html lang="en-us" dir="ltr"><head> <meta charset="utf-8" /> <title>Microsoft Apps</title> <meta name="viewport" content="width=device-width, initial-scale=1" /> <meta name="theme-color" media="(prefers
2024-10-02 10:16:47 UTC	16384	IN	Data Raw: 3a 20 6e 75 6c 6c 2c 0d 0a 20 20 20 20 20 20 20 20 22 73 75 62 63 61 74 65 67 6f 72 79 49 64 22 3a 20 6e 75 6c 6c 2c 0d 0a 20 20 20 20 20 20 20 20 22 6e 61 76 49 74 65 6d 49 64 22 3a 20 6e 75 6c 6c 2c 0d 0a 20 20 20 20 20 20 20 20 22 6e 61 76 49 64 22 3a 20 6e 75 6c 6c 2c 0d 0a 20 20 20 20 20 20 20 20 22 61 64 64 4f 6e 50 72 69 63 65 52 61 6e 67 65 22 3a 20 6e 75 6c 6c 2c 0d 0a 20 20 20 20 20 20 20 20 22 72 65 63 75 72 72 65 6e 63 65 50 6f 6c 69 63 79 22 3a 20 6e 75 6c 6c 2c 0d 0a 20 20 20 20 20 20 20 20 22 64 65 76 69 63 65 46 61 6d 69 6c 79 44 69 73 61 6c 6c 6f 77 65 64 52 65 61 73 6f 6e 22 3a 20 6e 75 6c 6c 2c 0d 0a 20 20 20 20 20 20 20 20 22 62 75 69 6c 74 46 6f 72 22 3a 20 6e 75 6c 6c 2c 0d 0a 20 20 20 20 20 20 20 20 22 72 65 76 69 73 69 6f 6e 49 64 Data Ascii: : null, "subcategoryId": null, "navItemId": null, "navId": null, "addOnPriceRange": null, "recurrencePolicy": null, "deviceFamilyDisallowedReason": null, "builtFor": null, "revisionId
2024-10-02 10:16:47 UTC	16384	IN	Data Raw: 20 20 20 20 22 63 6f 6c 6c 65 63 74 69 6f 6e 49 74 65 6d 54 79 70 65 22 3a 20 22 50 72 6f 64 75 63 74 22 2c 0d 0a 20 20 20 20 20 20 20 20 22 63 75 72 61 74 65 64 56 69 64 65 6f 55 72 69 22 3a 20 6e 75 6c 6c 2c 0d 0a 20 20 20 20 20 20 20 20 22 63 72 65 61 74 69 76 65 49 64 22 3a 20 6e 75 6c 6c 2c 0d 0a 20 20 20 20 20 20 20 20 22 70 61 79 6c 6f 61 64 49 64 22 3a 20 6e 75 6c 6c 2c 0d 0a 20 20 20 20 20 20 20 20 22 63 6f 6e 74 65 6e 74 54 79 70 65 22 3a 20 6e 75 6c 6c 2c 0d 0a 20 20 20 20 20 20 20 20 22 61 72 74 69 73 74 4e 61 6d 65 22 3a 20 6e 75 6c 6c 2c 0d 0a 20 20 20 20 20 20 20 20 22 61 72 74 69 73 74 49 64 22 3a 20 6e 75 6c 6c 2c 0d 0a 20 20 20 20 20 20 20 20 22 61 6c 62 75 6d 54 69 74 6c 65 22 3a 20 6e 75 6c 6c 2c 0d 0a 20 20 20 20 20 20 20 20 22 61 6c Data Ascii: "collectionItemType": "Product", "curatedVideoUri": null, "creativeId": null, "payloadId": null, "contentType": null, "artistName": null, "artistId": null, "albumTitle": null, "al
2024-10-02 10:16:47 UTC	16384	IN	Data Raw: 6e 75 6c 6c 2c 0d 0a 20 20 20 20 20 20 20 20 22 76 6f 69 63 65 54 69 74 6c 65 22 3a 20 6e 75 6c 6c 2c 0d 0a 20 20 20 20 20 20 20 20 22 70 68 72 61 73 65 43 75 73 74 6f 6d 50 72 6f 6e 75 6e 63 69 61 74 69 6f 6e 22 3a 20 6e 75 6c 6c 2c 0d 0a 20 20 20 20 20 20 20 20 22 70 6c 61 69 6e 74 65 78 74 50 61 73 73 4e 61 6d 65 22 3a 20 6e 75 6c 6c 2c 0d 0a 20 20 20 20 20 20 20 20 22 67 6c 79 70 68 54 65 78 74 50 61 73 73 4e 61 6d 65 22 3a 20 6e 75 6c 6c 2c 0d 0a 20 20 20 20 20 20 20 20 22 73 75 62 73 63 72 69 70 74 69 6f 6e 44 69 73 63 6f 75 6e 74 4d 65 73 73 61 67 65 54 65 6d 70 6c 61 74 65 22 3a 20 6e 75 6c 6c 2c 0d 0a 20 20 20 20 20 20 20 20 22 63 61 70 61 62 69 6c 69 74 69 65 73 54 61 62 6c 65 22 3a 20 6e 75 6c 6c 2c 0d 0a 20 20 20 20 20 20 20 20 22 63 61 70 61 Data Ascii: null, "voiceTitle": null, "phraseCustomPronunciation": null, "plaintextPassName": null, "glyphTextPassName": null, "subscriptionDiscountMessageTemplate": null, "capabilitiesTable": null, "capa
2024-10-02 10:16:47 UTC	16384	IN	Data Raw: 65 72 76 69 63 65 22 3a 20 6e 75 6c 6c 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 22 6a 73 6f 6e 45 78 74 65 6e 73 69 6f 6e 44 61 74 61 22 3a 20 7b 7d 0d 0a 20 20 20 20 20 20 20 20 20 20 7d 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 22 73 6b 75 49 64 22 3a 20 22 30 30 31 31 22 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 22 73 6b 75 44 69 73 70 6c 61 79 52 61 6e 6b 73 22 3a 20 6e 75 6c 6c 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 22 73 6b 75 54 69 74 6c 65 22 3a 20 6e 75 6c 6c 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 22 64 65 73 63 72 69 70 74 69 6f 6e 22 3a 20 6e 75 6c 6c 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 22 69 6d 61 67 65 73 22 3a 20 6e 75 6c 6c 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 22 Data Ascii: ervice": null, "jsonExtensionData": {} }, { "skuId": "0011", "skuDisplayRanks": null, "skuTitle": null, "description": null, "images": null, "
2024-10-02 10:16:47 UTC	16384	IN	Data Raw: 74 3d 73 6f 75 72 63 65 22 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 22 68 65 69 67 68 74 22 3a 20 30 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 22 77 69 64 74 68 22 3a 20 30 0d 0a 20 20 20 20 20 20 20 20 20 20 7d 0d 0a 20 20 20 20 20 20 20 20 5d 2c 0d 0a 20 20 20 20 20 20 20 20 22 73 75 62 74 69 74 6c 65 4e 61 72 72 61 74 6f 72 54 65 78 74 22 3a 20 6e 75 6c 6c 2c 0d 0a 20 20 20 20 20 20 20 20 22 74 79 70 65 54 61 67 22 3a 20 22 61 70 70 22 2c 0d 0a 20 20 20 20 20 20 20 20 22 72 61 74 69 6e 67 43 6f 75 6e 74 46 6f 72 6d 61 74 74 65 64 22 3a 20 22 31 33 4b 22 2c 0d 0a 20 20 20 20 20 20 20 20 22 69 63 6f 6e 55 72 6c 22 3a 20 22 68 74 74 70 73 3a 2f 2f 69 6d 61 67 65 73 2d 65 64 73 2d 73 73 6c 2e 78 62 6f 78 6c 69 76 65 2e 63 6f 6d 2f 69 6d 61 67 65 3f Data Ascii: t=source", "height": 0, "width": 0 } ], "subtitleNarratorText": null, "typeTag": "app", "ratingCountFormatted": "13K", "iconUrl": "https://images-eds-ssl.xboxlive.com/image?
2024-10-02 10:16:47 UTC	16384	IN	Data Raw: 64 22 3a 20 6e 75 6c 6c 2c 0d 0a 20 20 20 20 20 20 20 20 22 61 6c 74 65 72 6e 61 74 65 49 64 73 22 3a 20 6e 75 6c 6c 2c 0d 0a 20 20 20 20 20 20 20 20 22 63 75 72 61 74 65 64 42 47 43 6f 6c 6f 72 22 3a 20 6e 75 6c 6c 2c 0d 0a 20 20 20 20 20 20 20 20 22 63 75 72 61 74 65 64 46 47 43 6f 6c 6f 72 22 3a 20 6e 75 6c 6c 2c 0d 0a 20 20 20 20 20 20 20 20 22 63 75 72 61 74 65 64 49 6d 61 67 65 55 72 6c 22 3a 20 6e 75 6c 6c 2c 0d 0a 20 20 20 20 20 20 20 20 22 63 75 72 61 74 65 64 54 69 74 6c 65 22 3a 20 6e 75 6c 6c 2c 0d 0a 20 20 20 20 20 20 20 20 22 63 75 72 61 74 65 64 44 65 73 63 72 69 70 74 69 6f 6e 22 3a 20 6e 75 6c 6c 2c 0d 0a 20 20 20 20 20 20 20 20 22 64 6f 4e 6f 74 46 69 6c 74 65 72 22 3a 20 6e 75 6c 6c 2c 0d 0a 20 20 20 20 20 20 20 20 22 63 6f 6c 6c 65 63 Data Ascii: d": null, "alternateIds": null, "curatedBGColor": null, "curatedFGColor": null, "curatedImageUrl": null, "curatedTitle": null, "curatedDescription": null, "doNotFilter": null, "collec
2024-10-02 10:16:47 UTC	16384	IN	Data Raw: 20 20 20 20 20 20 20 22 69 6e 63 6f 6d 70 61 74 69 62 6c 65 4c 61 62 65 6c 22 3a 20 6e 75 6c 6c 2c 0d 0a 20 20 20 20 20 20 20 20 22 67 61 6d 69 6e 67 4f 70 74 69 6f 6e 73 58 62 6f 78 4c 69 76 65 22 3a 20 66 61 6c 73 65 2c 0d 0a 20 20 20 20 20 20 20 20 22 61 63 74 69 6f 6e 4f 76 65 72 72 69 64 65 73 22 3a 20 6e 75 6c 6c 2c 0d 0a 20 20 20 20 20 20 20 20 22 61 76 61 69 6c 61 62 6c 65 44 65 76 69 63 65 73 44 69 73 70 6c 61 79 54 65 78 74 22 3a 20 22 ee b1 8e 20 ee a3 aa 22 2c 0d 0a 20 20 20 20 20 20 20 20 22 61 76 61 69 6c 61 62 6c 65 44 65 76 69 63 65 73 4e 61 72 72 61 74 6f 72 54 65 78 74 22 3a 20 22 50 43 2c 4d 6f 62 69 6c 65 22 2c 0d 0a 20 20 20 20 20 20 20 20 22 6d 6f 64 65 6c 73 22 3a 20 6e 75 6c 6c 2c 0d 0a 20 20 20 20 20 20 20 20 22 63 61 70 61 62 69 Data Ascii: "incompatibleLabel": null, "gamingOptionsXboxLive": false, "actionOverrides": null, "availableDevicesDisplayText": " ", "availableDevicesNarratorText": "PC,Mobile", "models": null, "capabi
2024-10-02 10:16:47 UTC	16384	IN	Data Raw: 6e 64 6c 65 50 61 63 6b 61 67 65 49 64 65 6e 74 69 74 69 65 73 22 3a 20 6e 75 6c 6c 2c 0d 0a 20 20 20 20 20 20 20 20 22 70 63 67 61 53 68 6f 72 74 44 65 73 63 72 69 70 74 69 6f 6e 22 3a 20 6e 75 6c 6c 2c 0d 0a 20 20 20 20 20 20 20 20 22 70 63 67 61 54 72 61 69 6c 65 72 22 3a 20 6e 75 6c 6c 2c 0d 0a 20 20 20 20 20 20 20 20 22 70 63 67 61 4d 69 6e 69 6d 75 6d 55 73 65 72 41 67 65 22 3a 20 6e 75 6c 6c 2c 0d 0a 20 20 20 20 20 20 20 20 22 69 73 47 61 6d 69 6e 67 41 70 70 4f 6e 6c 79 22 3a 20 66 61 6c 73 65 2c 0d 0a 20 20 20 20 20 20 20 20 22 69 6e 73 74 61 6c 6c 65 72 54 79 70 65 22 3a 20 6e 75 6c 6c 2c 0d 0a 20 20 20 20 20 20 20 20 22 61 70 70 45 78 74 65 6e 73 69 6f 6e 22 3a 20 6e 75 6c 6c 2c 0d 0a 20 20 20 20 20 20 20 20 22 73 75 70 70 6f 72 74 73 49 6e 73 Data Ascii: ndlePackageIdentities": null, "pcgaShortDescription": null, "pcgaTrailer": null, "pcgaMinimumUserAge": null, "isGamingAppOnly": false, "installerType": null, "appExtension": null, "supportsIns
2024-10-02 10:16:47 UTC	16384	IN	Data Raw: 62 65 6c 22 3a 20 22 56 69 65 77 20 4d 69 63 72 6f 73 6f 66 74 20 41 63 63 6f 75 6e 74 20 44 65 74 61 69 6c 73 22 2c 0d 0a 20 20 20 20 22 4e 61 76 69 67 61 74 69 6f 6e 42 61 72 2e 55 73 65 72 43 69 72 63 6c 65 41 72 69 61 4c 61 62 65 6c 22 3a 20 22 4f 70 65 6e 20 75 73 65 72 20 64 72 6f 70 64 6f 77 6e 22 2c 0d 0a 20 20 20 20 22 4e 61 76 69 67 61 74 69 6f 6e 42 61 72 2e 55 73 65 72 43 69 72 63 6c 65 53 69 67 6e 49 6e 54 69 74 6c 65 22 3a 20 22 53 69 67 6e 20 69 6e 20 62 75 74 74 6f 6e 22 2c 0d 0a 20 20 20 20 22 4e 61 76 69 67 61 74 69 6f 6e 42 61 72 2e 55 73 65 72 43 69 72 63 6c 65 41 6c 74 54 61 67 22 3a 20 22 41 75 74 68 65 6e 74 69 63 61 74 69 6f 6e 20 75 73 65 72 20 6c 6f 67 6f 22 2c 0d 0a 20 20 20 20 22 4e 61 76 69 67 61 74 69 6f 6e 42 61 72 2e 4d 73 Data Ascii: bel": "View Microsoft Account Details", "NavigationBar.UserCircleAriaLabel": "Open user dropdown", "NavigationBar.UserCircleSignInTitle": "Sign in button", "NavigationBar.UserCircleAltTag": "Authentication user logo", "NavigationBar.Ms

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
71	192.168.2.16	49831	13.107.246.40	443	4912	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-02 10:16:47 UTC	639	OUT	GET /shared/edgeweb/img/max.5b1398e.png HTTP/1.1 Host: edgestatic.azureedge.net Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://www.microsoft.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-10-02 10:16:47 UTC	679	IN	HTTP/1.1 200 OK Date: Wed, 02 Oct 2024 10:16:47 GMT Content-Type: image/png Content-Length: 14447 Connection: close Access-Control-Allow-Origin: * Cache-Control: public, max-age=31536000, immutable ETag: W/"386f-19180c4daeb" Last-Modified: Fri, 23 Aug 2024 19:44:30 GMT Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Origin-Agent-Cluster: ?1 X-Content-Type-Options: nosniff X-Download-Options: noopen X-Frame-Options: SAMEORIGIN X-Permitted-Cross-Domain-Policies: none X-XSS-Protection: 0 x-azure-ref: 20241002T101647Z-15767c5fc55jdxmppy6cmd24bn00000001qg000000002bpc x-fd-int-roxy-purgeid: 0 X-Cache: TCP_MISS Accept-Ranges: bytes
2024-10-02 10:16:47 UTC	14447	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 b4 00 00 00 b4 08 06 00 00 00 3d cd 06 32 00 00 38 36 49 44 41 54 78 da 9c 97 cd ad 53 31 10 85 cf 5c 67 81 58 a5 84 94 90 0e 10 1d d0 01 5b 96 a1 02 44 07 94 40 07 88 0a a0 04 4a 48 09 6f 85 d8 c4 46 d1 b3 f5 c9 73 9e 73 11 23 8d e6 ef 78 64 fb 1e 8f 92 90 2e fa 47 39 4a 7f de 49 ed 8d d4 ce 92 4e 52 1c a5 26 24 84 b4 11 e3 23 e0 23 ba 2d 92 d4 e3 d2 e1 5b 8f 07 66 9b d6 50 97 c8 67 0c 7e 97 de 47 a2 2e ea 9e c3 06 3d 2c df 48 75 9f a0 5b b0 4d 8a 9e 6b f9 9e 90 51 a7 57 15 f9 67 db 1d 6c 23 66 fd 5d 2b d0 ee 83 a9 86 a7 57 ed 16 ac 5b 75 9b b0 c6 09 e4 45 de 70 57 4f 52 5c 25 fd 92 da 4f e9 f5 77 49 4f 7a 24 74 fa a0 1d 39 49 ed 22 b5 f7 52 1c 9d b0 7c 2c af 69 75 b0 05 39 b1 4b 02 43 c6 e1 b3 8e Data Ascii: PNGIHDR=286IDATxS1\gX[D@JHoFss#xd.G9JINR&$##-[fPg~G.=,Hu[MkQWgl#f]+W[uEpWOR\%OwIOz$t9I"R\|,iu9KC

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
72	192.168.2.16	49832	13.107.246.40	443	4912	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-02 10:16:47 UTC	645	OUT	GET /shared/edgeweb/img/pinterest.b958ffd.png HTTP/1.1 Host: edgestatic.azureedge.net Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://www.microsoft.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-10-02 10:16:47 UTC	697	IN	HTTP/1.1 200 OK Date: Wed, 02 Oct 2024 10:16:47 GMT Content-Type: image/png Content-Length: 2621 Connection: close Access-Control-Allow-Origin: * Cache-Control: public, max-age=31536000, immutable ETag: W/"a3d-19180c4db49" Last-Modified: Fri, 23 Aug 2024 19:44:30 GMT Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Origin-Agent-Cluster: ?1 X-Content-Type-Options: nosniff X-Download-Options: noopen X-Frame-Options: SAMEORIGIN X-Permitted-Cross-Domain-Policies: none X-XSS-Protection: 0 x-azure-ref: 20241002T101647Z-15767c5fc55w69c2zvnrz0gmgw00000009fg00000000endd x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-02 10:16:47 UTC	2621	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 90 00 00 00 90 08 06 00 00 00 e7 46 e2 b8 00 00 0a 04 49 44 41 54 78 01 ed dd 73 bc e4 c8 d7 c7 f1 8c ef d8 36 d6 b6 6d db b6 6d db b6 6d db f6 8e d6 b6 77 6c e3 9e e7 f3 47 3f 3f df b9 a9 ca a9 ee 54 e7 7c 5f af f7 7a 6f 25 35 67 d2 d5 49 55 25 b1 58 2c 16 8b c5 62 b1 58 2c 16 8b c5 62 b1 58 2c 16 8b c5 62 b1 58 2c 16 8b c5 62 b1 58 2c 16 8b c5 62 b1 58 2c 15 c9 b0 fe 0b b4 c3 1a 38 04 97 e3 71 0c c6 0f 18 0f f9 1f c6 e3 07 0c c6 e3 b8 1c 87 60 0d b4 4b 2c 55 5d 30 7d b0 2f ee c6 8f 90 00 7e c4 dd d8 17 7d 92 e8 63 45 b3 38 2e c4 17 90 0a f8 02 17 62 89 24 9a 58 d1 74 c2 31 f8 1a 92 23 5f e3 18 74 4a 2c b9 2c 9c 45 71 07 66 42 72 6c 26 ee c0 a2 49 2e 62 85 b3 14 9e 84 44 e8 49 2c 95 54 24 56 38 7d Data Ascii: PNGIHDRFIDATxs6mmmwlG??T\|_zo%5gIU%X,bX,bX,bX,bX,bX,8q`K,U]0}/~}cE8.b$Xt1#_tJ,,EqfBrl&I.bDI,T$V8}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
73	192.168.2.16	49833	13.107.246.40	443	4912	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-02 10:16:47 UTC	642	OUT	GET /shared/edgeweb/img/amazon.a8a5fd1.png HTTP/1.1 Host: edgestatic.azureedge.net Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://www.microsoft.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-10-02 10:16:47 UTC	697	IN	HTTP/1.1 200 OK Date: Wed, 02 Oct 2024 10:16:47 GMT Content-Type: image/png Content-Length: 1074 Connection: close Access-Control-Allow-Origin: * Cache-Control: public, max-age=31536000, immutable ETag: W/"432-19180c4db2a" Last-Modified: Fri, 23 Aug 2024 19:44:30 GMT Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Origin-Agent-Cluster: ?1 X-Content-Type-Options: nosniff X-Download-Options: noopen X-Frame-Options: SAMEORIGIN X-Permitted-Cross-Domain-Policies: none X-XSS-Protection: 0 x-azure-ref: 20241002T101647Z-15767c5fc55852fxfeh7csa2dn000000099g000000006yg7 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-02 10:16:47 UTC	1074	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 30 00 00 00 30 08 03 00 00 00 60 dc 09 b5 00 00 01 41 50 4c 54 45 00 00 00 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff a7 00 ff a8 00 04 05 05 1c 1d 1d 93 94 94 cc cc cc 55 56 56 ff ad 13 76 76 76 30 31 31 54 56 56 ff ff ff 03 05 05 ff d5 90 ff d5 91 d9 d9 d9 03 04 04 f2 f2 f2 a2 a2 a2 ff bf 51 e6 e6 e6 ff be 50 1b 1d 1d ff ef d8 ff ca 72 ff ea cb ff f0 d8 ff b8 3e ff c3 61 ff df ad 54 55 55 bd bd bd b0 b1 b1 fe a7 00 f3 f3 f3 ff e4 bb 43 Data Ascii: PNGIHDR00`APLTEUVVvvv011TVVQPr>aTUUC

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
74	192.168.2.16	49834	13.107.246.40	443	4912	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-02 10:16:47 UTC	645	OUT	GET /shared/edgeweb/img/instagram.4cd031e.png HTTP/1.1 Host: edgestatic.azureedge.net Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://www.microsoft.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-10-02 10:16:48 UTC	679	IN	HTTP/1.1 200 OK Date: Wed, 02 Oct 2024 10:16:48 GMT Content-Type: image/png Content-Length: 15692 Connection: close Access-Control-Allow-Origin: * Cache-Control: public, max-age=31536000, immutable ETag: W/"3d4c-19180c4db49" Last-Modified: Fri, 23 Aug 2024 19:44:30 GMT Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Origin-Agent-Cluster: ?1 X-Content-Type-Options: nosniff X-Download-Options: noopen X-Frame-Options: SAMEORIGIN X-Permitted-Cross-Domain-Policies: none X-XSS-Protection: 0 x-azure-ref: 20241002T101647Z-15767c5fc55fdfx81a30vtr1fw00000009p000000000b18p x-fd-int-roxy-purgeid: 0 X-Cache: TCP_MISS Accept-Ranges: bytes
2024-10-02 10:16:48 UTC	15692	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 80 00 00 00 80 08 06 00 00 00 c3 3e 61 cb 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 3d 06 49 44 41 54 78 da ec 9a 09 94 1d 57 79 e7 7f df bd 55 ef bd 7e bd 6a 5f 2d 1b 59 32 c6 32 60 90 6d d9 66 93 6d c0 b1 01 2f 07 04 18 73 3c 06 63 01 81 30 93 49 08 87 9c 49 22 18 70 60 f0 40 e0 c4 80 27 4c 72 18 86 c0 81 24 93 cd 10 9c 80 17 ec 48 c2 36 e0 05 62 64 59 de 25 59 5b ef fd fa bd aa ba df 3c d7 7b dd 97 72 a9 4a 2d c9 c3 39 cc cc 3d e7 d3 dd af ba eb ff ff fe df 77 ab 8b e7 b3 6c da f4 2d bb 7e f3 3d 21 aa 42 41 d9 c2 16 73 f1 c5 df a9 6e de 7c 4f fd dd ef be b3 7f f3 a6 7b 06 af b9 e6 d6 a1 6b ae f9 c9 d0 3b de f1 c3 79 6f 68 db a6 4d ff 3a ff 59 bb fa 8a ed 0b ae be 7a fb 82 2b af bc 67 e1 bb 36 Data Ascii: PNGIHDR>asRGB=IDATxWyU~j_-Y22`mfm/s<c0II"p`@'Lr$H6bdY%Y[<{rJ-9=wl-~=!BAsn\|O{k;yohM:Yz+g6

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
75	192.168.2.16	49835	13.107.246.40	443	4912	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-02 10:16:47 UTC	644	OUT	GET /shared/edgeweb/img/facebook.bb606e7.png HTTP/1.1 Host: edgestatic.azureedge.net Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://www.microsoft.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-10-02 10:16:47 UTC	698	IN	HTTP/1.1 200 OK Date: Wed, 02 Oct 2024 10:16:47 GMT Content-Type: image/png Content-Length: 5293 Connection: close Access-Control-Allow-Origin: * Cache-Control: public, max-age=31536000, immutable ETag: W/"14ad-19180c4dafb" Last-Modified: Fri, 23 Aug 2024 19:44:30 GMT Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Origin-Agent-Cluster: ?1 X-Content-Type-Options: nosniff X-Download-Options: noopen X-Frame-Options: SAMEORIGIN X-Permitted-Cross-Domain-Policies: none X-XSS-Protection: 0 x-azure-ref: 20241002T101647Z-15767c5fc55w69c2zvnrz0gmgw00000009q00000000039pz x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-02 10:16:47 UTC	5293	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 80 00 00 00 80 08 06 00 00 00 c3 3e 61 cb 00 00 14 74 49 44 41 54 78 da ed 5d 0b 94 1c 55 99 ae 91 18 0e ac 8f 55 32 53 55 3d 81 60 20 ae 26 01 84 9c 95 45 dd 05 56 44 e5 e1 0a 6c 80 dd 55 f7 2c 4a 58 91 08 d9 64 aa aa 7b 9e c9 1a 24 22 e1 21 20 1c 70 97 e3 ee 41 4e 30 41 1e 6a 24 6a 04 43 40 45 48 38 02 09 8a 10 81 a0 21 21 53 f7 56 f7 74 57 dd aa eb fd eb de ff a4 ec c9 63 66 52 33 dd d5 53 f7 9c 6f ba a7 a7 6a aa ba fe ef fe af fb df 7b b5 cc b5 01 fe 16 81 29 31 f6 d2 a6 59 6f bc 5d 2f d1 b9 ba 4d fe 49 b7 dc ab 74 9b 5e 6f d8 f4 5e c3 22 3f 13 ef 37 19 36 f9 bd c0 4e 81 aa 40 28 41 87 c4 eb 1b 02 2f 8a 63 9e 16 af eb 05 56 09 5c 27 7e 5f a8 db e4 5c 63 f1 ae d9 fa 12 fe 57 da b0 c6 db b4 05 4f Data Ascii: PNGIHDR>atIDATx]UU2SU=` &EVDlU,JXd{$"! pAN0Aj$jC@EH8!!SVtWcfR3Soj{)1Yo]/MIt^o^"?76N@(A/cV\'~_\cWO

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
76	192.168.2.16	49836	104.18.187.31	443	4912	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-02 10:16:47 UTC	619	OUT	GET /npm/@shoelace-style/shoelace@2.12.0/cdn/themes/light.css HTTP/1.1 Host: cdn.jsdelivr.net Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: text/css,/;q=0.1 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: style Referer: https://apps.microsoft.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-10-02 10:16:47 UTC	1069	IN	HTTP/1.1 200 OK Date: Wed, 02 Oct 2024 10:16:47 GMT Content-Type: text/css; charset=utf-8 Transfer-Encoding: chunked Connection: close access-control-allow-origin: * access-control-expose-headers: * timing-allow-origin: * Cache-Control: public, max-age=31536000, s-maxage=31536000, immutable cross-origin-resource-policy: cross-origin x-content-type-options: nosniff strict-transport-security: max-age=31536000; includeSubDomains; preload x-jsd-version: 2.12.0 x-jsd-version-type: version etag: W/"4b56-YiPl+RKtjZAxTh+GFWDs5rHZulk" Age: 7837275 x-served-by: cache-fra-etou8220159-FRA, cache-lga21920-LGA x-cache: HIT, HIT vary: Accept-Encoding CF-Cache-Status: HIT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=3BJm5lXZ09gEPbtjLn3XcoDo%2FH6hlfYXNVtnY%2BNu66teiwhmMHFKczlsFZvXx96kkS3mMNrSpHF%2BeJtq3t%2FERvysGKdaua7iVDlDjfIX7mZcoCvzI88Etmmn%2FAVkhAI4TSA%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8cc3f062cb314314-EWR
2024-10-02 10:16:47 UTC	300	IN	Data Raw: 34 62 35 36 0d 0a 3a 72 6f 6f 74 2c 0a 3a 68 6f 73 74 2c 0a 2e 73 6c 2d 74 68 65 6d 65 2d 6c 69 67 68 74 20 7b 0a 20 20 63 6f 6c 6f 72 2d 73 63 68 65 6d 65 3a 20 6c 69 67 68 74 3b 0a 0a 20 20 2d 2d 73 6c 2d 63 6f 6c 6f 72 2d 67 72 61 79 2d 35 30 3a 20 68 73 6c 28 30 20 30 25 20 39 37 2e 35 25 29 3b 0a 20 20 2d 2d 73 6c 2d 63 6f 6c 6f 72 2d 67 72 61 79 2d 31 30 30 3a 20 68 73 6c 28 32 34 30 20 34 2e 38 25 20 39 35 2e 39 25 29 3b 0a 20 20 2d 2d 73 6c 2d 63 6f 6c 6f 72 2d 67 72 61 79 2d 32 30 30 3a 20 68 73 6c 28 32 34 30 20 35 2e 39 25 20 39 30 25 29 3b 0a 20 20 2d 2d 73 6c 2d 63 6f 6c 6f 72 2d 67 72 61 79 2d 33 30 30 3a 20 68 73 6c 28 32 34 30 20 34 2e 39 25 20 38 33 2e 39 25 29 3b 0a 20 20 2d 2d 73 6c 2d 63 6f 6c 6f 72 2d 67 72 61 79 2d 34 30 30 3a 20 68 Data Ascii: 4b56:root,:host,.sl-theme-light { color-scheme: light; --sl-color-gray-50: hsl(0 0% 97.5%); --sl-color-gray-100: hsl(240 4.8% 95.9%); --sl-color-gray-200: hsl(240 5.9% 90%); --sl-color-gray-300: hsl(240 4.9% 83.9%); --sl-color-gray-400: h
2024-10-02 10:16:47 UTC	1369	IN	Data Raw: 32 34 30 20 33 2e 38 25 20 34 36 2e 31 25 29 3b 0a 20 20 2d 2d 73 6c 2d 63 6f 6c 6f 72 2d 67 72 61 79 2d 36 30 30 3a 20 68 73 6c 28 32 34 30 20 35 2e 32 25 20 33 33 2e 39 25 29 3b 0a 20 20 2d 2d 73 6c 2d 63 6f 6c 6f 72 2d 67 72 61 79 2d 37 30 30 3a 20 68 73 6c 28 32 34 30 20 35 2e 33 25 20 32 36 2e 31 25 29 3b 0a 20 20 2d 2d 73 6c 2d 63 6f 6c 6f 72 2d 67 72 61 79 2d 38 30 30 3a 20 68 73 6c 28 32 34 30 20 33 2e 37 25 20 31 35 2e 39 25 29 3b 0a 20 20 2d 2d 73 6c 2d 63 6f 6c 6f 72 2d 67 72 61 79 2d 39 30 30 3a 20 68 73 6c 28 32 34 30 20 35 2e 39 25 20 31 30 25 29 3b 0a 20 20 2d 2d 73 6c 2d 63 6f 6c 6f 72 2d 67 72 61 79 2d 39 35 30 3a 20 68 73 6c 28 32 34 30 20 37 2e 33 25 20 38 25 29 3b 0a 0a 20 20 2d 2d 73 6c 2d 63 6f 6c 6f 72 2d 72 65 64 2d 35 30 3a 20 68 Data Ascii: 240 3.8% 46.1%); --sl-color-gray-600: hsl(240 5.2% 33.9%); --sl-color-gray-700: hsl(240 5.3% 26.1%); --sl-color-gray-800: hsl(240 3.7% 15.9%); --sl-color-gray-900: hsl(240 5.9% 10%); --sl-color-gray-950: hsl(240 7.3% 8%); --sl-color-red-50: h
2024-10-02 10:16:47 UTC	1369	IN	Data Raw: 39 20 39 36 2e 37 25 20 36 34 2e 35 25 29 3b 0a 20 20 2d 2d 73 6c 2d 63 6f 6c 6f 72 2d 61 6d 62 65 72 2d 34 30 30 3a 20 68 73 6c 28 34 33 2e 33 20 39 36 2e 34 25 20 35 36 2e 33 25 29 3b 0a 20 20 2d 2d 73 6c 2d 63 6f 6c 6f 72 2d 61 6d 62 65 72 2d 35 30 30 3a 20 68 73 6c 28 33 37 2e 37 20 39 32 2e 31 25 20 35 30 2e 32 25 29 3b 0a 20 20 2d 2d 73 6c 2d 63 6f 6c 6f 72 2d 61 6d 62 65 72 2d 36 30 30 3a 20 68 73 6c 28 33 32 2e 31 20 39 34 2e 36 25 20 34 33 2e 37 25 29 3b 0a 20 20 2d 2d 73 6c 2d 63 6f 6c 6f 72 2d 61 6d 62 65 72 2d 37 30 30 3a 20 68 73 6c 28 32 36 20 39 30 2e 35 25 20 33 37 2e 31 25 29 3b 0a 20 20 2d 2d 73 6c 2d 63 6f 6c 6f 72 2d 61 6d 62 65 72 2d 38 30 30 3a 20 68 73 6c 28 32 32 2e 37 20 38 32 2e 35 25 20 33 31 2e 34 25 29 3b 0a 20 20 2d 2d 73 6c Data Ascii: 9 96.7% 64.5%); --sl-color-amber-400: hsl(43.3 96.4% 56.3%); --sl-color-amber-500: hsl(37.7 92.1% 50.2%); --sl-color-amber-600: hsl(32.1 94.6% 43.7%); --sl-color-amber-700: hsl(26 90.5% 37.1%); --sl-color-amber-800: hsl(22.7 82.5% 31.4%); --sl
2024-10-02 10:16:47 UTC	1369	IN	Data Raw: 6c 2d 63 6f 6c 6f 72 2d 67 72 65 65 6e 2d 35 30 3a 20 68 73 6c 28 31 33 38 2e 35 20 37 36 2e 35 25 20 39 36 2e 37 25 29 3b 0a 20 20 2d 2d 73 6c 2d 63 6f 6c 6f 72 2d 67 72 65 65 6e 2d 31 30 30 3a 20 68 73 6c 28 31 34 30 2e 36 20 38 34 2e 32 25 20 39 32 2e 35 25 29 3b 0a 20 20 2d 2d 73 6c 2d 63 6f 6c 6f 72 2d 67 72 65 65 6e 2d 32 30 30 3a 20 68 73 6c 28 31 34 31 20 37 38 2e 39 25 20 38 35 2e 31 25 29 3b 0a 20 20 2d 2d 73 6c 2d 63 6f 6c 6f 72 2d 67 72 65 65 6e 2d 33 30 30 3a 20 68 73 6c 28 31 34 31 2e 37 20 37 36 2e 36 25 20 37 33 2e 31 25 29 3b 0a 20 20 2d 2d 73 6c 2d 63 6f 6c 6f 72 2d 67 72 65 65 6e 2d 34 30 30 3a 20 68 73 6c 28 31 34 31 2e 39 20 36 39 2e 32 25 20 35 38 25 29 3b 0a 20 20 2d 2d 73 6c 2d 63 6f 6c 6f 72 2d 67 72 65 65 6e 2d 35 30 30 3a 20 68 Data Ascii: l-color-green-50: hsl(138.5 76.5% 96.7%); --sl-color-green-100: hsl(140.6 84.2% 92.5%); --sl-color-green-200: hsl(141 78.9% 85.1%); --sl-color-green-300: hsl(141.7 76.6% 73.1%); --sl-color-green-400: hsl(141.9 69.2% 58%); --sl-color-green-500: h
2024-10-02 10:16:47 UTC	1369	IN	Data Raw: 20 38 33 2e 39 25 20 33 31 2e 36 25 29 3b 0a 20 20 2d 2d 73 6c 2d 63 6f 6c 6f 72 2d 74 65 61 6c 2d 37 30 30 3a 20 68 73 6c 28 31 37 35 2e 33 20 37 37 2e 34 25 20 32 36 2e 31 25 29 3b 0a 20 20 2d 2d 73 6c 2d 63 6f 6c 6f 72 2d 74 65 61 6c 2d 38 30 30 3a 20 68 73 6c 28 31 37 36 2e 31 20 36 39 2e 34 25 20 32 31 2e 38 25 29 3b 0a 20 20 2d 2d 73 6c 2d 63 6f 6c 6f 72 2d 74 65 61 6c 2d 39 30 30 3a 20 68 73 6c 28 31 37 35 2e 39 20 36 30 2e 38 25 20 31 39 25 29 3b 0a 20 20 2d 2d 73 6c 2d 63 6f 6c 6f 72 2d 74 65 61 6c 2d 39 35 30 3a 20 68 73 6c 28 31 37 36 2e 35 20 35 38 2e 36 25 20 31 31 2e 34 25 29 3b 0a 0a 20 20 2d 2d 73 6c 2d 63 6f 6c 6f 72 2d 63 79 61 6e 2d 35 30 3a 20 68 73 6c 28 31 38 33 2e 32 20 31 30 30 25 20 39 36 2e 33 25 29 3b 0a 20 20 2d 2d 73 6c 2d 63 Data Ascii: 83.9% 31.6%); --sl-color-teal-700: hsl(175.3 77.4% 26.1%); --sl-color-teal-800: hsl(176.1 69.4% 21.8%); --sl-color-teal-900: hsl(175.9 60.8% 19%); --sl-color-teal-950: hsl(176.5 58.6% 11.4%); --sl-color-cyan-50: hsl(183.2 100% 96.3%); --sl-c
2024-10-02 10:16:47 UTC	1369	IN	Data Raw: 32 31 31 2e 37 20 39 36 2e 34 25 20 37 38 2e 34 25 29 3b 0a 20 20 2d 2d 73 6c 2d 63 6f 6c 6f 72 2d 62 6c 75 65 2d 34 30 30 3a 20 68 73 6c 28 32 31 33 2e 31 20 39 33 2e 39 25 20 36 37 2e 38 25 29 3b 0a 20 20 2d 2d 73 6c 2d 63 6f 6c 6f 72 2d 62 6c 75 65 2d 35 30 30 3a 20 68 73 6c 28 32 31 37 2e 32 20 39 31 2e 32 25 20 35 39 2e 38 25 29 3b 0a 20 20 2d 2d 73 6c 2d 63 6f 6c 6f 72 2d 62 6c 75 65 2d 36 30 30 3a 20 68 73 6c 28 32 32 31 2e 32 20 38 33 2e 32 25 20 35 33 2e 33 25 29 3b 0a 20 20 2d 2d 73 6c 2d 63 6f 6c 6f 72 2d 62 6c 75 65 2d 37 30 30 3a 20 68 73 6c 28 32 32 34 2e 33 20 37 36 2e 33 25 20 34 38 25 29 3b 0a 20 20 2d 2d 73 6c 2d 63 6f 6c 6f 72 2d 62 6c 75 65 2d 38 30 30 3a 20 68 73 6c 28 32 32 35 2e 39 20 37 30 2e 37 25 20 34 30 2e 32 25 29 3b 0a 20 20 Data Ascii: 211.7 96.4% 78.4%); --sl-color-blue-400: hsl(213.1 93.9% 67.8%); --sl-color-blue-500: hsl(217.2 91.2% 59.8%); --sl-color-blue-600: hsl(221.2 83.2% 53.3%); --sl-color-blue-700: hsl(224.3 76.3% 48%); --sl-color-blue-800: hsl(225.9 70.7% 40.2%);
2024-10-02 10:16:47 UTC	1369	IN	Data Raw: 2d 2d 73 6c 2d 63 6f 6c 6f 72 2d 76 69 6f 6c 65 74 2d 39 35 30 3a 20 68 73 6c 28 32 36 35 2e 31 20 36 31 2e 35 25 20 32 31 2e 34 25 29 3b 0a 0a 20 20 2d 2d 73 6c 2d 63 6f 6c 6f 72 2d 70 75 72 70 6c 65 2d 35 30 3a 20 68 73 6c 28 32 37 30 20 31 30 30 25 20 39 38 25 29 3b 0a 20 20 2d 2d 73 6c 2d 63 6f 6c 6f 72 2d 70 75 72 70 6c 65 2d 31 30 30 3a 20 68 73 6c 28 32 36 38 2e 37 20 31 30 30 25 20 39 35 2e 35 25 29 3b 0a 20 20 2d 2d 73 6c 2d 63 6f 6c 6f 72 2d 70 75 72 70 6c 65 2d 32 30 30 3a 20 68 73 6c 28 32 36 38 2e 36 20 31 30 30 25 20 39 31 2e 38 25 29 3b 0a 20 20 2d 2d 73 6c 2d 63 6f 6c 6f 72 2d 70 75 72 70 6c 65 2d 33 30 30 3a 20 68 73 6c 28 32 36 39 2e 32 20 39 37 2e 34 25 20 38 35 2e 31 25 29 3b 0a 20 20 2d 2d 73 6c 2d 63 6f 6c 6f 72 2d 70 75 72 70 6c 65 Data Ascii: --sl-color-violet-950: hsl(265.1 61.5% 21.4%); --sl-color-purple-50: hsl(270 100% 98%); --sl-color-purple-100: hsl(268.7 100% 95.5%); --sl-color-purple-200: hsl(268.6 100% 91.8%); --sl-color-purple-300: hsl(269.2 97.4% 85.1%); --sl-color-purple
2024-10-02 10:16:47 UTC	1369	IN	Data Raw: 3a 20 68 73 6c 28 33 33 30 2e 34 20 38 31 2e 32 25 20 36 30 2e 34 25 29 3b 0a 20 20 2d 2d 73 6c 2d 63 6f 6c 6f 72 2d 70 69 6e 6b 2d 36 30 30 3a 20 68 73 6c 28 33 33 33 2e 33 20 37 31 2e 34 25 20 35 30 2e 36 25 29 3b 0a 20 20 2d 2d 73 6c 2d 63 6f 6c 6f 72 2d 70 69 6e 6b 2d 37 30 30 3a 20 68 73 6c 28 33 33 35 2e 31 20 37 37 2e 36 25 20 34 32 25 29 3b 0a 20 20 2d 2d 73 6c 2d 63 6f 6c 6f 72 2d 70 69 6e 6b 2d 38 30 30 3a 20 68 73 6c 28 33 33 35 2e 38 20 37 34 2e 34 25 20 33 35 2e 33 25 29 3b 0a 20 20 2d 2d 73 6c 2d 63 6f 6c 6f 72 2d 70 69 6e 6b 2d 39 30 30 3a 20 68 73 6c 28 33 33 35 2e 39 20 36 39 25 20 33 30 2e 34 25 29 3b 0a 20 20 2d 2d 73 6c 2d 63 6f 6c 6f 72 2d 70 69 6e 6b 2d 39 35 30 3a 20 68 73 6c 28 33 33 36 2e 32 20 36 35 2e 34 25 20 31 35 2e 39 25 29 Data Ascii: : hsl(330.4 81.2% 60.4%); --sl-color-pink-600: hsl(333.3 71.4% 50.6%); --sl-color-pink-700: hsl(335.1 77.6% 42%); --sl-color-pink-800: hsl(335.8 74.4% 35.3%); --sl-color-pink-900: hsl(335.9 69% 30.4%); --sl-color-pink-950: hsl(336.2 65.4% 15.9%)
2024-10-02 10:16:47 UTC	1369	IN	Data Raw: 72 2d 67 72 65 65 6e 2d 35 30 29 3b 0a 20 20 2d 2d 73 6c 2d 63 6f 6c 6f 72 2d 73 75 63 63 65 73 73 2d 31 30 30 3a 20 76 61 72 28 2d 2d 73 6c 2d 63 6f 6c 6f 72 2d 67 72 65 65 6e 2d 31 30 30 29 3b 0a 20 20 2d 2d 73 6c 2d 63 6f 6c 6f 72 2d 73 75 63 63 65 73 73 2d 32 30 30 3a 20 76 61 72 28 2d 2d 73 6c 2d 63 6f 6c 6f 72 2d 67 72 65 65 6e 2d 32 30 30 29 3b 0a 20 20 2d 2d 73 6c 2d 63 6f 6c 6f 72 2d 73 75 63 63 65 73 73 2d 33 30 30 3a 20 76 61 72 28 2d 2d 73 6c 2d 63 6f 6c 6f 72 2d 67 72 65 65 6e 2d 33 30 30 29 3b 0a 20 20 2d 2d 73 6c 2d 63 6f 6c 6f 72 2d 73 75 63 63 65 73 73 2d 34 30 30 3a 20 76 61 72 28 2d 2d 73 6c 2d 63 6f 6c 6f 72 2d 67 72 65 65 6e 2d 34 30 30 29 3b 0a 20 20 2d 2d 73 6c 2d 63 6f 6c 6f 72 2d 73 75 63 63 65 73 73 2d 35 30 30 3a 20 76 61 72 28 Data Ascii: r-green-50); --sl-color-success-100: var(--sl-color-green-100); --sl-color-success-200: var(--sl-color-green-200); --sl-color-success-300: var(--sl-color-green-300); --sl-color-success-400: var(--sl-color-green-400); --sl-color-success-500: var(
2024-10-02 10:16:47 UTC	1369	IN	Data Raw: 30 30 29 3b 0a 20 20 2d 2d 73 6c 2d 63 6f 6c 6f 72 2d 64 61 6e 67 65 72 2d 35 30 30 3a 20 76 61 72 28 2d 2d 73 6c 2d 63 6f 6c 6f 72 2d 72 65 64 2d 35 30 30 29 3b 0a 20 20 2d 2d 73 6c 2d 63 6f 6c 6f 72 2d 64 61 6e 67 65 72 2d 36 30 30 3a 20 76 61 72 28 2d 2d 73 6c 2d 63 6f 6c 6f 72 2d 72 65 64 2d 36 30 30 29 3b 0a 20 20 2d 2d 73 6c 2d 63 6f 6c 6f 72 2d 64 61 6e 67 65 72 2d 37 30 30 3a 20 76 61 72 28 2d 2d 73 6c 2d 63 6f 6c 6f 72 2d 72 65 64 2d 37 30 30 29 3b 0a 20 20 2d 2d 73 6c 2d 63 6f 6c 6f 72 2d 64 61 6e 67 65 72 2d 38 30 30 3a 20 76 61 72 28 2d 2d 73 6c 2d 63 6f 6c 6f 72 2d 72 65 64 2d 38 30 30 29 3b 0a 20 20 2d 2d 73 6c 2d 63 6f 6c 6f 72 2d 64 61 6e 67 65 72 2d 39 30 30 3a 20 76 61 72 28 2d 2d 73 6c 2d 63 6f 6c 6f 72 2d 72 65 64 2d 39 30 30 29 3b 0a Data Ascii: 00); --sl-color-danger-500: var(--sl-color-red-500); --sl-color-danger-600: var(--sl-color-red-600); --sl-color-danger-700: var(--sl-color-red-700); --sl-color-danger-800: var(--sl-color-red-800); --sl-color-danger-900: var(--sl-color-red-900);

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
77	192.168.2.16	49837	13.107.246.40	443	4912	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-02 10:16:47 UTC	643	OUT	GET /shared/edgeweb/img/outlook.dcd709d.png HTTP/1.1 Host: edgestatic.azureedge.net Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://www.microsoft.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-10-02 10:16:48 UTC	678	IN	HTTP/1.1 200 OK Date: Wed, 02 Oct 2024 10:16:48 GMT Content-Type: image/png Content-Length: 5128 Connection: close Access-Control-Allow-Origin: * Cache-Control: public, max-age=31536000, immutable ETag: W/"1408-19180c4d8b9" Last-Modified: Fri, 23 Aug 2024 19:44:29 GMT Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Origin-Agent-Cluster: ?1 X-Content-Type-Options: nosniff X-Download-Options: noopen X-Frame-Options: SAMEORIGIN X-Permitted-Cross-Domain-Policies: none X-XSS-Protection: 0 x-azure-ref: 20241002T101647Z-15767c5fc55gs96cphvgp5f5vc00000009bg000000003dpd x-fd-int-roxy-purgeid: 0 X-Cache: TCP_MISS Accept-Ranges: bytes
2024-10-02 10:16:48 UTC	5128	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 80 00 00 00 80 08 06 00 00 00 c3 3e 61 cb 00 00 13 cf 49 44 41 54 78 01 ed 9d 05 70 1c 47 be c6 7f dd d3 33 0b 5a 12 99 e3 38 cc 8c ce 3b 0a 3d 66 66 66 66 66 66 66 66 3c 66 e6 bb 30 73 a2 8b 99 6d d1 f2 ce 4c f7 f3 56 57 6a 2a 3a cd 46 ab 91 76 d7 d6 fc 2a 1d de 71 69 bf af ff d4 3d 65 36 24 29 29 29 29 29 29 29 82 51 e5 9b df b5 0b e5 ed 46 c8 9d 18 9d 45 4a 52 56 80 31 06 a8 01 33 e8 ce c7 81 59 7a 20 f8 b6 77 33 72 38 ea 76 8c f8 46 e0 36 10 3b c1 64 11 82 94 15 60 b0 06 10 66 06 63 3e 44 28 ff 16 78 8e 18 14 c6 63 a4 50 ce 55 98 f0 97 c0 bc 16 21 fa 0d 54 29 02 01 14 41 5c 87 10 57 e2 30 8d 10 3f 0a 9c 64 19 24 4a 30 32 eb 1f 6f 17 88 f0 87 10 58 f1 53 92 e2 22 cc d7 10 e8 2f 39 bd 58 6e 09 be Data Ascii: PNGIHDR>aIDATxpG3Z8;=ffffffff<f0smLVWj:Fvqi=e6$)))))))QFEJRV13Yz w3r8vF6;d`fc>D(xcPU!T)A\W0?d$J02oXS"/9Xn

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
78	192.168.2.16	49838	13.107.246.40	443	4912	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-02 10:16:48 UTC	641	OUT	GET /assets/js/index-3c527300.css HTTP/1.1 Host: apps.microsoft.com Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: text/css,/;q=0.1 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: style Referer: https://apps.microsoft.com/apppack/edgefre?hl=en-us&gl=US Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8 Cookie: MSCC=NR
2024-10-02 10:16:48 UTC	1278	IN	HTTP/1.1 200 OK Date: Wed, 02 Oct 2024 10:16:48 GMT Content-Type: text/css Content-Length: 3499 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public,max-age=31536000,immutable ETag: "1db136ef678b3ab" Last-Modified: Mon, 30 Sep 2024 19:28:44 GMT Strict-Transport-Security: max-age=2592000 Request-Context: appId=cid-v1:04e455f9-321c-49bf-8d2c-d79fbf5e8cde MS-CV: 6oGxX+P5TkucMnQf.0 X-Content-Type-Options: nosniff Permissions-Policy: unload=() Content-Security-Policy: default-src 'self' data: https://.clarity.ms https://c.bing.com;script-src 'self' wcpstatic.microsoft.com js.monitor.azure.com www.microsoft.com www.clarity.ms get.microsoft.com xvsec.video.microsoft.com bat.bing.com 'unsafe-inline';style-src 'unsafe-inline';connect-src * data: ms-windows-store:;font-src ;img-src data: blob:;media-src 'self' blob: https://sfds-production.azurefd.net https://canvasstorageprodtorus.blob.core.windows.net;frame-src * ms-windows-store:;report-uri https://csp.microsoft.com/report/app-store-web-prod X-Powered-By: ASP.NET x-azure-ref: 20241002T101648Z-15767c5fc55lghvzbxktxfqntw00000008z000000000c2zu x-fd-int-roxy-purgeid: 66820190 X-Cache: TCP_MISS Accept-Ranges: bytes
2024-10-02 10:16:48 UTC	3499	IN	Data Raw: 3a 72 6f 6f 74 7b 2d 2d 68 65 61 64 65 72 2d 66 6f 6e 74 3a 20 53 65 67 6f 65 20 55 49 20 56 61 72 69 61 62 6c 65 20 44 69 73 70 6c 61 79 2c 20 22 53 65 67 6f 65 20 55 49 22 2c 20 73 79 73 74 65 6d 2d 75 69 2c 20 2d 61 70 70 6c 65 2d 73 79 73 74 65 6d 2c 20 42 6c 69 6e 6b 4d 61 63 53 79 73 74 65 6d 46 6f 6e 74 2c 20 52 6f 62 6f 74 6f 2c 20 22 48 65 6c 76 65 74 69 63 61 20 4e 65 75 65 22 2c 20 41 72 69 61 6c 2c 20 22 4e 6f 74 6f 20 53 61 6e 73 22 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 2d 2d 62 6f 64 79 2d 66 6f 6e 74 3a 20 53 65 67 6f 65 20 55 49 20 56 61 72 69 61 62 6c 65 20 54 65 78 74 2c 20 22 53 65 67 6f 65 20 55 49 22 2c 20 73 79 73 74 65 6d 2d 75 69 2c 20 2d 61 70 70 6c 65 2d 73 79 73 74 65 6d 2c 20 42 6c 69 6e 6b 4d 61 63 53 79 73 74 65 6d 46 6f 6e Data Ascii: :root{--header-font: Segoe UI Variable Display, "Segoe UI", system-ui, -apple-system, BlinkMacSystemFont, Roboto, "Helvetica Neue", Arial, "Noto Sans", sans-serif;--body-font: Segoe UI Variable Text, "Segoe UI", system-ui, -apple-system, BlinkMacSystemFon

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
79	192.168.2.16	49839	13.107.246.40	443	4912	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-02 10:16:48 UTC	659	OUT	GET /assets/js/index-36d30887.js HTTP/1.1 Host: apps.microsoft.com Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" Origin: https://apps.microsoft.com sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: same-origin Sec-Fetch-Mode: cors Sec-Fetch-Dest: script Referer: https://apps.microsoft.com/apppack/edgefre?hl=en-us&gl=US Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8 Cookie: MSCC=NR
2024-10-02 10:16:48 UTC	1287	IN	HTTP/1.1 200 OK Date: Wed, 02 Oct 2024 10:16:48 GMT Content-Type: text/javascript Content-Length: 655944 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public,max-age=31536000,immutable ETag: "1db136ef672bc48" Last-Modified: Mon, 30 Sep 2024 19:28:44 GMT Strict-Transport-Security: max-age=2592000 Request-Context: appId=cid-v1:04e455f9-321c-49bf-8d2c-d79fbf5e8cde MS-CV: g6/VCyr4BUGh79rz.0 X-Content-Type-Options: nosniff Permissions-Policy: unload=() Content-Security-Policy: default-src 'self' data: https://.clarity.ms https://c.bing.com;script-src 'self' wcpstatic.microsoft.com js.monitor.azure.com www.microsoft.com www.clarity.ms get.microsoft.com xvsec.video.microsoft.com bat.bing.com 'unsafe-inline';style-src 'unsafe-inline';connect-src * data: ms-windows-store:;font-src ;img-src data: blob:;media-src 'self' blob: https://sfds-production.azurefd.net https://canvasstorageprodtorus.blob.core.windows.net;frame-src * ms-windows-store:;report-uri https://csp.microsoft.com/report/app-store-web-prod X-Powered-By: ASP.NET x-azure-ref: 20241002T101648Z-15767c5fc55w69c2zvnrz0gmgw00000009ng000000005h0m x-fd-int-roxy-purgeid: 66820190 X-Cache: TCP_MISS Accept-Ranges: bytes
2024-10-02 10:16:48 UTC	15097	IN	Data Raw: 28 66 75 6e 63 74 69 6f 6e 28 29 7b 63 6f 6e 73 74 20 65 3d 64 6f 63 75 6d 65 6e 74 2e 63 72 65 61 74 65 45 6c 65 6d 65 6e 74 28 22 6c 69 6e 6b 22 29 2e 72 65 6c 4c 69 73 74 3b 69 66 28 65 26 26 65 2e 73 75 70 70 6f 72 74 73 26 26 65 2e 73 75 70 70 6f 72 74 73 28 22 6d 6f 64 75 6c 65 70 72 65 6c 6f 61 64 22 29 29 72 65 74 75 72 6e 3b 66 6f 72 28 63 6f 6e 73 74 20 73 20 6f 66 20 64 6f 63 75 6d 65 6e 74 2e 71 75 65 72 79 53 65 6c 65 63 74 6f 72 41 6c 6c 28 27 6c 69 6e 6b 5b 72 65 6c 3d 22 6d 6f 64 75 6c 65 70 72 65 6c 6f 61 64 22 5d 27 29 29 6f 28 73 29 3b 6e 65 77 20 4d 75 74 61 74 69 6f 6e 4f 62 73 65 72 76 65 72 28 73 3d 3e 7b 66 6f 72 28 63 6f 6e 73 74 20 72 20 6f 66 20 73 29 69 66 28 72 2e 74 79 70 65 3d 3d 3d 22 63 68 69 6c 64 4c 69 73 74 22 29 66 6f Data Ascii: (function(){const e=document.createElement("link").relList;if(e&&e.supports&&e.supports("modulepreload"))return;for(const s of document.querySelectorAll('link[rel="modulepreload"]'))o(s);new MutationObserver(s=>{for(const r of s)if(r.type==="childList")fo
2024-10-02 10:16:48 UTC	16384	IN	Data Raw: 2e 6e 65 78 74 53 69 62 6c 69 6e 67 3b 65 2e 72 65 6d 6f 76 65 28 29 2c 65 3d 6f 7d 7d 73 65 74 43 6f 6e 6e 65 63 74 65 64 28 65 29 7b 74 68 69 73 2e 5f 24 41 4d 3d 3d 3d 76 6f 69 64 20 30 26 26 28 74 68 69 73 2e 5f 24 43 76 3d 65 2c 74 68 69 73 2e 5f 24 41 50 3f 2e 28 65 29 29 7d 7d 63 6c 61 73 73 20 57 69 7b 67 65 74 20 74 61 67 4e 61 6d 65 28 29 7b 72 65 74 75 72 6e 20 74 68 69 73 2e 65 6c 65 6d 65 6e 74 2e 74 61 67 4e 61 6d 65 7d 67 65 74 20 5f 24 41 55 28 29 7b 72 65 74 75 72 6e 20 74 68 69 73 2e 5f 24 41 4d 2e 5f 24 41 55 7d 63 6f 6e 73 74 72 75 63 74 6f 72 28 65 2c 69 2c 6f 2c 73 2c 72 29 7b 74 68 69 73 2e 74 79 70 65 3d 31 2c 74 68 69 73 2e 5f 24 41 48 3d 51 2c 74 68 69 73 2e 5f 24 41 4e 3d 76 6f 69 64 20 30 2c 74 68 69 73 2e 65 6c 65 6d 65 6e 74 Data Ascii: .nextSibling;e.remove(),e=o}}setConnected(e){this._$AM===void 0&&(this._$Cv=e,this._$AP?.(e))}}class Wi{get tagName(){return this.element.tagName}get _$AU(){return this._$AM._$AU}constructor(e,i,o,s,r){this.type=1,this._$AH=Q,this._$AN=void 0,this.element
2024-10-02 10:16:48 UTC	16384	IN	Data Raw: 33 7c 31 32 38 2c 65 29 7b 69 3d 69 7c 7c 30 3b 66 6f 72 28 6c 65 74 20 73 3d 30 3b 73 3c 31 36 3b 2b 2b 73 29 65 5b 69 2b 73 5d 3d 6f 5b 73 5d 3b 72 65 74 75 72 6e 20 65 7d 72 65 74 75 72 6e 20 4c 6e 28 6f 29 7d 66 75 6e 63 74 69 6f 6e 20 6c 74 28 29 7b 72 65 74 75 72 6e 20 77 69 6e 64 6f 77 2e 73 74 6f 72 65 56 69 65 77 4d 6f 64 65 6c 7d 66 75 6e 63 74 69 6f 6e 20 41 69 28 29 7b 72 65 74 75 72 6e 20 6c 74 28 29 2e 69 73 4c 6f 63 61 6c 65 41 73 73 65 73 73 6d 65 6e 74 45 6e 61 62 6c 65 64 3d 3d 3d 21 30 7d 66 75 6e 63 74 69 6f 6e 20 44 6e 28 29 7b 72 65 74 75 72 6e 21 21 6e 61 76 69 67 61 74 6f 72 2e 75 73 65 72 41 67 65 6e 74 44 61 74 61 3f 2e 70 6c 61 74 66 6f 72 6d 3f 2e 6d 61 74 63 68 28 2f 77 69 6e 64 6f 77 73 2f 69 29 7c 7c 21 21 6e 61 76 69 67 61 Data Ascii: 3\|128,e){i=i\|\|0;for(let s=0;s<16;++s)e[i+s]=o[s];return e}return Ln(o)}function lt(){return window.storeViewModel}function Ai(){return lt().isLocaleAssessmentEnabled===!0}function Dn(){return!!navigator.userAgentData?.platform?.match(/windows/i)\|\|!!naviga
2024-10-02 10:16:48 UTC	16384	IN	Data Raw: 28 22 5c 5c 7b 22 2b 73 2b 22 5c 5c 7d 22 2c 22 67 69 22 29 2c 6e 3d 6f 2c 64 3d 74 79 70 65 6f 66 20 69 5b 73 5d 3d 3d 22 73 74 72 69 6e 67 22 3f 69 5b 73 5d 3a 60 24 7b 69 5b 73 5d 7d 60 3b 6f 3d 6f 2e 72 65 70 6c 61 63 65 28 72 2c 64 29 2c 6f 3d 3d 3d 6e 26 26 67 74 2e 77 61 72 6e 28 60 53 74 72 69 6e 67 20 74 72 61 6e 73 6c 61 74 69 6f 6e 20 77 61 72 6e 69 6e 67 3a 20 54 68 65 20 76 61 6c 75 65 20 24 7b 74 68 69 73 2e 67 65 74 28 65 29 7d 20 65 78 70 65 63 74 65 64 20 61 20 64 69 66 66 65 72 65 6e 74 20 6e 75 6d 62 65 72 20 6f 66 20 61 72 67 75 6d 65 6e 74 73 20 74 68 61 6e 20 77 61 73 20 73 75 70 70 6c 69 65 64 20 28 24 7b 69 2e 6c 65 6e 67 74 68 7d 29 2e 60 29 7d 72 65 74 75 72 6e 20 6f 7d 69 73 52 74 6c 28 29 7b 63 6f 6e 73 74 20 65 3d 5b 22 61 72 Data Ascii: ("\\{"+s+"\\}","gi"),n=o,d=typeof i[s]=="string"?i[s]:`${i[s]}`;o=o.replace(r,d),o===n&&gt.warn(`String translation warning: The value ${this.get(e)} expected a different number of arguments than was supplied (${i.length}).`)}return o}isRtl(){const e=["ar
2024-10-02 10:16:48 UTC	16384	IN	Data Raw: 68 69 73 2e 68 6f 73 74 2e 74 61 67 4e 61 6d 65 2e 74 6f 4c 6f 77 65 72 43 61 73 65 28 29 3d 3d 3d 22 73 6c 2d 62 75 74 74 6f 6e 22 3b 74 68 69 73 2e 68 6f 73 74 2e 69 73 43 6f 6e 6e 65 63 74 65 64 26 26 21 6f 26 26 21 6e 26 26 74 79 70 65 6f 66 20 73 3d 3d 22 73 74 72 69 6e 67 22 26 26 73 2e 6c 65 6e 67 74 68 3e 30 26 26 74 79 70 65 6f 66 20 72 3c 22 75 22 26 26 28 41 72 72 61 79 2e 69 73 41 72 72 61 79 28 72 29 3f 72 2e 66 6f 72 45 61 63 68 28 64 3d 3e 7b 69 2e 66 6f 72 6d 44 61 74 61 2e 61 70 70 65 6e 64 28 73 2c 64 2e 74 6f 53 74 72 69 6e 67 28 29 29 7d 29 3a 69 2e 66 6f 72 6d 44 61 74 61 2e 61 70 70 65 6e 64 28 73 2c 72 2e 74 6f 53 74 72 69 6e 67 28 29 29 29 7d 2c 74 68 69 73 2e 68 61 6e 64 6c 65 46 6f 72 6d 53 75 62 6d 69 74 3d 69 3d 3e 7b 76 61 72 Data Ascii: his.host.tagName.toLowerCase()==="sl-button";this.host.isConnected&&!o&&!n&&typeof s=="string"&&s.length>0&&typeof r<"u"&&(Array.isArray(r)?r.forEach(d=>{i.formData.append(s,d.toString())}):i.formData.append(s,r.toString()))},this.handleFormSubmit=i=>{var
2024-10-02 10:16:48 UTC	16384	IN	Data Raw: 5f 5f 70 72 65 66 69 78 2c 0a 20 20 2e 62 75 74 74 6f 6e 2d 2d 6c 6f 61 64 69 6e 67 20 2e 62 75 74 74 6f 6e 5f 5f 6c 61 62 65 6c 2c 0a 20 20 2e 62 75 74 74 6f 6e 2d 2d 6c 6f 61 64 69 6e 67 20 2e 62 75 74 74 6f 6e 5f 5f 73 75 66 66 69 78 2c 0a 20 20 2e 62 75 74 74 6f 6e 2d 2d 6c 6f 61 64 69 6e 67 20 2e 62 75 74 74 6f 6e 5f 5f 63 61 72 65 74 20 7b 0a 20 20 20 20 76 69 73 69 62 69 6c 69 74 79 3a 20 68 69 64 64 65 6e 3b 0a 20 20 7d 0a 0a 20 20 2e 62 75 74 74 6f 6e 2d 2d 6c 6f 61 64 69 6e 67 20 73 6c 2d 73 70 69 6e 6e 65 72 20 7b 0a 20 20 20 20 2d 2d 69 6e 64 69 63 61 74 6f 72 2d 63 6f 6c 6f 72 3a 20 63 75 72 72 65 6e 74 43 6f 6c 6f 72 3b 0a 20 20 20 20 70 6f 73 69 74 69 6f 6e 3a 20 61 62 73 6f 6c 75 74 65 3b 0a 20 20 20 20 66 6f 6e 74 2d 73 69 7a 65 3a 20 31 Data Ascii: __prefix, .button--loading .button__label, .button--loading .button__suffix, .button--loading .button__caret { visibility: hidden; } .button--loading sl-spinner { --indicator-color: currentColor; position: absolute; font-size: 1
2024-10-02 10:16:48 UTC	16384	IN	Data Raw: 56 61 6c 75 65 20 70 61 73 73 65 64 20 74 6f 20 27 6c 69 74 65 72 61 6c 27 20 66 75 6e 63 74 69 6f 6e 20 6d 75 73 74 20 62 65 20 61 20 27 6c 69 74 65 72 61 6c 27 20 72 65 73 75 6c 74 3a 20 24 7b 72 7d 2e 20 55 73 65 20 27 75 6e 73 61 66 65 53 74 61 74 69 63 27 20 74 6f 20 70 61 73 73 20 6e 6f 6e 2d 6c 69 74 65 72 61 6c 20 76 61 6c 75 65 73 2c 20 62 75 74 0a 20 20 20 20 20 20 20 20 20 20 20 20 74 61 6b 65 20 63 61 72 65 20 74 6f 20 65 6e 73 75 72 65 20 70 61 67 65 20 73 65 63 75 72 69 74 79 2e 60 29 7d 29 28 6f 29 2b 74 5b 73 2b 31 5d 2c 74 5b 30 5d 29 2c 72 3a 6d 61 7d 29 2c 64 72 3d 6e 65 77 20 4d 61 70 2c 63 6c 3d 74 3d 3e 28 65 2c 2e 2e 2e 69 29 3d 3e 7b 63 6f 6e 73 74 20 6f 3d 69 2e 6c 65 6e 67 74 68 3b 6c 65 74 20 73 2c 72 3b 63 6f 6e 73 74 20 6e 3d Data Ascii: Value passed to 'literal' function must be a 'literal' result: ${r}. Use 'unsafeStatic' to pass non-literal values, but take care to ensure page security.`)})(o)+t[s+1],t[0]),r:ma}),dr=new Map,cl=t=>(e,...i)=>{const o=i.length;let s,r;const n=
2024-10-02 10:16:48 UTC	16384	IN	Data Raw: 20 20 20 20 20 20 20 24 7b 58 28 59 2e 78 73 29 7d 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 26 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 2d 2d 73 68 69 6d 6d 65 72 2d 68 65 69 67 68 74 3a 20 31 32 30 70 78 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 7d 0a 0a 20 20 20 20 2e 66 6f 6f 74 65 72 2d 73 68 69 6d 6d 65 72 20 7b 0a 20 20 20 20 20 20 20 20 2d 2d 73 68 69 6d 6d 65 72 2d 68 65 69 67 68 74 3a 20 34 39 35 70 78 3b 0a 20 20 20 20 20 20 20 20 2d 2d 73 68 69 6d 6d 65 72 2d 70 61 64 64 69 6e 67 3a 20 34 30 70 78 3b 0a 20 20 20 20 20 20 20 20 2d 2d 73 68 69 6d 6d 65 72 2d 62 6f 72 64 65 72 2d 72 61 64 69 75 73 3a 20 30 3b 0a 20 20 20 20 20 20 20 20 7a 2d 69 6e 64 65 78 3a 20 63 61 6c 63 28 76 Data Ascii: ${X(Y.xs)} { & { --shimmer-height: 120px; } } } .footer-shimmer { --shimmer-height: 495px; --shimmer-padding: 40px; --shimmer-border-radius: 0; z-index: calc(v
2024-10-02 10:16:48 UTC	16384	IN	Data Raw: 75 63 74 44 65 74 61 69 6c 73 28 65 2c 69 3d 21 31 29 7b 63 6f 6e 73 74 20 6f 3d 60 2f 61 70 69 2f 50 72 6f 64 75 63 74 73 44 65 74 61 69 6c 73 2f 47 65 74 50 72 6f 64 75 63 74 44 65 74 61 69 6c 73 42 79 49 64 2f 24 7b 65 7d 60 3b 72 65 74 75 72 6e 20 74 68 69 73 2e 67 65 74 4a 73 6f 6e 57 69 74 68 4d 61 72 6b 65 74 4c 6f 63 61 6c 65 28 6f 2c 7b 69 6e 63 6c 75 64 65 53 74 72 75 63 74 75 72 65 64 3a 69 7d 29 7d 67 65 74 50 64 70 50 61 67 65 28 65 29 7b 63 6f 6e 73 74 20 69 3d 6c 74 28 29 3b 69 66 28 69 3f 2e 70 72 6f 64 75 63 74 44 65 74 61 69 6c 73 26 26 65 2e 6c 6f 63 61 6c 65 43 6f 6d 70 61 72 65 28 69 2e 70 72 6f 64 75 63 74 44 65 74 61 69 6c 73 2e 70 72 6f 64 75 63 74 49 64 2c 76 6f 69 64 20 30 2c 7b 73 65 6e 73 69 74 69 76 69 74 79 3a 22 62 61 73 65 Data Ascii: uctDetails(e,i=!1){const o=`/api/ProductsDetails/GetProductDetailsById/${e}`;return this.getJsonWithMarketLocale(o,{includeStructured:i})}getPdpPage(e){const i=lt();if(i?.productDetails&&e.localeCompare(i.productDetails.productId,void 0,{sensitivity:"base
2024-10-02 10:16:48 UTC	16384	IN	Data Raw: 2d 74 79 70 65 3d 22 63 6f 6d 70 75 74 65 64 22 20 6d 65 64 69 61 2d 74 79 70 65 3d 22 61 70 70 73 22 20 63 61 74 65 67 6f 72 79 3d 22 24 7b 64 65 63 6f 64 65 55 52 49 43 6f 6d 70 6f 6e 65 6e 74 28 69 2e 70 61 72 61 6d 73 3f 2e 63 61 74 65 67 6f 72 79 7c 7c 22 22 29 7d 22 20 73 75 62 73 63 72 69 70 74 69 6f 6e 3d 22 24 7b 54 28 69 2e 71 75 65 72 79 3f 2e 73 75 62 73 63 72 69 70 74 69 6f 6e 29 7d 22 3e 3c 2f 63 6f 6c 6c 65 63 74 69 6f 6e 73 2d 70 61 67 65 3e 60 2c 28 29 3d 3e 46 28 28 29 3d 3e 69 6d 70 6f 72 74 28 22 2e 2f 63 6f 6c 6c 65 63 74 69 6f 6e 73 2d 30 65 66 39 33 63 66 30 2e 6a 73 22 29 2c 5b 22 61 73 73 65 74 73 2f 6a 73 2f 63 6f 6c 6c 65 63 74 69 6f 6e 73 2d 30 65 66 39 33 63 66 30 2e 6a 73 22 2c 22 61 73 73 65 74 73 2f 6a 73 2f 61 6c 65 72 74 Data Ascii: -type="computed" media-type="apps" category="${decodeURIComponent(i.params?.category\|\|"")}" subscription="${T(i.query?.subscription)}"></collections-page>`,()=>F(()=>import("./collections-0ef93cf0.js"),["assets/js/collections-0ef93cf0.js","assets/js/alert

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
80	192.168.2.16	49840	13.107.246.40	443	4912	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-02 10:16:48 UTC	642	OUT	GET /shared/edgeweb/img/office.b772a89.png HTTP/1.1 Host: edgestatic.azureedge.net Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://www.microsoft.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-10-02 10:16:48 UTC	678	IN	HTTP/1.1 200 OK Date: Wed, 02 Oct 2024 10:16:48 GMT Content-Type: image/png Content-Length: 8725 Connection: close Access-Control-Allow-Origin: * Cache-Control: public, max-age=31536000, immutable ETag: W/"2215-19180c4db59" Last-Modified: Fri, 23 Aug 2024 19:44:30 GMT Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Origin-Agent-Cluster: ?1 X-Content-Type-Options: nosniff X-Download-Options: noopen X-Frame-Options: SAMEORIGIN X-Permitted-Cross-Domain-Policies: none X-XSS-Protection: 0 x-azure-ref: 20241002T101648Z-15767c5fc55rv8zjq9dg0musxg000000098g00000000dgcq x-fd-int-roxy-purgeid: 0 X-Cache: TCP_MISS Accept-Ranges: bytes
2024-10-02 10:16:48 UTC	8725	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 80 00 00 00 80 08 06 00 00 00 c3 3e 61 cb 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 00 38 65 58 49 66 4d 4d 00 2a 00 00 00 08 00 01 87 69 00 04 00 00 00 01 00 00 00 1a 00 00 00 00 00 02 a0 02 00 04 00 00 00 01 00 00 00 80 a0 03 00 04 00 00 00 01 00 00 00 80 00 00 00 00 6b 46 26 4d 00 00 21 88 49 44 41 54 78 01 ed 9d 79 90 65 75 75 c7 cf 7d af 7b 16 36 65 19 16 45 48 ac 01 37 0c 8a 22 2a b1 14 15 45 8d 94 5b 14 ab 40 0d 0a 68 40 93 18 4d 2a 49 95 35 6e 31 7f 24 ff 68 19 63 45 53 a9 a8 89 65 2a 45 95 a2 22 22 b2 c8 22 a8 80 38 2a b2 2a c8 00 c3 2a b3 76 f7 7b 37 df cf 39 ef f4 bb fd a6 7b 98 77 bb 5f bf 37 e3 fb cd dc fb db 7f f7 dc f3 fd fe ce 6f b9 f7 be 2e ec f7 c8 ad 33 db eb 31 b3 3f Data Ascii: PNGIHDR>agAMAa8eXIfMMikF&M!IDATxyeuu}{6eEH7"E[@h@MI5n1$hcESeE"""8***v{79{w_7o.31?

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
81	192.168.2.16	49841	13.107.246.40	443	4912	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-02 10:16:48 UTC	678	OUT	GET /shared/cms/lrs1c69a1j/section-images/935d5e3b261649808ca8fbeb888a5d63.png HTTP/1.1 Host: edgestatic.azureedge.net Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://www.microsoft.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-10-02 10:16:48 UTC	701	IN	HTTP/1.1 200 OK Date: Wed, 02 Oct 2024 10:16:48 GMT Content-Type: image/png Content-Length: 600262 Connection: close Access-Control-Allow-Origin: * Cache-Control: public, max-age=31536000, immutable ETag: W/"928c6-190dc808597" Last-Modified: Mon, 22 Jul 2024 22:12:08 GMT Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Origin-Agent-Cluster: ?1 X-Content-Type-Options: nosniff X-Download-Options: noopen X-Frame-Options: SAMEORIGIN X-Permitted-Cross-Domain-Policies: none X-XSS-Protection: 0 x-azure-ref: 20241002T101648Z-15767c5fc55w69c2zvnrz0gmgw00000009kg000000008rvw x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-02 10:16:48 UTC	15683	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 06 22 00 00 03 26 08 06 00 00 00 78 8b 99 0a 00 00 00 09 70 48 59 73 00 00 16 25 00 00 16 25 01 49 52 24 f0 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 09 28 5b 49 44 41 54 78 01 ec fd 77 9c 1d 47 96 df 0b 9e b8 b6 2c aa 60 0a a6 08 6f 68 40 03 82 a0 f7 6d d9 be 7b 7a ba 29 cd 8e c6 49 2b cd be 79 9a 7e 9f 7d ab d5 1f a3 cf 13 c8 f7 3e d2 7e 3e bb ab b7 6f 47 9a 99 7d 2b 69 76 ac 66 9a dd d3 3d dd d3 96 ed d0 f4 0e 24 41 12 04 48 78 57 30 05 a0 0a 55 28 77 5d 6c 9c b8 19 79 23 f3 66 e6 cd 6b ab 0a f8 7d c9 c2 bd 37 4d 64 a4 89 c8 cc f3 8b 73 0e 11 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: PNGIHDR"&xpHYs%%IR$sRGBgAMAa([IDATxwG,`oh@m{z)I+y~}>~>oG}+ivf=$AHxW0U(w]ly#fk}7Mds
2024-10-02 10:16:48 UTC	16384	IN	Data Raw: aa fb b8 af b3 b6 c5 eb b2 0e 20 82 43 2f 89 e0 e7 f7 a0 75 82 b6 13 b4 bd 20 3c 76 15 cf 87 ac 5e ae e6 21 8e 79 ff ae 35 5f f8 cf b9 6c f2 f4 06 3c d7 b8 9b 8a d1 2e ed 63 6d 42 2a 85 6e a7 55 b4 b7 9d b6 b2 f4 56 f4 c7 8b ad 57 0a bf eb d5 b3 27 c1 7d 75 f8 d5 7a 6d 23 6a 5c 49 ed 3b 1e b5 ae e0 66 ce 2f 68 15 5f 78 e2 e1 a6 85 08 ce eb c9 61 d6 4b a5 d2 73 ab 56 ad fa 04 0f 58 ee ea ea d2 27 95 05 09 25 3c e8 ef 4a 88 d0 d1 56 f8 bb b2 31 ea 4f 2b 3f 6d f9 ae 6a bd 87 5a df af b7 66 bb 60 68 7e b8 39 b8 ee 71 44 08 fe 2a ec ac f4 4e 2c 36 77 39 23 42 18 01 c2 c0 ae 55 26 f1 0c e7 87 60 af 08 55 e6 a0 2e b0 03 96 9b 7b 06 56 d3 6f af db 4e 6b 06 ba 69 d5 50 37 ad 5c d1 45 a7 cf 5e a4 65 74 9a 6e da 90 a1 54 5f 1f e5 b3 cb 68 66 d9 8d 54 c8 b6 26 29 50 Data Ascii: C/u <v^!y5_l<.cmBnUVW'}uzm#j\I;f/h_xaKsVX'%<JV1O+?mjZf`h~9qDN,6w9#BU&`U.{VoNkiP7\E^etnT_hfT&)P
2024-10-02 10:16:48 UTC	16384	IN	Data Raw: 1e 08 6d d6 e3 90 f1 66 80 b4 2f 4f 84 ff 80 c0 3b a2 83 40 88 00 75 c3 a1 99 8c 17 04 37 60 fe 1e a4 2c 72 a3 e7 4f cb 2d 8a ba ba ba dc f0 4c 8e 1b 95 8e ef 66 77 26 a7 4f 9f 6e 4b 27 c0 55 86 c2 01 00 00 00 00 00 00 00 00 00 00 ae 0f a2 2d 61 93 57 c6 69 7c ec 12 6d bf 63 17 f5 2f 19 a0 4c 26 4b 83 83 cb 68 db 4d b7 d2 95 2b 63 34 7a e1 1c cd 27 3c 58 79 ed da b5 da 4e c8 89 aa f9 8f bd 22 78 60 33 47 5a b1 43 bf 9b 1c 11 c6 2b 82 e1 e8 2d c6 23 c2 f9 d3 61 9e 1c 41 a2 8d 69 b6 41 10 29 02 a0 7e dc 46 ce f9 21 b8 f1 da ea a2 42 c7 61 33 ca a3 d5 01 e8 f5 54 c7 60 62 b9 b9 c9 aa b9 23 31 42 04 b5 a9 13 40 8e 08 00 00 00 00 00 00 00 00 00 00 00 ca 4c 4f 4d 51 b1 58 a4 ee ee 6e cf f4 25 03 83 1c 3a 9d a6 a6 ae d2 7c c2 e1 db 4d e4 14 b6 1b 3a f6 43 e9 d8 Data Ascii: mf/O;@u7`,rO-Lfw&OnK'U-aWi\|mc/L&KhM+c4z'<XyN"x`3GZC+-#aAiA)~F!Ba3T`b#1B@LOMQXn%:\|M:C
2024-10-02 10:16:48 UTC	16384	IN	Data Raw: 72 a4 f0 86 77 99 f3 06 f1 2e 9c a6 88 15 e6 b8 6a c5 94 7f f3 b5 c3 95 55 fe ba 5b 23 8b 10 2e 75 23 62 78 87 f6 53 f5 c9 87 cc 72 9f 11 8f e6 a2 38 14 a8 8f ec 9e 6b 28 7f e5 75 74 4e fd 85 29 14 0a 85 42 a1 50 28 14 0a 85 42 a1 b8 60 e1 5b 71 3c 3b 41 bd 5e a7 6a b5 1a 7e 2a 86 2a f1 3a 3b cf 0a d1 fb 5b b6 6c 71 c4 83 8a 40 c4 08 f0 8b 58 82 6f 34 82 43 cb 25 22 78 35 3c b6 08 c4 8b 0b f8 a0 50 90 f0 35 4e c4 ea 42 85 08 c5 59 41 7c ab c5 15 45 dc e8 b8 e1 f1 5d 82 55 8b 42 29 4b f1 e5 06 65 d3 74 2a 3e 44 88 23 47 8e f0 67 a5 e0 9f 43 dd d3 ed e9 a5 e2 3b 3e 48 d9 eb 6f 67 52 1d 84 3d 7f 82 9c 11 85 16 04 6c 3d d1 3b 40 c5 77 7d c8 90 d5 d7 b5 10 ef de f8 68 74 44 b0 74 02 eb 05 b8 4f ca e6 c2 58 0a 31 e4 8b 81 8b a5 78 9e ba 7a 02 92 5e 5c 56 81 3c Data Ascii: rw.jU[#.u#bxSr8k(utN)BP(B`[q<;A^j~*:;[lq@Xo4C%"x5<P5NBYA\|E]UB)Ket>D#GgC;>HogR=l=;@w}htDtOX1xz^\V<
2024-10-02 10:16:48 UTC	16384	IN	Data Raw: 74 c8 10 fe e4 7b 1e f5 f5 0d d0 73 fb 0e 52 09 f1 22 7c 8f c5 88 b1 13 d3 34 3b 55 59 55 21 c2 e4 0d d6 10 2c 40 80 47 8e 7b d7 31 3c b3 2f 1c 34 2c 21 42 2f 3d f8 ed 48 2c 63 8a 5d 3a 3c fe c0 6d 13 be eb f8 7c 75 b1 a8 10 21 ca 10 08 14 88 0e b6 f8 60 05 f8 e0 e8 e3 a6 82 51 c9 52 f9 3e 82 84 e0 3b 44 08 d9 2f 8c 0b e1 1b c5 ca 15 93 1a 85 62 b5 01 4b 08 88 10 ff ee 4f 67 68 d3 a0 4b 3f fe fa 22 dd b1 27 47 c5 dc 85 d1 01 55 6a 3e 1d 3d 5d a7 e7 0e d7 e8 a7 7f 67 8a fe d9 3b ba e9 ad d7 e5 69 b0 47 3b 58 85 62 a9 88 bb 59 b2 dd 31 d9 eb 93 82 56 c7 c5 0a 7d c9 51 28 14 0a 85 42 a1 50 28 14 0a c5 ea c1 1a 8f 52 ab 18 81 b8 0f a5 f9 79 3a f4 da 01 58 17 84 6e 99 aa 74 f8 d0 7e ba fe ed 5b a8 bb bb 27 4a 06 43 db 62 5f 8e 56 1b 08 56 6d 4f 66 c7 64 78 0a Data Ascii: t{sR"\|4;UYU!,@G{1</4,!B/=H,c]:<m\|u!`QR>;D/bKOghK?"'GUj>=]g;iG;XbY1V}Q(BP(Ry:Xnt~['JCb_VVmOfdx
2024-10-02 10:16:48 UTC	16384	IN	Data Raw: a5 f7 e4 14 2d 87 4a 85 f8 4e 4a f2 4d 17 12 ec ef c7 b2 42 91 94 d7 5c b3 9d 10 f4 89 a7 90 e2 b2 89 f6 50 5c f4 ad fd 1a d7 63 0b 16 5e 8b 48 82 cd 5e 48 c0 73 9e 42 f1 38 e0 ba db 58 b9 c5 ca c9 0f dd 94 e2 b7 e7 f8 61 b9 85 82 46 fc 3a 12 85 94 58 3b 08 4f e2 fb 1e 2d 5e 2a 6c 98 1c 5c 53 5d 84 ac 58 da e1 f5 3b 96 90 10 c5 36 e2 54 c2 f3 98 ca ae f3 77 3f ba 16 87 ec 06 10 88 f4 5e 3d e1 39 16 8a 5b 4d 79 6b 6a 7f ed 2e a3 b9 cf 48 15 21 50 3f f5 c6 39 50 57 0a 85 42 a1 50 28 02 44 43 c4 45 5e b1 f0 c8 1d dc d0 cd 9f 08 67 f0 ca bf dc 80 45 84 88 11 00 44 08 00 93 e1 b1 34 7c b4 53 2c 16 23 11 02 61 04 e0 c1 c7 0e 56 2d 4b 58 44 60 a2 3d 3e 86 eb f6 43 8b 08 47 c5 88 d5 43 a2 10 61 2a 80 2b 02 15 84 2f 62 ba 42 8d e1 07 59 2e 99 18 a8 74 11 22 8c 00 Data Ascii: -JNJMB\P\c^H^HsB8XaF:X;O-^l\S]X;6Tw?^=9[Mykj.H!P?9PWBP(DCE^gED4\|S,#aV-KXD`=>CGCa+/bBY.t"
2024-10-02 10:16:48 UTC	16384	IN	Data Raw: c6 88 f6 ce f7 e9 f2 da 88 7a e6 f7 e2 c0 6f f0 d9 01 f7 14 c2 e3 26 cc b0 9d 3d 7b 86 16 0d 01 00 47 d5 f0 09 01 72 60 cd bc ab 73 b3 73 d7 cc 51 35 04 63 35 cc 43 5d b8 78 d1 6a 45 1c 3a 74 88 96 96 9c cf 94 55 93 7e 6d f2 86 fc 0c 06 03 ba 31 84 7d 40 78 62 51 47 c4 98 af 33 e0 e7 7e 57 f1 5d f5 3d ae 52 aa 08 fe e5 ef f1 b5 5d f8 a4 c4 a8 2b 42 3b bc 9c 7e e6 df 0b 52 24 1a 26 97 47 35 d8 5a 0a 1a 4f 7c 9f df db 3c 60 29 fe 6d 93 3b e9 31 f2 f4 ba 64 0b 42 16 74 f3 b9 6d 48 fe d8 58 00 50 37 7f aa 42 5c c9 98 df 96 2e a5 63 7a 1e 47 1a 56 8c 9a 4a ce 59 ba 90 45 01 1e 66 9f ba 70 2d b9 a0 1b 91 b5 46 d0 a8 a3 52 97 25 97 77 bd 2d 0d 6b bd f5 e9 27 79 3c cc dc 32 33 14 1d 73 8f 7f 96 fb 7d 4b ce 92 18 74 5e eb 1e a4 96 bc 5d aa 41 98 91 13 da 69 f1 b5 Data Ascii: zo&={Gr`ssQ5c5C]xjE:tU~m1}@xbQG3~W]=R]+B;~R$&G5ZO\|<`)m;1dBtmHXP7B\.czGVJYEfp-FR%w-k'y<23s}Kt^]Ai
2024-10-02 10:16:48 UTC	16384	IN	Data Raw: 7e 93 1c df e3 e8 a8 9a 41 3b 29 f9 b8 25 4e 5b 6c 0b a8 e2 71 35 f4 43 a5 9a a7 a0 a7 8e 4b 15 08 09 dd 08 33 49 b4 18 94 a4 b6 87 ff d2 1c 8c f9 27 0f 11 d3 d4 41 09 30 0b c9 66 cf 26 bf 15 4d 5c 14 fb 89 26 d6 65 53 b6 54 b5 5b 6b 86 32 ee 36 ed 43 c4 e7 c6 39 0e 1d de 5e 25 ee 49 5b fa b9 b8 3e eb 1a 03 6b 80 ca b7 59 31 b4 6e 1b 7b d3 30 f2 a4 78 30 0d 23 c6 b5 50 0c 75 f5 a6 9c 64 e9 93 2c ab f6 fe 1b e7 f0 74 0e b0 a3 9f ec bb 1c 55 a5 42 5a a5 ee 2c f3 52 4b a0 37 bb 17 ae b5 74 4b 67 22 c7 8d cf b5 98 03 dd 23 ca 9b 02 4c e7 9b 70 22 5c 95 e1 5e 2d 13 6f e4 d6 03 bc 7e de 08 f9 f6 75 13 c6 3a 15 e7 20 67 aa b0 b2 87 4f 78 0c b1 0e 8f f9 00 09 3b 8d 0e d5 28 6c 2f 11 cf e9 de 98 63 a3 7d c2 48 eb bb 84 5c a5 e0 35 ad ec e1 82 78 28 df 87 b2 6b 06 Data Ascii: ~A;)%N[lq5CK3I'A0f&M\&eST[k26C9^%I[>kY1n{0x0#Pud,tUBZ,RK7tKg"#Lp"\^-o~u: gOx;(l/c}H\5x(k
2024-10-02 10:16:48 UTC	16384	IN	Data Raw: ff fd 29 fe 1a 44 44 6f ae 08 9c bf d4 25 e9 2e 10 ee 6b 9e 84 08 4e ab a9 e5 35 d3 ba 09 d0 64 f7 a5 d9 89 68 61 7e f2 1a a8 09 ca a8 29 9e 4b c1 48 9f 09 da 31 d1 e1 3f 91 ad c2 18 a2 e2 9b 94 e4 43 80 6c e5 38 74 18 98 13 82 42 f6 5b 0f 44 c5 19 62 e7 45 ae 56 f9 d4 b2 52 7c 82 39 e6 75 07 6b b6 b5 2f 85 53 c3 be 5e a4 89 95 3c bf b9 c8 f7 5d 35 e2 2b f4 95 96 38 24 10 b9 5d 69 a4 4b 39 04 5b 8b f6 55 f1 53 a9 68 8a cf f7 21 dd 98 e0 49 c4 e4 ff f7 fd a7 01 c6 2a 37 1e 4a 2d a6 b6 a9 72 6a 69 7b 30 43 b4 83 db e2 49 ef 67 20 37 ca 85 2c 13 8f e4 e7 b4 68 2a 0e 24 d4 c8 93 5b 49 1e 35 03 dd de 94 4e 45 01 b7 e7 b5 14 e6 9d 5a 90 51 be 85 6c d8 40 70 a8 d4 dc 91 25 2a 38 5f d6 bf 81 8e f3 b9 0d e8 cd 2a 51 ed 23 f2 6d 20 da a2 0a d7 f9 0d 9c be 55 18 e0 Data Ascii: )DDo%.kN5dha~)KH1?Cl8tB[DbEVR\|9uk/S^<]5+8$]iK9[USh!I7J-rji{0CIg 7,h$[I5NEZQl@p%8_Q#m U
2024-10-02 10:16:48 UTC	16384	IN	Data Raw: ee 20 ab 25 81 09 e3 68 3c b6 24 85 8f c4 4c 90 fb 76 f7 38 a0 88 9e 25 18 0c a8 ab 7b 06 58 36 e1 c7 06 d0 35 fd 6e 6d a5 b6 a4 84 d5 90 a8 9c 06 45 e5 c1 2f 2c 6f 01 64 0c a1 0e 1c fc 4a 98 70 93 89 dd f1 6e 1f 83 ca ed 74 b7 66 a5 3c e9 a1 c8 69 12 38 c7 be 7e 29 5d b9 7b a9 72 66 73 04 bf 16 70 df 66 3d 88 4f dd 5c 8a 39 51 c5 fb 36 0d d6 f4 ba c1 88 9f 37 e0 f7 0d 9b 3e d1 b0 52 d6 ef 03 7c 4f da e2 10 35 58 6c de 27 57 fb 3c d9 bd 6b 9a c1 74 2d 9c 4b 3a 6a 66 64 80 ed cb 34 36 f5 61 12 53 53 3a 4b 6b b4 aa fb c4 86 3a d8 31 b8 5c c4 5a 60 a4 b5 0c 29 70 26 90 22 12 2b 6d bf 38 75 e0 b9 25 13 bc a6 82 fd 84 56 01 34 19 3c e0 01 e0 4d 5b e7 a8 b8 04 93 5e 00 cf a7 ce 8c 57 30 f5 e5 c2 d7 9e ac 80 38 10 4b 39 2d 06 4b 5c 54 42 d3 22 e6 17 f7 e0 a8 40 Data Ascii: %h<$Lv8%{X65nmE/,odJpntf<i8~)]{rfspf=O\9Q67>R\|O5Xl'W<kt-K:jfd46aSS:Kk:1\Z`)p&"+m8u%V4<M[^W08K9-K\TB"@

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
82	192.168.2.16	49842	13.107.246.40	443	4912	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-02 10:16:48 UTC	678	OUT	GET /shared/cms/lrs1c69a1j/section-images/38c8c879d3854390897db9c4b7f3a682.jpg HTTP/1.1 Host: edgestatic.azureedge.net Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://www.microsoft.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-10-02 10:16:48 UTC	702	IN	HTTP/1.1 200 OK Date: Wed, 02 Oct 2024 10:16:48 GMT Content-Type: image/jpeg Content-Length: 157074 Connection: close Access-Control-Allow-Origin: * Cache-Control: public, max-age=31536000, immutable ETag: W/"26592-18c5b6d7e6c" Last-Modified: Tue, 12 Dec 2023 00:29:11 GMT Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Origin-Agent-Cluster: ?1 X-Content-Type-Options: nosniff X-Download-Options: noopen X-Frame-Options: SAMEORIGIN X-Permitted-Cross-Domain-Policies: none X-XSS-Protection: 0 x-azure-ref: 20241002T101648Z-15767c5fc55qdcd62bsn50hd6s00000009700000000044e8 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-02 10:16:48 UTC	15682	IN	Data Raw: ff d8 ff e1 00 18 45 78 69 66 00 00 49 49 2a 00 08 00 00 00 00 00 00 00 00 00 00 00 ff ec 00 11 44 75 63 6b 79 00 01 00 04 00 00 00 50 00 00 ff e1 03 4c 68 74 74 70 3a 2f 2f 6e 73 2e 61 64 6f 62 65 2e 63 6f 6d 2f 78 61 70 2f 31 2e 30 2f 00 3c 3f 78 70 61 63 6b 65 74 20 62 65 67 69 6e 3d 22 ef bb bf 22 20 69 64 3d 22 57 35 4d 30 4d 70 43 65 68 69 48 7a 72 65 53 7a 4e 54 63 7a 6b 63 39 64 22 3f 3e 20 3c 78 3a 78 6d 70 6d 65 74 61 20 78 6d 6c 6e 73 3a 78 3d 22 61 64 6f 62 65 3a 6e 73 3a 6d 65 74 61 2f 22 20 78 3a 78 6d 70 74 6b 3d 22 41 64 6f 62 65 20 58 4d 50 20 43 6f 72 65 20 39 2e 31 2d 63 30 30 31 20 37 39 2e 61 38 64 34 37 35 33 34 39 2c 20 32 30 32 33 2f 30 33 2f 32 33 2d 31 33 3a 30 35 3a 34 35 20 20 20 20 20 20 20 20 22 3e 20 3c 72 64 66 3a 52 44 46 Data Ascii: ExifII*DuckyPLhttp://ns.adobe.com/xap/1.0/<?xpacket begin="" id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 9.1-c001 79.a8d475349, 2023/03/23-13:05:45 "> <rdf:RDF
2024-10-02 10:16:48 UTC	16384	IN	Data Raw: 13 d3 e5 f2 cf ba 4f 5b 87 cf 8f be 1b fb d8 b7 fd a3 3f a1 9f c4 27 43 2f 96 7d d2 7a dc 3e 7c 7d f0 df de bc 1f b4 4e fd 0d df 88 4e 86 5f 2c fb a4 f5 98 7c f8 fb e1 bf bd 58 7f 68 5d fa 13 bf 10 9d 0c be 59 f7 4a fa cc 3e 7c 7d f0 df de ac 5f b4 0f fd 09 df 88 4e 86 5f 2c fb a4 f5 98 7c f8 fb e1 bf bd 38 fe 7f 7f e8 4e fc 42 74 32 f9 67 dd 27 ac c3 e7 c7 df 03 f7 a4 cf 9f a4 fd 05 df 88 4e 86 5f 2c fb a4 f5 98 7c f8 fb e1 bf bd 16 fc fb 27 e8 2f fc 42 74 27 e5 9f 74 9e af 1f 9e 3d f0 df de 80 f9 f6 5f d0 5f f8 84 e8 4f cb 3e e9 3d 5e 3f 3c 7b e1 bf bc ff 00 ff 00 6e 4b fa 0b ff 00 10 a7 46 7e 59 f7 49 ea f1 f9 e3 df 03 f7 9c 7e 7b 9b f4 07 fe 21 3a 33 f2 cf ba 4f 57 8f cf 1e f8 6f ef 35 df 3d 4d fa 03 ff 00 10 9d 19 f9 67 dd 27 ab c7 e7 8f 7c 37 f7 98 Data Ascii: O[?'C/}z>\|}NN_,\|Xh]YJ>\|}_N_,\|8NBt2g'N_,\|'/Bt't=__O>=^?<{nKF~YI~{!:3OWo5=Mg'\|7
2024-10-02 10:16:48 UTC	16384	IN	Data Raw: 14 a5 b8 22 52 65 bc 8b 56 89 96 2b 65 24 58 16 ad 9a 4d cd a2 bd ac cc 24 5a a2 22 5b 54 66 91 7b 11 10 73 4e 2a 88 96 ed 51 94 5c d4 44 4b 74 a3 34 8b 9a 55 b4 a4 cb 55 b4 a2 39 a9 12 94 99 6a b6 94 91 6a b6 89 b9 ab 51 29 30 f8 2b 58 17 ae 65 c2 95 6b 79 3a 52 ca 5d ad 3b 14 b6 e2 16 0d 05 49 96 aa 17 6b 4e 80 14 b5 a5 83 54 b6 a9 66 b3 91 66 d6 21 60 da 6a 46 a9 50 d1 a6 89 65 2e 1b a3 0e 95 2d 69 50 ce 45 2d a5 5a de 44 66 5d 0d 61 a8 c3 05 57 4b a1 8c d1 87 5a 96 b1 0e 86 b3 45 75 2c aa c1 aa 2d 2a d6 fb c8 d5 2a 1b c8 a0 a8 6f 22 2d 2e d6 74 28 52 cd 67 42 2d 2c d6 d2 98 29 6d 2a d6 f8 52 ec 95 da d0 14 5a 59 ad aa 14 b0 65 14 6a 21 50 0a 96 ab 35 9c 8a 5a d2 ed 60 52 db 8c 55 6b 54 b5 54 37 91 4b 6a 96 6b 74 78 14 69 70 34 50 20 b0 6d 02 8a ab 5a Data Ascii: "ReV+e$XM$Z"[Tf{sNQ\DKt4UU9jjQ)0+Xeky:R];IkNTff!`jFPe.-iPE-ZDf]aWKZEu,-o"-.t(RgB-,)mRZYej!P5Z`RUkTT7Kjktxip4P mZ
2024-10-02 10:16:48 UTC	16384	IN	Data Raw: 8d 23 e1 30 87 07 53 78 1d de 59 65 73 1a 65 cb cd 7e b5 bb 96 51 d1 ec 9c 78 f7 65 f8 3e 31 2f f1 f5 df ae 61 96 65 56 56 99 cd b5 b5 d5 97 ae 0f d6 96 96 5b d7 37 0d 92 18 db 10 91 ae 79 89 ee 85 ac 71 ab 81 c5 ee 7d 0b da c2 31 3a f9 bc 7b bf ab 79 da a9 98 8f a7 d3 de fe 98 ff 00 0a 7f c4 c5 df 7e d9 2d db 38 93 2c 87 29 cf ec 25 10 43 3c 30 cb 04 37 ce dc 92 69 3b 16 bf 79 ae 31 44 23 74 85 a6 8d 2f 60 21 bb f1 ef 31 99 9e 12 fd 0f e9 7f a8 e5 e6 62 b3 8a ca 3c 7e 9e de f7 ec 70 6a 05 15 7d 73 01 54 1a 06 d4 0c ac 45 81 5d 32 04 8c 64 4c e9 5d 00 80 ad 10 3d 50 61 24 20 54 02 05 28 15 00 80 40 20 c2 01 41 94 14 a2 05 40 2d 58 ca 05 50 a4 51 04 ce 94 08 e0 8a 5a 2b 60 a2 5a 0a 25 94 28 96 a3 52 88 42 81 68 ab 34 c4 08 42 05 21 50 84 20 42 28 83 30 2a Data Ascii: #0SxYese~Qxe>1/aeVV[7yq}1:{y~-8,)%C<07i;y1D#t/`!1b<~pj}sTE]2dL]=Pa$ T(@ A@-XPQZ+`Z%(RBh4B!P B(0*
2024-10-02 10:16:48 UTC	16384	IN	Data Raw: fd 4b fd d8 7f 84 fc 53 31 f7 85 5f fe 3d 93 8a 6a fd 5f 27 e3 53 a9 b3 f2 cf bf f0 23 cb 7e a3 fe ec 3f c2 7e 2e fa ae 56 f5 d2 ad 28 a7 08 ab 34 f2 a1 4a 82 68 11 55 69 c2 88 2a d3 cb 52 a2 a8 3a 7a d0 a5 9b ca a4 aa 8d 38 e1 ad 45 38 28 b1 4a 04 2c e0 f5 a5 2c 1c 53 04 53 a2 9c 14 a5 89 36 05 4a 0d c9 54 58 38 03 a9 14 ed 08 a7 a0 51 4e 06 9d ba 90 50 04 69 40 34 05 0a 3e ef 2e 84 68 fb a8 1c 0a 23 50 a0 08 28 00 a2 8b 67 01 16 d4 03 42 51 67 01 03 80 8a 70 31 41 40 11 68 e1 aa 2d 1e 9a 11 a3 86 e1 81 40 e0 29 4d 51 83 71 28 a6 dd f1 22 98 37 42 06 0c e8 2a 2a 8d 6e 2a ac 2a 1a 8b 47 01 16 94 08 b1 07 14 51 26 0c 0d 39 90 54 53 a1 10 e1 14 c0 55 11 a0 04 14 14 c3 42 29 c0 14 3a 39 11 16 8c 01 a9 41 d0 00 d4 83 50 36 e8 40 c0 2c ce 36 b1 26 a0 4d 05 98 Data Ascii: KS1_=j_'S#~?~.V(4JhUiR:z8E8(J,,SS6JTX8QNPi@4>.h#P(gBQgp1A@h-@)MQq("7Bn*GQ&9TSUB):9AP6@,6&M
2024-10-02 10:16:48 UTC	16384	IN	Data Raw: 4e 83 4a 68 44 99 7e 69 ef c7 f8 69 ee f3 be 6e 19 cc 32 db dc a2 cb 87 f8 a5 ac 7c 9c 3b c6 f6 36 b1 c7 79 69 74 6a e6 f6 c6 30 c3 71 03 dd 51 24 4f 34 20 97 30 b2 5d d9 1b db 6b 7e 70 9e e7 cf f3 5e 53 0d fc 66 26 38 bf 86 fc 71 fc 3f f7 cb c0 d7 19 b5 b6 75 dd ce 77 25 ae 48 e9 0d f6 79 96 d9 4f 7f 97 08 63 ad 6e 3d 6e dd 8e 8d b1 96 f9 55 79 69 1a 1e 1a ea b4 7d 49 cf 1c a3 83 f2 99 79 5d cc 32 98 98 7c 0d f2 12 03 98 fa b1 d8 b4 83 50 6b a1 70 ca 25 d2 22 bb 7b 5c ce 71 a1 c5 72 98 75 84 77 8e d5 97 4a 66 fe 24 61 4d 4a 29 c3 ab ce 88 e8 91 ad 63 5a 19 33 66 12 b5 af 71 68 70 dd 76 23 74 ef 00 6a 39 30 c5 48 9b 6b 38 88 ec 9b 75 c4 eb 00 fd e7 5a 4c f6 76 4e 6e e3 a7 15 ed 77 1e 03 ea d8 c6 01 e5 ae dd d8 0b 6b e5 54 66 a7 99 19 61 13 fc be 3d df 49 Data Ascii: NJhD~iin2\|;6yitj0qQ$O4 0]k~p^Sf&8q?uw%HyOcn=nUyi}Iy]2\|Pkp%"{\qruwJf$aMJ)cZ3fqhpv#tj90Hk8uZLvNnwkTfa=I
2024-10-02 10:16:48 UTC	16384	IN	Data Raw: 58 9f 33 87 b6 19 37 79 bc 34 7e d5 6f 6f 73 73 23 c8 6c 11 b0 da 79 4e 70 3b 8d 1b d7 2d 21 ce a1 dd ab 48 a0 d3 a0 1d 46 12 be a7 1e c8 8f bb e2 fc c3 c5 5c 73 9b 66 3c 5f 9e d8 e5 b9 3f 11 5e 5e db 3c bd f9 64 d2 70 7c 10 b4 3d 8d 7c 4c 88 4f 1f ac 96 b5 a4 0d ea b8 8a 51 cf 3a 47 ae 33 a8 a7 c3 dd de d5 b9 95 73 ec 7a a5 e7 10 f1 ed 98 2f 8f bb dc e6 e2 92 0f 83 0d bd e5 59 52 31 39 5e 49 7f 43 a3 e0 b8 f3 eb 5a 9c ea 3e 9f 06 7a b9 5f f2 b8 1b c6 fd ed c5 35 63 e0 8c ce 3b 56 90 18 f8 b8 7b 32 12 b4 3a b4 6e f4 d9 01 1a a8 77 58 ee 5a 2e 5a b2 fa 7f c2 f5 f7 22 bf 2b cb c5 de 07 7e 91 c5 1c 56 dc 15 c4 4e 94 92 1f 70 cc 9e b4 69 dd d0 d7 f0 ab 1b 5a bc 51 c4 ee d1 ae 0e 15 a3 96 27 3c be 9f f0 eb 1e 63 7b d9 8f 87 e0 f6 bc b3 8e 3b eb b8 b6 82 ea f3 Data Ascii: X37y4~ooss#lyNp;-!HF\sf<_?^^<dp\|=\|LOQ:G3sz/YR19^ICZ>z_5c;V{2:nwXZ.Z"+~VNpiZQ'<c{;
2024-10-02 10:16:48 UTC	16384	IN	Data Raw: 77 09 1d 21 95 fe 71 f1 a9 af 71 99 d9 d9 72 3b 2d e1 4a 8c 18 31 1f 18 f8 d5 ea 6e 27 43 65 ca ec b3 85 8e a8 f9 3c a2 af 53 71 8e 86 ca 0f ca f8 5f 63 3e c8 f8 d3 a9 b8 74 36 5c af ca 78 5e 86 81 82 b5 c2 a7 c6 ac 6e ee 33 3e 5b 61 ca ec a7 86 75 06 75 9f 1a bd 5d c6 3d 36 ca 0e ca 78 6f ea 69 af 13 e3 4e ae 69 e9 76 6d cc fc 9f 87 48 c1 cd c7 46 25 6a 37 73 62 7c ae cb 94 e4 fc 3c 3e 30 af f3 8a bd 6c d9 9f 2b b2 8b f2 7e 1d 3a 1e 29 c8 4a 46 ee 6c cf 95 da e6 83 f2 7c 8b 53 c7 26 2b 5d 5c d9 9f 2b b4 89 c9 b2 2d 6f 18 e9 a9 4e ae 64 79 4d ae 69 3b 2a c8 47 df 07 d9 27 53 34 9f 29 b5 cd 07 e5 d9 08 fb f3 7e c9 5e a6 69 3e 5f 6a 3d ae 77 65 d9 15 31 99 b4 e7 4e a6 6c 74 36 f9 a2 ec bf 21 d7 2b 7e c9 3a 99 93 b3 b5 cd 13 97 e4 43 ef ad a7 f3 95 ea 66 cf Data Ascii: w!qqr;-J1n'Ce<Sq_c>t6\x^n3>[auu]=6xoiNivmHF%j7sb\|<>0l+~:)JFl\|S&+]\+-oNdyMi;*G'S4)~^i>_j=we1Nlt6!+~:Cf
2024-10-02 10:16:48 UTC	16384	IN	Data Raw: 9c 69 e6 ba 33 87 f3 5a 6b e0 59 d2 d7 51 71 9a e8 24 4a 2b a8 b5 e3 fb 0a 69 5e aa ad cd 3f ba 91 c3 eb b1 eb a2 69 5e b4 18 e6 87 55 bc c3 67 c2 4d 29 d5 1f ad 0d 2a 62 92 bc ae dd f6 de 15 d2 75 7b 87 eb 67 93 41 0c c0 6d ac 67 fe f9 34 93 b9 f4 fa 49 bf 5a 60 37 9b 20 ae b2 5a 7f b4 e5 34 a7 52 58 73 26 7d 51 e7 89 ee 1d 61 aa e9 5e a4 fd 20 de bf 1e b2 d0 76 11 bb e0 35 f6 94 a5 d6 61 7a d3 f0 69 c8 00 77 84 34 29 49 aa 01 bb 7f 27 53 fd da 25 2e b4 df 7c d6 fc 27 b1 bc ee 03 db 90 2b 4c ce 7f 52 2e cc a0 03 ee f1 83 b3 b4 6f cb 29 46 ae f4 7f 59 c1 5f bb b0 72 07 46 7d a2 53 4a 6b 86 fe b2 8b 54 bd 67 c4 15 d2 bd 48 6f eb 16 7c 52 e3 5d 04 07 11 d6 1a 13 49 ae 07 eb 16 fd 56 3a cb 5f e3 4d 32 6a 29 cc 18 35 91 ce cf 1b 4a 69 93 51 4e 62 d3 cb cd 87 Data Ascii: i3ZkYQq$J+i^?i^UgM)*bu{gAmg4IZ`7 Z4RXs&}Qa^ v5aziw4)I'S%.\|'+LR.o)FY_rF}SJkTgHo\|R]IV:_M2j)5JiQNb
2024-10-02 10:16:48 UTC	10320	IN	Data Raw: 00 f7 14 b5 8c 61 23 24 95 c0 bf a1 c1 4b 6e 22 18 64 9b 6c 87 90 bc 25 ad 63 2c ed 64 d6 64 1f 5d 54 b4 d1 0d ed ce b9 24 4b 3a 53 dc 3b 6a fc 77 a5 9d 39 e4 0c 8e d3 be ee 9c 52 d3 4a 66 43 ad d5 e7 05 2d bd 10 53 2d 34 3b aa be 34 b3 49 3b 67 ea 92 9e ce 75 2d ad 30 3d 62 5d 52 b7 a4 9f 1a 27 4e 39 17 b7 71 d2 e6 bb ec bd c2 8b a1 86 5d 74 6f f4 fc 68 ba 7e 9c 08 67 3b 07 41 72 8d 69 21 b8 78 ff 00 f9 84 7b 88 46 11 f4 82 f6 f2 7d 58 fa fa a5 b5 a2 07 ac 3a 98 97 a5 ac 61 65 f5 8e 57 f4 a5 ac 6d 33 d6 06 3e 53 bd b5 26 4e 92 2e 9c 1f 8c e3 ce 12 da 8d ba 44 c9 5d 15 07 95 49 96 a3 12 b9 e4 e9 c5 49 96 a2 13 2e e4 52 da a4 f7 8e ca 15 2d 74 97 78 f3 f4 29 6d 69 61 79 e5 09 66 94 cb cd 6b ed 60 a5 b5 a4 bb e7 9d 4b 5d 25 2e 3a f0 4b 5a 2e ff 00 2a 96 ba Data Ascii: a#$Kn"dl%c,dd]T$K:S;jw9RJfC-S-4;4I;gu-0=b]R'N9q]toh~g;Ari!x{F}X:aeWm3>S&N.D]II.R-tx)miayfk`K]%.:KZ.*

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
83	192.168.2.16	49843	13.107.246.40	443	4912	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-02 10:16:48 UTC	678	OUT	GET /shared/cms/lrs1c69a1j/section-images/2068e415cbe2442b82f2fba24ee0c202.png HTTP/1.1 Host: edgestatic.azureedge.net Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://www.microsoft.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-10-02 10:16:48 UTC	701	IN	HTTP/1.1 200 OK Date: Wed, 02 Oct 2024 10:16:48 GMT Content-Type: image/png Content-Length: 358295 Connection: close Access-Control-Allow-Origin: * Cache-Control: public, max-age=31536000, immutable ETag: W/"57797-190c6ac82c8" Last-Modified: Thu, 18 Jul 2024 16:28:32 GMT Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Origin-Agent-Cluster: ?1 X-Content-Type-Options: nosniff X-Download-Options: noopen X-Frame-Options: SAMEORIGIN X-Permitted-Cross-Domain-Policies: none X-XSS-Protection: 0 x-azure-ref: 20241002T101648Z-15767c5fc55lghvzbxktxfqntw0000000930000000005mya x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-02 10:16:48 UTC	15683	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 0c a8 00 00 09 78 08 03 00 00 00 ce 29 9e bd 00 00 02 f7 50 4c 54 45 00 00 00 2b 2b 2b 19 19 19 12 12 12 0e 0e 0e 0d 0d 0d 10 10 10 0a 0a 0a 10 10 10 0b 0b 0b 0b 0b 0b 08 08 08 09 09 09 07 07 07 07 07 07 06 06 06 09 09 09 0c 0c 0c 0b 0b 0b 07 07 07 0a 0a 0a 07 07 07 07 07 07 07 07 07 08 08 08 04 04 04 06 06 06 04 04 04 03 03 03 06 06 06 04 04 04 03 03 03 05 05 05 06 06 06 73 73 73 fb fb fb 07 07 07 05 05 05 04 04 04 05 05 05 04 04 04 e8 e8 e8 e1 e1 e1 88 88 88 e9 e9 e9 87 87 87 79 79 78 c9 c9 c9 a6 a6 a6 af af 71 68 68 68 fd fd fd f3 f3 f3 ea ea ea 8d 8d 8d d1 d1 d1 ec ec ec eb eb eb e4 e4 e4 e9 e9 e9 d6 d6 d6 ea ea ea 96 96 96 eb eb eb e4 e4 e4 de de de e3 e3 e3 e9 e9 e9 fe fe 00 fb fb fb e7 e7 e7 fb Data Ascii: PNGIHDRx)PLTE+++sssyyxqhhh
2024-10-02 10:16:48 UTC	16384	IN	Data Raw: 72 1b ec f1 ec f5 7b 4e cd b5 f4 81 36 d7 c1 fc 68 bc fe 79 3e 2b 2c 34 f6 da f5 f5 32 5b c1 a0 ca 24 20 2a 4e ea d7 fa 89 a8 e4 a0 98 7e 5e 54 bd f3 99 d2 7a 6f 6b 42 54 ca 87 b4 95 81 fd 2d 8b 2e 0b 24 da 73 22 28 47 3b ad 58 8c 47 58 9a df 4d 72 75 71 44 65 94 8f d4 1a 8b 0a 4b 05 b3 56 d2 c4 21 ff 91 7e 28 39 a2 c2 12 e5 40 54 46 3b 8b b2 61 d8 c7 b3 36 9d 9d 40 6a 83 f6 6a 28 2a 2e 51 01 26 6f 88 de 73 26 93 76 f7 cd d5 74 50 51 81 39 2a ae ae 5f 9a 86 11 15 e4 dc c9 f8 aa a6 5f 98 72 14 d4 14 c4 ff 48 7a 2f 0b 0f fd 8c 7b bc 78 9d 89 15 fe ed a0 55 cb eb 2a 4b 66 43 90 40 a4 9f 6a e5 91 a9 60 b7 d0 71 40 c5 b1 14 c6 64 ea 97 af ae 5f c0 f3 7c 8b 52 1a 2d 8d 45 65 d5 ae 6f 12 e0 e5 0f ba 91 24 52 7b b7 25 0a 72 cc 2e 7f 6d d4 65 42 cc fe 11 b9 ba 80 Data Ascii: r{N6hy>+,42[$ N~^TzokBT-.$s"(G;XGXMruqDeKV!~(9@TF;a6@jj(.Q&os&vtPQ9__rHz/{xUKfC@j`q@d_\|R-Eeo$R{%r.meB
2024-10-02 10:16:48 UTC	16384	IN	Data Raw: 39 6e 4f 35 ff 0d dd 5d 52 f3 be e6 3b 8e f9 ce 5d 29 e1 b4 0b ff f1 f6 0f 7d 63 d7 46 54 88 31 33 dd 89 a9 eb 17 22 2a 00 b4 88 a8 24 89 1d f8 48 a2 62 02 2a d5 cf 08 a6 02 02 18 96 a8 bc 52 15 fa 9e 39 4c 05 9c 32 d2 bf f9 d4 77 fd 02 97 f3 e5 57 a5 2a 4f b9 7e 6a fc db f3 0f 85 6c f3 10 cd 64 fa 9b 98 ca 00 ba 43 81 ff 11 32 15 5f 54 18 63 77 9e a8 70 88 0a 00 81 93 e9 e7 73 4f 54 dc cc 2f 12 15 a4 7e 81 cb 19 80 a8 b8 aa 82 89 8f e0 42 06 36 99 fe bf e1 9b 52 15 c5 af e7 e7 e7 9f 8f 74 f8 6c e7 ab 04 cf 51 b9 9f 45 37 61 08 df 7d 07 ff 21 94 fb 45 78 35 2a 4a 54 4c d7 af b9 ea fa 05 51 01 e0 52 66 9f 8f 93 e9 17 8b 69 ec 4c a6 47 31 3d 18 08 57 77 fd 1a a1 48 05 b4 2f 52 f1 34 05 a2 d2 12 8a a2 18 1e 65 b8 a6 d8 c9 f4 8b fb de ab 10 00 78 33 a0 f2 81 Data Ascii: 9nO5]R;])}cFT13"$HbR9L2wWO~jldC2_TcwpsOT/~B6RtlQE7a}!Ex5JTLQRfiLG1=WwH/R4ex3
2024-10-02 10:16:48 UTC	16384	IN	Data Raw: ce ba 78 2f ef b6 f3 46 cd 78 92 73 79 c4 30 26 b4 ee 8c d4 d9 eb c6 ed ad b1 03 ac 1d 0a f9 a6 a1 06 07 4b ec 6e 35 88 6f 7f e5 f5 dd 18 51 21 84 6c 40 f4 1b 02 2a 0a 45 85 90 27 4e a6 77 51 c1 57 bf b8 3e 71 75 46 3d ec 02 f2 24 51 31 b1 08 5e f1 0c 51 c1 86 49 e9 04 b9 3f 2e 2a 87 8d a2 72 f6 63 51 54 de bf 7b 37 7c 65 51 19 8e 17 17 95 fa bf f3 dd 22 ea a2 a2 ad de c5 33 b9 5b 56 83 36 75 07 51 81 26 fd aa 8a 8a 8f 3d 6e b7 f1 57 8a 0a de 2a 37 e9 31 a5 69 29 2a 89 26 9c 26 50 54 08 21 eb 10 f1 44 7c 67 7a 85 a2 42 c8 63 a2 f2 eb 46 54 8e 63 51 d9 ef 39 45 a5 1c 53 c1 ad 4d 34 8d dc 1a ca cd 72 55 57 20 56 f4 7d 6f 39 3b 41 ab b7 c7 36 2b 44 86 ac 9e 7a 18 18 97 ca 8a 8d de dc 07 70 74 cf f9 a3 e8 f7 49 99 b4 86 ea 3e 81 d7 e4 db f5 96 d5 6a 7d 3c e8 Data Ascii: x/Fxsy0&Kn5oQ!l@E'NwQW>quF=$Q1^QI?.rcQT{7\|eQ"3[V6uQ&=nW71i)&&PT!D\|gzBcFTcQ9ESM4rUW V}o9;A6+DzptI>j}<
2024-10-02 10:16:48 UTC	16384	IN	Data Raw: 77 77 1e 54 2e 93 0a 36 7c 04 00 00 80 07 e0 34 a8 78 96 db f0 31 32 a4 c4 1a 15 78 c8 5c 50 79 f3 e2 10 54 b0 46 c5 38 0d 29 78 f4 0b 00 00 00 ae 16 82 0a dc b0 7b 0f 2a 8f ce a7 54 1c ac 51 01 00 00 80 eb e6 7f 11 18 c7 97 7e 19 d3 a3 5f f3 f9 12 41 05 1e ac 63 50 79 73 a7 41 c5 79 74 06 8b e9 01 00 00 e0 ca f9 97 6f fd 22 97 41 85 20 a8 c0 c3 e5 82 ca db 37 6f ee 39 a8 7c 7f c3 47 3c fa 05 00 00 00 d7 c8 27 3f 1b 54 9a 5f 09 2a c2 13 be 7f 6c 24 20 3e fb 9a 17 c5 e6 c0 5f 45 8d c5 51 9a a6 42 04 ec 5f 12 69 1a 9c 8f 64 14 d5 42 98 4e 45 7f bf 53 9e b7 88 43 33 aa a1 69 f6 97 08 ba 76 11 b0 3b e6 f6 51 79 6d 83 8a 5b 4c ef 82 ca 1d 45 95 f3 98 82 d7 13 03 00 00 c0 f5 fb 2a a8 b8 98 72 30 3d fa b5 d9 fc 52 50 99 27 a9 10 3e b3 c2 88 84 ec 6b cd c0 a3 28 Data Ascii: wwT.6\|4x12x\PyTF8)x{TQ~_AcPysAyto"A 7o9\|G<'?T_l$ >_EQB_idBNESC3iv;Qym[LE*r0=RP'>k(
2024-10-02 10:16:48 UTC	16384	IN	Data Raw: 68 37 21 d8 6c 21 18 0f 83 84 6f 6c 97 7e 4d 11 a4 71 ac ad 8d 51 64 40 2b a1 fa 86 1f 45 54 be ea 49 8e 56 eb cd d2 af c9 43 89 dc 1c e9 7a 8d 8a 57 00 da 90 0b 4e e0 6e 4b 49 82 98 56 32 a6 d6 a8 f8 d1 b5 54 1a fd 28 e9 64 14 93 e4 ef 89 8a 1e 11 04 c3 9d cf bf 20 2a 35 45 a4 70 8e 38 aa 8f a9 e0 54 2a c0 d6 64 62 81 f4 29 f2 fb 7c f8 50 97 7e bd ff b2 f4 0b aa 72 8f 2f 7c 3c 7d cb 4a 54 9e 50 54 0e 80 a2 42 08 21 84 ec c5 cc 15 f5 15 78 ca 1f 16 15 ef bf 8a 8a d4 89 04 05 56 a2 a2 66 ae 17 d3 0f 83 0d 61 25 2a e2 18 0b 51 49 61 25 2a 65 bb 21 72 df bb 10 62 1c 7f 28 2a 36 af 44 a5 08 56 88 11 a2 22 c5 f4 20 85 a5 33 01 b9 d0 e6 18 21 2a ce 7d 47 54 a4 4b 91 2e de e9 d6 f6 5d 51 51 02 52 18 e2 d7 c7 54 32 6e af 80 6c 01 45 65 27 14 95 0a 6e ef 7b 9a c2 Data Ascii: h7!l!ol~MqQd@+ETIVCzWNnKIV2T(d 5Ep8Tdb)\|P~r/\|<}JTPTB!xVfa%QIa%e!rb(6DV" 3!}GTK.]QQRT2nlEe'n{
2024-10-02 10:16:48 UTC	16384	IN	Data Raw: c4 8e bb c2 65 20 33 4b 84 11 fc d0 14 fc b0 76 af 1f 22 d5 4c 05 77 66 8e 36 fa 84 79 c0 a3 cd ec 01 81 14 55 dd 75 dd 5d d1 1b c1 8f c4 22 5f a3 61 40 ac 6c 3f 33 f2 08 d7 ad 32 dd 4a 86 51 85 ea e1 ed 41 d0 c4 57 d7 75 31 69 60 a1 55 0f 81 2b 70 48 d7 45 54 8c e1 63 58 55 38 31 1c 12 53 52 55 65 b0 14 66 88 a9 28 95 ed ed 0a 8d 2f 1b 8a 69 ea 6c f7 39 53 34 3e b8 c2 e6 e8 3d 53 3a 28 d3 1e 34 c6 8d c4 e7 0d d3 d8 16 94 a1 69 35 a6 1c a3 5c 96 a1 2b b4 24 c5 a2 60 04 55 59 7c 56 a9 7c 56 49 34 ab 32 69 74 b6 28 90 7f b7 d9 a2 50 a4 bc af 3c ad e0 27 c3 18 98 06 8c 9f 2a da 5f 03 65 2b 10 e8 21 eb 10 07 2a 94 f7 d5 60 04 51 a8 5f 68 6c d5 cc 75 85 99 2b f1 99 ab 30 c7 d3 84 d1 95 65 b9 78 f7 09 d0 0e 6c 81 1e c0 c6 f3 aa b2 ac 73 1e 39 e2 93 14 f1 b3 cd Data Ascii: e 3Kv"Lwf6yUu]"_a@l?32JQAWu1i`U+pHETcXU81SRUef(/il9S4>=S:(4i5\+$`UY\|V\|VI42it(P<'_e+!`Q_hlu+0exls9
2024-10-02 10:16:48 UTC	16384	IN	Data Raw: 5e 3b 4d a7 2c fb 2a 4f f2 d9 3e d8 92 0a 57 95 b2 a8 38 4e 21 2a ae 10 15 c1 0e c3 45 e5 c6 33 16 15 a4 d1 9f e0 29 42 54 04 5b 8d 10 15 c1 c5 47 47 3c c3 57 54 7a fd 7e 97 44 c5 ac e4 e4 e9 08 9e 37 46 80 96 24 7e f9 c2 47 df 5f 2b 2a aa 2c 5b 79 80 4e 34 1a 45 1e 39 9d 1b 1c 66 59 8b 02 e0 55 b0 6a 93 d0 2f e8 b9 d9 74 3c 6f 4e b5 ae 46 9a fc 4a 90 83 30 1c 4a 1c 4a 7f 58 fa 65 7d dd 75 47 ac 29 71 ac 4b 05 85 a8 64 83 c1 5a 51 61 d1 32 bf f4 9c 9f 7c 5b 71 5d 77 8f 40 0c 2c 11 5c 54 c2 7e bf 9c 2c d3 2e c2 e0 86 a6 b5 25 62 55 54 68 b8 6a c5 70 75 1b 8d 94 8b 0a 86 2b cb 32 d4 27 6d 80 89 ca 41 b7 5b 16 15 c4 a8 7e 92 8c 29 c5 a2 51 5a 10 a8 a0 1a f2 a1 44 51 22 69 33 5c 54 3a b5 5a 79 9e fc 20 98 c0 23 fa 7d 3e 5c fc 20 64 a4 a9 4c ab 55 de c5 6a 9a Data Ascii: ^;M,O>W8N!E3)BT[GG<WTz~D7F$~G_+*,[yN4E9fYUj/t<oNFJ0JJXe}uG)qKdZQa2\|[q]w@,\T~,.%bUThjpu+2'mA[~)QZDQ"i3\T:Zy #}>\ dLUj
2024-10-02 10:16:48 UTC	16384	IN	Data Raw: 50 78 f5 f2 e5 cb 8a 2e fe e0 e0 28 9b fd 87 6d a5 f5 fb ef cf fe fe 3b 35 3f 6f 08 2a eb eb eb a8 7f 7a f6 ec 99 d1 f2 fe 4e a5 8e 4c 0f 7f 5c f8 72 81 dc fb 5f ed c6 2f 5e a0 e8 eb f5 fa 3a 0f 2a e3 2f 5f 26 b3 d9 17 bf 1b a2 ca ce c1 41 fc 12 1d c7 1e 3f ce 2d 2f af e8 0f e0 f6 e6 e6 9f 13 13 39 e1 5e 70 0c 07 99 cc c4 e6 e6 26 be b9 71 40 05 f5 4a 87 fa 29 7f bb 4b 4b e9 57 af 78 50 39 3b 3b 7b f0 60 7a 6e 6e ce 70 ec e3 83 07 77 eb 0e 2a d8 0b 66 22 2e 15 20 c1 4f 3f dd b9 73 e7 f8 c1 83 bd bd 3d 43 50 39 3c 4c 1c 1f 3f b9 73 c7 b0 58 ec ce ee ee f6 c9 c9 c6 6f 66 50 65 f2 ec 6c 6a f7 5c b8 df dc ad 5b 97 03 95 d1 44 62 91 5c 0c 07 8e 2d 5c 3c 73 b3 4c 50 79 f4 e8 11 76 bf bd b4 b4 ab 3f 2f bc 01 0f b6 b7 f7 c4 a0 72 76 b6 95 4e 1f e3 c8 6a 0a 2a 4e Data Ascii: Px.(m;5?ozNL\r_/^:/_&A?-/9^p&q@J)KKWxP9;;{`znnpwf". O?s=CP9<L?sXofPelj\[Db\-\<sLPyv?/rvNjN
2024-10-02 10:16:48 UTC	16384	IN	Data Raw: 70 59 2c 71 55 89 4a 28 95 5a 99 9f 37 53 5f cb fe 7e 7c 73 53 dc 6e e2 f5 6c 96 d2 1f 37 6f cf e5 72 42 4e b2 f8 7c 4e d2 4a d2 e7 2b 29 2a 2a 89 44 82 25 2a 66 f3 92 56 ab 93 52 54 d6 8f 8f e5 11 95 91 fa 64 7a e0 32 99 1e 2b 2a dd 62 6c 6c 0c 56 7e 3d 79 f2 64 70 7c 1c 45 05 69 a3 a2 52 4b 51 a9 17 95 49 90 94 0a 95 59 7a 4c a6 47 7a 0c e1 a2 f2 89 64 c3 f4 ef 35 4c a9 b4 0e d3 57 2d 45 d9 61 7a af c1 30 db f9 c1 67 5e ef f2 7f 14 55 16 3a dc 50 ec 20 74 6c 0e 07 1c 29 1b 60 0a ac 0c 17 b8 55 76 51 81 62 12 44 a9 10 3a cb 30 4f 2f a5 a8 ac 79 bd 7a 05 44 25 e2 72 79 08 85 fd 68 54 a7 2a 51 01 a2 76 fb 6b 42 61 de e9 2c c0 3c bd e4 bb 89 5f da ed 59 81 27 19 13 09 da 53 74 ba 5c 3e 05 45 85 ff db 4c dc 3e 5f 41 52 51 31 1a a5 16 95 b1 77 a6 32 c9 cf a8 Data Ascii: pY,qUJ(Z7S_~\|sSnl7orBN\|NJ+)*D%fVRTdz2+bllV~=ydp\|EiRKQIYzLGzd5LW-Eaz0g^U:P tl)`UvQbD:0O/yzD%ryhTQvkBa,<_Y'St\>EL>_ARQ1w2

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
84	192.168.2.16	49844	13.107.246.40	443	4912	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-02 10:16:48 UTC	678	OUT	GET /shared/cms/lrs1c69a1j/section-images/166ba0e92d8b4ad0b18bdf3455bfce5c.jpg HTTP/1.1 Host: edgestatic.azureedge.net Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://www.microsoft.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-10-02 10:16:48 UTC	702	IN	HTTP/1.1 200 OK Date: Wed, 02 Oct 2024 10:16:48 GMT Content-Type: image/jpeg Content-Length: 230923 Connection: close Access-Control-Allow-Origin: * Cache-Control: public, max-age=31536000, immutable ETag: W/"3860b-18c5b6fa681" Last-Modified: Tue, 12 Dec 2023 00:31:32 GMT Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Origin-Agent-Cluster: ?1 X-Content-Type-Options: nosniff X-Download-Options: noopen X-Frame-Options: SAMEORIGIN X-Permitted-Cross-Domain-Policies: none X-XSS-Protection: 0 x-azure-ref: 20241002T101648Z-15767c5fc55kg97hfq5uqyxxaw00000009c0000000007rg8 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-02 10:16:48 UTC	15682	IN	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 00 00 01 00 01 00 00 ff db 00 84 00 06 06 06 06 07 06 07 08 08 07 0a 0b 0a 0b 0a 0f 0e 0c 0c 0e 0f 16 10 11 10 11 10 16 22 15 19 15 15 19 15 22 1e 24 1e 1c 1e 24 1e 36 2a 26 26 2a 36 3e 34 32 34 3e 4c 44 44 4c 5f 5a 5f 7c 7c a7 01 06 06 06 06 07 06 07 08 08 07 0a 0b 0a 0b 0a 0f 0e 0c 0c 0e 0f 16 10 11 10 11 10 16 22 15 19 15 15 19 15 22 1e 24 1e 1c 1e 24 1e 36 2a 26 26 2a 36 3e 34 32 34 3e 4c 44 44 4c 5f 5a 5f 7c 7c a7 ff c2 00 11 08 04 b0 07 80 03 01 22 00 02 11 01 03 11 01 ff c4 00 1d 00 01 00 01 05 01 01 01 00 00 00 00 00 00 00 00 00 00 01 02 03 04 05 06 07 08 09 ff da 00 08 01 01 00 00 00 00 f9 88 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 02 af 64 bb e2 d4 83 a2 ca 00 Data Ascii: JFIF""$$6&&6>424>LDDL_Z_\|\|""$$6&&6>424>LDDL_Z_\|\|"d
2024-10-02 10:16:48 UTC	16384	IN	Data Raw: 5b 9b ee 6f 91 67 75 95 00 00 00 01 8b 48 cb 90 00 d6 f2 a0 3e af ee ff 00 3a 5d 60 05 14 c5 ba ea b1 6b 63 eb 5e 7d 81 85 ae 4c 5d e8 3d 8b dc 36 69 91 13 04 38 bf 20 d5 7a 2f b1 41 62 db 0e cd b9 a8 f0 9f 1f 74 9b ce 7a ae 83 d5 33 bc 97 89 de 67 d5 4f 37 b4 e9 bd 4b 65 72 d6 55 71 cc e9 2b d5 59 c7 bf c8 cc 75 77 2f ed b2 31 f0 2b ba af 3e bd 3d 37 33 f3 69 e7 fc 19 ee fd 8a e5 ea 21 15 dd 52 55 35 45 ba 2a ad 6d 4a aa 98 b3 5d 75 a8 b5 66 d5 c9 a6 9b b8 f8 f4 32 2e 61 fc d8 f4 2e b0 00 00 00 06 be d0 da 48 00 3c 6b 18 0f ab fb bf ce 97 58 01 b1 ed f8 dd 05 51 37 68 c9 58 f4 ee ab c2 35 a3 63 d4 fb b7 ac 57 66 ed 54 45 c2 0e 17 c9 78 dd 9f a3 fb 55 2c 4c 7b 56 eb 88 2e 78 97 88 3a 7c 84 75 36 fd 1b c7 f9 cd be cb 6f 6b 45 b2 df 76 3d 5e cb 16 f6 65 ef Data Ascii: [oguH>:]`kc^}L]=6i8 z/Abtz3gO7KerUq+Yuw/1+>=73i!RU5E*mJ]uf2.a.H<kXQ7hX5cWfTExU,L{V.x:\|u6okEv=^e
2024-10-02 10:16:48 UTC	16384	IN	Data Raw: 0c d0 b1 a4 3f 0c d9 0d 76 92 47 c9 63 06 18 41 87 a6 1c 47 2b fa c7 53 a3 77 6d 59 38 41 8d 6e 0b a3 54 68 33 2a 6e d7 7a 8f 09 98 65 a3 fb 07 85 7e 3e 49 d8 78 d9 13 1c e9 ba cf 65 c1 b6 fc 3d 9c 19 b2 3c 5c a3 b4 c8 b4 fe f1 a2 82 53 14 81 ca 17 57 af 15 1e 38 15 33 c9 eb 4c 43 40 1a 7f f0 16 22 5c d9 2e dd b0 0e 66 16 87 0b 85 46 f1 b1 3d 90 49 84 7c ac 8b 2c b5 e0 6d a8 75 7c d6 10 61 67 7b 21 30 1d 76 c9 76 cf 15 0c 26 59 43 01 f3 3c 07 15 26 13 0f f4 84 50 b0 91 1b c3 7f 50 9f 1c 0f c3 4f 23 61 31 18 dc 06 da d6 bb bc d6 11 b5 c4 31 63 dd 59 a9 c0 2e 48 63 1e ca 65 44 f7 67 0b ae 00 9b 28 9d 8e 78 79 6f 45 c3 6d fd d0 5c af 1b 19 17 d8 c4 c3 9b d5 b4 00 4b 6d 5c 83 29 66 38 33 73 da 47 f9 ae 5a 8e ce 50 96 9f 9a 87 9e 0c ac e8 f3 7b 17 0b bc 94 b3 Data Ascii: ?vGcAG+SwmY8AnTh3*nze~>Ixe=<\SW83LC@"\.fF=I\|,mu\|ag{!0vv&YC<&PPO#a11cY.HceDg(xyoEm\Km\)f83sGZP{
2024-10-02 10:16:49 UTC	16384	IN	Data Raw: ed a5 cd 22 bb 2a b0 78 6c cc 4c 0c 95 ae 0c 7f c2 aa 66 86 4d 23 46 c0 e2 3f 15 c9 18 51 3e 6d 4f 66 89 b8 78 1b b2 30 a8 38 7b 74 08 80 55 ad e0 83 1a 0e c5 41 c1 16 33 ba 17 28 6b 8c 9b cf 9c 7b 8e 4d fb 94 5f 1f 9f bd 97 77 e0 c0 d1 10 32 81 e7 a7 b7 44 4f ba 6d 2b cc 1c aa 38 7b 64 d0 73 47 d9 fd 99 71 00 8e 3b 56 02 48 9f 84 8a c3 b1 a0 11 e3 ec 4a f6 46 c2 e7 9a 37 7a bb 70 d9 5a 8e 62 6b fb 25 a6 95 44 34 93 b1 75 6e a0 5d 51 b9 32 8e 56 83 b5 db 16 5b 37 39 59 fc 61 69 53 aa 0d 07 f3 84 22 8b 7c cd 40 40 1d b4 91 44 fb 7c 50 2c 68 ec d4 a2 5a ed 68 07 b4 79 f0 92 49 1f 23 e2 5e ce d6 6e de 1b 10 92 49 b9 1e 73 33 8b ad 90 58 4a c4 47 2c b8 ae 4e 6c 4e b5 d9 0d eb 70 50 3e 37 c5 8e 60 9e 69 7e a5 d5 bf 67 c1 46 c3 8e e4 f8 d8 3b 70 c8 1b fd d7 29 Data Ascii: "*xlLfM#F?Q>mOfx08{tUA3(k{M_w2DOm+8{dsGq;VHJF7zpZbk%D4un]Q2V[79YaiS"\|@@D\|P,hZhyI#^nIs3XJG,NlNpP>7`i~gF;p)
2024-10-02 10:16:49 UTC	16384	IN	Data Raw: a8 53 ca eb 9c cd 47 f9 a6 4a 62 70 20 ea a1 c5 5e d2 ed fb c2 6b e6 92 b6 33 e2 e4 f1 8b 00 12 d1 5e 1e 0b 25 8f 17 04 e8 f1 2c 76 8f ea a7 c5 19 8c 3e fa 14 d9 38 39 09 c7 e6 6a 38 f0 df e8 d0 c4 e3 27 d9 5f 92 6e 16 67 76 e4 a2 e8 cc 65 0e a7 cd 38 fd 4b b4 fc bc f8 59 a7 8e 46 e5 3b 57 11 a6 e2 81 c2 8c 44 99 20 e7 00 69 5e c5 77 d1 49 2c 92 ba e7 ba a5 61 a2 ce 9e 36 71 3a f9 2c 5b 1f 2c 12 38 db d4 7d 5b 47 03 d4 3a 6e 53 e5 c1 48 c4 4d 3d 40 4b 8f 12 15 d1 e6 60 98 e8 83 ae 8d 80 d7 c7 82 e8 ec cb a6 fe 95 65 7c 14 ec c3 01 33 7e a4 5b d8 a5 6e a8 e2 8c 30 87 3e 6b 7e ab 26 e0 3c 4e 94 f5 4d 87 0d 1e 48 79 8a 8e 60 2f ad 6e d7 82 fa a8 b0 f1 3f 29 af 26 47 8a 9e 01 3e 38 33 b1 50 08 85 1b 1b 9c 0e fa 81 54 d8 b0 ec 64 01 d9 5d 66 87 3e ea dd af 05 Data Ascii: SGJbp ^k3^%,v>89j8'_ngve8KYF;WD i^wI,a6q:,[,8}[G:nSHM=@K`e\|3~[n0>k~&<NMHy`/n?)&G>83PTd]f>
2024-10-02 10:16:49 UTC	16384	IN	Data Raw: 9d 06 1d bd a7 af f6 21 f9 96 6e 08 6e 2b a4 e1 07 f4 6b a6 41 fb a5 d3 e3 fd d0 5f 48 0e e3 57 d2 3f c2 d5 f4 8b b8 35 1e 52 93 c1 1e 52 9b f8 7d 17 d2 58 8e 23 d1 7d 25 88 e2 3d 11 e5 1c 40 e1 e8 be 92 9f f8 7d 17 d2 53 70 6f a2 fa 4a 4e e3 3d 17 d2 27 f7 4c 5f 48 37 f7 0c 5d 3a 1d f8 71 ea 86 33 09 fb 97 7a ae 91 81 3f bc 0b fd 89 ff 00 d3 91 e6 10 8a 2c ba 47 33 2b a6 f4 d2 4e 20 f0 b1 49 87 64 95 2d d1 c9 cd 2c 75 08 f6 4e df 64 0f 60 fb b9 3b 6f fe 63 ee 39 37 ee 51 7c 7e 7e f7 93 3e fd 0f c7 e5 ec d5 1e 71 cc 79 9e d6 b8 51 c0 11 c0 a9 f9 1f 0c fd 59 56 1f 0d 8a 7e 4e c4 c1 ba e1 c4 2a 2c 3f 26 cf 88 3d d1 c4 8f 92 97 92 e1 85 8d 71 71 71 b8 78 04 62 15 35 76 8a 91 8d d5 55 55 e6 a2 d1 55 57 9a a8 57 9e 88 10 b3 4a 15 a5 78 f3 0e 6a 55 c1 04 dd 8a Data Ascii: !nn+kA_HW?5RR}X#}%=@}SpoJN='L_H7]:q3z?,G3+N Id-,uNd`;oc97Q\|~~>qyQYV~N*,?&=qqqxb5vUUUWWJxjU
2024-10-02 10:16:49 UTC	16384	IN	Data Raw: 85 18 d5 ec 12 b0 21 4d 8d 25 d6 07 ac e9 ab 12 89 4b 9a a9 e9 34 62 f8 b9 6b 70 62 83 41 c5 e2 59 58 ea 22 56 61 7b 10 da 2e da 50 e6 91 98 93 5a 02 cd 7e 11 1c f7 9d 5c 03 96 f4 94 2e b5 02 36 56 b7 e3 13 75 f0 a3 1a 94 eb 5f 1b 13 69 5e 2c 74 96 52 90 10 fe 30 0d ab 65 c0 6d 13 4c 31 9b d1 9a 16 9f 93 ae 83 e4 7b fe ff 00 9a 21 8f 56 32 4d ee 1c e2 7b cf 31 52 dc 4d e0 e2 18 64 b1 59 da 99 59 e5 68 de 74 7a 11 1d 85 1b e9 1e b2 cf 49 fd 44 7b ef 5e a5 b6 a0 ec cd 99 85 fd 74 86 e6 8e 6d d0 d4 30 dc 50 d4 ff 00 69 6d 70 0b a2 9c f7 95 6a 17 65 00 0f 2c bf d1 95 8e 97 7f a4 06 bd a0 6f 30 d8 85 8a 86 3a 87 11 c0 f2 43 72 dd ea 60 1f 68 0c a6 a3 65 87 51 4f ac a0 63 65 b1 65 a3 c8 9a 35 a9 5b d5 42 4a 96 b6 0e 90 ba 26 bf ab 39 5b fb f8 f3 9d 20 b8 37 c4 Data Ascii: !M%K4bkpbAYX"Va{.PZ~\.6Vu_i^,tR0emL1{!V2M{1RMdYYhtzID{^tm0Pimpje,o0:Cr`heQOcee5[BJ&9[ 7
2024-10-02 10:16:49 UTC	16384	IN	Data Raw: 18 23 a5 49 c8 35 aa 40 ae fe 94 cb 99 c2 bd 3c 6e 65 4f 6b 76 62 19 28 2f 7b 2d cc ac 37 bb 8e d3 9f 7b 9e 7f 23 df f7 fc dd 4f 53 4e 96 af 14 74 02 67 9b a5 44 02 d6 71 08 51 bb 6b 2c a6 98 a8 b8 60 ef 2d 2d 49 6c cb ec 62 36 1a 97 9e f2 a4 a2 dd 5f 66 6b 18 28 8f 33 77 2e d7 9d 7e a2 8e b8 01 62 58 a6 5d f2 95 7f 94 c3 47 86 23 61 6e 3f cf 8c 52 e9 ea 10 82 a7 53 9f 90 28 d8 cf ac e3 7f 30 75 a8 33 d0 52 88 7d c8 d2 2a 05 a8 ec 43 0d b3 35 70 a1 8c f9 66 19 78 8c 7a d7 47 d1 6c 97 35 3a e4 74 bf 81 db a5 a1 8c 58 66 1a 91 a3 05 3f 28 97 f0 1a ff 00 25 7c 70 f0 82 83 d1 72 fa a5 03 01 6c 74 f7 9f 5f e6 34 c1 87 00 01 36 d0 cb 6b ca a5 9b 76 98 07 95 bc 4c ea 95 c6 66 77 22 a9 61 1c b4 cd 26 1c 42 32 32 fa 4f 18 62 08 a3 00 00 97 3a 80 9e 93 b3 84 dc 6a Data Ascii: #I5@<neOkvb(/{-7{#OSNtgDqQk,`--Ilb6_fk(3w.~bX]G#an?RS(0u3R}*C5pfxzGl5:tXf?(%\|prlt_46kvLfw"a&B22Ob:j
2024-10-02 10:16:49 UTC	16384	IN	Data Raw: 5b a3 57 f3 34 48 23 1d a0 42 60 7e e9 a6 01 41 a9 06 cb 65 d6 7d 50 e9 29 79 77 22 fb 47 78 79 19 88 65 25 65 fa 23 46 20 58 10 6c 91 53 89 51 66 ac c1 f2 8a f2 88 0c be 83 78 10 cb 01 51 c3 68 03 03 4d a2 b3 75 0a b9 f6 88 d5 97 72 15 58 5e 51 71 84 c1 0d ea 62 fd 36 1b ca 1c 69 c4 57 ce 80 5f e0 22 b1 a3 31 df 43 e1 fc e5 04 58 68 42 d9 89 63 21 16 83 6e a0 f9 af a1 34 fc 20 af 80 34 dc 01 76 ba c3 3d 6f e0 5e ab e0 65 86 6d c1 ae f2 a2 63 22 b7 94 45 31 4f 7a 4b 13 6d 31 71 cd 46 91 76 ed 9e 50 86 09 b9 05 bb 66 ff 00 88 ea 7b 5e 31 bc d5 e8 4a 7e 13 e1 75 f8 0d 4f 8b da 39 f9 1e ff 00 bf e6 fb 3e f8 ac 4b 75 51 ac 82 56 03 70 22 dd d8 1a 66 8e 87 07 ee d6 33 0c ef f8 58 07 d3 bb 7d 25 d7 5a 52 b8 cb 31 2e df ac e1 d6 3a 46 84 38 cc 11 8a 28 cc 32 90 Data Ascii: [W4H#B`~Ae}P)yw"Gxye%e#F XlSQfxQhMurX^Qqb6iW_"1CXhBc!n4 4v=o^emc"E1OzKm1qFvPf{^1J~uO9>KuQVp"f3X}%ZR1.:F8(2
2024-10-02 10:16:49 UTC	16384	IN	Data Raw: e0 45 75 b8 47 c7 e0 e4 a3 01 01 12 9e 48 50 25 8b dc 1c 43 45 f7 53 af d3 7e d6 db 7d 70 80 46 13 10 8d 99 6a 2c e7 3d 27 51 74 e7 a0 34 89 1b fd e2 36 ab 95 61 b9 d2 6d f4 65 f7 f0 82 89 1c 52 59 da 1f 6e 75 45 3e 83 32 9c 35 c4 06 e0 eb 30 bd e0 c1 61 fc c2 fd c4 fa 2a 69 03 78 ce 7e 92 8b c8 4a a2 82 3a ed 9a 76 c1 49 4c d3 88 88 27 46 af 4e 00 86 16 c9 6c 56 7c c5 10 68 61 ef 0b e0 07 37 ba 44 68 ab 9f b5 2c 1f 38 99 66 4b 48 d6 b8 cf 60 11 aa 5a 84 d5 2a fb 4d 45 63 97 45 b2 01 a6 2b f5 26 01 9e d6 23 f2 42 e7 d6 fa 33 2b 60 5a 35 44 0b 85 d2 32 a6 a0 2e 50 26 8a 8b 55 95 73 2f 0a 83 a3 10 8b 03 c9 0e 4d a3 30 a6 08 35 f3 f4 75 0d 1d 2a c6 90 bd 59 3f 2e ff 00 73 f2 2f f7 05 86 b4 0a 0f 8e eb c3 63 e7 bb 1d ae 0d 6e 00 b6 19 c8 28 c3 81 1d 48 78 c0 Data Ascii: EuGHP%CES~}pFj,='Qt46ameRYnuE>250aix~J:vIL'FNlV\|ha7Dh,8fKH`ZMEcE+&#B3+`Z5D2.P&Us/M05u*Y?.s/cn(Hx

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
85	192.168.2.16	49845	152.195.19.97	443	4912	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-02 10:16:48 UTC	620	OUT	GET /filestreamingservice/files/bdc392b9-6b81-4aaa-b3ee-2fffd9562edb?P1=1728468990&P2=404&P3=2&P4=fYCr80phaT2bw%2b97uzl%2bZm4Y9sWhLMBhIRsYhHez6bNE%2fFFZZ4zgZrSJ7EBeaEm2%2fZHS5qyeUFkGOOxDRvW5Gw%3d%3d HTTP/1.1 Host: msedgeextensions.sf.tlu.dl.delivery.mp.microsoft.com Connection: keep-alive MS-CV: xxx6Kkdk1ksoy08AVfOlJe Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-10-02 10:16:48 UTC	632	IN	HTTP/1.1 200 OK Accept-Ranges: bytes Age: 7790739 Cache-Control: public, max-age=17280000 Content-Type: application/x-chrome-extension Date: Wed, 02 Oct 2024 10:16:48 GMT Etag: "Gv3jDkaZdFLRHkoq2781zOehQE8=" Last-Modified: Wed, 24 Jan 2024 00:25:37 GMT MS-CorrelationId: b4b4aabf-4d02-4629-96b1-a382405b6a31 MS-CV: 642I+iNy0Qp5KFcIV/sUKh.0 MS-RequestId: 5245ac9e-0afd-43ce-8780-5c7d0bedf1d4 Server: ECAcc (nyd/D11E) X-AspNet-Version: 4.0.30319 X-AspNetMvc-Version: 5.3 X-Cache: HIT X-CCC: US X-CID: 11 X-Powered-By: ASP.NET X-Powered-By: ARR/3.0 X-Powered-By: ASP.NET Content-Length: 11185 Connection: close
2024-10-02 10:16:48 UTC	11185	IN	Data Raw: 43 72 32 34 03 00 00 00 1d 05 00 00 12 ac 04 0a a6 02 30 82 01 22 30 0d 06 09 2a 86 48 86 f7 0d 01 01 01 05 00 03 82 01 0f 00 30 82 01 0a 02 82 01 01 00 bb 4e a9 d8 c8 e8 cb ac 89 0d 45 23 09 ef 07 9e ab ed 9a 39 65 ef 75 ea 71 bc a5 c4 56 59 59 ef 8c 08 40 04 2b ed 43 d0 dc 6b a7 4f 88 b9 62 4b d3 60 94 de 36 ee 47 92 ab 25 8a 1e cc 0d fa 33 5a 12 19 8e 65 20 5f fd 36 15 d6 13 1e 46 ae 8b 31 70 18 f1 a8 4b 1d 5a ff de 0e 83 8e 11 b2 2f 20 ed 33 88 cb fb 4f 54 94 9e 60 00 d3 bc 30 ab c0 d7 59 8b b0 96 46 54 fc f0 34 33 1c 74 68 d6 79 f9 0c 8c 7d 8a 91 98 ca 70 c6 4c 0f 1b c8 32 53 b9 26 69 cc 60 09 8d 6f ec f9 a6 66 8d 6f 48 81 0e 05 8a f1 97 4e b8 c3 94 3a b3 f7 69 6a 54 89 33 da 9e 46 7b d1 30 bb 2c cc 66 3f 27 66 e3 43 51 74 3b 62 5f 22 50 63 08 e5 20 Data Ascii: Cr240"0*H0NE#9euqVYY@+CkObK`6G%3Ze _6F1pKZ/ 3OT`0YFT43thy}pL2S&i`ofoHN:ijT3F{0,f?'fCQt;b_"Pc

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
86	192.168.2.16	49846	13.107.246.40	443	4912	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-02 10:16:48 UTC	609	OUT	GET /clarity.js HTTP/1.1 Host: apps.microsoft.com Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://apps.microsoft.com/apppack/edgefre?hl=en-us&gl=US Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8 Cookie: MSCC=NR
2024-10-02 10:16:48 UTC	1199	IN	HTTP/1.1 200 OK Date: Wed, 02 Oct 2024 10:16:48 GMT Content-Type: text/javascript Content-Length: 315 Connection: close Cache-Control: public, max-age=3600 ETag: "1db136e4014d83b" Last-Modified: Mon, 30 Sep 2024 19:23:38 GMT Strict-Transport-Security: max-age=2592000 Request-Context: appId=cid-v1:04e455f9-321c-49bf-8d2c-d79fbf5e8cde MS-CV: FFk1WLu1SEye2TDU.0 X-Content-Type-Options: nosniff Permissions-Policy: unload=() Content-Security-Policy: default-src 'self' data: https://.clarity.ms https://c.bing.com;script-src 'self' wcpstatic.microsoft.com js.monitor.azure.com www.microsoft.com www.clarity.ms get.microsoft.com xvsec.video.microsoft.com bat.bing.com 'unsafe-inline';style-src 'unsafe-inline';connect-src * data: ms-windows-store:;font-src ;img-src data: blob:;media-src 'self' blob: https://sfds-production.azurefd.net https://canvasstorageprodtorus.blob.core.windows.net;frame-src * ms-windows-store:;report-uri https://csp.microsoft.com/report/app-store-web-prod X-Powered-By: ASP.NET x-azure-ref: 20241002T101648Z-15767c5fc55w69c2zvnrz0gmgw00000009p000000000508r x-fd-int-roxy-purgeid: 66820190 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-02 10:16:48 UTC	315	IN	Data Raw: 2f 2a 20 65 73 6c 69 6e 74 2d 64 69 73 61 62 6c 65 20 2a 2f 0d 0a 28 66 75 6e 63 74 69 6f 6e 28 63 2c 6c 2c 61 2c 72 2c 69 2c 74 2c 79 29 7b 0d 0a 20 20 20 20 63 5b 61 5d 3d 63 5b 61 5d 7c 7c 66 75 6e 63 74 69 6f 6e 28 29 7b 28 63 5b 61 5d 2e 71 3d 63 5b 61 5d 2e 71 7c 7c 5b 5d 29 2e 70 75 73 68 28 61 72 67 75 6d 65 6e 74 73 29 7d 3b 0d 0a 20 20 20 20 74 3d 6c 2e 63 72 65 61 74 65 45 6c 65 6d 65 6e 74 28 72 29 3b 74 2e 61 73 79 6e 63 3d 31 3b 74 2e 73 72 63 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 63 6c 61 72 69 74 79 2e 6d 73 2f 74 61 67 2f 22 2b 69 3b 0d 0a 20 20 20 20 79 3d 6c 2e 67 65 74 45 6c 65 6d 65 6e 74 73 42 79 54 61 67 4e 61 6d 65 28 72 29 5b 30 5d 3b 79 2e 70 61 72 65 6e 74 4e 6f 64 65 2e 69 6e 73 65 72 74 42 65 66 6f 72 65 28 74 2c 79 29 3b Data Ascii: /* eslint-disable */(function(c,l,a,r,i,t,y){ c[a]=c[a]\|\|function(){(c[a].q=c[a].q\|\|[]).push(arguments)}; t=l.createElement(r);t.async=1;t.src="https://www.clarity.ms/tag/"+i; y=l.getElementsByTagName(r)[0];y.parentNode.insertBefore(t,y);

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
87	192.168.2.16	49847	13.107.246.40	443	4912	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-02 10:16:48 UTC	678	OUT	GET /shared/cms/lrs1c69a1j/section-images/cea0e14e0ec44c1a9e8b92a6715ef1c1.png HTTP/1.1 Host: edgestatic.azureedge.net Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://www.microsoft.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-10-02 10:16:49 UTC	701	IN	HTTP/1.1 200 OK Date: Wed, 02 Oct 2024 10:16:49 GMT Content-Type: image/png Content-Length: 503853 Connection: close Access-Control-Allow-Origin: * Cache-Control: public, max-age=31536000, immutable ETag: W/"7b02d-190c69cb8a2" Last-Modified: Thu, 18 Jul 2024 16:11:18 GMT Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Origin-Agent-Cluster: ?1 X-Content-Type-Options: nosniff X-Download-Options: noopen X-Frame-Options: SAMEORIGIN X-Permitted-Cross-Domain-Policies: none X-XSS-Protection: 0 x-azure-ref: 20241002T101649Z-15767c5fc55472x4k7dmphmadg0000000900000000009tg5 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-02 10:16:49 UTC	15683	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 05 c2 00 00 03 44 08 06 00 00 00 93 b7 5c 2b 00 00 00 09 70 48 59 73 00 00 16 25 00 00 16 25 01 49 52 24 f0 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 07 af c2 49 44 41 54 78 01 ec fd 09 bc 65 c7 55 df 8b af da fb 9c 73 ef ed b9 25 b5 ac 96 65 a9 2d c9 b6 dc f2 84 db 43 3c d2 0a c6 03 06 6c 88 e5 30 e5 0f 24 90 e4 11 92 30 e4 e5 9f e1 61 49 24 ef 41 3e ef 05 27 bc 17 f8 13 07 9c 3c cc 03 2c 08 e1 91 60 c0 80 05 21 c6 93 30 06 4b 96 6c 49 6e 4d 96 a5 56 8f 77 3c d3 5e ff 5a 55 b5 aa d6 de f7 dc 1e a4 96 74 5b fd fb 4a a7 cf 3e 7b d7 ae b9 ea 9c fb ab b5 57 11 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: PNGIHDRD\+pHYs%%IR$sRGBgAMAaIDATxeUs%e-C<l0$0aI$A>'<,`!0KlInMVw<^ZUt[J>{W
2024-10-02 10:16:49 UTC	16384	IN	Data Raw: 1d ff 5e e4 be 74 cb 96 2d d7 7b 21 fb b0 af ff ff 76 e4 c8 91 8f 74 2c ff b3 95 b8 fa a2 d7 a7 05 3c 62 26 7e c4 9f 7f a9 9c 38 78 f0 a0 bb ed b6 db c8 f8 06 ef 2e 82 02 00 00 00 00 00 00 00 78 82 3c 91 bf 54 01 00 4f 23 e9 11 79 ba f1 c6 1b c3 bb 17 4a c2 79 2f be 88 10 9e 2d c1 d3 06 6e ae 2b 82 27 ab c3 ad 17 5f 7c f1 4d a7 12 c1 01 00 9b 1b d9 eb 72 65 c2 f4 e9 c7 a6 b4 65 c7 73 e8 d2 5d 97 d2 25 5b 76 d1 ae c1 3c 6d ad 2b 5a 5d 5a a6 95 95 15 d9 90 d5 0b e1 76 03 dc 68 06 1e 44 66 7f d8 f7 22 73 8f 26 54 4d d7 88 87 cb 34 5d 95 8d 31 bf 42 8f 3f f2 20 9d 38 f2 58 d8 2c 73 a1 5f f9 b0 4c 67 f4 dc 58 f4 96 12 37 d0 7c 72 25 4c af b1 17 9a bd 3e 5c 35 74 c9 25 5b e9 9d 6f 7a 21 bd f4 05 7b 69 cb 7c 9f 36 33 7e 4e de e3 c5 f0 ef b9 e8 a2 8b 6e 4c a7 42 Data Ascii: ^t-{!vt,<b&~8x.x<TO#yJy/-n+'_\|Mrees]%[v<m+Z]ZvhDf"s&TM4]1B? 8X,s_LgX7\|r%L>\5t%[oz!{i\|63~NnLB
2024-10-02 10:16:49 UTC	16384	IN	Data Raw: ef ef a3 af f9 3f 0f 45 cb 70 5f be ef 3e b0 f3 ac 7c 86 8b 4f e3 07 1f 7c 90 96 96 96 e8 7c e4 b2 cb 2e a3 bd 7b f7 d2 93 e5 83 1f fc 60 18 97 e7 63 3d c8 9c 22 3e a8 a5 2e 9e 0c 5f 38 71 2f 1d 5a 7c 90 86 d3 f3 6f 3c 6c ef 6f a5 d7 ec 79 b9 7f df 46 e7 1a 9d 9b e5 25 73 bc 2e 62 aa 38 2e be c0 75 1e 4f 38 df 97 c2 e7 03 07 0e 88 60 25 3e c2 9d ff 61 2b a7 5a 7f e5 12 00 00 74 48 7f e4 da 3f 7c 49 dc ed c9 39 71 89 72 df 7d f7 c9 b5 ea 45 ff d3 5d 7f c3 f5 e6 7e c0 8a 53 7a 5b 16 20 f2 d3 e5 f2 47 bb 0a a7 49 10 6e c9 94 aa 29 84 64 54 68 30 99 d2 88 d5 c4 37 89 8b 49 3c 71 ae 23 8c 11 65 c5 c7 15 01 23 59 91 26 cd cc 25 ab 5c 75 f9 6c 0c eb 9c 0a c2 6e 9d f9 34 a9 8e c5 ed bc b5 12 6f 92 e8 9f f5 0d 2e d7 8a 70 9b 85 c1 54 77 14 ad 36 ad ca c3 a5 46 b3 Data Ascii: ?Ep_>\|O\|\|.{`c=">._8q/Z\|o<loyF%s.b8.uO8`%>a+ZtH?\|I9qr}E]~Sz[ GIn)dTh07I<q#e#Y&%\uln4o.pTw6F
2024-10-02 10:16:49 UTC	16384	IN	Data Raw: fe d3 32 0d 20 fa c2 7f 5a 1a b6 43 da 5f 53 d9 d6 c6 ce 46 7f a9 bb 23 9f 34 9f ce 7e db 92 18 c7 4c c2 e9 33 ec 7e 4d d0 87 d4 2d 56 bb 97 8f 97 1e 1a 21 f8 c0 b8 f6 09 70 3d 00 6d e4 33 f6 3d fe b2 e4 33 6f 5f 4c 16 82 33 7c 67 2b 70 fe b3 f2 9a e7 8d b8 03 62 b8 34 4e 26 10 2d f3 1c 5e e7 6b b5 cf 9a a6 ad 96 e4 a4 a5 44 d9 4d 8b 58 8e 93 b9 67 e9 8d 5a ee ad e9 e6 01 37 2d b5 ff f2 34 21 f7 9b df fc a6 28 15 0b c1 93 12 b1 4d df d3 c1 e4 3e 29 9d 45 78 27 9d cc 42 09 e0 23 2e 98 c9 00 84 57 f9 0d 30 24 de 39 c5 4a b0 6f b8 67 8b 70 0b 55 18 8c f3 0b c9 6c 85 e3 6c cd ca 4f d1 d6 15 0a ac c2 19 7a 5b 81 0b 08 16 bb a0 26 03 a3 6d d9 3d 0a 2f 92 f9 85 2f 5e 48 17 05 c0 0d 79 d6 a1 4f a7 0f fc f3 87 a3 2b 14 6b e9 bd 7c 79 de e7 73 eb ee 5e 47 bb ef b1 Data Ascii: 2 ZC_SF#4~L3~M-V!p=m3=3o_L3\|g+pb4N&-^kDMXgZ7-4!(M>)Ex'B#.W0$9JogpUllOz[&m=//^HyO+k\|ys^G
2024-10-02 10:16:49 UTC	16384	IN	Data Raw: cf e9 f3 84 2c a2 8a 89 2d ed 81 d2 b6 4c 06 7c 6e cb 39 09 db 08 4c 39 c7 41 dd 8e 55 28 f3 90 6e 93 ef 3f 1a bd 4e 34 b8 5c 17 4e ad bc a5 ff 3b 57 c1 6f a2 0c a0 ab fb 43 f9 bc 94 db 41 79 0c ba 91 02 fe f2 0b 15 a7 b3 2d a5 b4 87 a9 9f d1 ca df f5 d7 04 f8 8d f1 b7 4d b7 32 0e d7 9a 07 1b 9f 1c 55 30 be 65 d3 9a 1b b7 db 6e 3b bf cb 2e bb 68 e5 b2 d4 6b f8 f8 39 6e 68 d1 2d 96 d9 49 27 b3 47 f4 76 5a 7f 56 0d 30 c0 9f d2 33 0c 67 8b 40 bc 1c f3 3e dc a4 58 28 c9 8b 67 fe 21 ac c2 77 d8 61 07 ba ee ba eb a2 6f e5 df 16 26 ff 6f 0a bb 1f 60 30 b5 74 e9 d2 7b 7c cd 9f ec ba 40 f7 af ba 65 92 0e 7d e8 8e b4 76 ed 6f e8 ba 1b 6e a6 79 c3 db de 30 ba 65 cb 14 4d 87 1b e5 8a dd 1f 44 17 fd 2c 2f 56 b4 c7 76 f3 ee 71 1c 0c 4e d9 c7 fa da b5 6b 15 8a 6f 4b 12 Data Ascii: ,-L\|n9L9AU(n?N4\N;WoCAy-M2U0en;.hk9nh-I'GvZV03g@>X(g!wao&o`0t{\|@e}vony0eMD,/VvqNkoK
2024-10-02 10:16:49 UTC	16384	IN	Data Raw: 27 93 12 39 01 9d 39 a2 d6 07 96 7c ff 27 b3 10 61 52 84 5a 84 c3 59 b8 db 76 7e 66 80 3c 73 98 f4 2c ea b7 aa 4b 86 df 83 f5 74 6e 6b fd 9f bc b5 ba 6e 8b 0f c7 01 89 07 c5 93 74 37 6d b7 80 f4 d4 b7 6f 72 ec fb e3 b6 c7 6a 4b ea ad cb a0 74 88 7c 6b 7c f7 a4 1c fa c7 15 1b 27 55 ed c7 ff 56 f5 df 0e d4 4d 5c d3 1b af dc f8 5f a7 bf 61 7c cd 69 d7 33 00 1f 1f 1f df 1c 8e 86 37 0f 6a b6 df 7e fb 86 17 c7 a4 e4 17 bc 61 08 ce eb 80 b0 0b 34 4a cf 84 d1 2d 8a d4 25 ee 0d 9e 3a 29 e4 5e 35 b4 4e 3a e9 e4 0f 2a 45 7f e4 17 16 b6 fe 0a 33 7a 11 86 f3 e7 d3 61 a6 4f 41 f8 53 9e f2 94 0f 6d d9 b2 e5 87 61 20 fc 11 c3 6f f8 04 67 6b 71 bb 70 26 4b 78 e9 5e 14 60 f8 9b c3 f9 3d a8 93 4e 3a e9 e4 0f 28 33 c1 70 7b ae 7c d1 ef df d6 fb 0c ae d9 9a ba 0d 58 e3 e5 d8 Data Ascii: '99\|'aRZYv~f<s,Ktnknt7morjKt\|k\|'UVM\_a\|i37j~a4J-%:)^5N:*E3zaOASma ogkqp&Kx^`=N:(3p{\|X
2024-10-02 10:16:49 UTC	16384	IN	Data Raw: 4e 3e d4 77 cd f1 cf 6e 95 10 c1 fd 29 00 e6 bc 93 66 84 31 57 57 57 23 50 cd 80 fa 81 03 07 b8 bf 39 58 c2 0b 08 1f dd a4 30 d8 c7 3a 82 fb 14 0e 67 17 11 94 5f de b5 0c 76 95 c2 96 e0 a1 ff 4e 20 07 c6 75 00 c0 bb 00 88 b3 be d5 e5 8a b8 47 e9 ae 7f cb f7 ff 39 f7 45 5f f5 8b 11 f2 16 a3 11 1f 81 6f 51 a5 6d 15 c6 5c dd d0 cb 8f bc 78 aa d1 34 66 48 92 33 fb f4 20 82 6b 71 31 c1 ee 9c 03 18 ed b4 64 7e 51 4e c0 34 95 cd ea 85 25 dc b5 b8 ec 15 45 a4 8b e1 9d b3 66 d6 91 0f e3 aa c0 ab 67 c5 77 26 7f 8f fa 38 b8 23 31 02 60 c6 98 62 31 d1 4a 35 8a b8 ae b7 c5 f0 cb 3a ea a0 f5 f6 c5 db b9 13 f1 3d d9 ea 7a 3b 2d c9 ea 8b 7a 95 b2 4d 5d 36 7d f0 fd d4 9d 7e 58 aa 5b 20 00 e5 78 40 30 c0 e8 a8 50 a7 33 a5 64 f9 0d b6 29 8d 80 e4 b1 49 00 78 a7 34 69 89 c4 Data Ascii: N>wn)f1WWW#P9X0:g_vN uG9E_oQm\x4fH3 kq1d~QN4%Efgw&8#1`b1J5:=z;-zM]6}~X[ x@0P3d)Ix4i
2024-10-02 10:16:49 UTC	16384	IN	Data Raw: 2b 43 7b 7f fc 8d af ed 4e 07 59 f6 06 9d 4c 42 5a 6e b3 3d a1 cd b6 ff de b5 fe e4 e7 27 3d ec ff c8 ef fa ab af 3b d2 6d 0a fd 60 cf eb 16 ba b3 21 ee a1 a0 8b fd 41 57 0f 05 7d 92 34 e1 ea 95 4b 31 fd e4 a3 e7 fc ad 9f 7b c8 dd f7 f8 63 b4 ff ec b5 fe 6a c8 13 a0 79 7a 3c e8 fc 48 e8 57 27 43 de bd 5c bf d0 57 4f 87 f3 fe c0 6f 7f d0 cd 03 41 37 a7 a5 63 ec 0d 3a e1 fe 3c e1 be cf ef 41 41 2e ba 9a f2 f1 8e 29 fb 42 38 a7 e5 3a 4f 3e ba ec 59 d9 b1 56 8f a6 fc a7 6f 4f 5a a1 3d 41 be 50 0e c5 1a ef 4b 2a 8f f5 4d e5 f3 35 77 c1 fd 3c 26 43 23 3d b4 77 c9 c5 d6 0c 65 ce 85 7a af ec 7d 83 3b cd b2 9c 5d f6 c8 bf 4f f4 cd 65 cd cd 9d 89 ba 79 3c c8 1a cb d9 93 74 c0 f2 c5 7e 42 a9 6f 9e 36 fd 84 cb 7a 28 b4 69 94 8d 49 c6 77 ac 41 08 3b 12 f4 f1 00 c7 b3 Data Ascii: +C{NYLBZn='=;m`!AW}4K1{cjyz<HW'C\WOoA7c:<AA.)B8:O>YVoOZ=APK*M5w<&C#=wez};]Oey<t~Bo6z(iIwA;
2024-10-02 10:16:49 UTC	16384	IN	Data Raw: 0f 78 b6 08 95 8d f5 5c ed 16 c5 e6 37 d6 e0 11 04 17 d7 0d ca 9b 2f 56 5f f5 59 ef a2 ec a1 25 85 0b 48 6d cd a7 bc 57 c0 4b 2b e3 21 b3 cf 3e bf 5d 06 70 30 e1 05 e0 99 5c 24 48 7a 80 e5 f1 be c3 44 a2 9c 5a e5 09 79 06 7b 05 00 16 50 34 32 53 10 99 9c c1 63 63 de 14 e4 29 b9 74 89 91 4e a1 82 62 d2 cf 48 68 67 f7 78 94 b0 6c cd 2d e1 de 00 e2 d1 bb 77 4f f0 8c 22 79 52 11 c9 c8 38 e2 ad 62 c9 9d 71 e1 54 5f 6f d7 15 5c 96 45 98 a5 32 3a 68 91 7c 36 49 72 19 f2 b0 59 52 ab 72 5b f4 a4 d6 e7 9f 78 8c 7c d9 cb a2 e6 01 26 b3 11 b6 37 be b5 91 46 52 39 42 ee 58 89 0e 80 5d 9a 88 26 d4 9b 04 7c 86 bd b6 02 45 0e 91 e8 26 72 e4 49 57 52 92 2b 57 31 b0 3e a2 0d 09 5e d1 72 9c b4 53 64 25 49 a9 c9 c2 9b 04 0c 00 80 df a1 a1 9d 2f 9c e6 a0 9e 2a 93 8c 89 ec 82 Data Ascii: x\7/V_Y%HmWK+!>]p0\$HzDZy{P42Scc)tNbHhgxl-wO"yR8bqT_o\E2:h\|6IrYRr[x\|&7FR9BX]&\|E&rIWR+W1>^rSd%I/*
2024-10-02 10:16:49 UTC	16384	IN	Data Raw: cd cb 20 e4 76 af 7d cd 6b 3a 04 db f7 ec d9 e3 1e 38 fe d1 7e b7 dd 0e 42 79 82 e1 54 e5 b7 97 0b 19 3d 40 73 9c b9 85 33 9f 76 38 a8 41 d5 db 11 a7 dd d7 23 13 b0 3c 0f 48 de 1a 76 19 15 8d a9 01 28 b9 ea e6 f8 70 b7 13 ac 69 b9 c6 9e 03 17 52 c0 0e 66 81 4f 1b e8 6f 0f b0 5d 9a 50 4d 5f 9f f1 af 29 9c 81 dd 83 37 4d f7 ba 9c 5c 4d 2b 55 f2 a4 81 9d 0e dc e8 b0 6e 53 da 8a 55 85 58 ab 23 53 7b fe dd 22 50 d7 38 37 29 2f fe eb 29 19 c6 c5 89 11 87 bb 04 db a8 f7 5b 89 86 df b7 82 34 b7 0d c1 5d fa ad 41 4c a7 aa b0 a5 dd 79 27 fc 3a f4 4c 88 2c 91 dc 49 f7 af 07 30 7f b0 69 82 7b 7f ab d1 fe 74 e4 c1 bd 51 09 69 4b 91 bb fd 76 d9 68 88 f2 5e d9 e6 44 ce 9a e5 d0 d6 f5 66 9a 58 ec 77 6a ec 72 6a ec 70 8d 00 5b 44 03 f1 56 93 28 b5 c8 a1 9e 27 68 f6 e5 79 Data Ascii: v}k:8~ByT=@s3v8A#<Hv(piRfOo]PM_)7M\M+UnSUX#S{"P87)/)[4]ALy':L,I0i{tQiKvh^DfXwjrjp[DV('hy

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
88	192.168.2.16	49848	77.75.76.70	443	3540	C:\Users\user\AppData\Roaming\Seznam.cz\sznsetup.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-02 10:16:49 UTC	121	OUT	GET /update/cz.seznam.software.ielisticka3-3.3.5-win32.zip HTTP/1.1 Host: download.seznam.cz Connection: Keep-Alive
2024-10-02 10:16:49 UTC	266	IN	HTTP/1.1 200 OK server: envoy date: Wed, 02 Oct 2024 10:16:49 GMT content-type: application/zip content-length: 724 last-modified: Tue, 30 Apr 2024 09:02:57 GMT etag: "6630b3c1-2d4" accept-ranges: bytes x-envoy-upstream-service-time: 0 connection: close
2024-10-02 10:16:49 UTC	724	IN	Data Raw: 50 4b 03 04 14 00 02 00 08 00 76 70 54 4c 28 07 b1 3f 18 01 00 00 29 02 00 00 0b 00 00 00 63 6f 6e 74 72 6f 6c 2e 69 6e 69 8d 91 4f 4e c5 20 10 c6 f7 4d b8 03 4b 5d 94 d8 d6 7f 1b 36 26 2e 4c 8c 1b 97 c6 05 85 e9 93 94 02 61 78 7d da 78 05 0f e1 d2 73 a8 f7 92 6a fb aa 89 d1 17 12 18 98 df 37 43 e6 bb f1 42 b6 62 05 b7 24 b3 a2 03 2e 07 86 30 a4 90 a1 6b e2 46 04 60 1a 8c c6 a8 13 56 91 ac 87 80 da 59 5e b1 8a 1d 91 4c 3a db 18 2d 23 72 1c 6c 3e 4b f2 45 42 32 6f 44 6c 5c e8 f8 46 db aa 24 99 b6 18 85 31 7c 3a 59 2d 22 c9 d6 76 7e de 46 5f 09 05 1e ac c2 df fe 95 3a 2a c0 36 3a bf 60 3f 7e 51 0b 84 6f 15 5c c7 3a 2d 83 1b f3 ac 43 65 d3 d6 cb 50 14 07 7f b6 31 7a 75 17 d1 03 a8 bc 28 ff 65 eb c6 dd cb 75 4d f7 c6 01 9d ee ef 40 1b 27 14 84 51 50 b2 93 5d Data Ascii: PKvpTL(?)control.iniON MK]6&.Lax}xsj7CBb$.0kF`VY^L:-#rl>KEB2oDl\F$1\|:Y-"v~F_:*6:`?~Qo\:-CeP1zu(euM@'QP]

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
89	192.168.2.16	49851	13.107.246.40	443	4912	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-02 10:16:49 UTC	656	OUT	GET /assets/js/index-70a46923.js HTTP/1.1 Host: apps.microsoft.com Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" Origin: https://apps.microsoft.com sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: same-origin Sec-Fetch-Mode: cors Sec-Fetch-Dest: script Referer: https://apps.microsoft.com/assets/js/index-36d30887.js Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8 Cookie: MSCC=NR
2024-10-02 10:16:49 UTC	1287	IN	HTTP/1.1 200 OK Date: Wed, 02 Oct 2024 10:16:49 GMT Content-Type: text/javascript Content-Length: 298103 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public,max-age=31536000,immutable ETag: "1db136ef67c3277" Last-Modified: Mon, 30 Sep 2024 19:28:44 GMT Strict-Transport-Security: max-age=2592000 Request-Context: appId=cid-v1:04e455f9-321c-49bf-8d2c-d79fbf5e8cde MS-CV: 3qbrZAaGS0Kyrrgs.0 X-Content-Type-Options: nosniff Permissions-Policy: unload=() Content-Security-Policy: default-src 'self' data: https://.clarity.ms https://c.bing.com;script-src 'self' wcpstatic.microsoft.com js.monitor.azure.com www.microsoft.com www.clarity.ms get.microsoft.com xvsec.video.microsoft.com bat.bing.com 'unsafe-inline';style-src 'unsafe-inline';connect-src * data: ms-windows-store:;font-src ;img-src data: blob:;media-src 'self' blob: https://sfds-production.azurefd.net https://canvasstorageprodtorus.blob.core.windows.net;frame-src * ms-windows-store:;report-uri https://csp.microsoft.com/report/app-store-web-prod X-Powered-By: ASP.NET x-azure-ref: 20241002T101649Z-15767c5fc55fdfx81a30vtr1fw00000009u0000000001g4u x-fd-int-roxy-purgeid: 66820190 X-Cache: TCP_MISS Accept-Ranges: bytes
2024-10-02 10:16:49 UTC	15097	IN	Data Raw: 69 6d 70 6f 72 74 7b 61 67 20 61 73 20 68 2c 61 68 20 61 73 20 4f 65 2c 61 69 20 61 73 20 59 2c 61 6a 20 61 73 20 5a 6e 2c 61 6b 20 61 73 20 58 65 2c 61 6c 20 61 73 20 6a 2c 61 6d 20 61 73 20 41 2c 61 6e 20 61 73 20 62 2c 61 6f 20 61 73 20 51 2c 61 70 20 61 73 20 48 74 2c 61 71 20 61 73 20 70 6f 2c 61 72 20 61 73 20 68 72 2c 61 73 20 61 73 20 6a 72 2c 61 74 20 61 73 20 55 6f 2c 61 75 20 61 73 20 65 72 2c 61 76 20 61 73 20 4c 74 2c 61 77 20 61 73 20 65 61 2c 61 78 20 61 73 20 72 65 2c 61 79 20 61 73 20 24 2c 61 7a 20 61 73 20 48 6f 2c 61 41 20 61 73 20 74 61 2c 61 42 20 61 73 20 4f 74 2c 61 43 20 61 73 20 6e 61 2c 61 44 20 61 73 20 74 72 2c 61 45 20 61 73 20 4c 6f 2c 61 46 20 61 73 20 6e 72 2c 61 47 20 61 73 20 6c 69 2c 61 48 20 61 73 20 44 6f 2c 61 49 20 Data Ascii: import{ag as h,ah as Oe,ai as Y,aj as Zn,ak as Xe,al as j,am as A,an as b,ao as Q,ap as Ht,aq as po,ar as hr,as as jr,at as Uo,au as er,av as Lt,aw as ea,ax as re,ay as $,az as Ho,aA as ta,aB as Ot,aC as na,aD as tr,aE as Lo,aF as nr,aG as li,aH as Do,aI
2024-10-02 10:16:49 UTC	16384	IN	Data Raw: 74 28 22 26 22 29 2c 72 3d 6f 3d 3e 64 65 63 6f 64 65 55 52 49 43 6f 6d 70 6f 6e 65 6e 74 28 6f 2e 72 65 70 6c 61 63 65 28 2f 5c 2b 2f 67 2c 22 20 22 29 29 3b 72 65 74 75 72 6e 20 6e 2e 66 6f 72 45 61 63 68 28 6f 3d 3e 7b 69 66 28 6f 2e 74 72 69 6d 28 29 29 7b 63 6f 6e 73 74 5b 61 2c 73 5d 3d 6f 2e 73 70 6c 69 74 28 2f 3d 28 2e 2b 29 2f 67 2c 32 29 3b 61 26 26 73 26 26 28 74 5b 72 28 61 29 5d 3d 72 28 73 29 29 7d 7d 29 2c 74 7d 73 74 61 74 69 63 20 74 72 69 6d 41 72 72 61 79 45 6e 74 72 69 65 73 28 65 29 7b 72 65 74 75 72 6e 20 65 2e 6d 61 70 28 74 3d 3e 74 2e 74 72 69 6d 28 29 29 7d 73 74 61 74 69 63 20 72 65 6d 6f 76 65 45 6d 70 74 79 53 74 72 69 6e 67 73 46 72 6f 6d 41 72 72 61 79 28 65 29 7b 72 65 74 75 72 6e 20 65 2e 66 69 6c 74 65 72 28 74 3d 3e 21 Data Ascii: t("&"),r=o=>decodeURIComponent(o.replace(/\+/g," "));return n.forEach(o=>{if(o.trim()){const[a,s]=o.split(/=(.+)/g,2);a&&s&&(t[r(a)]=r(s))}}),t}static trimArrayEntries(e){return e.map(t=>t.trim())}static removeEmptyStringsFromArray(e){return e.filter(t=>!
2024-10-02 10:16:49 UTC	16384	IN	Data Raw: 65 73 68 54 6f 6b 65 6e 53 69 7a 65 22 2c 22 71 75 65 75 65 64 54 69 6d 65 4d 73 22 2c 22 73 74 61 72 74 54 69 6d 65 4d 73 22 2c 22 73 74 61 74 75 73 22 2c 22 6d 75 6c 74 69 4d 61 74 63 68 65 64 41 54 22 2c 22 6d 75 6c 74 69 4d 61 74 63 68 65 64 49 44 22 2c 22 6d 75 6c 74 69 4d 61 74 63 68 65 64 52 54 22 5d 29 3b 2f 2a 21 20 40 61 7a 75 72 65 2f 6d 73 61 6c 2d 63 6f 6d 6d 6f 6e 20 76 31 34 2e 31 33 2e 30 20 32 30 32 34 2d 30 37 2d 30 31 20 2a 2f 63 6f 6e 73 74 20 48 65 3d 28 69 2c 65 2c 74 2c 6e 2c 72 29 3d 3e 28 2e 2e 2e 6f 29 3d 3e 7b 74 2e 74 72 61 63 65 28 60 45 78 65 63 75 74 69 6e 67 20 66 75 6e 63 74 69 6f 6e 20 24 7b 65 7d 60 29 3b 63 6f 6e 73 74 20 61 3d 6e 3f 2e 73 74 61 72 74 4d 65 61 73 75 72 65 6d 65 6e 74 28 65 2c 72 29 3b 69 66 28 72 29 7b Data Ascii: eshTokenSize","queuedTimeMs","startTimeMs","status","multiMatchedAT","multiMatchedID","multiMatchedRT"]);/! @azure/msal-common v14.13.0 2024-07-01 /const He=(i,e,t,n,r)=>(...o)=>{t.trace(`Executing function ${e}`);const a=n?.startMeasurement(e,r);if(r){
2024-10-02 10:16:49 UTC	16384	IN	Data Raw: 29 2c 57 72 28 65 2c 74 2c 21 31 29 2c 59 2e 43 4f 4e 46 49 47 3b 69 66 28 74 68 69 73 2e 6c 6f 67 67 65 72 2e 76 65 72 62 6f 73 65 28 22 44 69 64 20 6e 6f 74 20 66 69 6e 64 20 63 6c 6f 75 64 20 64 69 73 63 6f 76 65 72 79 20 6d 65 74 61 64 61 74 61 20 69 6e 20 74 68 65 20 63 6f 6e 66 69 67 2e 2e 2e 20 41 74 74 65 6d 70 74 69 6e 67 20 74 6f 20 67 65 74 20 63 6c 6f 75 64 20 64 69 73 63 6f 76 65 72 79 20 6d 65 74 61 64 61 74 61 20 66 72 6f 6d 20 74 68 65 20 68 61 72 64 63 6f 64 65 64 20 76 61 6c 75 65 73 2e 22 29 2c 74 68 69 73 2e 6f 70 74 69 6f 6e 73 2e 73 6b 69 70 41 75 74 68 6f 72 69 74 79 4d 65 74 61 64 61 74 61 43 61 63 68 65 29 74 68 69 73 2e 6c 6f 67 67 65 72 2e 76 65 72 62 6f 73 65 28 22 53 6b 69 70 70 69 6e 67 20 68 61 72 64 63 6f 64 65 64 20 63 6c Data Ascii: ),Wr(e,t,!1),Y.CONFIG;if(this.logger.verbose("Did not find cloud discovery metadata in the config... Attempting to get cloud discovery metadata from the hardcoded values."),this.options.skipAuthorityMetadataCache)this.logger.verbose("Skipping hardcoded cl
2024-10-02 10:16:49 UTC	16384	IN	Data Raw: 69 73 2c 44 65 2e 70 72 6f 74 6f 74 79 70 65 29 2c 74 68 69 73 2e 6e 61 6d 65 3d 22 43 61 63 68 65 45 72 72 6f 72 22 2c 74 68 69 73 2e 65 72 72 6f 72 43 6f 64 65 3d 65 2c 74 68 69 73 2e 65 72 72 6f 72 4d 65 73 73 61 67 65 3d 6e 7d 7d 2f 2a 21 20 40 61 7a 75 72 65 2f 6d 73 61 6c 2d 63 6f 6d 6d 6f 6e 20 76 31 34 2e 31 33 2e 30 20 32 30 32 34 2d 30 37 2d 30 31 20 2a 2f 63 6c 61 73 73 20 76 74 7b 63 6f 6e 73 74 72 75 63 74 6f 72 28 65 2c 74 2c 6e 2c 72 29 7b 74 68 69 73 2e 63 6c 69 65 6e 74 49 64 3d 65 2c 74 68 69 73 2e 63 72 79 70 74 6f 49 6d 70 6c 3d 74 2c 74 68 69 73 2e 63 6f 6d 6d 6f 6e 4c 6f 67 67 65 72 3d 6e 2e 63 6c 6f 6e 65 28 76 69 2c 54 6f 29 2c 74 68 69 73 2e 73 74 61 74 69 63 41 75 74 68 6f 72 69 74 79 4f 70 74 69 6f 6e 73 3d 72 7d 67 65 74 41 6c Data Ascii: is,De.prototype),this.name="CacheError",this.errorCode=e,this.errorMessage=n}}/! @azure/msal-common v14.13.0 2024-07-01 /class vt{constructor(e,t,n,r){this.clientId=e,this.cryptoImpl=t,this.commonLogger=n.clone(vi,To),this.staticAuthorityOptions=r}getAl
2024-10-02 10:16:49 UTC	16384	IN	Data Raw: 63 6c 69 65 6e 74 43 61 70 61 62 69 6c 69 74 69 65 73 3a 5b 5d 2c 61 7a 75 72 65 43 6c 6f 75 64 4f 70 74 69 6f 6e 73 3a 79 73 2c 73 6b 69 70 41 75 74 68 6f 72 69 74 79 4d 65 74 61 64 61 74 61 43 61 63 68 65 3a 21 31 2c 2e 2e 2e 69 7d 7d 66 75 6e 63 74 69 6f 6e 20 72 6f 28 69 29 7b 72 65 74 75 72 6e 20 69 2e 61 75 74 68 4f 70 74 69 6f 6e 73 2e 61 75 74 68 6f 72 69 74 79 2e 6f 70 74 69 6f 6e 73 2e 70 72 6f 74 6f 63 6f 6c 4d 6f 64 65 3d 3d 3d 45 65 2e 4f 49 44 43 7d 2f 2a 21 20 40 61 7a 75 72 65 2f 6d 73 61 6c 2d 63 6f 6d 6d 6f 6e 20 76 31 34 2e 31 33 2e 30 20 32 30 32 34 2d 30 37 2d 30 31 20 2a 2f 63 6c 61 73 73 20 66 65 20 65 78 74 65 6e 64 73 20 4e 7b 63 6f 6e 73 74 72 75 63 74 6f 72 28 65 2c 74 2c 6e 2c 72 2c 6f 29 7b 73 75 70 65 72 28 65 2c 74 2c 6e 29 Data Ascii: clientCapabilities:[],azureCloudOptions:ys,skipAuthorityMetadataCache:!1,...i}}function ro(i){return i.authOptions.authority.options.protocolMode===Ee.OIDC}/! @azure/msal-common v14.13.0 2024-07-01 /class fe extends N{constructor(e,t,n,r,o){super(e,t,n)
2024-10-02 10:16:49 UTC	16384	IN	Data Raw: 65 6e 5f 65 78 70 69 72 65 73 5f 69 6e 3b 6b 3d 6e 2b 78 7d 76 3d 43 69 28 74 68 69 73 2e 68 6f 6d 65 41 63 63 6f 75 6e 74 49 64 65 6e 74 69 66 69 65 72 2c 6c 2c 65 2e 72 65 66 72 65 73 68 5f 74 6f 6b 65 6e 2c 74 68 69 73 2e 63 6c 69 65 6e 74 49 64 2c 65 2e 66 6f 63 69 2c 61 2c 6b 29 7d 6c 65 74 20 5f 3d 6e 75 6c 6c 3b 72 65 74 75 72 6e 20 65 2e 66 6f 63 69 26 26 28 5f 3d 7b 63 6c 69 65 6e 74 49 64 3a 74 68 69 73 2e 63 6c 69 65 6e 74 49 64 2c 65 6e 76 69 72 6f 6e 6d 65 6e 74 3a 6c 2c 66 61 6d 69 6c 79 49 64 3a 65 2e 66 6f 63 69 7d 29 2c 7b 61 63 63 6f 75 6e 74 3a 6d 2c 69 64 54 6f 6b 65 6e 3a 75 2c 61 63 63 65 73 73 54 6f 6b 65 6e 3a 66 2c 72 65 66 72 65 73 68 54 6f 6b 65 6e 3a 76 2c 61 70 70 4d 65 74 61 64 61 74 61 3a 5f 7d 7d 73 74 61 74 69 63 20 61 73 Data Ascii: en_expires_in;k=n+x}v=Ci(this.homeAccountIdentifier,l,e.refresh_token,this.clientId,e.foci,a,k)}let _=null;return e.foci&&(_={clientId:this.clientId,environment:l,familyId:e.foci}),{account:m,idToken:u,accessToken:f,refreshToken:v,appMetadata:_}}static as
2024-10-02 10:16:49 UTC	16384	IN	Data Raw: 76 65 6e 74 43 6f 72 73 50 72 65 66 6c 69 67 68 74 26 26 65 2e 63 63 73 43 72 65 64 65 6e 74 69 61 6c 29 73 77 69 74 63 68 28 65 2e 63 63 73 43 72 65 64 65 6e 74 69 61 6c 2e 74 79 70 65 29 7b 63 61 73 65 20 58 2e 48 4f 4d 45 5f 41 43 43 4f 55 4e 54 5f 49 44 3a 74 72 79 7b 63 6f 6e 73 74 20 72 3d 6e 74 28 65 2e 63 63 73 43 72 65 64 65 6e 74 69 61 6c 2e 63 72 65 64 65 6e 74 69 61 6c 29 3b 6e 2e 61 64 64 43 63 73 4f 69 64 28 72 29 7d 63 61 74 63 68 28 72 29 7b 74 68 69 73 2e 6c 6f 67 67 65 72 2e 76 65 72 62 6f 73 65 28 22 43 6f 75 6c 64 20 6e 6f 74 20 70 61 72 73 65 20 68 6f 6d 65 20 61 63 63 6f 75 6e 74 20 49 44 20 66 6f 72 20 43 43 53 20 48 65 61 64 65 72 3a 20 22 2b 72 29 7d 62 72 65 61 6b 3b 63 61 73 65 20 58 2e 55 50 4e 3a 6e 2e 61 64 64 43 63 73 55 70 Data Ascii: ventCorsPreflight&&e.ccsCredential)switch(e.ccsCredential.type){case X.HOME_ACCOUNT_ID:try{const r=nt(e.ccsCredential.credential);n.addCcsOid(r)}catch(r){this.logger.verbose("Could not parse home account ID for CCS Header: "+r)}break;case X.UPN:n.addCcsUp
2024-10-02 10:16:49 UTC	16384	IN	Data Raw: 72 66 6f 72 6d 61 6e 63 65 20 65 76 65 6e 74 73 22 2c 74 29 2c 74 68 69 73 2e 63 61 6c 6c 62 61 63 6b 73 2e 66 6f 72 45 61 63 68 28 28 6e 2c 72 29 3d 3e 7b 74 68 69 73 2e 6c 6f 67 67 65 72 2e 74 72 61 63 65 28 60 50 65 72 66 6f 72 6d 61 6e 63 65 43 6c 69 65 6e 74 3a 20 45 6d 69 74 74 69 6e 67 20 65 76 65 6e 74 20 74 6f 20 63 61 6c 6c 62 61 63 6b 20 24 7b 72 7d 60 2c 74 29 2c 6e 2e 61 70 70 6c 79 28 6e 75 6c 6c 2c 5b 65 5d 29 7d 29 7d 74 72 75 6e 63 61 74 65 49 6e 74 65 67 72 61 6c 46 69 65 6c 64 73 28 65 29 7b 74 68 69 73 2e 69 6e 74 46 69 65 6c 64 73 2e 66 6f 72 45 61 63 68 28 74 3d 3e 7b 74 20 69 6e 20 65 26 26 74 79 70 65 6f 66 20 65 5b 74 5d 3d 3d 22 6e 75 6d 62 65 72 22 26 26 28 65 5b 74 5d 3d 4d 61 74 68 2e 66 6c 6f 6f 72 28 65 5b 74 5d 29 29 7d 29 Data Ascii: rformance events",t),this.callbacks.forEach((n,r)=>{this.logger.trace(`PerformanceClient: Emitting event to callback ${r}`,t),n.apply(null,[e])})}truncateIntegralFields(e){this.intFields.forEach(t=>{t in e&&typeof e[t]=="number"&&(e[t]=Math.floor(e[t]))})
2024-10-02 10:16:49 UTC	16384	IN	Data Raw: 75 74 3a 74 3f 2e 6c 6f 61 64 46 72 61 6d 65 54 69 6d 65 6f 75 74 7c 7c 6a 73 2c 69 66 72 61 6d 65 48 61 73 68 54 69 6d 65 6f 75 74 3a 74 3f 2e 6c 6f 61 64 46 72 61 6d 65 54 69 6d 65 6f 75 74 7c 7c 63 6f 2c 6e 61 76 69 67 61 74 65 46 72 61 6d 65 57 61 69 74 3a 30 2c 72 65 64 69 72 65 63 74 4e 61 76 69 67 61 74 69 6f 6e 54 69 6d 65 6f 75 74 3a 57 73 2c 61 73 79 6e 63 50 6f 70 75 70 73 3a 21 31 2c 61 6c 6c 6f 77 52 65 64 69 72 65 63 74 49 6e 49 66 72 61 6d 65 3a 21 31 2c 61 6c 6c 6f 77 4e 61 74 69 76 65 42 72 6f 6b 65 72 3a 21 31 2c 6e 61 74 69 76 65 42 72 6f 6b 65 72 48 61 6e 64 73 68 61 6b 65 54 69 6d 65 6f 75 74 3a 74 3f 2e 6e 61 74 69 76 65 42 72 6f 6b 65 72 48 61 6e 64 73 68 61 6b 65 54 69 6d 65 6f 75 74 7c 7c 59 73 2c 70 6f 6c 6c 49 6e 74 65 72 76 61 Data Ascii: ut:t?.loadFrameTimeout\|\|js,iframeHashTimeout:t?.loadFrameTimeout\|\|co,navigateFrameWait:0,redirectNavigationTimeout:Ws,asyncPopups:!1,allowRedirectInIframe:!1,allowNativeBroker:!1,nativeBrokerHandshakeTimeout:t?.nativeBrokerHandshakeTimeout\|\|Ys,pollInterva

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
90	192.168.2.16	49850	13.107.246.40	443	4912	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-02 10:16:49 UTC	644	OUT	GET /louserzed-strings/en-gb/strings.json?v=bd1e6f1fd0 HTTP/1.1 Host: apps.microsoft.com Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: same-origin Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://apps.microsoft.com/apppack/edgefre?hl=en-us&gl=US Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8 Cookie: MSCC=NR
2024-10-02 10:16:49 UTC	1287	IN	HTTP/1.1 200 OK Date: Wed, 02 Oct 2024 10:16:49 GMT Content-Type: application/json Content-Length: 33454 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public,max-age=31536000,immutable ETag: "1db136e40145bae" Last-Modified: Mon, 30 Sep 2024 19:23:38 GMT Strict-Transport-Security: max-age=2592000 Request-Context: appId=cid-v1:04e455f9-321c-49bf-8d2c-d79fbf5e8cde MS-CV: QKI5JWjVGUuhW/QV.0 X-Content-Type-Options: nosniff Permissions-Policy: unload=() Content-Security-Policy: default-src 'self' data: https://.clarity.ms https://c.bing.com;script-src 'self' wcpstatic.microsoft.com js.monitor.azure.com www.microsoft.com www.clarity.ms get.microsoft.com xvsec.video.microsoft.com bat.bing.com 'unsafe-inline';style-src 'unsafe-inline';connect-src * data: ms-windows-store:;font-src ;img-src data: blob:;media-src 'self' blob: https://sfds-production.azurefd.net https://canvasstorageprodtorus.blob.core.windows.net;frame-src * ms-windows-store:;report-uri https://csp.microsoft.com/report/app-store-web-prod X-Powered-By: ASP.NET x-azure-ref: 20241002T101649Z-15767c5fc55qkvj6vefppu9qh400000009800000000032sx x-fd-int-roxy-purgeid: 66820190 X-Cache: TCP_MISS Accept-Ranges: bytes
2024-10-02 10:16:49 UTC	15097	IN	Data Raw: 7b 0d 0a 20 20 22 41 62 6f 75 74 50 61 67 65 2e 44 69 73 63 6c 61 69 6d 65 72 50 6c 75 73 22 3a 20 22 53 63 72 65 65 6e 73 20 73 69 6d 75 6c 61 74 65 64 2e 20 46 65 61 74 75 72 65 73 20 61 6e 64 20 61 70 70 20 61 76 61 69 6c 61 62 69 6c 69 74 79 20 6d 61 79 20 76 61 72 79 20 62 79 20 72 65 67 69 6f 6e 2e 20 41 70 70 73 2c 20 67 61 6d 65 73 2c 20 61 6e 64 20 6f 74 68 65 72 20 63 6f 6e 74 65 6e 74 2f 73 75 62 73 63 72 69 70 74 69 6f 6e 73 20 73 6f 6c 64 20 73 65 70 61 72 61 74 65 6c 79 3b 20 66 72 65 65 20 61 70 70 73 20 6d 61 79 20 63 6f 6e 74 61 69 6e 20 61 64 73 20 6f 72 20 69 6e 2d 61 70 70 20 70 75 72 63 68 61 73 65 73 2e 22 2c 0d 0a 20 20 22 41 62 6f 75 74 50 61 67 65 2e 44 69 73 63 6c 61 69 6d 65 72 4f 6e 65 22 3a 20 22 4f 6e 6c 79 20 61 70 70 6c 69 Data Ascii: { "AboutPage.DisclaimerPlus": "Screens simulated. Features and app availability may vary by region. Apps, games, and other content/subscriptions sold separately; free apps may contain ads or in-app purchases.", "AboutPage.DisclaimerOne": "Only appli
2024-10-02 10:16:49 UTC	16384	IN	Data Raw: 72 6f 64 75 63 74 22 3a 20 22 50 72 6f 64 75 63 74 20 7b 30 7d 20 6f 66 20 7b 31 7d 20 73 65 6c 65 63 74 65 64 22 2c 0d 0a 20 20 22 50 72 6f 64 75 63 74 44 65 74 61 69 6c 73 2e 43 6f 6d 69 6e 67 53 6f 6f 6e 54 65 78 74 22 3a 20 22 43 6f 6d 69 6e 67 20 73 6f 6f 6e 22 2c 0d 0a 20 20 22 50 72 6f 64 75 63 74 44 65 74 61 69 6c 73 2e 43 6f 6e 73 6f 6c 69 64 61 74 65 43 61 74 65 67 6f 72 79 22 3a 20 22 2b 20 7b 30 7d 22 2c 0d 0a 20 20 22 50 72 6f 64 75 63 74 44 65 74 61 69 6c 73 2e 43 72 65 61 74 65 41 70 70 42 61 64 67 65 22 3a 20 22 43 72 65 61 74 65 20 61 70 70 20 62 61 64 67 65 22 2c 0d 0a 20 20 22 50 72 6f 64 75 63 74 44 65 74 61 69 6c 73 2e 44 65 66 61 75 6c 74 49 6d 61 67 65 2e 6c 61 62 65 6c 22 3a 20 22 50 72 6f 64 75 63 74 20 69 6d 61 67 65 22 2c 0d 0a Data Ascii: roduct": "Product {0} of {1} selected", "ProductDetails.ComingSoonText": "Coming soon", "ProductDetails.ConsolidateCategory": "+ {0}", "ProductDetails.CreateAppBadge": "Create app badge", "ProductDetails.DefaultImage.label": "Product image",
2024-10-02 10:16:49 UTC	1973	IN	Data Raw: 70 72 6f 63 65 73 73 20 74 68 69 73 20 72 65 71 75 65 73 74 2e 22 2c 0d 0a 20 20 22 45 72 72 6f 72 2e 49 6e 76 61 6c 69 64 50 72 6f 64 75 63 74 49 64 2e 54 69 74 6c 65 22 3a 20 22 49 6e 76 61 6c 69 64 20 70 72 6f 64 75 63 74 20 49 64 20 7b 30 7d 22 2c 0d 0a 20 20 22 45 72 72 6f 72 2e 49 6e 76 61 6c 69 64 50 72 6f 64 75 63 74 49 64 2e 44 65 73 63 72 69 70 74 69 6f 6e 22 3a 20 22 57 65 20 63 6f 75 6c 64 6e 27 74 20 70 72 6f 63 65 73 73 20 74 68 69 73 20 72 65 71 75 65 73 74 2e 20 50 6c 65 61 73 65 20 6d 61 6b 65 20 73 75 72 65 20 74 68 61 74 20 70 72 6f 64 75 63 74 20 69 64 20 69 73 20 76 61 6c 69 64 20 61 6e 64 20 74 72 79 20 61 67 61 69 6e 2e 22 2c 0d 0a 20 20 22 45 72 72 6f 72 2e 50 72 6f 64 75 63 74 4e 6f 74 46 6f 75 6e 64 2e 54 69 74 6c 65 22 3a 20 22 Data Ascii: process this request.", "Error.InvalidProductId.Title": "Invalid product Id {0}", "Error.InvalidProductId.Description": "We couldn't process this request. Please make sure that product id is valid and try again.", "Error.ProductNotFound.Title": "

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
91	192.168.2.16	49849	13.107.246.40	443	4912	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-02 10:16:49 UTC	716	OUT	GET /api/settings/flags?gl=US&hl=en-us&sessionId= HTTP/1.1 Host: apps.microsoft.com Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 X-API-Ref: db2c8457ef6ae807db500c0199cc06898be1b23d3cd9b3206a65b7c81f4185f0 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: same-origin Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://apps.microsoft.com/apppack/edgefre?hl=en-us&gl=US Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8 Cookie: MSCC=NR
2024-10-02 10:16:49 UTC	1104	IN	HTTP/1.1 200 OK Date: Wed, 02 Oct 2024 10:16:49 GMT Content-Type: application/json; charset=utf-8 Transfer-Encoding: chunked Connection: close Cache-Control: no-store Strict-Transport-Security: max-age=2592000 Request-Context: appId=cid-v1:04e455f9-321c-49bf-8d2c-d79fbf5e8cde MS-CV: zYo9Z2NKzECXSeCu.0 X-Content-Type-Options: nosniff Permissions-Policy: unload=() Content-Security-Policy: default-src 'self' data: https://.clarity.ms https://c.bing.com;script-src 'self' wcpstatic.microsoft.com js.monitor.azure.com www.microsoft.com www.clarity.ms get.microsoft.com xvsec.video.microsoft.com bat.bing.com 'unsafe-inline';style-src 'unsafe-inline';connect-src * data: ms-windows-store:;font-src ;img-src data: blob:;media-src 'self' blob: https://sfds-production.azurefd.net https://canvasstorageprodtorus.blob.core.windows.net;frame-src * ms-windows-store:;report-uri https://csp.microsoft.com/report/app-store-web-prod X-Powered-By: ASP.NET x-azure-ref: 20241002T101649Z-15767c5fc55dtdv4d4saq7t47n0000000980000000002a2c x-fd-int-roxy-purgeid: 66820190 X-Cache: PRIVATE_NOSTORE
2024-10-02 10:16:49 UTC	894	IN	Data Raw: 33 37 32 0d 0a 7b 22 63 6f 6e 74 65 78 74 22 3a 22 36 31 34 36 64 30 31 61 2d 65 33 37 30 3a 32 36 33 31 33 3b 66 31 38 64 65 37 36 65 2d 62 63 35 33 3a 32 36 33 36 32 3b 35 64 61 64 61 64 31 38 2d 65 65 34 36 3a 32 36 33 36 35 3b 31 34 65 33 61 33 64 39 2d 64 38 32 37 3a 32 39 33 38 32 3b 34 31 39 33 33 64 30 36 2d 36 64 66 61 3a 32 39 38 34 30 3b 64 33 65 31 34 65 63 34 2d 62 33 33 32 3a 32 39 38 35 31 3b 61 63 65 30 62 32 35 64 2d 32 65 32 63 3a 33 30 30 35 35 3b 39 64 62 33 62 65 66 65 2d 30 35 65 63 3a 33 32 35 38 31 3b 63 67 32 63 67 34 32 32 3a 31 35 37 38 34 39 3b 22 2c 22 73 65 73 73 69 6f 6e 49 64 22 3a 22 62 36 64 30 65 63 65 32 2d 32 39 61 37 2d 34 31 34 33 2d 39 33 31 63 2d 64 36 32 31 36 34 38 64 37 63 62 38 22 2c 22 73 65 73 73 69 6f 6e 44 Data Ascii: 372{"context":"6146d01a-e370:26313;f18de76e-bc53:26362;5dadad18-ee46:26365;14e3a3d9-d827:29382;41933d06-6dfa:29840;d3e14ec4-b332:29851;ace0b25d-2e2c:30055;9db3befe-05ec:32581;cg2cg422:157849;","sessionId":"b6d0ece2-29a7-4143-931c-d621648d7cb8","sessionD

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
92	192.168.2.16	49852	13.107.246.40	443	4912	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-02 10:16:49 UTC	715	OUT	GET /api/Products/ZeroStateSearch?gl=US&hl=en-us HTTP/1.1 Host: apps.microsoft.com Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 X-API-Ref: ebe1c0636328a720580a52e74af985ddefbb0609f391016b633be0072e31e7fc sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: same-origin Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://apps.microsoft.com/apppack/edgefre?hl=en-us&gl=US Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8 Cookie: MSCC=NR
2024-10-02 10:16:50 UTC	1072	IN	HTTP/1.1 200 OK Date: Wed, 02 Oct 2024 10:16:50 GMT Content-Type: application/json; charset=utf-8 Transfer-Encoding: chunked Connection: close Strict-Transport-Security: max-age=2592000 Request-Context: appId=cid-v1:04e455f9-321c-49bf-8d2c-d79fbf5e8cde MS-CV: SyDX9Kw85U2vX7is.0 X-Content-Type-Options: nosniff Permissions-Policy: unload=() Content-Security-Policy: default-src 'self' data: https://.clarity.ms https://c.bing.com;script-src 'self' wcpstatic.microsoft.com js.monitor.azure.com www.microsoft.com www.clarity.ms get.microsoft.com xvsec.video.microsoft.com bat.bing.com 'unsafe-inline';style-src 'unsafe-inline';connect-src * data: ms-windows-store:;font-src ;img-src data: blob:;media-src 'self' blob: https://sfds-production.azurefd.net https://canvasstorageprodtorus.blob.core.windows.net;frame-src * ms-windows-store:;report-uri https://csp.microsoft.com/report/app-store-web-prod X-Powered-By: ASP.NET x-azure-ref: 20241002T101649Z-15767c5fc55w69c2zvnrz0gmgw00000009k0000000009gaf x-fd-int-roxy-purgeid: 66820190 X-Cache: TCP_MISS
2024-10-02 10:16:50 UTC	15312	IN	Data Raw: 33 36 39 36 0d 0a 7b 22 73 65 63 74 69 6f 6e 54 69 74 6c 65 22 3a 22 52 65 63 6f 6d 6d 65 6e 64 65 64 20 66 6f 72 20 79 6f 75 22 2c 22 70 72 6f 64 75 63 74 73 22 3a 5b 7b 22 70 72 6f 64 75 63 74 49 64 22 3a 22 39 4e 5a 44 48 58 4c 39 53 4a 4a 38 22 2c 22 62 61 6e 6e 65 72 54 65 78 74 22 3a 6e 75 6c 6c 2c 22 74 69 74 6c 65 22 3a 22 50 65 72 73 6f 6e 61 20 35 20 52 6f 79 61 6c 22 2c 22 73 75 62 74 69 74 6c 65 22 3a 6e 75 6c 6c 2c 22 63 61 74 65 67 6f 72 69 65 73 22 3a 5b 22 52 6f 6c 65 20 70 6c 61 79 69 6e 67 22 5d 2c 22 61 76 65 72 61 67 65 52 61 74 69 6e 67 22 3a 34 2e 39 2c 22 69 6d 61 67 65 73 22 3a 5b 7b 22 69 6d 61 67 65 54 79 70 65 22 3a 22 6c 6f 67 6f 22 2c 22 62 61 63 6b 67 72 6f 75 6e 64 43 6f 6c 6f 72 22 3a 22 22 2c 22 66 6f 72 65 67 72 6f 75 6e Data Ascii: 3696{"sectionTitle":"Recommended for you","products":[{"productId":"9NZDHXL9SJJ8","bannerText":null,"title":"Persona 5 Royal","subtitle":null,"categories":["Role playing"],"averageRating":4.9,"images":[{"imageType":"logo","backgroundColor":"","foregroun
2024-10-02 10:16:50 UTC	16384	IN	Data Raw: 2c 22 62 61 63 6b 67 72 6f 75 6e 64 43 6f 6c 6f 72 22 3a 22 23 30 61 38 61 64 33 22 2c 22 66 6f 72 65 67 72 6f 75 6e 64 43 6f 6c 6f 72 22 3a 22 22 2c 22 63 61 70 74 69 6f 6e 22 3a 22 22 2c 22 69 6d 61 67 65 50 6f 73 69 74 69 6f 6e 49 6e 66 6f 22 3a 22 22 2c 22 70 72 6f 64 75 63 74 43 6f 6c 6f 72 22 3a 6e 75 6c 6c 2c 22 75 72 6c 22 3a 22 68 74 74 70 73 3a 2f 2f 73 74 6f 72 65 2d 69 6d 61 67 65 73 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 69 6d 61 67 65 2f 61 70 70 73 2e 33 32 36 36 35 2e 31 33 35 31 30 37 39 38 38 38 32 36 30 36 36 39 37 2e 64 64 39 34 32 30 34 39 2d 30 30 39 37 2d 34 37 35 37 2d 38 38 37 30 2d 63 38 39 63 64 30 65 39 31 34 30 39 2e 35 35 35 37 65 62 31 61 2d 30 61 39 36 2d 34 34 38 39 2d 62 61 34 31 2d 39 63 32 63 38 34 33 39 64 30 64 Data Ascii: ,"backgroundColor":"#0a8ad3","foregroundColor":"","caption":"","imagePositionInfo":"","productColor":null,"url":"https://store-images.microsoft.com/image/apps.32665.13510798882606697.dd942049-0097-4757-8870-c89cd0e91409.5557eb1a-0a96-4489-ba41-9c2c8439d0d
2024-10-02 10:16:50 UTC	16384	IN	Data Raw: 74 69 6f 6e 22 3a 22 22 2c 22 69 6d 61 67 65 50 6f 73 69 74 69 6f 6e 49 6e 66 6f 22 3a 22 22 2c 22 70 72 6f 64 75 63 74 43 6f 6c 6f 72 22 3a 6e 75 6c 6c 2c 22 75 72 6c 22 3a 22 68 74 74 70 73 3a 2f 2f 73 74 6f 72 65 2d 69 6d 61 67 65 73 2e 73 2d 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 69 6d 61 67 65 2f 61 70 70 73 2e 35 32 33 37 34 2e 31 33 35 31 30 37 39 38 38 38 36 36 39 31 39 32 34 2e 36 34 34 35 65 39 65 39 2d 39 64 36 36 2d 34 35 33 39 2d 39 37 38 33 2d 36 63 65 62 36 31 36 34 32 61 38 39 2e 31 39 33 39 63 37 30 33 2d 63 37 31 39 2d 34 32 31 35 2d 61 66 33 36 2d 38 30 62 37 65 37 61 36 33 31 39 39 22 2c 22 68 65 69 67 68 74 22 3a 36 32 30 2c 22 77 69 64 74 68 22 3a 36 32 30 7d 2c 7b 22 69 6d 61 67 65 54 79 70 65 22 3a 22 74 69 6c 65 22 2c 22 62 61 Data Ascii: tion":"","imagePositionInfo":"","productColor":null,"url":"https://store-images.s-microsoft.com/image/apps.52374.13510798886691924.6445e9e9-9d66-4539-9783-6ceb61642a89.1939c703-c719-4215-af36-80b7e7a63199","height":620,"width":620},{"imageType":"tile","ba
2024-10-02 10:16:50 UTC	16384	IN	Data Raw: 65 73 74 c2 ae 3a 20 4d 61 74 63 68 20 33 20 50 75 7a 7a 6c 65 20 47 61 6d 65 22 2c 22 76 69 64 65 6f 50 75 72 70 6f 73 65 22 3a 22 74 72 61 69 6c 65 72 22 2c 22 61 75 64 69 6f 45 6e 63 6f 64 69 6e 67 22 3a 22 22 2c 22 76 69 64 65 6f 45 6e 63 6f 64 69 6e 67 22 3a 22 61 76 63 31 22 2c 22 64 65 65 70 4c 69 6e 6b 22 3a 6e 75 6c 6c 2c 22 69 6d 61 67 65 22 3a 7b 22 69 6d 61 67 65 54 79 70 65 22 3a 22 74 72 61 69 6c 65 72 22 2c 22 62 61 63 6b 67 72 6f 75 6e 64 43 6f 6c 6f 72 22 3a 6e 75 6c 6c 2c 22 66 6f 72 65 67 72 6f 75 6e 64 43 6f 6c 6f 72 22 3a 6e 75 6c 6c 2c 22 63 61 70 74 69 6f 6e 22 3a 22 4a 65 77 65 6c 73 20 6f 66 20 74 68 65 20 57 69 6c 64 20 57 65 73 74 c2 ae 3a 20 4d 61 74 63 68 20 33 20 50 75 7a 7a 6c 65 20 47 61 6d 65 22 2c 22 69 6d 61 67 65 50 6f Data Ascii: est: Match 3 Puzzle Game","videoPurpose":"trailer","audioEncoding":"","videoEncoding":"avc1","deepLink":null,"image":{"imageType":"trailer","backgroundColor":null,"foregroundColor":null,"caption":"Jewels of the Wild West: Match 3 Puzzle Game","imagePo
2024-10-02 10:16:50 UTC	4596	IN	Data Raw: 66 74 2e 63 6f 6d 2f 69 6d 61 67 65 2f 61 70 70 73 2e 34 35 38 32 39 2e 31 33 35 31 30 37 39 38 38 38 33 33 38 36 32 38 32 2e 62 30 34 30 61 30 36 38 2d 32 62 35 34 2d 34 63 37 32 2d 62 37 35 37 2d 62 38 34 65 30 63 34 38 33 36 30 37 2e 62 39 31 33 65 63 33 30 2d 32 31 65 38 2d 34 38 37 37 2d 62 36 34 62 2d 31 63 35 34 66 35 38 35 61 62 31 64 22 2c 22 68 65 69 67 68 74 22 3a 33 31 30 2c 22 77 69 64 74 68 22 3a 33 31 30 7d 2c 7b 22 69 6d 61 67 65 54 79 70 65 22 3a 22 74 69 6c 65 22 2c 22 62 61 63 6b 67 72 6f 75 6e 64 43 6f 6c 6f 72 22 3a 22 74 72 61 6e 73 70 61 72 65 6e 74 22 2c 22 66 6f 72 65 67 72 6f 75 6e 64 43 6f 6c 6f 72 22 3a 22 22 2c 22 63 61 70 74 69 6f 6e 22 3a 22 22 2c 22 69 6d 61 67 65 50 6f 73 69 74 69 6f 6e 49 6e 66 6f 22 3a 22 22 2c 22 70 72 Data Ascii: ft.com/image/apps.45829.13510798883386282.b040a068-2b54-4c72-b757-b84e0c483607.b913ec30-21e8-4877-b64b-1c54f585ab1d","height":310,"width":310},{"imageType":"tile","backgroundColor":"transparent","foregroundColor":"","caption":"","imagePositionInfo":"","pr

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
93	192.168.2.16	49859	172.64.41.3	443	4912	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-02 10:16:49 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-10-02 10:16:49 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 04 65 64 67 65 09 6d 69 63 72 6f 73 6f 66 74 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 51 00 0c 00 4d 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: edgemicrosoftcom)QM
2024-10-02 10:16:49 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Wed, 02 Oct 2024 10:16:49 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8cc3f06ebfa10f9d-EWR alt-svc: h3=":443"; ma=86400
2024-10-02 10:16:49 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 04 00 00 00 01 04 65 64 67 65 09 6d 69 63 72 6f 73 6f 66 74 03 63 6f 6d 00 00 01 00 01 c0 0c 00 05 00 01 00 00 0e 07 00 2d 12 65 64 67 65 2d 6d 69 63 72 6f 73 6f 66 74 2d 63 6f 6d 0b 64 75 61 6c 2d 61 2d 30 30 33 36 08 61 2d 6d 73 65 64 67 65 03 6e 65 74 00 c0 30 00 05 00 01 00 00 00 33 00 02 c0 43 c0 43 00 01 00 01 00 00 00 33 00 04 0d 6b 15 ef c0 43 00 01 00 01 00 00 00 33 00 04 cc 4f c5 ef 00 00 29 04 d0 00 00 00 00 01 3e 00 0c 01 3a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: edgemicrosoftcom-edge-microsoft-comdual-a-0036a-msedgenet03CC3kC3O)>:

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
94	192.168.2.16	49860	172.64.41.3	443	4912	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-02 10:16:49 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-10-02 10:16:49 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 04 65 64 67 65 09 6d 69 63 72 6f 73 6f 66 74 03 63 6f 6d 00 00 41 00 01 00 00 29 10 00 00 00 00 00 00 51 00 0c 00 4d 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: edgemicrosoftcomA)QM
2024-10-02 10:16:49 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Wed, 02 Oct 2024 10:16:49 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8cc3f06e9bfe423a-EWR alt-svc: h3=":443"; ma=86400
2024-10-02 10:16:49 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 01 00 01 00 01 04 65 64 67 65 09 6d 69 63 72 6f 73 6f 66 74 03 63 6f 6d 00 00 41 00 01 c0 0c 00 05 00 01 00 00 0d 9d 00 2d 12 65 64 67 65 2d 6d 69 63 72 6f 73 6f 66 74 2d 63 6f 6d 0b 64 75 61 6c 2d 61 2d 30 30 33 36 08 61 2d 6d 73 65 64 67 65 03 6e 65 74 00 c0 4f 00 06 00 01 00 00 00 7d 00 23 03 6e 73 31 c0 4f 06 6d 73 6e 68 73 74 c0 11 78 2b 22 e5 00 00 07 08 00 00 03 84 00 24 ea 00 00 00 00 f0 00 00 29 04 d0 00 00 00 00 01 3d 00 0c 01 39 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: edgemicrosoftcomA-edge-microsoft-comdual-a-0036a-msedgenetO}#ns1Omsnhstx+"$)=9

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
95	192.168.2.16	49854	13.107.246.40	443	4912	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-02 10:16:49 UTC	678	OUT	GET /shared/cms/lrs1c69a1j/section-images/92176a17dafb4a90a9de118656f92fb2.jpg HTTP/1.1 Host: edgestatic.azureedge.net Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://www.microsoft.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-10-02 10:16:49 UTC	700	IN	HTTP/1.1 200 OK Date: Wed, 02 Oct 2024 10:16:49 GMT Content-Type: image/jpeg Content-Length: 21531 Connection: close Access-Control-Allow-Origin: * Cache-Control: public, max-age=31536000, immutable ETag: W/"541b-18c5b683bd9" Last-Modified: Tue, 12 Dec 2023 00:23:26 GMT Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Origin-Agent-Cluster: ?1 X-Content-Type-Options: nosniff X-Download-Options: noopen X-Frame-Options: SAMEORIGIN X-Permitted-Cross-Domain-Policies: none X-XSS-Protection: 0 x-azure-ref: 20241002T101649Z-15767c5fc552g4w83buhsr3htc00000009c00000000083c4 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-02 10:16:49 UTC	15684	IN	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 00 00 48 00 48 00 00 ff e1 00 4c 45 78 69 66 00 00 4d 4d 00 2a 00 00 00 08 00 01 87 69 00 04 00 00 00 01 00 00 00 1a 00 00 00 00 00 03 a0 01 00 03 00 00 00 01 00 01 00 00 a0 02 00 04 00 00 00 01 00 00 01 2c a0 03 00 04 00 00 00 01 00 00 01 2c 00 00 00 00 ff c0 00 11 08 01 2c 01 2c 03 01 22 00 02 11 01 03 11 01 ff c4 00 1f 00 00 01 05 01 01 01 01 01 01 00 00 00 00 00 00 00 00 01 02 03 04 05 06 07 08 09 0a 0b ff c4 00 b5 10 00 02 01 03 03 02 04 03 05 05 04 04 00 00 01 7d 01 02 03 00 04 11 05 12 21 31 41 06 13 51 61 07 22 71 14 32 81 91 a1 08 23 42 b1 c1 15 52 d1 f0 24 33 62 72 82 09 0a 16 17 18 19 1a 25 26 27 28 29 2a 34 35 36 37 38 39 3a 43 44 45 46 47 48 49 4a 53 54 55 56 57 58 59 5a 63 64 65 66 67 68 69 6a 73 74 75 Data Ascii: JFIFHHLExifMMi,,,,"}!1AQa"q2#BR$3br%&'()456789:CDEFGHIJSTUVWXYZcdefghijstu
2024-10-02 10:16:49 UTC	5847	IN	Data Raw: 65 69 0f ed 11 e2 af b1 e5 43 8b 26 65 d8 54 2b 1b 48 73 83 9e 73 8c e4 00 32 6b e6 5b 75 68 c3 15 6c 64 60 9e 2b ec bf da f7 43 d7 af 3e 36 f8 83 59 16 e7 ec 53 0b 55 8d da 64 d8 44 76 d1 2b 6d dc 7e 51 bc 1e 09 eb f5 af 96 e2 d1 af ce e4 db 10 0c 06 44 92 c6 30 3b 1e 58 74 cf f9 19 af 43 d9 fb a8 f8 3a d8 84 aa ce dd d9 83 13 3a a4 9f 3e 09 5f f6 0f d7 a9 fe a0 f5 f7 aa f1 93 22 f2 e0 1e bd 14 75 fa 35 76 70 69 7a b8 92 58 6d d2 06 77 56 5c 24 c8 0e 3a 9c 15 70 48 c7 6c 91 8a 58 fc 39 ae fc c0 42 bc 1e 7f 7a 7a e3 d7 cc eb eb ed 59 4a 91 d5 43 1a 92 49 b3 23 45 59 24 bf 50 c0 61 d2 43 c1 4c fc a8 d8 fe 30 7a 8a b3 3c fa 8f 96 23 8e 09 19 49 e9 bf 27 f2 56 f4 ff 00 0a ef bc 3f e0 6f 15 49 a8 83 25 84 29 98 e5 cb 5c b6 d8 f0 23 63 f3 92 49 0b 8e f5 d1 dc Data Ascii: eiC&eT+Hss2k[uhld`+C>6YSUdDv+m~QD0;XtC::>_"u5vpizXmwV\$:pHlX9BzzYJCI#EY$PaCL0z<#I'V?oI%)\#cI

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
96	192.168.2.16	49853	13.107.246.40	443	4912	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-02 10:16:49 UTC	678	OUT	GET /shared/cms/lrs1c69a1j/section-images/bbd7bff84da242f286f1e64f4f51d171.jpg HTTP/1.1 Host: edgestatic.azureedge.net Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://www.microsoft.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-10-02 10:16:49 UTC	700	IN	HTTP/1.1 200 OK Date: Wed, 02 Oct 2024 10:16:49 GMT Content-Type: image/jpeg Content-Length: 29375 Connection: close Access-Control-Allow-Origin: * Cache-Control: public, max-age=31536000, immutable ETag: W/"72bf-18c5b76614f" Last-Modified: Tue, 12 Dec 2023 00:38:54 GMT Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Origin-Agent-Cluster: ?1 X-Content-Type-Options: nosniff X-Download-Options: noopen X-Frame-Options: SAMEORIGIN X-Permitted-Cross-Domain-Policies: none X-XSS-Protection: 0 x-azure-ref: 20241002T101649Z-15767c5fc55tsfp92w7yna557w00000009b000000000a0qp x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-02 10:16:49 UTC	15684	IN	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 00 00 48 00 48 00 00 ff e1 00 4c 45 78 69 66 00 00 4d 4d 00 2a 00 00 00 08 00 01 87 69 00 04 00 00 00 01 00 00 00 1a 00 00 00 00 00 03 a0 01 00 03 00 00 00 01 00 01 00 00 a0 02 00 04 00 00 00 01 00 00 01 2c a0 03 00 04 00 00 00 01 00 00 01 2c 00 00 00 00 ff c0 00 11 08 01 2c 01 2c 03 01 22 00 02 11 01 03 11 01 ff c4 00 1f 00 00 01 05 01 01 01 01 01 01 00 00 00 00 00 00 00 00 01 02 03 04 05 06 07 08 09 0a 0b ff c4 00 b5 10 00 02 01 03 03 02 04 03 05 05 04 04 00 00 01 7d 01 02 03 00 04 11 05 12 21 31 41 06 13 51 61 07 22 71 14 32 81 91 a1 08 23 42 b1 c1 15 52 d1 f0 24 33 62 72 82 09 0a 16 17 18 19 1a 25 26 27 28 29 2a 34 35 36 37 38 39 3a 43 44 45 46 47 48 49 4a 53 54 55 56 57 58 59 5a 63 64 65 66 67 68 69 6a 73 74 75 Data Ascii: JFIFHHLExifMMi,,,,"}!1AQa"q2#BR$3br%&'()456789:CDEFGHIJSTUVWXYZcdefghijstu
2024-10-02 10:16:49 UTC	13691	IN	Data Raw: 06 93 47 5d 0e e5 b3 1e 77 44 31 d1 80 e4 1f a8 ce 3e 95 e8 7a 2d d2 e9 ba 7d a3 03 89 2c 75 01 22 f2 78 52 01 6e dd 0a e6 bf 40 a4 95 4a 76 3e 27 11 47 96 4c fa 3e 5d 35 25 8e e3 4f 38 0d 19 2a 3b 10 4f cd fc 8e 7e 84 d7 96 6a 5a 4e a3 76 b7 17 30 62 49 11 48 73 17 f0 ba 03 82 47 d4 60 f4 f5 f6 af 61 79 47 da ad ee 03 7c f2 2b a3 81 c8 3e 53 0e 47 d0 31 06 be 66 b5 9a 79 bc 57 ac 59 cd 29 13 9b a9 c4 83 38 18 63 88 ff 00 2c 63 eb 5d 39 5a 94 9c b5 d8 f3 b1 56 4a e3 fc 3b e2 8d 46 dd 96 4c 97 40 76 ca 99 3f 37 f5 fa 1e c6 bb 3d 71 12 e2 6d 37 c4 96 ad bc e3 ca 76 fe 26 47 e1 49 03 b8 6e 0d 79 dc 36 a2 d2 f6 29 e5 1b 63 9c ec 95 7d 18 1c 7f f5 eb d1 74 ab 4b 88 fc eb 27 cb c6 1c 32 82 73 b4 9e bf 81 38 23 eb 5e d6 22 31 52 e7 47 9d 7b ab 33 b1 36 e0 2c 17 Data Ascii: G]wD1>z-},u"xRn@Jv>'GL>]5%O8*;O~jZNv0bIHsG`ayG\|+>SG1fyWY)8c,c]9ZVJ;FL@v?7=qm7v&GIny6)c}tK'2s8#^"1RG{36,

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
97	192.168.2.16	49855	13.107.246.40	443	4912	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-02 10:16:49 UTC	678	OUT	GET /shared/cms/lrs1c69a1j/section-images/d369d673d1e74d5eb64a9da00f0a2c2b.jpg HTTP/1.1 Host: edgestatic.azureedge.net Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://www.microsoft.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-10-02 10:16:49 UTC	700	IN	HTTP/1.1 200 OK Date: Wed, 02 Oct 2024 10:16:49 GMT Content-Type: image/jpeg Content-Length: 23044 Connection: close Access-Control-Allow-Origin: * Cache-Control: public, max-age=31536000, immutable ETag: W/"5a04-18c5b547f62" Last-Modified: Tue, 12 Dec 2023 00:01:53 GMT Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Origin-Agent-Cluster: ?1 X-Content-Type-Options: nosniff X-Download-Options: noopen X-Frame-Options: SAMEORIGIN X-Permitted-Cross-Domain-Policies: none X-XSS-Protection: 0 x-azure-ref: 20241002T101649Z-15767c5fc55lghvzbxktxfqntw00000009500000000020re x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-02 10:16:49 UTC	15684	IN	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 00 00 48 00 48 00 00 ff e1 00 4c 45 78 69 66 00 00 4d 4d 00 2a 00 00 00 08 00 01 87 69 00 04 00 00 00 01 00 00 00 1a 00 00 00 00 00 03 a0 01 00 03 00 00 00 01 00 01 00 00 a0 02 00 04 00 00 00 01 00 00 01 2c a0 03 00 04 00 00 00 01 00 00 01 2c 00 00 00 00 ff c0 00 11 08 01 2c 01 2c 03 01 22 00 02 11 01 03 11 01 ff c4 00 1f 00 00 01 05 01 01 01 01 01 01 00 00 00 00 00 00 00 00 01 02 03 04 05 06 07 08 09 0a 0b ff c4 00 b5 10 00 02 01 03 03 02 04 03 05 05 04 04 00 00 01 7d 01 02 03 00 04 11 05 12 21 31 41 06 13 51 61 07 22 71 14 32 81 91 a1 08 23 42 b1 c1 15 52 d1 f0 24 33 62 72 82 09 0a 16 17 18 19 1a 25 26 27 28 29 2a 34 35 36 37 38 39 3a 43 44 45 46 47 48 49 4a 53 54 55 56 57 58 59 5a 63 64 65 66 67 68 69 6a 73 74 75 Data Ascii: JFIFHHLExifMMi,,,,"}!1AQa"q2#BR$3br%&'()456789:CDEFGHIJSTUVWXYZcdefghijstu
2024-10-02 10:16:49 UTC	7360	IN	Data Raw: b4 7b d8 e4 47 f2 e3 38 e7 05 f0 7e a3 a5 7b 58 f8 99 e3 b5 f8 3a 7e 08 47 76 6d b4 09 75 47 d5 6e fc b6 f9 e6 3e 5c 61 22 ff 00 66 34 68 cc a4 65 81 7c 36 14 af 3f a8 09 e1 7f 0d b3 93 1e 99 12 05 ed 82 01 c7 d3 d3 ff 00 ad d2 af ff 00 c2 1d e1 c7 06 6f ec b8 d7 80 bc b1 03 83 e8 09 1d fd ab cd a9 5b 0b 75 29 e1 79 ac ee af 2e ab 67 b1 ed ff 00 68 63 27 17 0f ae 59 3d ed 04 bf 1b fe 87 e7 fc 5f b4 8f ed 31 3f 86 ad 7c 27 67 e2 5b e8 74 cd 3a da 0b 38 61 b1 b4 8a db ca b7 81 42 46 81 ad 62 8d f1 b5 76 e4 9c e3 8c d7 8b 5d db 7c 43 d5 2e 1a fe 6d 3b 50 bc 9e 66 72 cf f6 59 dd 99 89 2c 58 b1 52 49 c9 3c e7 9e a7 3c d7 eb 78 f0 d6 8b ce db 05 56 62 58 32 6f 04 9c 8c f7 ef b7 9c e7 3d ea 19 f4 ad 11 77 34 d6 cc 98 c9 ce 5b 9e 9c 67 fc 9a e3 9d 4c 17 33 94 32 Data Ascii: {G8~{X:~GvmuGn>\a"f4he\|6?o[u)y.ghc'Y=_1?\|'g[t:8aBFbv]\|C.m;PfrY,XRI<<xVbX2o=w4[gL32

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
98	192.168.2.16	49856	13.107.246.40	443	4912	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-02 10:16:49 UTC	678	OUT	GET /shared/cms/lrs1c69a1j/section-images/fbee95612d3b45979dd58820b1e0df59.jpg HTTP/1.1 Host: edgestatic.azureedge.net Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://www.microsoft.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-10-02 10:16:49 UTC	700	IN	HTTP/1.1 200 OK Date: Wed, 02 Oct 2024 10:16:49 GMT Content-Type: image/jpeg Content-Length: 14465 Connection: close Access-Control-Allow-Origin: * Cache-Control: public, max-age=31536000, immutable ETag: W/"3881-18c5b7fea11" Last-Modified: Tue, 12 Dec 2023 00:49:18 GMT Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Origin-Agent-Cluster: ?1 X-Content-Type-Options: nosniff X-Download-Options: noopen X-Frame-Options: SAMEORIGIN X-Permitted-Cross-Domain-Policies: none X-XSS-Protection: 0 x-azure-ref: 20241002T101649Z-15767c5fc55gq5fmm10nm5qqr800000009m0000000001pme x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-02 10:16:49 UTC	14465	IN	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 00 00 48 00 48 00 00 ff e1 00 4c 45 78 69 66 00 00 4d 4d 00 2a 00 00 00 08 00 01 87 69 00 04 00 00 00 01 00 00 00 1a 00 00 00 00 00 03 a0 01 00 03 00 00 00 01 00 01 00 00 a0 02 00 04 00 00 00 01 00 00 01 2c a0 03 00 04 00 00 00 01 00 00 01 2c 00 00 00 00 ff c0 00 11 08 01 2c 01 2c 03 01 22 00 02 11 01 03 11 01 ff c4 00 1f 00 00 01 05 01 01 01 01 01 01 00 00 00 00 00 00 00 00 01 02 03 04 05 06 07 08 09 0a 0b ff c4 00 b5 10 00 02 01 03 03 02 04 03 05 05 04 04 00 00 01 7d 01 02 03 00 04 11 05 12 21 31 41 06 13 51 61 07 22 71 14 32 81 91 a1 08 23 42 b1 c1 15 52 d1 f0 24 33 62 72 82 09 0a 16 17 18 19 1a 25 26 27 28 29 2a 34 35 36 37 38 39 3a 43 44 45 46 47 48 49 4a 53 54 55 56 57 58 59 5a 63 64 65 66 67 68 69 6a 73 74 75 Data Ascii: JFIFHHLExifMMi,,,,"}!1AQa"q2#BR$3br%&'()456789:CDEFGHIJSTUVWXYZcdefghijstu

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
99	192.168.2.16	49857	13.107.246.40	443	4912	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-02 10:16:49 UTC	678	OUT	GET /shared/cms/lrs1c69a1j/section-images/e37077f885ed4fa6961e58e8b4c8b10d.jpg HTTP/1.1 Host: edgestatic.azureedge.net Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://www.microsoft.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-10-02 10:16:49 UTC	700	IN	HTTP/1.1 200 OK Date: Wed, 02 Oct 2024 10:16:49 GMT Content-Type: image/jpeg Content-Length: 23709 Connection: close Access-Control-Allow-Origin: * Cache-Control: public, max-age=31536000, immutable ETag: W/"5c9d-18c5b7b085d" Last-Modified: Tue, 12 Dec 2023 00:43:58 GMT Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Origin-Agent-Cluster: ?1 X-Content-Type-Options: nosniff X-Download-Options: noopen X-Frame-Options: SAMEORIGIN X-Permitted-Cross-Domain-Policies: none X-XSS-Protection: 0 x-azure-ref: 20241002T101649Z-15767c5fc55w69c2zvnrz0gmgw00000009k0000000009gap x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-02 10:16:49 UTC	15684	IN	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 00 00 48 00 48 00 00 ff e1 00 4c 45 78 69 66 00 00 4d 4d 00 2a 00 00 00 08 00 01 87 69 00 04 00 00 00 01 00 00 00 1a 00 00 00 00 00 03 a0 01 00 03 00 00 00 01 00 01 00 00 a0 02 00 04 00 00 00 01 00 00 01 2c a0 03 00 04 00 00 00 01 00 00 01 2c 00 00 00 00 ff c0 00 11 08 01 2c 01 2c 03 01 22 00 02 11 01 03 11 01 ff c4 00 1f 00 00 01 05 01 01 01 01 01 01 00 00 00 00 00 00 00 00 01 02 03 04 05 06 07 08 09 0a 0b ff c4 00 b5 10 00 02 01 03 03 02 04 03 05 05 04 04 00 00 01 7d 01 02 03 00 04 11 05 12 21 31 41 06 13 51 61 07 22 71 14 32 81 91 a1 08 23 42 b1 c1 15 52 d1 f0 24 33 62 72 82 09 0a 16 17 18 19 1a 25 26 27 28 29 2a 34 35 36 37 38 39 3a 43 44 45 46 47 48 49 4a 53 54 55 56 57 58 59 5a 63 64 65 66 67 68 69 6a 73 74 75 Data Ascii: JFIFHHLExifMMi,,,,"}!1AQa"q2#BR$3br%&'()456789:CDEFGHIJSTUVWXYZcdefghijstu
2024-10-02 10:16:49 UTC	8025	IN	Data Raw: bf 60 59 6d ad a7 94 85 ea 44 71 b3 10 3d f8 af 86 74 9f da 08 59 6a 26 de e9 6e b4 73 37 cb bf 76 f8 98 1e cc 53 91 f8 8c 7b d7 dc 7e 2d 56 4f 08 78 80 a8 c1 fe ce bc 1f 8f 90 f8 af cd 6d 33 42 8e fa 44 49 50 33 70 01 3d 6b 8f 15 82 58 88 d9 e8 7e 71 c6 1e 29 63 b8 73 17 49 61 ac e3 24 db 8b 57 bb bf 47 bf dc 7d 33 a4 fc 6b f0 e5 94 de 5e a1 a8 da cf 6f 2f fa c8 cc a8 e3 1d c9 5c 9e 3e b5 de 69 df 10 fc 33 1f 88 2d 2e 34 fb 84 bd d0 f5 05 68 66 8b 78 91 20 67 1b 76 b0 e7 30 ca 09 04 1c 81 d3 ee 9e 3e 78 8b e1 68 9e 0c a4 71 9d dc 90 47 5a a4 9f 07 d1 66 f3 45 a2 46 fd 37 af ca d8 3e 84 73 5e 05 5e 19 8c a1 68 d4 35 c3 7d 2b 71 2a a7 fb 46 5d a7 93 7f aa b1 ef 5a c7 c3 4f 0e f8 37 c7 96 5f 12 fc 1b 6e 2f 6c c3 f9 b3 69 c6 43 22 42 cd 9f de 5b 2b 31 03 19 Data Ascii: `YmDq=tYj&ns7vS{~-VOxm3BDIP3p=kX~q)csIa$WG}3k^o/\>i3-.4hfx gv0>xhqGZfEF7>s^^h5}+q*F]ZO7_n/liC"B[+1

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
100	192.168.2.16	49861	13.107.246.40	443	4912	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-02 10:16:50 UTC	678	OUT	GET /shared/cms/lrs1c69a1j/section-images/173b124fd99446babb8439cf477b38fd.jpg HTTP/1.1 Host: edgestatic.azureedge.net Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://www.microsoft.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-10-02 10:16:50 UTC	700	IN	HTTP/1.1 200 OK Date: Wed, 02 Oct 2024 10:16:50 GMT Content-Type: image/jpeg Content-Length: 34690 Connection: close Access-Control-Allow-Origin: * Cache-Control: public, max-age=31536000, immutable ETag: W/"8782-18c5b62005b" Last-Modified: Tue, 12 Dec 2023 00:16:38 GMT Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Origin-Agent-Cluster: ?1 X-Content-Type-Options: nosniff X-Download-Options: noopen X-Frame-Options: SAMEORIGIN X-Permitted-Cross-Domain-Policies: none X-XSS-Protection: 0 x-azure-ref: 20241002T101650Z-15767c5fc552g4w83buhsr3htc00000009ag00000000b8g6 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-02 10:16:50 UTC	15684	IN	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 00 00 48 00 48 00 00 ff e1 00 4c 45 78 69 66 00 00 4d 4d 00 2a 00 00 00 08 00 01 87 69 00 04 00 00 00 01 00 00 00 1a 00 00 00 00 00 03 a0 01 00 03 00 00 00 01 00 01 00 00 a0 02 00 04 00 00 00 01 00 00 01 2c a0 03 00 04 00 00 00 01 00 00 01 2c 00 00 00 00 ff c0 00 11 08 01 2c 01 2c 03 01 22 00 02 11 01 03 11 01 ff c4 00 1f 00 00 01 05 01 01 01 01 01 01 00 00 00 00 00 00 00 00 01 02 03 04 05 06 07 08 09 0a 0b ff c4 00 b5 10 00 02 01 03 03 02 04 03 05 05 04 04 00 00 01 7d 01 02 03 00 04 11 05 12 21 31 41 06 13 51 61 07 22 71 14 32 81 91 a1 08 23 42 b1 c1 15 52 d1 f0 24 33 62 72 82 09 0a 16 17 18 19 1a 25 26 27 28 29 2a 34 35 36 37 38 39 3a 43 44 45 46 47 48 49 4a 53 54 55 56 57 58 59 5a 63 64 65 66 67 68 69 6a 73 74 75 Data Ascii: JFIFHHLExifMMi,,,,"}!1AQa"q2#BR$3br%&'()456789:CDEFGHIJSTUVWXYZcdefghijstu
2024-10-02 10:16:50 UTC	16384	IN	Data Raw: a0 ed d1 54 01 ec 05 6b 67 75 6d 8e 7f 65 16 9d f7 09 8c c5 16 77 46 11 c8 48 56 20 e1 8a e3 38 3d f1 9e 6a e5 bb e8 eb a3 5e 09 cc e3 54 69 61 f2 36 2a 18 0c 00 3f 9c 24 24 86 0f bb cb 29 b4 11 80 c0 f5 06 b3 2e 2d ee ac ca 47 75 13 44 59 44 8a ac 30 76 b7 42 07 b8 ad dd 5b 46 87 49 86 ce 68 ae 52 e9 e6 01 9c 23 44 f1 82 55 5c 05 64 91 89 c6 ec 30 65 5d a4 63 92 48 13 2a 8a e9 37 b9 a4 28 b4 9c 92 d1 1c f8 18 19 27 03 d6 b7 f5 ed 1e e3 c3 ba b4 da 45 c9 3f 68 b4 21 64 c9 43 b6 40 3e 65 0d 1b c8 8c 01 c8 c8 6e 7d 01 c8 18 aa b9 3d 33 5d 3f 86 6c 74 5b ab b9 ce b9 7b 0d 8c 50 5b cb 24 42 68 a7 91 27 99 47 c9 0e 2d f0 ea 58 9e 18 90 a3 1f 31 c7 05 d4 97 2f bc f6 f4 33 84 79 bd d5 bf dc 64 db 82 e7 6e 3d cd 77 d3 e8 16 f6 7e 10 d3 75 df ed 5b 29 a6 d4 ae 6e Data Ascii: TkgumewFHV 8=j^Tia6?$$).-GuDYD0vB[FIhR#DU\d0e]cH7('E?h!dC@>en}=3]?lt[{P[$Bh'G-X1/3ydn=w~u[)n
2024-10-02 10:16:50 UTC	2622	IN	Data Raw: 1c 9f 5a fd 3c f1 4c d3 dd e8 d7 c6 6d d2 19 21 95 18 f2 49 dc ac 4f 27 80 71 9c 74 af c7 ae d5 f9 bf 81 bc 3d 4e 8d 3c 4c db bc 9f 2a bf 96 a7 de 78 a9 c9 84 74 28 d0 8d 93 bb 7e ba 7f 9f e2 7f ff d0 fc 48 9d 26 55 e8 45 65 48 cd bf 9a fa 23 58 f8 5f e2 cb 3d 39 2e 2f 34 cb 88 e3 29 9f 31 a2 65 52 71 c9 cf 38 cf bd 78 66 af a6 5c 69 f7 2f 05 c4 66 37 43 82 18 10 7f 5a cf 2c cd a8 62 7f 85 24 fd 19 cd 9a 64 f5 f0 ce f5 60 d7 aa 32 03 1a 7e e3 9c e6 9b b0 f7 a7 85 e0 0f 4a f6 0f 19 d8 72 96 2d 81 d4 9c 01 eb 56 03 b2 f0 78 3d c6 39 07 d2 a0 8f 7c 6e af 1b 15 75 21 83 03 82 08 e4 10 6a fd c4 d7 ba 8d d4 b7 da 84 f2 5d dc ce c5 e4 96 57 69 24 76 3d 4b 33 12 49 3e a4 d2 bb bf 90 a4 95 86 09 78 a6 b5 c7 18 15 61 6d 9f d3 35 62 e6 e2 e6 e2 d9 2d 65 11 6c 8f 18 Data Ascii: Z<Lm!IO'qt=N<L*xt(~H&UEeH#X_=9./4)1eRq8xf\i/f7CZ,b$d`2~Jr-Vx=9\|nu!j]Wi$v=K3I>xam5b-el

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
101	192.168.2.16	49862	151.101.1.108	443	4912	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-02 10:16:50 UTC	561	OUT	GET /dmp/up/pixie.js HTTP/1.1 Host: acdn.adnxs.com Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://www.microsoft.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-10-02 10:16:50 UTC	563	IN	HTTP/1.1 200 OK Connection: close Content-Length: 25860 Server: nginx/1.18.0 (Ubuntu) Content-Type: application/javascript Last-Modified: Thu, 19 Sep 2024 17:33:01 GMT ETag: "66ec604d-6504" Expires: Sat, 21 Sep 2024 08:07:11 GMT Cache-Control: max-age=86402 Access-Control-Allow-Origin: * Via: 1.1 varnish, 1.1 varnish Accept-Ranges: bytes Age: 6609 Date: Wed, 02 Oct 2024 10:16:50 GMT X-Served-By: cache-lga21930-LGA, cache-ewr-kewr1740067-EWR X-Cache: HIT, HIT X-Cache-Hits: 222, 0 X-Timer: S1727864210.215957,VS0,VE2 Vary: Accept-Encoding
2024-10-02 10:16:50 UTC	1371	IN	Data Raw: 28 28 29 3d 3e 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 76 61 72 20 65 3d 7b 37 30 32 38 3a 28 65 2c 74 29 3d 3e 7b 4f 62 6a 65 63 74 2e 64 65 66 69 6e 65 50 72 6f 70 65 72 74 79 28 74 2c 22 5f 5f 65 73 4d 6f 64 75 6c 65 22 2c 7b 76 61 6c 75 65 3a 21 30 7d 29 2c 74 2e 63 6f 6e 66 69 67 3d 74 2e 50 69 78 69 65 43 6f 6e 66 69 67 3d 76 6f 69 64 20 30 3b 63 6c 61 73 73 20 6e 7b 63 6f 6e 73 74 72 75 63 74 6f 72 28 29 7b 74 68 69 73 2e 62 61 73 65 55 52 4c 3d 22 68 74 74 70 73 3a 2f 2f 69 62 2e 61 64 6e 78 73 2e 63 6f 6d 2f 70 69 78 69 65 22 2c 74 68 69 73 2e 64 65 66 61 75 6c 74 44 6f 6d 61 69 6e 3d 22 69 62 2e 61 64 6e 78 73 2e 63 6f 6d 22 2c 74 68 69 73 2e 63 6f 6f 6b 69 65 46 72 65 65 44 6f 6d 61 69 6e 3d 22 69 62 2e 61 64 6e 78 73 2d 73 69 6d 70 6c 65 2e Data Ascii: (()=>{"use strict";var e={7028:(e,t)=>{Object.defineProperty(t,"__esModule",{value:!0}),t.config=t.PixieConfig=void 0;class n{constructor(){this.baseURL="https://ib.adnxs.com/pixie",this.defaultDomain="ib.adnxs.com",this.cookieFreeDomain="ib.adnxs-simple.
2024-10-02 10:16:50 UTC	1371	IN	Data Raw: 2c 65 76 65 6e 74 5f 74 69 6d 65 3a 22 65 74 22 2c 69 66 72 61 6d 65 3a 22 69 66 22 2c 66 6c 6f 63 5f 69 64 3a 22 66 69 64 22 7d 2c 74 2e 62 75 69 6c 64 50 69 78 65 6c 3d 61 2c 74 2e 73 65 6e 64 54 72 61 63 6b 45 76 65 6e 74 3d 66 75 6e 63 74 69 6f 6e 28 65 29 7b 63 6f 6e 73 74 7b 65 76 65 6e 74 3a 74 2c 70 61 72 61 6d 73 3a 6e 7d 3d 65 3b 69 2e 6c 6f 67 67 65 72 2e 64 65 62 75 67 28 60 54 72 61 63 6b 20 65 76 65 6e 74 3a 20 27 24 7b 74 7d 27 60 29 3b 63 6f 6e 73 74 20 73 3d 4f 62 6a 65 63 74 2e 61 73 73 69 67 6e 28 7b 65 76 65 6e 74 52 65 71 75 65 73 74 49 64 3a 2b 2b 72 7d 2c 65 29 3b 28 30 2c 6f 2e 62 72 6f 61 64 63 61 73 74 45 76 65 6e 74 29 28 6f 2e 54 52 41 43 4b 5f 50 49 58 45 4c 5f 45 56 45 4e 54 2c 7b 74 72 61 63 6b 45 76 65 6e 74 3a 73 7d 29 2c Data Ascii: ,event_time:"et",iframe:"if",floc_id:"fid"},t.buildPixel=a,t.sendTrackEvent=function(e){const{event:t,params:n}=e;i.logger.debug(`Track event: '${t}'`);const s=Object.assign({eventRequestId:++r},e);(0,o.broadcastEvent)(o.TRACK_PIXEL_EVENT,{trackEvent:s}),
2024-10-02 10:16:50 UTC	1371	IN	Data Raw: 64 6f 77 2e 74 6f 70 3f 77 69 6e 64 6f 77 2e 74 6f 70 2e 70 6f 73 74 4d 65 73 73 61 67 65 28 4f 62 6a 65 63 74 2e 61 73 73 69 67 6e 28 7b 74 79 70 65 3a 65 7d 2c 74 29 2c 22 2a 22 29 3a 63 6f 6e 73 6f 6c 65 2e 77 61 72 6e 28 22 77 69 6e 64 6f 77 2e 74 6f 70 20 69 73 20 6e 6f 74 20 61 76 61 69 6c 61 62 6c 65 2e 22 29 7d 7d 2c 32 36 35 36 3a 28 65 2c 74 2c 6e 29 3d 3e 7b 4f 62 6a 65 63 74 2e 64 65 66 69 6e 65 50 72 6f 70 65 72 74 79 28 74 2c 22 5f 5f 65 73 4d 6f 64 75 6c 65 22 2c 7b 76 61 6c 75 65 3a 21 30 7d 29 2c 74 2e 50 69 78 65 6c 3d 76 6f 69 64 20 30 3b 63 6f 6e 73 74 20 69 3d 6e 28 37 30 32 38 29 2c 6f 3d 6e 28 37 35 31 34 29 2c 73 3d 6e 28 34 39 37 29 3b 74 2e 50 69 78 65 6c 3d 63 6c 61 73 73 7b 63 6f 6e 73 74 72 75 63 74 6f 72 28 65 29 7b 74 68 69 Data Ascii: dow.top?window.top.postMessage(Object.assign({type:e},t),"*"):console.warn("window.top is not available.")}},2656:(e,t,n)=>{Object.defineProperty(t,"__esModule",{value:!0}),t.Pixel=void 0;const i=n(7028),o=n(7514),s=n(497);t.Pixel=class{constructor(e){thi
2024-10-02 10:16:50 UTC	1371	IN	Data Raw: 3d 6e 28 31 30 33 37 29 2c 75 3d 6e 28 35 39 35 34 29 2c 64 3d 6e 28 35 38 39 29 3b 66 75 6e 63 74 69 6f 6e 20 6c 28 29 7b 74 72 79 7b 72 65 74 75 72 6e 20 77 69 6e 64 6f 77 21 3d 3d 77 69 6e 64 6f 77 2e 74 6f 70 7d 63 61 74 63 68 28 65 29 7b 72 65 74 75 72 6e 21 31 7d 7d 66 75 6e 63 74 69 6f 6e 20 63 28 65 3d 28 6e 65 77 20 44 61 74 65 29 2e 67 65 74 54 69 6d 65 28 29 29 7b 63 6f 6e 73 74 7b 68 72 65 66 3a 74 7d 3d 77 69 6e 64 6f 77 2e 6c 6f 63 61 74 69 6f 6e 2c 7b 72 65 66 65 72 72 65 72 3a 6e 7d 3d 64 6f 63 75 6d 65 6e 74 3b 72 65 74 75 72 6e 7b 76 65 72 73 69 6f 6e 3a 22 30 2e 30 2e 34 31 22 2c 68 72 65 66 3a 74 2c 72 65 66 65 72 72 65 72 3a 6e 2c 73 74 61 72 74 5f 74 69 6d 65 3a 65 2c 65 76 65 6e 74 5f 74 69 6d 65 3a 28 6e 65 77 20 44 61 74 65 29 2e Data Ascii: =n(1037),u=n(5954),d=n(589);function l(){try{return window!==window.top}catch(e){return!1}}function c(e=(new Date).getTime()){const{href:t}=window.location,{referrer:n}=document;return{version:"0.0.41",href:t,referrer:n,start_time:e,event_time:(new Date).
2024-10-02 10:16:50 UTC	1371	IN	Data Raw: 65 3a 6e 2c 70 61 72 61 6d 73 3a 6f 7d 3d 65 3b 74 68 69 73 2e 70 72 6f 63 65 73 73 41 63 74 69 6f 6e 28 74 2c 6e 2c 6f 29 2c 65 3d 69 2e 73 68 69 66 74 28 29 7d 7d 7d 2c 74 68 69 73 2e 74 72 61 63 6b 3d 28 65 2c 74 29 3d 3e 7b 6f 2e 63 6f 6e 66 69 67 2e 75 70 64 61 74 65 42 61 73 65 55 52 4c 73 28 21 74 68 69 73 2e 68 61 73 43 6f 6e 73 65 6e 74 28 29 29 3b 63 6f 6e 73 74 20 6e 3d 7b 7d 3b 74 26 26 28 74 2e 68 61 73 4f 77 6e 50 72 6f 70 65 72 74 79 28 22 75 72 6c 22 29 26 26 28 6e 2e 68 72 65 66 3d 74 2e 75 72 6c 29 2c 74 2e 68 61 73 4f 77 6e 50 72 6f 70 65 72 74 79 28 22 72 65 66 65 72 72 65 72 22 29 26 26 28 6e 2e 72 65 66 65 72 72 65 72 3d 74 2e 72 65 66 65 72 72 65 72 29 29 2c 74 68 69 73 2e 70 69 78 65 6c 49 64 73 2e 66 6f 72 45 61 63 68 28 28 69 3d Data Ascii: e:n,params:o}=e;this.processAction(t,n,o),e=i.shift()}}},this.track=(e,t)=>{o.config.updateBaseURLs(!this.hasConsent());const n={};t&&(t.hasOwnProperty("url")&&(n.href=t.url),t.hasOwnProperty("referrer")&&(n.referrer=t.referrer)),this.pixelIds.forEach((i=
2024-10-02 10:16:50 UTC	1371	IN	Data Raw: 73 65 6e 74 73 5b 74 68 69 73 2e 58 41 4e 44 52 5f 56 45 4e 44 4f 52 5f 49 44 5d 26 26 21 30 21 3d 3d 65 2e 76 65 6e 64 6f 72 2e 6c 65 67 69 74 69 6d 61 74 65 49 6e 74 65 72 65 73 74 73 5b 74 68 69 73 2e 58 41 4e 44 52 5f 56 45 4e 44 4f 52 5f 49 44 5d 7c 7c 28 74 68 69 73 2e 74 63 66 2e 63 6f 6e 73 65 6e 74 3d 6e 28 31 29 26 26 6e 28 37 29 26 26 6e 28 39 29 26 26 6e 28 31 30 29 26 26 6e 28 33 29 26 26 6e 28 34 29 29 7d 7d 2c 74 68 69 73 2e 63 68 65 63 6b 54 43 46 3d 28 29 3d 3e 7b 22 66 75 6e 63 74 69 6f 6e 22 3d 3d 74 79 70 65 6f 66 20 77 69 6e 64 6f 77 2e 5f 5f 74 63 66 61 70 69 3f 77 69 6e 64 6f 77 2e 5f 5f 74 63 66 61 70 69 28 22 61 64 64 45 76 65 6e 74 4c 69 73 74 65 6e 65 72 22 2c 32 2c 74 68 69 73 2e 74 63 66 43 61 6c 6c 62 61 63 6b 2e 62 69 6e 64 Data Ascii: sents[this.XANDR_VENDOR_ID]&&!0!==e.vendor.legitimateInterests[this.XANDR_VENDOR_ID]\|\|(this.tcf.consent=n(1)&&n(7)&&n(9)&&n(10)&&n(3)&&n(4))}},this.checkTCF=()=>{"function"==typeof window.__tcfapi?window.__tcfapi("addEventListener",2,this.tcfCallback.bind
2024-10-02 10:16:50 UTC	1371	IN	Data Raw: 73 41 63 74 69 6f 6e 3d 28 65 2c 74 2c 6e 29 3d 3e 7b 22 63 6f 6e 73 65 6e 74 22 3d 3d 3d 65 3f 74 68 69 73 2e 70 72 6f 63 65 73 73 42 69 6e 61 72 79 43 6f 6e 73 65 6e 74 28 74 2c 6e 29 3a 22 63 6f 6e 66 69 67 22 3d 3d 3d 65 3f 74 68 69 73 2e 70 72 6f 63 65 73 73 54 43 46 43 6f 6e 73 65 6e 74 28 74 2c 6e 29 3a 22 69 6e 69 74 22 3d 3d 3d 65 3f 76 6f 69 64 20 30 21 3d 3d 28 6e 75 6c 6c 3d 3d 6e 3f 76 6f 69 64 20 30 3a 6e 2e 70 73 45 6e 61 62 6c 65 64 29 3f 74 68 69 73 2e 69 6e 69 74 28 74 2c 21 21 6e 2e 70 73 45 6e 61 62 6c 65 64 29 3a 74 68 69 73 2e 69 6e 69 74 28 74 29 3a 22 65 76 65 6e 74 22 3d 3d 3d 65 3f 28 74 68 69 73 2e 74 72 61 63 6b 28 74 2c 6e 29 2c 74 68 69 73 2e 68 61 73 55 45 54 26 26 28 6e 75 6c 6c 21 3d 74 68 69 73 2e 75 65 74 48 61 6e 64 6c Data Ascii: sAction=(e,t,n)=>{"consent"===e?this.processBinaryConsent(t,n):"config"===e?this.processTCFConsent(t,n):"init"===e?void 0!==(null==n?void 0:n.psEnabled)?this.init(t,!!n.psEnabled):this.init(t):"event"===e?(this.track(t,n),this.hasUET&&(null!=this.uetHandl
2024-10-02 10:16:50 UTC	1371	IN	Data Raw: 6e 74 29 28 61 2e 53 54 41 52 54 5f 50 49 58 49 45 2c 7b 73 74 61 72 74 54 69 6d 65 3a 74 2c 76 65 72 73 69 6f 6e 3a 6e 7d 29 7d 29 29 7d 63 6f 6e 73 65 6e 74 57 61 69 74 65 64 28 29 7b 72 65 74 75 72 6e 21 74 68 69 73 2e 62 69 6e 61 72 79 43 6f 6e 73 65 6e 74 2e 65 6e 61 62 6c 65 64 26 26 21 74 68 69 73 2e 74 63 66 2e 65 6e 61 62 6c 65 64 7c 7c 74 68 69 73 2e 62 69 6e 61 72 79 43 6f 6e 73 65 6e 74 2e 65 6e 61 62 6c 65 64 26 26 28 74 68 69 73 2e 62 69 6e 61 72 79 43 6f 6e 73 65 6e 74 2e 77 61 69 74 46 6f 72 55 70 64 61 74 65 3c 3d 30 7c 7c 74 68 69 73 2e 62 69 6e 61 72 79 43 6f 6e 73 65 6e 74 2e 68 61 73 57 61 69 74 65 64 29 7c 7c 74 68 69 73 2e 74 63 66 2e 65 6e 61 62 6c 65 64 26 26 28 74 68 69 73 2e 74 63 66 2e 68 61 73 4c 6f 61 64 65 64 7c 7c 74 68 69 Data Ascii: nt)(a.START_PIXIE,{startTime:t,version:n})}))}consentWaited(){return!this.binaryConsent.enabled&&!this.tcf.enabled\|\|this.binaryConsent.enabled&&(this.binaryConsent.waitForUpdate<=0\|\|this.binaryConsent.hasWaited)\|\|this.tcf.enabled&&(this.tcf.hasLoaded\|\|thi
2024-10-02 10:16:50 UTC	1371	IN	Data Raw: 28 29 7b 72 65 74 75 72 6e 28 6e 65 77 20 44 61 74 65 29 2e 67 65 74 54 69 6d 65 28 29 7d 73 74 61 74 69 63 20 64 69 66 66 28 65 2c 74 29 7b 72 65 74 75 72 6e 20 74 2d 65 7d 7d 7d 2c 35 39 35 34 3a 28 65 2c 74 2c 6e 29 3d 3e 7b 4f 62 6a 65 63 74 2e 64 65 66 69 6e 65 50 72 6f 70 65 72 74 79 28 74 2c 22 5f 5f 65 73 4d 6f 64 75 6c 65 22 2c 7b 76 61 6c 75 65 3a 21 30 7d 29 2c 74 2e 55 45 54 3d 76 6f 69 64 20 30 3b 63 6f 6e 73 74 20 69 3d 6e 28 37 35 31 34 29 3b 74 2e 55 45 54 3d 63 6c 61 73 73 7b 63 6f 6e 73 74 72 75 63 74 6f 72 28 65 2c 74 2c 6e 2c 69 29 7b 69 66 28 74 68 69 73 2e 6c 6f 61 64 55 45 54 4a 53 3d 28 65 2c 74 2c 6e 29 3d 3e 7b 63 6f 6e 73 74 20 69 3d 64 6f 63 75 6d 65 6e 74 2e 63 72 65 61 74 65 45 6c 65 6d 65 6e 74 28 22 73 63 72 69 70 74 22 29 Data Ascii: (){return(new Date).getTime()}static diff(e,t){return t-e}}},5954:(e,t,n)=>{Object.defineProperty(t,"__esModule",{value:!0}),t.UET=void 0;const i=n(7514);t.UET=class{constructor(e,t,n,i){if(this.loadUETJS=(e,t,n)=>{const i=document.createElement("script")
2024-10-02 10:16:50 UTC	1371	IN	Data Raw: 65 66 61 75 6c 74 3a 65 7d 7d 3b 4f 62 6a 65 63 74 2e 64 65 66 69 6e 65 50 72 6f 70 65 72 74 79 28 74 2c 22 5f 5f 65 73 4d 6f 64 75 6c 65 22 2c 7b 76 61 6c 75 65 3a 21 30 7d 29 2c 74 2e 69 6e 69 74 49 6e 74 65 72 65 73 74 47 72 6f 75 70 73 3d 74 2e 62 75 69 6c 64 47 72 6f 75 70 3d 74 2e 66 65 74 63 68 41 64 73 3d 74 2e 73 75 70 70 6f 72 74 73 49 6e 74 65 72 65 73 74 47 72 6f 75 70 73 3d 76 6f 69 64 20 30 3b 63 6f 6e 73 74 20 6f 3d 69 28 6e 28 37 37 35 38 29 29 2c 73 3d 38 36 34 65 35 2a 6f 2e 64 65 66 61 75 6c 74 2e 44 45 46 41 55 4c 54 5f 4c 49 46 45 54 49 4d 45 5f 44 41 59 53 3b 76 61 72 20 72 3b 21 66 75 6e 63 74 69 6f 6e 28 65 29 7b 65 5b 65 2e 43 6f 6d 70 61 74 69 62 69 6c 69 74 79 4d 6f 64 65 3d 30 5d 3d 22 43 6f 6d 70 61 74 69 62 69 6c 69 74 79 4d Data Ascii: efault:e}};Object.defineProperty(t,"__esModule",{value:!0}),t.initInterestGroups=t.buildGroup=t.fetchAds=t.supportsInterestGroups=void 0;const o=i(n(7758)),s=864e5*o.default.DEFAULT_LIFETIME_DAYS;var r;!function(e){e[e.CompatibilityMode=0]="CompatibilityM

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
102	192.168.2.16	49863	13.107.246.40	443	4912	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-02 10:16:50 UTC	578	OUT	GET /scripts/c/ms.jsll-3.min.js HTTP/1.1 Host: js.monitor.azure.com Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://www.microsoft.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-10-02 10:16:50 UTC	960	IN	HTTP/1.1 200 OK Date: Wed, 02 Oct 2024 10:16:50 GMT Content-Type: text/javascript; charset=utf-8 Content-Length: 185160 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: no-transform, public, max-age=1800, immutable Last-Modified: Mon, 01 Jul 2024 17:04:14 GMT ETag: 0x8DC99EFD5B33A6F x-ms-request-id: c8edd135-701e-0013-4c1b-0fe4d3000000 x-ms-version: 2009-09-19 x-ms-meta-jssdkver: 3.2.18 x-ms-meta-jssdksrc: [cdn]/scripts/c/ms.jsll-3.2.18.min.js Access-Control-Expose-Headers: x-ms-request-id,Server,x-ms-version,x-ms-meta-jssdkver,x-ms-meta-jssdksrc,Content-Type,Cache-Control,Last-Modified,ETag,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding Access-Control-Allow-Origin: * x-azure-ref: 20241002T101650Z-15767c5fc55gs96cphvgp5f5vc00000009b000000000414n x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-02 10:16:50 UTC	15424	IN	Data Raw: 2f 2a 21 0a 20 2a 20 31 44 53 20 4a 53 4c 4c 20 53 4b 55 2c 20 33 2e 32 2e 31 38 0a 20 2a 20 43 6f 70 79 72 69 67 68 74 20 28 63 29 20 4d 69 63 72 6f 73 6f 66 74 20 61 6e 64 20 63 6f 6e 74 72 69 62 75 74 6f 72 73 2e 20 41 6c 6c 20 72 69 67 68 74 73 20 72 65 73 65 72 76 65 64 2e 0a 20 2a 20 28 4d 69 63 72 6f 73 6f 66 74 20 49 6e 74 65 72 6e 61 6c 20 4f 6e 6c 79 29 0a 20 2a 2f 0a 21 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 76 61 72 20 6e 3d 22 75 6e 64 65 66 69 6e 65 64 22 3b 69 66 28 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 65 78 70 6f 72 74 73 26 26 74 79 70 65 6f 66 20 6d 6f 64 75 6c 65 21 3d 6e 29 74 28 65 78 70 6f 72 74 73 29 3b 65 6c 73 65 20 69 66 28 22 66 75 6e 63 74 69 6f 6e 22 3d 3d 74 79 70 65 6f 66 20 64 65 66 69 6e 65 26 26 64 65 66 Data Ascii: /! 1DS JSLL SKU, 3.2.18 * Copyright (c) Microsoft and contributors. All rights reserved. * (Microsoft Internal Only) */!function(e,t){var n="undefined";if("object"==typeof exports&&typeof module!=n)t(exports);else if("function"==typeof define&&def
2024-10-02 10:16:50 UTC	16384	IN	Data Raw: 39 36 37 32 39 35 7c 33 26 74 29 3e 3e 3e 30 2c 6e 3d 30 29 3b 72 65 74 75 72 6e 20 72 7d 76 61 72 20 57 72 3d 65 2c 47 72 3d 22 32 2e 38 2e 31 38 22 2c 58 72 3d 22 2e 22 2b 4b 72 28 36 29 2c 51 72 3d 30 3b 66 75 6e 63 74 69 6f 6e 20 4a 72 28 65 29 7b 72 65 74 75 72 6e 20 31 3d 3d 3d 65 5b 4d 5d 7c 7c 39 3d 3d 3d 65 5b 4d 5d 7c 7c 21 2b 65 5b 4d 5d 7d 66 75 6e 63 74 69 6f 6e 20 59 72 28 65 2c 74 29 7b 72 65 74 75 72 6e 20 4d 74 28 65 2b 51 72 2b 2b 2b 28 28 74 3d 76 6f 69 64 20 30 21 3d 3d 74 26 26 74 29 3f 22 2e 22 2b 47 72 3a 70 29 2b 58 72 29 7d 66 75 6e 63 74 69 6f 6e 20 24 72 28 65 29 7b 76 61 72 20 61 3d 7b 69 64 3a 59 72 28 22 5f 61 69 44 61 74 61 2d 22 2b 28 65 7c 7c 70 29 2b 22 2e 22 2b 47 72 29 2c 61 63 63 65 70 74 3a 4a 72 2c 67 65 74 3a 66 75 Data Ascii: 967295\|3&t)>>>0,n=0);return r}var Wr=e,Gr="2.8.18",Xr="."+Kr(6),Qr=0;function Jr(e){return 1===e[M]\|\|9===e[M]\|\|!+e[M]}function Yr(e,t){return Mt(e+Qr+++((t=void 0!==t&&t)?"."+Gr:p)+Xr)}function $r(e){var a={id:Yr("_aiData-"+(e\|\|p)+"."+Gr),accept:Jr,get:fu
2024-10-02 10:16:50 UTC	16384	IN	Data Raw: 2c 68 5b 51 5d 3d 66 75 6e 63 74 69 6f 6e 28 65 2c 74 2c 6e 2c 72 29 7b 4e 26 26 74 6e 28 55 61 29 2c 68 5b 68 65 5d 28 29 26 26 74 6e 28 22 43 6f 72 65 20 73 68 6f 75 6c 64 20 6e 6f 74 20 62 65 20 69 6e 69 74 69 61 6c 69 7a 65 64 20 6d 6f 72 65 20 74 68 61 6e 20 6f 6e 63 65 22 29 2c 43 3d 65 7c 7c 7b 7d 2c 68 5b 76 65 5d 3d 43 2c 59 28 65 5b 6d 65 5d 29 26 26 74 6e 28 22 50 6c 65 61 73 65 20 70 72 6f 76 69 64 65 20 69 6e 73 74 72 75 6d 65 6e 74 61 74 69 6f 6e 20 6b 65 79 22 29 2c 69 3d 72 2c 68 5b 4c 61 5d 3d 72 3b 65 3d 5a 74 28 43 2e 64 69 73 61 62 6c 65 44 62 67 45 78 74 29 2c 21 30 3d 3d 3d 65 26 26 50 26 26 28 69 5b 49 65 5d 28 50 29 2c 50 3d 6e 75 6c 6c 29 2c 69 26 26 21 50 26 26 21 30 21 3d 3d 65 26 26 28 50 3d 66 75 6e 63 74 69 6f 6e 28 65 29 7b Data Ascii: ,h[Q]=function(e,t,n,r){N&&tn(Ua),h[he]()&&tn("Core should not be initialized more than once"),C=e\|\|{},h[ve]=C,Y(e[me])&&tn("Please provide instrumentation key"),i=r,h[La]=r;e=Zt(C.disableDbgExt),!0===e&&P&&(i[Ie](P),P=null),i&&!P&&!0!==e&&(P=function(e){
2024-10-02 10:16:50 UTC	16384	IN	Data Raw: 6f 6e 20 4b 73 28 65 29 7b 76 61 72 20 74 2c 6e 3d 6e 75 6c 6c 3b 69 66 28 65 29 74 72 79 7b 65 5b 4c 73 5d 3f 6e 3d 7a 73 28 65 5b 4c 73 5d 29 3a 65 5b 4d 73 5d 26 26 65 5b 4d 73 5d 5b 4c 73 5d 3f 6e 3d 7a 73 28 65 5b 4d 73 5d 5b 4c 73 5d 29 3a 65 2e 65 78 63 65 70 74 69 6f 6e 26 26 65 2e 65 78 63 65 70 74 69 6f 6e 5b 4c 73 5d 3f 6e 3d 7a 73 28 65 2e 65 78 63 65 70 74 69 6f 6e 5b 4c 73 5d 29 3a 6a 73 28 65 29 3f 6e 3d 65 3a 6a 73 28 65 5b 55 73 5d 29 3f 6e 3d 65 5b 55 73 5d 3a 77 69 6e 64 6f 77 26 26 77 69 6e 64 6f 77 2e 6f 70 65 72 61 26 26 65 5b 48 73 5d 3f 6e 3d 66 75 6e 63 74 69 6f 6e 28 65 29 7b 66 6f 72 28 76 61 72 20 74 3d 5b 5d 2c 6e 3d 65 5b 77 6f 5d 28 22 5c 6e 22 29 2c 72 3d 30 3b 72 3c 6e 5b 68 5d 3b 72 2b 2b 29 7b 76 61 72 20 69 3d 6e 5b 72 Data Ascii: on Ks(e){var t,n=null;if(e)try{e[Ls]?n=zs(e[Ls]):e[Ms]&&e[Ms][Ls]?n=zs(e[Ms][Ls]):e.exception&&e.exception[Ls]?n=zs(e.exception[Ls]):js(e)?n=e:js(e[Us])?n=e[Us]:window&&window.opera&&e[Hs]?n=function(e){for(var t=[],n=e[wo]("\n"),r=0;r<n[h];r++){var i=n[r
2024-10-02 10:16:50 UTC	16384	IN	Data Raw: 6b 54 72 61 63 65 20 66 61 69 6c 65 64 2c 20 74 72 61 63 65 20 77 69 6c 6c 20 6e 6f 74 20 62 65 20 63 6f 6c 6c 65 63 74 65 64 3a 20 22 2b 76 28 72 29 2c 7b 65 78 63 65 70 74 69 6f 6e 3a 73 65 28 72 29 7d 29 7d 7d 2c 53 2e 74 72 61 63 6b 4d 65 74 72 69 63 3d 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 74 72 79 7b 76 61 72 20 6e 3d 54 63 28 65 2c 74 63 5b 52 63 5d 2c 74 63 5b 4d 63 5d 2c 53 5b 4c 63 5d 28 29 2c 74 29 3b 53 5b 47 5d 5b 55 63 5d 28 6e 29 7d 63 61 74 63 68 28 72 29 7b 64 28 31 2c 33 36 2c 22 74 72 61 63 6b 4d 65 74 72 69 63 20 66 61 69 6c 65 64 2c 20 6d 65 74 72 69 63 20 77 69 6c 6c 20 6e 6f 74 20 62 65 20 63 6f 6c 6c 65 63 74 65 64 3a 20 22 2b 76 28 72 29 2c 7b 65 78 63 65 70 74 69 6f 6e 3a 73 65 28 72 29 7d 29 7d 7d 2c 53 5b 56 63 5d 3d 66 75 Data Ascii: kTrace failed, trace will not be collected: "+v(r),{exception:se(r)})}},S.trackMetric=function(e,t){try{var n=Tc(e,tc[Rc],tc[Mc],S[Lc](),t);S[G][Uc](n)}catch(r){d(1,36,"trackMetric failed, metric will not be collected: "+v(r),{exception:se(r)})}},S[Vc]=fu
2024-10-02 10:16:50 UTC	16384	IN	Data Raw: 7c 4c 74 28 72 2c 22 2f 22 29 29 26 26 28 61 2e 73 79 6e 63 3d 33 29 29 2c 65 26 26 28 61 2e 74 61 72 67 65 74 55 72 69 3d 66 75 6e 63 74 69 6f 6e 28 74 29 7b 76 61 72 20 65 3d 22 22 3b 73 77 69 74 63 68 28 74 2e 74 61 67 4e 61 6d 65 29 7b 63 61 73 65 22 41 22 3a 63 61 73 65 22 41 52 45 41 22 3a 65 3d 74 2e 68 72 65 66 7c 7c 22 22 3b 62 72 65 61 6b 3b 63 61 73 65 22 49 4d 47 22 3a 65 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 69 66 28 74 29 7b 76 61 72 20 65 3d 4d 75 28 74 2c 4c 75 29 3b 69 66 28 65 26 26 31 3d 3d 3d 65 2e 6c 65 6e 67 74 68 29 7b 69 66 28 65 5b 30 5d 2e 68 72 65 66 29 72 65 74 75 72 6e 20 65 5b 30 5d 2e 68 72 65 66 3b 69 66 28 65 5b 30 5d 2e 73 72 63 29 72 65 74 75 72 6e 20 65 5b 30 5d 2e 73 72 63 7d 7d 72 65 74 75 72 6e 22 22 7d 28 29 3b 62 72 Data Ascii: \|Lt(r,"/"))&&(a.sync=3)),e&&(a.targetUri=function(t){var e="";switch(t.tagName){case"A":case"AREA":e=t.href\|\|"";break;case"IMG":e=function(){if(t){var e=Mu(t,Lu);if(e&&1===e.length){if(e[0].href)return e[0].href;if(e[0].src)return e[0].src}}return""}();br
2024-10-02 10:16:50 UTC	16384	IN	Data Raw: 72 79 28 65 2c 74 29 7d 2c 66 2e 74 72 61 63 6b 45 76 65 6e 74 3d 66 75 6e 63 74 69 6f 6e 28 6e 2c 65 29 7b 6e 2e 6c 61 74 65 6e 63 79 3d 6e 2e 6c 61 74 65 6e 63 79 7c 7c 31 2c 6e 2e 62 61 73 65 44 61 74 61 3d 6e 2e 62 61 73 65 44 61 74 61 7c 7c 7b 7d 2c 6e 2e 64 61 74 61 3d 6e 2e 64 61 74 61 7c 7c 7b 7d 2c 75 65 28 65 29 26 26 65 65 28 65 2c 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 6e 2e 64 61 74 61 5b 65 5d 3d 74 7d 29 2c 66 2e 63 6f 72 65 2e 74 72 61 63 6b 28 6e 29 7d 2c 66 2e 74 72 61 63 6b 50 61 67 65 56 69 65 77 3d 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 49 2e 5f 72 65 63 6f 72 64 54 69 6d 65 53 70 61 6e 28 22 64 77 65 6c 6c 54 69 6d 65 22 2c 21 31 29 2c 54 2e 76 3d 30 2c 69 3d 21 31 2c 66 2e 69 64 2e 69 6e 69 74 69 61 6c 69 7a 65 49 64 73 28 29 Data Ascii: ry(e,t)},f.trackEvent=function(n,e){n.latency=n.latency\|\|1,n.baseData=n.baseData\|\|{},n.data=n.data\|\|{},ue(e)&&ee(e,function(e,t){n.data[e]=t}),f.core.track(n)},f.trackPageView=function(e,t){I._recordTimeSpan("dwellTime",!1),T.v=0,i=!1,f.id.initializeIds()
2024-10-02 10:16:50 UTC	16384	IN	Data Raw: 65 72 43 61 73 65 28 29 3d 3d 69 29 7b 6e 3d 21 30 3b 62 72 65 61 6b 7d 7d 7d 72 65 74 75 72 6e 20 6e 7d 66 75 6e 63 74 69 6f 6e 20 56 66 28 65 2c 74 2c 6e 2c 72 29 7b 74 26 26 6e 26 26 30 3c 6e 2e 6c 65 6e 67 74 68 26 26 28 72 26 26 4f 66 5b 74 5d 3f 28 65 2e 68 64 72 73 5b 4f 66 5b 74 5d 5d 3d 6e 2c 65 2e 75 73 65 48 64 72 73 3d 21 30 29 3a 65 2e 75 72 6c 2b 3d 22 26 22 2b 74 2b 22 3d 22 2b 6e 29 7d 66 75 6e 63 74 69 6f 6e 20 48 66 28 65 2c 74 29 7b 72 65 74 75 72 6e 20 74 26 26 28 48 74 28 74 29 3f 65 3d 5b 74 5d 2e 63 6f 6e 63 61 74 28 65 29 3a 46 28 74 29 26 26 28 65 3d 74 2e 63 6f 6e 63 61 74 28 65 29 29 29 2c 65 7d 4d 66 28 63 66 2c 63 66 2c 21 31 29 2c 4d 66 28 6e 66 2c 6e 66 29 2c 4d 66 28 72 66 2c 22 43 6c 69 65 6e 74 2d 49 64 22 29 2c 4d 66 28 Data Ascii: erCase()==i){n=!0;break}}}return n}function Vf(e,t,n,r){t&&n&&0<n.length&&(r&&Of[t]?(e.hdrs[Of[t]]=n,e.useHdrs=!0):e.url+="&"+t+"="+n)}function Hf(e,t){return t&&(Ht(t)?e=[t].concat(e):F(t)&&(e=t.concat(e))),e}Mf(cf,cf,!1),Mf(nf,nf),Mf(rf,"Client-Id"),Mf(
2024-10-02 10:16:50 UTC	16384	IN	Data Raw: 61 74 68 2e 63 65 69 6c 28 72 29 2a 74 5b 31 5d 29 2c 30 3c 3d 6e 26 26 30 3c 3d 74 5b 31 5d 26 26 6e 3e 74 5b 31 5d 26 26 28 6e 3d 74 5b 31 5d 29 2c 74 2e 70 75 73 68 28 6e 29 2c 42 5b 65 5d 3d 74 29 7d 29 7d 2c 6c 2e 66 6c 75 73 68 3d 66 75 6e 63 74 69 6f 6e 28 65 2c 74 2c 6e 29 7b 76 6f 69 64 20 30 3d 3d 3d 65 26 26 28 65 3d 21 30 29 2c 55 7c 7c 28 6e 3d 6e 7c 7c 31 2c 65 3f 6e 75 6c 6c 3d 3d 4c 3f 28 63 28 29 2c 6d 28 31 2c 30 2c 6e 29 2c 4c 3d 73 28 66 75 6e 63 74 69 6f 6e 28 29 7b 4c 3d 6e 75 6c 6c 2c 66 75 6e 63 74 69 6f 6e 20 72 28 65 2c 74 29 7b 61 28 31 2c 30 2c 74 29 2c 76 28 29 2c 66 75 6e 63 74 69 6f 6e 20 6e 28 65 29 7b 44 2e 69 73 43 6f 6d 70 6c 65 74 65 6c 79 49 64 6c 65 28 29 3f 65 28 29 3a 4c 3d 73 28 66 75 6e 63 74 69 6f 6e 28 29 7b 4c Data Ascii: ath.ceil(r)*t[1]),0<=n&&0<=t[1]&&n>t[1]&&(n=t[1]),t.push(n),B[e]=t)})},l.flush=function(e,t,n){void 0===e&&(e=!0),U\|\|(n=n\|\|1,e?null==L?(c(),m(1,0,n),L=s(function(){L=null,function r(e,t){a(1,0,t),v(),function n(e){D.isCompletelyIdle()?e():L=s(function(){L
2024-10-02 10:16:50 UTC	16384	IN	Data Raw: 28 29 7d 7d 29 2c 65 7d 74 28 73 70 2c 61 70 3d 43 74 29 2c 73 70 2e 5f 5f 69 65 44 79 6e 3d 31 3b 76 61 72 20 63 70 3d 73 70 3b 66 75 6e 63 74 69 6f 6e 20 75 70 28 74 29 7b 76 61 72 20 6e 3d 70 6f 28 29 2c 72 3d 74 61 28 29 3b 72 65 28 75 70 2c 74 68 69 73 2c 66 75 6e 63 74 69 6f 6e 28 65 29 7b 65 2e 67 65 74 54 72 61 63 65 49 64 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 74 26 26 74 2e 67 65 74 54 72 61 63 65 43 74 78 26 26 74 2e 67 65 74 54 72 61 63 65 43 74 78 28 29 2e 67 65 74 54 72 61 63 65 49 64 28 29 7c 7c 72 7d 2c 65 2e 67 65 74 4c 61 73 74 50 61 67 65 56 69 65 77 49 64 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 6e 7d 7d 29 7d 75 70 2e 5f 5f 69 65 44 79 6e 3d 31 3b 76 61 72 20 6c 70 3d 75 70 2c 66 70 3d 22 64 75 72 61 Data Ascii: ()}}),e}t(sp,ap=Ct),sp.__ieDyn=1;var cp=sp;function up(t){var n=po(),r=ta();re(up,this,function(e){e.getTraceId=function(){return t&&t.getTraceCtx&&t.getTraceCtx().getTraceId()\|\|r},e.getLastPageViewId=function(){return n}})}up.__ieDyn=1;var lp=up,fp="dura

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
103	192.168.2.16	49865	13.107.246.40	443	4912	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-02 10:16:50 UTC	678	OUT	GET /shared/cms/lrs1c69a1j/section-images/ea9d7038df454660bfdb39a6de1c22d8.jpg HTTP/1.1 Host: edgestatic.azureedge.net Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://www.microsoft.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-10-02 10:16:50 UTC	700	IN	HTTP/1.1 200 OK Date: Wed, 02 Oct 2024 10:16:50 GMT Content-Type: image/jpeg Content-Length: 24029 Connection: close Access-Control-Allow-Origin: * Cache-Control: public, max-age=31536000, immutable ETag: W/"5ddd-18c5b7fec43" Last-Modified: Tue, 12 Dec 2023 00:49:19 GMT Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Origin-Agent-Cluster: ?1 X-Content-Type-Options: nosniff X-Download-Options: noopen X-Frame-Options: SAMEORIGIN X-Permitted-Cross-Domain-Policies: none X-XSS-Protection: 0 x-azure-ref: 20241002T101650Z-15767c5fc55qkvj6vefppu9qh4000000094000000000ag0u x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-02 10:16:50 UTC	15684	IN	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 00 00 48 00 48 00 00 ff e1 00 4c 45 78 69 66 00 00 4d 4d 00 2a 00 00 00 08 00 01 87 69 00 04 00 00 00 01 00 00 00 1a 00 00 00 00 00 03 a0 01 00 03 00 00 00 01 00 01 00 00 a0 02 00 04 00 00 00 01 00 00 01 2c a0 03 00 04 00 00 00 01 00 00 01 2c 00 00 00 00 ff c0 00 11 08 01 2c 01 2c 03 01 22 00 02 11 01 03 11 01 ff c4 00 1f 00 00 01 05 01 01 01 01 01 01 00 00 00 00 00 00 00 00 01 02 03 04 05 06 07 08 09 0a 0b ff c4 00 b5 10 00 02 01 03 03 02 04 03 05 05 04 04 00 00 01 7d 01 02 03 00 04 11 05 12 21 31 41 06 13 51 61 07 22 71 14 32 81 91 a1 08 23 42 b1 c1 15 52 d1 f0 24 33 62 72 82 09 0a 16 17 18 19 1a 25 26 27 28 29 2a 34 35 36 37 38 39 3a 43 44 45 46 47 48 49 4a 53 54 55 56 57 58 59 5a 63 64 65 66 67 68 69 6a 73 74 75 Data Ascii: JFIFHHLExifMMi,,,,"}!1AQa"q2#BR$3br%&'()456789:CDEFGHIJSTUVWXYZcdefghijstu
2024-10-02 10:16:50 UTC	8345	IN	Data Raw: 02 bd ea 33 d0 f3 27 13 9e 94 ef c8 1f 9f ad 73 f7 03 3c 8e dd 7f cf f3 ad b9 18 31 25 3a 0a c7 bb dc bd 7e eb 0c 7e 23 a7 b5 77 c6 47 14 e9 9c bd de 0b 32 f5 ee 3f 1f 7a e4 ee 49 88 82 41 c0 ec 78 f4 22 bb 1b c0 57 e7 c6 40 e7 ea 0f 6f cf 3c 57 27 a8 ed 75 24 76 e7 f3 e7 fa ff 00 93 5d 11 96 84 72 0b 03 e5 43 1e bd fa 74 ff 00 eb d5 d0 d5 97 66 7f 74 39 ee 6b 47 86 e9 f4 af 43 0f 33 86 b4 41 f9 1c d6 6c c9 91 83 fe 7f 4a d3 6e 95 4e 55 04 66 bd 2a 6c e2 92 39 9b b8 72 08 23 35 cf c9 6b 99 32 57 3f e7 d6 bb 09 e2 dd 90 47 1f 4a a2 b6 80 ca 08 1c 83 e9 d2 aa 48 23 2b 1e dd f0 86 2b a4 bb 45 4b 82 a0 f5 01 7a f2 3d 6b ec dd 4b 4e b3 d6 3c 3d 71 a6 5e 26 fb 6b d8 1a 19 14 f3 95 71 b5 b3 f8 1a f8 ff 00 e1 7e 9c a2 fe 2c 27 a6 0e ee 3f c2 be d1 10 3c 36 0a 8e Data Ascii: 3's<1%:~~#wG2?zIAx"W@o<W'u$v]rCtft9kGC3AlJnNUf*l9r#5k2W?GJH#++EKz=kKN<=q^&kq~,'?<6

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
104	192.168.2.16	49866	13.107.246.40	443	4912	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-02 10:16:50 UTC	678	OUT	GET /shared/cms/lrs1c69a1j/section-images/7a62d65e6d6b48d5b5278067c3a78dba.png HTTP/1.1 Host: edgestatic.azureedge.net Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://www.microsoft.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-10-02 10:16:50 UTC	701	IN	HTTP/1.1 200 OK Date: Wed, 02 Oct 2024 10:16:50 GMT Content-Type: image/png Content-Length: 772233 Connection: close Access-Control-Allow-Origin: * Cache-Control: public, max-age=31536000, immutable ETag: W/"bc889-18c5b7fe9c3" Last-Modified: Tue, 12 Dec 2023 00:49:18 GMT Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Origin-Agent-Cluster: ?1 X-Content-Type-Options: nosniff X-Download-Options: noopen X-Frame-Options: SAMEORIGIN X-Permitted-Cross-Domain-Policies: none X-XSS-Protection: 0 x-azure-ref: 20241002T101650Z-15767c5fc554l9xf959gp9cb1s00000003p00000000011wm x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-02 10:16:50 UTC	15683	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 02 58 00 00 02 58 08 06 00 00 00 be 66 98 dc 00 00 00 09 70 48 59 73 00 00 16 25 00 00 16 25 01 49 52 24 f0 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 0b c8 1e 49 44 41 54 78 01 64 fd 67 b3 25 49 92 25 88 99 99 bb 5f f6 78 90 64 55 dd d3 0b 08 44 56 64 21 80 00 d8 0f f8 79 f9 33 b1 10 88 f4 cc 34 a9 a9 aa cc 8c 88 c7 2e 71 62 d0 43 cc 6f d4 6e 76 47 45 c4 8b 4b dc cd cd 94 1c 3d 7a 34 df 3e fd 54 73 8a ff 72 97 6a 9d 13 fe 5c e3 7f 4b e6 4f fd 5f 8e 7f 8b 9f 76 25 a5 a5 ea 47 78 6d e9 53 cd fe b7 ba f0 fd 29 f7 f1 f3 21 fe 3c e1 5d 29 3e 28 5e 5c 52 5e e6 78 6b 4d fd b0 4f f3 32 a5 52 3a 7e 6e 8e 8f ac cb 92 96 f8 dc dc 0f f1 f9 53 7c f4 92 4a df c7 5b bb Data Ascii: PNGIHDRXXfpHYs%%IR$sRGBgAMAaIDATxdg%I%_xdUDVd!y34.qbConvGEK=z4>Tsrj\KO_v%GxmS)!<])>(^\R^xkMO2R:~nS\|J[
2024-10-02 10:16:50 UTC	16384	IN	Data Raw: 04 03 04 b1 35 cc 26 3b 8b 04 3f c5 f5 42 35 17 9b fe 7c 1a d3 01 ce 65 12 8a 75 b8 dd 86 91 57 99 f1 36 32 ee 53 18 d4 03 b2 9f 05 c4 dd 37 2e 2c 08 b3 9b fd 83 4b 61 6f 42 a6 8a 87 66 92 d3 a3 91 2c 99 d2 0d 9a df 37 e4 de 04 52 a3 17 7d 26 37 ac 5b 5c 42 80 21 e7 08 99 91 08 5c 76 09 8e 8e 17 8e 0d cb 35 4d 26 63 2f 2c 9d c8 08 aa dc 83 f5 45 e9 85 c4 c3 5c 8d 58 5a 25 9d 59 f0 91 07 8f f2 0c d8 d8 20 e2 e2 33 10 5c 21 90 a5 c1 19 85 b4 55 91 02 1b e9 3b d9 a0 ae 43 37 89 6e 55 c1 f4 30 8e 83 ee 5f d3 d9 5b b9 ab 69 f8 54 1a 66 da a9 b1 65 45 ea 0e 23 3f 0f 8a d5 28 ab 76 0a 06 a9 8b 85 b2 29 b2 08 06 e4 dd fa 7c b3 b3 54 20 36 8c c5 c8 eb da 29 73 43 19 15 c1 60 b1 72 74 a7 4e 57 f2 bd 50 62 68 87 99 01 66 96 73 d0 ee 67 f0 56 19 5c 2c 2e a1 69 0f 57 Data Ascii: 5&;?B5\|euW62S7.,KaoBf,7R}&7[\B!\v5M&c/,E\XZ%Y 3\!U;C7nU0_[iTfeE#?(v)\|T 6)sC`rtNWPbhfsgV\,.iW
2024-10-02 10:16:50 UTC	16384	IN	Data Raw: cc f9 91 17 26 04 e8 94 43 e6 aa ce aa 45 8a f4 9d 82 db 6c 1d 30 38 b4 c3 87 3f 85 93 d8 ab a1 42 8a 35 1c 16 7d 3a 29 18 3b bf 7e 25 47 6d f9 6e 54 85 d4 2c 7a 72 54 2a 39 31 49 08 4d 4d d6 a3 39 91 e7 33 c6 3e 85 c0 ef cc 46 80 89 e8 0b 50 e0 be 53 b0 07 7e d5 fd ed 0d 83 80 8e 3a 3b 13 03 44 38 94 b7 d7 57 f2 9f 1a a1 14 9d a0 40 9d 06 4a 92 f4 1a 3c 1b 28 d2 4d ec 7d 88 ef e2 ea d0 f5 84 dc ea 14 01 cf 6e a7 f1 4a 50 ca 46 10 8a b1 57 e0 6c bd bd bc f0 de e0 28 50 4a a5 f1 47 37 14 b4 9f 60 c0 a9 49 27 a9 06 2c 3f 50 88 ae 4c e4 98 8d d4 ff 6a 19 2d b3 9e 34 2e 52 57 47 c9 12 fb 08 01 48 5c 16 3b ae 58 96 c9 ea 96 c4 99 65 87 6d 1d 4d 83 70 12 b2 54 97 cf c2 c1 03 35 3c 7b d4 56 92 14 09 75 a2 e2 f3 9f 7e fa 29 02 e8 87 f4 b7 7f fb ef e2 d0 b0 ac 52 Data Ascii: &CEl08?B5}:);~%GmnT,zrT*91IMM93>FPS~:;D8W@J<(M}nJPFWl(PJG7`I',?PLj-4.RWGH\;XemMpT5<{Vu~)R
2024-10-02 10:16:50 UTC	16384	IN	Data Raw: ad af 11 88 7e f7 0f b7 ca ba a4 84 be 7b 82 61 f1 40 ef de 03 0d db 04 95 01 d7 29 62 00 f5 ec 73 73 b9 9e 59 ed 1b 6e 7e 4e 65 78 3e 4d 16 0b 77 a3 d6 fa 59 0b 34 8a 59 4d ce 22 97 51 62 66 7c 52 4e d3 36 d0 ee c2 0f 6e 10 ee f1 c9 cd 35 4b 3f 78 a0 65 52 97 35 25 1a bb a6 a0 d9 52 b8 23 6b 41 8e 15 3c 65 7b 12 a2 84 bc 24 ed c0 82 75 ae aa 42 f6 01 ac 6d 5c 33 54 85 4c 40 9d dd b1 96 6a 6c 4d 3d 94 de 89 88 4e f7 e6 b0 ba 8b 6d 24 fb 2e ba b7 9b 4c ac b1 fb 80 d5 ce 56 01 55 94 e6 2b 3f 78 ca 00 72 ef 56 1e f5 78 20 9d 1b 6b 02 ce e9 84 75 ab 2c ad f8 9b a4 c3 ae 24 0f ac a9 c6 3a fe c5 9f fe 89 8d a1 c6 0a 11 85 18 4f c0 d3 fc ec 5c 87 cd 14 2c 0a 63 5c fb 87 9a 4b c6 7a 36 cc 3f 3a 60 a7 c6 44 3d 51 8a 16 7e 6e d5 7c 31 3f 39 d7 fe 81 1d 02 b1 4d 80 Data Ascii: ~{a@)bssYn~Nex>MwY4YM"Qbf\|RN6n5K?xeR5%R#kA<e{$uBm\3TL@jlM=Nm$.LVU+?xrVx ku,$:O\,c\Kz6?:`D=Q~n\|1?9M
2024-10-02 10:16:50 UTC	16384	IN	Data Raw: 75 67 1e bc ea 5e 49 43 db a4 88 b8 e1 b3 6e 60 5c 86 9e d9 86 37 d1 6a 75 90 df 19 ba 3e 95 42 8b b2 3f 6f b9 b4 ab 54 f9 c3 35 57 07 c5 34 c1 6e 71 b9 80 2f 40 5d d3 7a c2 02 d1 24 fb cd 4e 8b 97 5c cc e9 18 b4 e7 bc 38 bb d4 7d f7 96 7d cf dc e4 05 e4 5b 64 e3 1a a0 cf f4 58 da a6 b4 da 78 e0 30 1d 85 2a a1 d8 a6 f4 67 5f bc 48 7f f6 f5 17 1a 33 04 f6 fe e3 2f 7f 27 20 79 77 f3 49 9d b5 e8 67 5e 5c 5e a8 ec b2 3e 14 e9 c2 ca 36 08 dc 11 ae 73 20 50 74 54 98 22 32 46 16 d3 91 36 cf ba f6 d3 3b 82 75 bc b0 24 18 07 a4 1c a2 6c c1 87 ac dc d4 b2 9c 2e 34 57 01 cc 00 24 b1 b5 4f d7 f2 1f da 6f ef fd e0 15 a7 69 ae ff b0 5b a7 f4 dc 32 06 26 68 bf 0d 60 1d 7a 9c 26 1a 3a 4a 37 c7 6d d6 1b f7 81 c2 f8 12 e3 60 7b 46 fb 15 e0 37 03 29 f7 84 cb e5 f2 dc 9d aa Data Ascii: ug^ICn`\7ju>B?oT5W4nq/@]z$N\8}}[dXx0*g_H3/' ywIg^\^>6s PtT"2F6;u$l.4W$Ooi[2&h`z&:J7m`{F7)
2024-10-02 10:16:50 UTC	16384	IN	Data Raw: 4e 3f 77 87 38 d1 15 32 cb 9b 5a e9 83 d2 a7 c4 ca 85 0b ce dd b6 02 26 b5 d0 29 8a 05 41 06 79 fb bd f2 b5 9a f0 1c 63 03 91 2d 03 f7 8f 8c b7 a1 3b e6 53 c7 47 68 ad 85 40 2d df c9 01 72 00 77 d7 e9 f9 38 2f 02 d8 b0 40 b8 d6 a0 f5 bc 40 b1 4b c9 0f 15 95 37 45 b8 3e 21 c2 70 8b dc d1 d8 08 f0 62 14 99 99 47 b2 e5 aa b2 88 52 cd d6 e3 1d e8 20 2c cb e8 38 cc a7 aa 32 92 0c aa 70 56 2f e2 bd 2a e9 75 34 66 95 cf 38 f6 f9 55 0f a4 db ca 1d 69 1c 4a 2a d9 f4 cf 52 63 a7 7b c6 0e a5 34 36 7b 95 3c 19 31 a5 b3 23 83 c5 79 6a 88 db 31 b6 ca 37 6b ca 52 5e b2 1a 20 f8 a7 b4 63 63 66 64 a7 64 ca 8f bb 1d e5 c1 47 99 28 6e d7 5b 3d 33 c0 a8 7b c6 ed 14 83 a4 cf 07 9b 89 5d 02 a5 69 dd 4b 67 4f 16 cb 93 b4 3c 59 78 64 0b f7 43 39 66 2e 06 67 6c 26 d8 2e f4 7d f6 Data Ascii: N?w82Z&)Ayc-;SGh@-rw8/@@K7E>!pbGR ,82pV/u4f8UiJRc{46{<1#yj17kR^ ccfddG(n[=3{]iKgO<YxdC9f.gl&.}
2024-10-02 10:16:50 UTC	16384	IN	Data Raw: 28 dd 9b 1b 38 bb d7 d6 ab 8a 5f 1f 1a e1 1b 75 31 2b 09 3b 0c d7 33 01 e3 74 96 6b f8 2f 6a 7a 6b e0 01 ad e0 a1 1d 03 30 d6 99 3c 3e 59 8a 51 58 e0 33 0f 71 3f 37 71 0e e6 b8 37 be 62 52 31 ce c5 08 2c c0 94 92 05 a5 c2 7e 72 5b c1 8c 2b 9a 71 47 6a 3d a5 19 8c 0f 37 16 a8 76 0f ac 1e c0 2a ef 9f dd 8d 0d 2d ea f7 50 61 63 cb 13 50 38 47 25 d7 a6 f4 89 8d 66 08 c0 94 63 d1 ea 75 f6 bc 0b 09 1b d2 18 7f df 07 eb 53 87 c4 fa 60 b7 62 a7 d8 d8 92 e1 50 ef b1 9f 76 04 da ce d9 b5 57 7f 60 dd 06 2b 3b 9f c5 56 df dd b7 19 98 b1 84 b1 09 56 97 37 0c 10 c7 6e ae 71 2a 87 2b 3b 1a 5e da 9b 76 05 12 46 a1 f9 7a 5b 00 b4 3b ef bc 67 f5 8d 37 f8 cc 58 c4 e6 a7 90 5d 36 6c 7c af d0 26 f0 fc c5 2b db da ff 06 a4 d7 99 ee b7 3c af 89 c5 00 64 05 18 68 e9 da cc b8 a6 Data Ascii: (8_u1+;3tk/jzk0<>YQX3q?7q7bR1,~r[+qGj=7v-PacP8G%fcuS`bPvW`+;VV7nq+;^vFz[;g7X]6l\|&+<dh
2024-10-02 10:16:50 UTC	16384	IN	Data Raw: 4b e0 b9 58 fb 86 7a 83 85 b2 85 ea f1 ea f2 52 a6 d9 29 ce 63 94 20 d2 9a 77 b3 65 78 6d b6 59 df 8c 87 32 f3 f2 9c f6 00 5e d8 ad 46 b0 a6 ae 2a 4a 82 78 8d 6e 9b 73 f1 ea 6a d9 1f e2 67 18 90 4a 06 84 a1 9a 94 22 17 f8 ec dc 48 08 98 e6 ab 01 64 ad 81 bc 4c fa b7 f9 d4 b6 36 77 ed fc ec b5 01 12 da d6 f6 8e 7c 1a 23 00 95 21 40 57 6f 6b db 0e ee 3f b0 f3 e3 d7 f2 51 08 a8 86 90 c4 4c 4d 0d 6b 9d e7 6a 63 5f 8b 36 19 d7 66 42 29 24 51 d7 0f af 1f e9 f6 99 66 e8 55 34 20 97 f7 1f cf 21 c3 65 93 b5 17 1e 6a 53 a7 f1 9e cf 92 bc 6a b9 8c c1 64 b4 e8 85 d9 a8 ed e8 6b bb 90 89 46 90 e5 2a 60 43 0e 77 b7 ed 83 77 9e da ff e3 af 7f 6c f3 47 0f 6d 86 cf f5 ce ee a6 fd e2 93 4f c4 5c b1 c1 e0 ff fa 7f f9 3f db 7b 00 48 04 67 f4 a6 90 15 38 39 3d 93 1f 86 72 11 Data Ascii: KXzR)c wexmY2^FJxnsjgJ"HdL6w\|#!@Wok?QLMkjc_6fB)$QfU4 !ejSjdkF`CwwlGmO\?{Hg89=r
2024-10-02 10:16:50 UTC	16384	IN	Data Raw: 21 1e 1f 9f 63 36 18 6c ee 1e 6a d6 df 0c 4c e6 98 19 57 15 0f 88 fc e5 4f 7f 8a fb 17 c7 7b 74 22 60 9c 36 bb 3e 25 81 ed eb 04 4d b9 87 7a 9a 9f 02 1c 1b d8 a5 d9 8d 2f 35 34 bf d7 02 70 09 63 37 e8 9b 29 42 16 54 64 d5 b5 d8 d3 7f 42 e6 8f d2 14 0b 85 46 45 de 26 05 dd 5e 0f 20 6f 1f 78 01 c2 35 bb 4a 93 f4 c2 ad 05 04 90 6c 1b af 79 f0 30 ab 6e fa 88 8a 71 d8 48 24 8d fa a6 b3 0e 2c 57 ba f2 cc a6 6a dd 59 86 9b eb 29 9e a9 4c b2 4c ad ea 09 de 69 70 d8 b7 da be f9 72 bf 63 be 95 33 61 1e 06 ca 86 85 66 c7 03 64 b5 e2 d0 cb a3 10 db c0 d9 03 f8 b7 38 bb b0 70 19 70 85 63 52 3c c0 b3 23 75 53 f2 fb 5a 60 44 3b 1b 4d 01 10 ee 4f 75 36 42 28 f3 ca 8b 3c b2 5e 15 00 a0 c5 6c a1 82 d5 81 b2 cf 1a ad 60 d1 5a b0 80 5b 17 02 cd 75 76 ae 29 0c 73 a5 fb 86 40 Data Ascii: !c6ljLWO{t"`6>%Mz/54pc7)BTdBFE&^ ox5Jly0nqH$,WjY)LLiprc3afd8ppcR<#uSZ`D;MOu6B(<^l`Z[uv)s@
2024-10-02 10:16:50 UTC	16384	IN	Data Raw: 26 d8 99 ba 46 e4 9c 1d ef eb dd 53 0c cb 2e b6 c5 94 99 5f 55 07 1a f5 30 f5 72 10 f7 d3 61 19 20 73 04 c6 8a 02 6e 9a 61 52 77 44 36 ac d1 ad eb b9 90 2d a2 a0 b4 41 ed 44 b5 81 52 26 40 5f f9 86 04 f0 3c b8 ea 78 36 63 00 ce 51 ff 12 b1 a3 86 ef 6c 29 06 0d af 2e fc 50 c1 f5 55 78 fd 58 2e b5 d6 5c 5d 2f 2f bf fa 52 07 2b 3f 73 8c c0 bc 8a 92 01 47 ef 70 c5 9c 1f 1c 4b 50 af b6 63 ba 73 53 1c 1d 92 8e 19 01 cb 3c 16 9b a7 21 cc 78 06 2b 38 2c e8 9a cc 83 99 03 ac 09 30 9c 65 4d 50 6a 5d 53 97 55 82 00 3e 3a 3d c5 01 3d 14 ab 23 53 3e bc 83 0e 6d 1d b0 66 08 d0 b8 73 da ed 55 17 aa 33 3b 9e 4d c4 8e 90 25 a8 0b a4 4e 65 c8 4a 4f 1e 76 d4 cd f8 9c 78 c0 c5 e5 50 7a c7 5a 43 60 e6 ef 2e 66 f9 32 58 52 f4 de 69 57 f1 77 99 c0 0a f5 3c 04 5e cd 72 cb af 15 Data Ascii: &FS._U0ra snaRwD6-ADR&@_<x6cQl).PUxX.\]//R+?sGpKPcsS<!x+8,0eMPj]SU>:==#S>mfsU3;M%NeJOvxPzZC`.f2XRiWw<^r

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
105	192.168.2.16	49875	157.240.241.1	443	4912	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-02 10:16:50 UTC	569	OUT	GET /en_US/fbevents.js HTTP/1.1 Host: connect.facebook.net Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://www.microsoft.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-10-02 10:16:50 UTC	1451	IN	HTTP/1.1 200 OK Vary: Accept-Encoding Content-Type: application/x-javascript; charset=utf-8 timing-allow-origin: * reporting-endpoints: coop_report="https://www.facebook.com/browser_reporting/coop/?minimize=0", coep_report="https://www.facebook.com/browser_reporting/coep/?minimize=0", permissions_policy="https://www.facebook.com/ajax/browser_error_reports/" report-to: {"max_age":2592000,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coop\/?minimize=0"}],"group":"coop_report","include_subdomains":true}, {"max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coep\/?minimize=0"}],"group":"coep_report"}, {"max_age":21600,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/"}],"group":"permissions_policy"} content-security-policy: default-src 'self' data: blob: ;script-src 'unsafe-inline' .facebook.com .fbcdn.net .facebook.net 127.0.0.1:* blob: data: 'self' https://.google-analytics.com .google.com;style-src data: blob: 'unsafe-inline' ;connect-src .facebook.com facebook.com .fbcdn.net .facebook.net wss://.facebook.com: wss://.whatsapp.com: wss://.fbcdn.net attachment.fbsbx.com ws://localhost: blob: .cdninstagram.com 'self' https://.google-analytics.com;img-src 'self' data: blob: * https://*.google-analytics.com;block-all-mixed-content;upgrade-insecure-requests;require-trusted-types-for 'script'; document-policy: force-load-at-top
2024-10-02 10:16:50 UTC	1680	IN	Data Raw: 70 65 72 6d 69 73 73 69 6f 6e 73 2d 70 6f 6c 69 63 79 3a 20 61 63 63 65 6c 65 72 6f 6d 65 74 65 72 3d 28 29 2c 20 61 74 74 72 69 62 75 74 69 6f 6e 2d 72 65 70 6f 72 74 69 6e 67 3d 28 29 2c 20 61 75 74 6f 70 6c 61 79 3d 28 29 2c 20 62 6c 75 65 74 6f 6f 74 68 3d 28 29 2c 20 63 61 6d 65 72 61 3d 28 29 2c 20 63 68 2d 64 65 76 69 63 65 2d 6d 65 6d 6f 72 79 3d 28 29 2c 20 63 68 2d 64 6f 77 6e 6c 69 6e 6b 3d 28 29 2c 20 63 68 2d 64 70 72 3d 28 29 2c 20 63 68 2d 65 63 74 3d 28 29 2c 20 63 68 2d 72 74 74 3d 28 29 2c 20 63 68 2d 73 61 76 65 2d 64 61 74 61 3d 28 29 2c 20 63 68 2d 75 61 2d 61 72 63 68 3d 28 29 2c 20 63 68 2d 75 61 2d 62 69 74 6e 65 73 73 3d 28 29 2c 20 63 68 2d 76 69 65 77 70 6f 72 74 2d 68 65 69 67 68 74 3d 28 29 2c 20 63 68 2d 76 69 65 77 70 6f 72 Data Ascii: permissions-policy: accelerometer=(), attribution-reporting=(), autoplay=(), bluetooth=(), camera=(), ch-device-memory=(), ch-downlink=(), ch-dpr=(), ch-ect=(), ch-rtt=(), ch-save-data=(), ch-ua-arch=(), ch-ua-bitness=(), ch-viewport-height=(), ch-viewpor
2024-10-02 10:16:50 UTC	1	IN	Data Raw: 2f Data Ascii: /
2024-10-02 10:16:50 UTC	14707	IN	Data Raw: 2a 2a 0a 2a 20 43 6f 70 79 72 69 67 68 74 20 28 63 29 20 32 30 31 37 2d 70 72 65 73 65 6e 74 2c 20 46 61 63 65 62 6f 6f 6b 2c 20 49 6e 63 2e 20 41 6c 6c 20 72 69 67 68 74 73 20 72 65 73 65 72 76 65 64 2e 0a 2a 0a 2a 20 59 6f 75 20 61 72 65 20 68 65 72 65 62 79 20 67 72 61 6e 74 65 64 20 61 20 6e 6f 6e 2d 65 78 63 6c 75 73 69 76 65 2c 20 77 6f 72 6c 64 77 69 64 65 2c 20 72 6f 79 61 6c 74 79 2d 66 72 65 65 20 6c 69 63 65 6e 73 65 20 74 6f 20 75 73 65 2c 0a 2a 20 63 6f 70 79 2c 20 6d 6f 64 69 66 79 2c 20 61 6e 64 20 64 69 73 74 72 69 62 75 74 65 20 74 68 69 73 20 73 6f 66 74 77 61 72 65 20 69 6e 20 73 6f 75 72 63 65 20 63 6f 64 65 20 6f 72 20 62 69 6e 61 72 79 20 66 6f 72 6d 20 66 6f 72 20 75 73 65 0a 2a 20 69 6e 20 63 6f 6e 6e 65 63 74 69 6f 6e 20 77 69 74 Data Ascii: * Copyright (c) 2017-present, Facebook, Inc. All rights reserved. You are hereby granted a non-exclusive, worldwide, royalty-free license to use,* copy, modify, and distribute this software in source code or binary form for use* in connection wit
2024-10-02 10:16:50 UTC	16384	IN	Data Raw: 7b 64 6f 6d 61 69 6e 5f 75 72 69 3a 62 2c 65 76 65 6e 74 5f 74 79 70 65 3a 63 2c 65 78 74 72 61 63 74 6f 72 5f 74 79 70 65 3a 64 2c 69 64 3a 61 7d 3a 6e 75 6c 6c 7d 66 75 6e 63 74 69 6f 6e 20 67 28 61 29 7b 69 66 28 61 3d 3d 6e 75 6c 6c 7c 7c 28 74 79 70 65 6f 66 20 61 3d 3d 3d 22 75 6e 64 65 66 69 6e 65 64 22 3f 22 75 6e 64 65 66 69 6e 65 64 22 3a 69 28 61 29 29 21 3d 3d 22 6f 62 6a 65 63 74 22 29 72 65 74 75 72 6e 20 6e 75 6c 6c 3b 61 3d 61 2e 65 78 74 72 61 63 74 6f 72 5f 63 6f 6e 66 69 67 3b 69 66 28 61 3d 3d 6e 75 6c 6c 7c 7c 28 74 79 70 65 6f 66 20 61 3d 3d 3d 22 75 6e 64 65 66 69 6e 65 64 22 3f 22 75 6e 64 65 66 69 6e 65 64 22 3a 69 28 61 29 29 21 3d 3d 22 6f 62 6a 65 63 74 22 29 72 65 74 75 72 6e 20 6e 75 6c 6c 3b 76 61 72 20 62 3d 61 2e 70 61 72 Data Ascii: {domain_uri:b,event_type:c,extractor_type:d,id:a}:null}function g(a){if(a==null\|\|(typeof a==="undefined"?"undefined":i(a))!=="object")return null;a=a.extractor_config;if(a==null\|\|(typeof a==="undefined"?"undefined":i(a))!=="object")return null;var b=a.par
2024-10-02 10:16:50 UTC	16384	IN	Data Raw: 28 66 75 6e 63 74 69 6f 6e 28 29 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 76 61 72 20 61 3d 66 2e 67 65 74 46 62 65 76 65 6e 74 73 4d 6f 64 75 6c 65 73 28 22 53 69 67 6e 61 6c 73 46 42 45 76 65 6e 74 73 54 79 70 65 64 22 29 2c 62 3d 61 2e 54 79 70 65 64 3b 61 2e 63 6f 65 72 63 65 3b 61 2e 65 6e 66 6f 72 63 65 3b 61 3d 62 2e 61 72 72 61 79 4f 66 28 62 2e 6f 62 6a 65 63 74 57 69 74 68 46 69 65 6c 64 73 28 7b 61 6c 6c 6f 63 61 74 69 6f 6e 3a 62 2e 6e 75 6d 62 65 72 28 29 2c 63 6f 64 65 3a 62 2e 73 74 72 69 6e 67 28 29 2c 6e 61 6d 65 3a 62 2e 73 74 72 69 6e 67 28 29 2c 70 61 73 73 52 61 74 65 3a 62 2e 6e 75 6d 62 65 72 28 29 7d 29 29 3b 6b 2e 65 78 70 6f 72 74 73 3d 61 7d 29 28 29 3b 72 65 74 75 72 6e 20 6b 2e 65 78 70 6f 72 74 73 7d 28 61 2c 62 2c 63 2c 64 Data Ascii: (function(){"use strict";var a=f.getFbeventsModules("SignalsFBEventsTyped"),b=a.Typed;a.coerce;a.enforce;a=b.arrayOf(b.objectWithFields({allocation:b.number(),code:b.string(),name:b.string(),passRate:b.number()}));k.exports=a})();return k.exports}(a,b,c,d
2024-10-02 10:16:50 UTC	16384	IN	Data Raw: 75 6c 6c 26 26 74 79 70 65 6f 66 20 67 3d 3d 3d 22 73 74 72 69 6e 67 22 3f 67 3a 6e 75 6c 6c 3b 67 3d 7b 7d 3b 68 21 3d 6e 75 6c 6c 26 26 28 74 79 70 65 6f 66 20 68 3d 3d 3d 22 75 6e 64 65 66 69 6e 65 64 22 3f 22 75 6e 64 65 66 69 6e 65 64 22 3a 69 28 68 29 29 3d 3d 3d 22 6f 62 6a 65 63 74 22 26 26 28 67 3d 68 29 3b 72 65 74 75 72 6e 20 61 21 3d 6e 75 6c 6c 26 26 63 21 3d 6e 75 6c 6c 3f 5b 61 2c 63 2c 6a 2c 66 2c 67 5d 3a 6e 75 6c 6c 7d 63 3d 6e 65 77 20 61 28 67 29 3b 6c 2e 65 78 70 6f 72 74 73 3d 63 7d 29 28 29 3b 72 65 74 75 72 6e 20 6c 2e 65 78 70 6f 72 74 73 7d 28 61 2c 62 2c 63 2c 64 29 7d 29 3b 0a 66 2e 65 6e 73 75 72 65 4d 6f 64 75 6c 65 52 65 67 69 73 74 65 72 65 64 28 22 73 69 67 6e 61 6c 73 46 42 45 76 65 6e 74 73 47 65 74 49 73 43 68 72 6f 6d Data Ascii: ull&&typeof g==="string"?g:null;g={};h!=null&&(typeof h==="undefined"?"undefined":i(h))==="object"&&(g=h);return a!=null&&c!=null?[a,c,j,f,g]:null}c=new a(g);l.exports=c})();return l.exports}(a,b,c,d)});f.ensureModuleRegistered("signalsFBEventsGetIsChrom
2024-10-02 10:16:50 UTC	1676	IN	Data Raw: 2e 70 72 6f 74 6f 74 79 70 65 2e 68 61 73 4f 77 6e 50 72 6f 70 65 72 74 79 2e 63 61 6c 6c 28 65 2c 61 29 3f 65 5b 61 5d 3a 61 7d 66 75 6e 63 74 69 6f 6e 20 71 28 61 29 7b 72 65 74 75 72 6e 20 4f 62 6a 65 63 74 2e 70 72 6f 74 6f 74 79 70 65 2e 68 61 73 4f 77 6e 50 72 6f 70 65 72 74 79 2e 63 61 6c 6c 28 68 2c 61 29 3f 68 5b 61 5d 3a 61 7d 66 75 6e 63 74 69 6f 6e 20 72 28 61 29 7b 69 66 28 74 79 70 65 6f 66 20 61 3d 3d 3d 22 73 74 72 69 6e 67 22 29 72 65 74 75 72 6e 20 61 3b 69 66 28 74 79 70 65 6f 66 20 61 3d 3d 3d 22 6e 75 6d 62 65 72 22 29 72 65 74 75 72 6e 20 69 73 4e 61 4e 28 61 29 3f 76 6f 69 64 20 30 3a 61 3b 74 72 79 7b 72 65 74 75 72 6e 20 4a 53 4f 4e 2e 73 74 72 69 6e 67 69 66 79 28 61 29 7d 63 61 74 63 68 28 61 29 7b 7d 72 65 74 75 72 6e 20 61 2e Data Ascii: .prototype.hasOwnProperty.call(e,a)?e[a]:a}function q(a){return Object.prototype.hasOwnProperty.call(h,a)?h[a]:a}function r(a){if(typeof a==="string")return a;if(typeof a==="number")return isNaN(a)?void 0:a;try{return JSON.stringify(a)}catch(a){}return a.
2024-10-02 10:16:50 UTC	14708	IN	Data Raw: 69 6f 6e 28 61 29 7b 72 65 74 75 72 6e 20 63 2e 6d 6f 64 75 6c 65 45 6e 63 6f 64 69 6e 67 73 2e 6d 61 70 21 3d 6e 75 6c 6c 26 26 61 20 69 6e 20 63 2e 6d 6f 64 75 6c 65 45 6e 63 6f 64 69 6e 67 73 2e 6d 61 70 3f 63 2e 6d 6f 64 75 6c 65 45 6e 63 6f 64 69 6e 67 73 2e 6d 61 70 5b 61 5d 3a 6e 75 6c 6c 7d 29 2c 66 75 6e 63 74 69 6f 6e 28 61 29 7b 72 65 74 75 72 6e 20 61 21 3d 6e 75 6c 6c 7d 29 3b 66 2e 6c 65 6e 67 74 68 3e 30 26 26 28 74 68 69 73 2e 6d 6f 64 75 6c 65 45 6e 63 6f 64 69 6e 67 73 2e 68 61 73 68 21 3d 6e 75 6c 6c 26 26 61 2e 61 70 70 65 6e 64 28 22 68 6d 65 22 2c 74 68 69 73 2e 6d 6f 64 75 6c 65 45 6e 63 6f 64 69 6e 67 73 2e 68 61 73 68 29 2c 61 2e 61 70 70 65 6e 64 28 22 65 78 5f 6d 22 2c 66 2e 6a 6f 69 6e 28 22 2c 22 29 29 29 7d 7d 5d 29 3b 72 65 Data Ascii: ion(a){return c.moduleEncodings.map!=null&&a in c.moduleEncodings.map?c.moduleEncodings.map[a]:null}),function(a){return a!=null});f.length>0&&(this.moduleEncodings.hash!=null&&a.append("hme",this.moduleEncodings.hash),a.append("ex_m",f.join(",")))}}]);re
2024-10-02 10:16:50 UTC	16384	IN	Data Raw: 65 74 46 62 65 76 65 6e 74 73 4d 6f 64 75 6c 65 73 28 22 53 69 67 6e 61 6c 73 46 42 45 76 65 6e 74 73 45 76 65 6e 74 73 22 29 3b 76 61 72 20 6c 3d 62 2e 66 69 72 65 64 3b 66 75 6e 63 74 69 6f 6e 20 6d 28 61 2c 62 29 7b 76 61 72 20 63 3d 21 30 2c 64 3d 21 31 2c 65 3d 76 6f 69 64 20 30 3b 74 72 79 7b 66 6f 72 28 76 61 72 20 66 3d 62 5b 74 79 70 65 6f 66 20 53 79 6d 62 6f 6c 3d 3d 3d 22 66 75 6e 63 74 69 6f 6e 22 3f 53 79 6d 62 6f 6c 2e 69 74 65 72 61 74 6f 72 3a 22 40 40 69 74 65 72 61 74 6f 72 22 5d 28 29 2c 62 3b 21 28 63 3d 28 62 3d 66 2e 6e 65 78 74 28 29 29 2e 64 6f 6e 65 29 3b 63 3d 21 30 29 7b 62 3d 62 2e 76 61 6c 75 65 3b 6c 2e 74 72 69 67 67 65 72 28 61 2c 62 29 7d 7d 63 61 74 63 68 28 61 29 7b 64 3d 21 30 2c 65 3d 61 7d 66 69 6e 61 6c 6c 79 7b 74 Data Ascii: etFbeventsModules("SignalsFBEventsEvents");var l=b.fired;function m(a,b){var c=!0,d=!1,e=void 0;try{for(var f=b[typeof Symbol==="function"?Symbol.iterator:"@@iterator"](),b;!(c=(b=f.next()).done);c=!0){b=b.value;l.trigger(a,b)}}catch(a){d=!0,e=a}finally{t
2024-10-02 10:16:50 UTC	16384	IN	Data Raw: 6e 63 74 69 6f 6e 20 79 28 61 29 7b 72 65 74 75 72 6e 20 66 75 6e 63 74 69 6f 6e 28 62 29 7b 72 65 74 75 72 6e 20 62 3d 3d 6e 75 6c 6c 3f 6e 75 6c 6c 3a 61 28 62 29 7d 7d 66 75 6e 63 74 69 6f 6e 20 7a 28 62 29 7b 72 65 74 75 72 6e 20 66 75 6e 63 74 69 6f 6e 28 65 29 7b 76 61 72 20 64 3d 42 28 65 2c 49 2e 6f 62 6a 65 63 74 28 29 29 3b 65 3d 63 28 4f 62 6a 65 63 74 2e 6b 65 79 73 28 62 29 2c 66 75 6e 63 74 69 6f 6e 28 63 2c 65 29 7b 69 66 28 63 3d 3d 6e 75 6c 6c 29 72 65 74 75 72 6e 20 6e 75 6c 6c 3b 76 61 72 20 66 3d 62 5b 65 5d 2c 67 3d 64 5b 65 5d 3b 66 3d 66 28 67 29 3b 72 65 74 75 72 6e 20 61 28 7b 7d 2c 63 2c 6c 28 7b 7d 2c 65 2c 66 29 29 7d 2c 7b 7d 29 3b 72 65 74 75 72 6e 20 65 7d 7d 66 75 6e 63 74 69 6f 6e 20 41 28 61 2c 62 29 7b 74 72 79 7b 72 65 Data Ascii: nction y(a){return function(b){return b==null?null:a(b)}}function z(b){return function(e){var d=B(e,I.object());e=c(Object.keys(b),function(c,e){if(c==null)return null;var f=b[e],g=d[e];f=f(g);return a({},c,l({},e,f))},{});return e}}function A(a,b){try{re

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
106	192.168.2.16	49868	13.107.246.40	443	4912	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-02 10:16:50 UTC	662	OUT	GET /assets/js/applicationinsights-web-9ad09b9c.js HTTP/1.1 Host: apps.microsoft.com Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" Origin: https://apps.microsoft.com sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: same-origin Sec-Fetch-Mode: cors Sec-Fetch-Dest: script Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8 Cookie: MSCC=NR; exp-session-id=b6d0ece2-29a7-4143-931c-d621648d7cb8
2024-10-02 10:16:50 UTC	1306	IN	HTTP/1.1 200 OK Date: Wed, 02 Oct 2024 10:16:50 GMT Content-Type: text/javascript Content-Length: 89384 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public,max-age=31536000,immutable ETag: "1db136ef679e328" Last-Modified: Mon, 30 Sep 2024 19:28:44 GMT Strict-Transport-Security: max-age=2592000 Request-Context: appId=cid-v1:04e455f9-321c-49bf-8d2c-d79fbf5e8cde MS-CV: wLcPmGdTiUuMyF4C.0 X-Content-Type-Options: nosniff Permissions-Policy: unload=() Content-Security-Policy: default-src 'self' data: https://.clarity.ms https://c.bing.com;script-src 'self' wcpstatic.microsoft.com js.monitor.azure.com www.microsoft.com www.clarity.ms get.microsoft.com xvsec.video.microsoft.com bat.bing.com 'unsafe-inline';style-src 'unsafe-inline';connect-src * data: ms-windows-store:;font-src ;img-src data: blob:;media-src 'self' blob: https://sfds-production.azurefd.net https://canvasstorageprodtorus.blob.core.windows.net;frame-src * ms-windows-store:;report-uri https://csp.microsoft.com/report/app-store-web-prod X-Powered-By: ASP.NET x-azure-ref: 20241002T101650Z-15767c5fc55rg5b7sh1vuv8t7n00000009sg00000000408a x-fd-int-roxy-purgeid: 66820190 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-02 10:16:50 UTC	15078	IN	Data Raw: 69 6d 70 6f 72 74 7b 67 20 61 73 20 68 63 2c 5f 20 61 73 20 47 75 2c 53 20 61 73 20 7a 75 2c 68 20 61 73 20 41 63 2c 61 20 61 73 20 64 65 2c 69 20 61 73 20 48 2c 63 20 61 73 20 49 63 2c 73 20 61 73 20 50 72 2c 62 20 61 73 20 50 6f 2c 64 20 61 73 20 66 6e 2c 65 20 61 73 20 47 2c 6f 20 61 73 20 43 65 2c 66 20 61 73 20 51 6e 2c 6a 20 61 73 20 59 6f 2c 6b 20 61 73 20 74 72 2c 6c 20 61 73 20 57 69 2c 6d 20 61 73 20 6d 72 2c 6e 20 61 73 20 65 65 2c 70 20 61 73 20 47 74 2c 71 20 61 73 20 65 72 2c 72 20 61 73 20 5f 72 2c 75 20 61 73 20 5a 6e 2c 74 20 61 73 20 52 63 2c 76 20 61 73 20 6d 63 2c 77 20 61 73 20 62 6f 2c 78 20 61 73 20 56 6e 2c 79 20 61 73 20 43 63 2c 7a 20 61 73 20 24 2c 41 20 61 73 20 76 65 2c 42 20 61 73 20 51 74 2c 43 20 61 73 20 59 65 2c 44 20 61 Data Ascii: import{g as hc,_ as Gu,S as zu,h as Ac,a as de,i as H,c as Ic,s as Pr,b as Po,d as fn,e as G,o as Ce,f as Qn,j as Yo,k as tr,l as Wi,m as mr,n as ee,p as Gt,q as er,r as _r,u as Zn,t as Rc,v as mc,w as bo,x as Vn,y as Cc,z as $,A as ve,B as Qt,C as Ye,D a
2024-10-02 10:16:50 UTC	16384	IN	Data Raw: 28 65 2c 75 29 7d 29 2c 6f 3d 6e 65 77 20 72 28 65 2c 4c 65 28 4c 65 28 7b 7d 2c 6e 29 2c 7b 65 78 63 65 70 74 69 6f 6e 73 3a 69 7d 29 2c 74 2c 61 29 3b 72 65 74 75 72 6e 20 6f 7d 2c 72 2e 70 72 6f 74 6f 74 79 70 65 2e 74 6f 49 6e 74 65 72 66 61 63 65 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 65 2c 6e 3d 74 68 69 73 2c 74 3d 6e 2e 65 78 63 65 70 74 69 6f 6e 73 2c 61 3d 6e 2e 70 72 6f 70 65 72 74 69 65 73 2c 69 3d 6e 2e 6d 65 61 73 75 72 65 6d 65 6e 74 73 2c 6f 3d 6e 2e 73 65 76 65 72 69 74 79 4c 65 76 65 6c 2c 75 3d 6e 2e 70 72 6f 62 6c 65 6d 47 72 6f 75 70 2c 64 3d 6e 2e 69 64 2c 63 3d 6e 2e 69 73 4d 61 6e 75 61 6c 2c 6c 3d 74 20 69 6e 73 74 61 6e 63 65 6f 66 20 41 72 72 61 79 26 26 55 74 28 74 2c 66 75 6e 63 74 69 6f 6e 28 54 29 7b 72 65 74 75 72 Data Ascii: (e,u)}),o=new r(e,Le(Le({},n),{exceptions:i}),t,a);return o},r.prototype.toInterface=function(){var e,n=this,t=n.exceptions,a=n.properties,i=n.measurements,o=n.severityLevel,u=n.problemGroup,d=n.id,c=n.isManual,l=t instanceof Array&&Ut(t,function(T){retur
2024-10-02 10:16:50 UTC	16384	IN	Data Raw: 69 6e 67 22 29 7b 76 61 72 20 57 3d 5a 72 28 29 3b 67 3d 57 26 26 57 5b 77 6e 5d 7c 7c 22 22 7d 61 2e 73 74 6f 70 28 5f 2c 67 2c 49 2c 79 29 2c 43 26 26 75 5b 6e 6f 5d 28 5f 2c 67 29 7d 63 61 74 63 68 28 61 65 29 7b 4a 28 31 2c 33 32 2c 22 73 74 6f 70 54 72 61 63 6b 50 61 67 65 20 66 61 69 6c 65 64 2c 20 70 61 67 65 20 76 69 65 77 20 77 69 6c 6c 20 6e 6f 74 20 62 65 20 63 6f 6c 6c 65 63 74 65 64 3a 20 22 2b 76 65 28 61 65 29 2c 7b 65 78 63 65 70 74 69 6f 6e 3a 24 28 61 65 29 7d 29 7d 7d 2c 53 5b 5f 75 5d 3d 66 75 6e 63 74 69 6f 6e 28 5f 2c 67 2c 49 29 7b 76 61 72 20 79 3d 5f 26 26 28 5f 5b 44 69 5d 7c 7c 5f 5b 45 74 5d 29 7c 7c 4b 75 28 5f 29 26 26 5f 7c 7c 7b 6e 61 6d 65 3a 5f 26 26 74 79 70 65 6f 66 20 5f 2c 6d 65 73 73 61 67 65 3a 5f 7c 7c 61 72 7d 3b Data Ascii: ing"){var W=Zr();g=W&&W[wn]\|\|""}a.stop(_,g,I,y),C&&u[no](_,g)}catch(ae){J(1,32,"stopTrackPage failed, page view will not be collected: "+ve(ae),{exception:$(ae)})}},S[_u]=function(_,g,I){var y=_&&(_[Di]\|\|_[Et])\|\|Ku(_)&&_\|\|{name:_&&typeof _,message:_\|\|ar};
2024-10-02 10:16:50 UTC	16384	IN	Data Raw: 75 72 6e 20 47 28 65 2c 32 2c 35 30 2c 22 43 69 72 63 75 6c 61 72 20 72 65 66 65 72 65 6e 63 65 20 64 65 74 65 63 74 65 64 20 77 68 69 6c 65 20 73 65 72 69 61 6c 69 7a 69 6e 67 20 6f 62 6a 65 63 74 22 2c 7b 6e 61 6d 65 3a 75 7d 2c 21 30 29 2c 63 3b 69 66 28 21 6f 2e 61 69 44 61 74 61 43 6f 6e 74 72 61 63 74 29 7b 69 66 28 75 3d 3d 3d 22 6d 65 61 73 75 72 65 6d 65 6e 74 73 22 29 63 3d 69 28 6f 2c 22 6e 75 6d 62 65 72 22 2c 75 29 3b 65 6c 73 65 20 69 66 28 75 3d 3d 3d 22 70 72 6f 70 65 72 74 69 65 73 22 29 63 3d 69 28 6f 2c 22 73 74 72 69 6e 67 22 2c 75 29 3b 65 6c 73 65 20 69 66 28 75 3d 3d 3d 22 74 61 67 73 22 29 63 3d 69 28 6f 2c 22 73 74 72 69 6e 67 22 2c 75 29 3b 65 6c 73 65 20 69 66 28 45 72 28 6f 29 29 63 3d 61 28 6f 2c 75 29 3b 65 6c 73 65 7b 47 28 Data Ascii: urn G(e,2,50,"Circular reference detected while serializing object",{name:u},!0),c;if(!o.aiDataContract){if(u==="measurements")c=i(o,"number",u);else if(u==="properties")c=i(o,"string",u);else if(u==="tags")c=i(o,"string",u);else if(Er(o))c=a(o,u);else{G(
2024-10-02 10:16:50 UTC	16384	IN	Data Raw: 2e 61 6a 78 6d 6e 2e 22 2c 56 74 3d 22 64 69 61 67 4c 6f 67 22 2c 77 72 3d 22 5f 61 6a 61 78 44 61 74 61 22 2c 4a 72 3d 22 66 65 74 63 68 22 2c 44 74 3d 22 46 61 69 6c 65 64 20 74 6f 20 6d 6f 6e 69 74 6f 72 20 58 4d 4c 48 74 74 70 52 65 71 75 65 73 74 22 2c 61 63 3d 22 2c 20 6d 6f 6e 69 74 6f 72 69 6e 67 20 64 61 74 61 20 66 6f 72 20 74 68 69 73 20 61 6a 61 78 20 63 61 6c 6c 20 22 2c 43 6e 3d 61 63 2b 22 6d 61 79 20 62 65 20 69 6e 63 6f 72 72 65 63 74 2e 22 2c 77 75 3d 61 63 2b 22 77 6f 6e 27 74 20 62 65 20 73 65 6e 74 2e 22 2c 4d 75 3d 22 46 61 69 6c 65 64 20 74 6f 20 67 65 74 20 52 65 71 75 65 73 74 2d 43 6f 6e 74 65 78 74 20 63 6f 72 72 65 6c 61 74 69 6f 6e 20 68 65 61 64 65 72 20 61 73 20 69 74 20 6d 61 79 20 62 65 20 6e 6f 74 20 69 6e 63 6c 75 64 65 Data Ascii: .ajxmn.",Vt="diagLog",wr="_ajaxData",Jr="fetch",Dt="Failed to monitor XMLHttpRequest",ac=", monitoring data for this ajax call ",Cn=ac+"may be incorrect.",wu=ac+"won't be sent.",Mu="Failed to get Request-Context correlation header as it may be not include
2024-10-02 10:16:50 UTC	8770	IN	Data Raw: 2c 75 5b 66 63 5d 3d 66 75 6e 63 74 69 6f 6e 28 54 2c 68 29 7b 4e 65 28 54 2e 65 78 74 2c 42 65 2e 4f 53 45 78 74 2c 75 2e 6f 73 29 7d 2c 75 5b 75 63 5d 3d 66 75 6e 63 74 69 6f 6e 28 54 2c 68 29 7b 76 61 72 20 66 3d 75 2e 61 70 70 6c 69 63 61 74 69 6f 6e 3b 69 66 28 66 29 7b 76 61 72 20 70 3d 78 65 28 54 2c 44 61 29 3b 4e 65 28 70 2c 5f 65 2e 61 70 70 6c 69 63 61 74 69 6f 6e 56 65 72 73 69 6f 6e 2c 66 2e 76 65 72 2c 65 65 29 2c 4e 65 28 70 2c 5f 65 2e 61 70 70 6c 69 63 61 74 69 6f 6e 42 75 69 6c 64 2c 66 2e 62 75 69 6c 64 2c 65 65 29 7d 7d 2c 75 5b 73 63 5d 3d 66 75 6e 63 74 69 6f 6e 28 54 2c 68 29 7b 76 61 72 20 66 3d 75 2e 64 65 76 69 63 65 3b 69 66 28 66 29 7b 76 61 72 20 70 3d 78 65 28 78 65 28 54 2c 67 61 29 2c 42 65 2e 44 65 76 69 63 65 45 78 74 29 Data Ascii: ,u[fc]=function(T,h){Ne(T.ext,Be.OSExt,u.os)},u[uc]=function(T,h){var f=u.application;if(f){var p=xe(T,Da);Ne(p,_e.applicationVersion,f.ver,ee),Ne(p,_e.applicationBuild,f.build,ee)}},u[sc]=function(T,h){var f=u.device;if(f){var p=xe(xe(T,ga),Be.DeviceExt)

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
107	192.168.2.16	49869	13.107.246.40	443	4912	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-02 10:16:50 UTC	654	OUT	GET /assets/js/InstrumentHooks-cd565348.js HTTP/1.1 Host: apps.microsoft.com Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" Origin: https://apps.microsoft.com sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: same-origin Sec-Fetch-Mode: cors Sec-Fetch-Dest: script Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8 Cookie: MSCC=NR; exp-session-id=b6d0ece2-29a7-4143-931c-d621648d7cb8
2024-10-02 10:16:50 UTC	1286	IN	HTTP/1.1 200 OK Date: Wed, 02 Oct 2024 10:16:50 GMT Content-Type: text/javascript Content-Length: 59244 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public,max-age=31536000,immutable ETag: "1db136ef678596c" Last-Modified: Mon, 30 Sep 2024 19:28:44 GMT Strict-Transport-Security: max-age=2592000 Request-Context: appId=cid-v1:04e455f9-321c-49bf-8d2c-d79fbf5e8cde MS-CV: s1CWtq1ie0qy+T09.0 X-Content-Type-Options: nosniff Permissions-Policy: unload=() Content-Security-Policy: default-src 'self' data: https://.clarity.ms https://c.bing.com;script-src 'self' wcpstatic.microsoft.com js.monitor.azure.com www.microsoft.com www.clarity.ms get.microsoft.com xvsec.video.microsoft.com bat.bing.com 'unsafe-inline';style-src 'unsafe-inline';connect-src * data: ms-windows-store:;font-src ;img-src data: blob:;media-src 'self' blob: https://sfds-production.azurefd.net https://canvasstorageprodtorus.blob.core.windows.net;frame-src * ms-windows-store:;report-uri https://csp.microsoft.com/report/app-store-web-prod X-Powered-By: ASP.NET x-azure-ref: 20241002T101650Z-15767c5fc55w69c2zvnrz0gmgw00000009g000000000d479 x-fd-int-roxy-purgeid: 66820190 X-Cache: TCP_MISS Accept-Ranges: bytes
2024-10-02 10:16:50 UTC	15098	IN	Data Raw: 76 61 72 20 66 72 3d 76 6f 69 64 20 30 2c 58 3d 6e 75 6c 6c 2c 7a 61 3d 22 22 2c 43 6f 3d 22 62 6f 6f 6c 65 61 6e 22 2c 5f 69 3d 22 66 75 6e 63 74 69 6f 6e 22 2c 4e 6f 3d 22 6e 75 6d 62 65 72 22 2c 63 74 3d 22 6f 62 6a 65 63 74 22 2c 53 72 3d 22 70 72 6f 74 6f 74 79 70 65 22 2c 76 61 3d 22 5f 5f 70 72 6f 74 6f 5f 5f 22 2c 49 6f 3d 22 73 74 72 69 6e 67 22 2c 71 72 3d 22 75 6e 64 65 66 69 6e 65 64 22 2c 6c 61 3d 22 63 6f 6e 73 74 72 75 63 74 6f 72 22 2c 48 61 3d 22 53 79 6d 62 6f 6c 22 2c 64 75 3d 22 5f 70 6f 6c 79 66 69 6c 6c 22 2c 4f 6f 3d 22 69 6e 64 65 78 4f 66 22 2c 4c 6f 3d 22 6c 61 73 74 49 6e 64 65 78 4f 66 22 2c 24 6e 3d 22 6c 65 6e 67 74 68 22 2c 43 65 3d 22 64 6f 6e 65 22 2c 6d 6f 3d 22 76 61 6c 75 65 22 2c 57 61 3d 22 6e 61 6d 65 22 2c 56 61 3d Data Ascii: var fr=void 0,X=null,za="",Co="boolean",_i="function",No="number",ct="object",Sr="prototype",va="__proto__",Io="string",qr="undefined",la="constructor",Ha="Symbol",du="_polyfill",Oo="indexOf",Lo="lastIndexOf",$n="length",Ce="done",mo="value",Wa="name",Va=
2024-10-02 10:16:50 UTC	16384	IN	Data Raw: 63 74 69 6f 6e 28 74 29 7b 6e 26 26 6e 28 7b 76 61 6c 75 65 3a 74 2c 72 65 6a 65 63 74 65 64 3a 21 31 7d 29 7d 2c 66 75 6e 63 74 69 6f 6e 28 74 29 7b 6e 26 26 6e 28 7b 72 65 6a 65 63 74 65 64 3a 21 30 2c 72 65 61 73 6f 6e 3a 74 7d 29 7d 29 7d 66 75 6e 63 74 69 6f 6e 20 79 66 28 72 2c 6e 2c 74 2c 69 29 7b 76 61 72 20 61 3d 72 3b 72 65 74 75 72 6e 20 6a 74 28 72 29 3f 28 6e 7c 7c 74 29 26 26 28 61 3d 72 2e 74 68 65 6e 28 6e 2c 74 29 29 3a 6e 26 26 6e 28 72 29 2c 69 26 26 28 61 3d 68 63 28 61 2c 69 29 29 2c 61 7d 66 75 6e 63 74 69 6f 6e 20 68 63 28 72 2c 6e 29 7b 76 61 72 20 74 3d 72 3b 72 65 74 75 72 6e 20 6e 26 26 28 6a 74 28 72 29 3f 72 2e 66 69 6e 61 6c 6c 79 3f 74 3d 72 2e 66 69 6e 61 6c 6c 79 28 6e 29 3a 74 3d 72 2e 74 68 65 6e 28 66 75 6e 63 74 69 6f Data Ascii: ction(t){n&&n({value:t,rejected:!1})},function(t){n&&n({rejected:!0,reason:t})})}function yf(r,n,t,i){var a=r;return jt(r)?(n\|\|t)&&(a=r.then(n,t)):n&&n(r),i&&(a=hc(a,i)),a}function hc(r,n){var t=r;return n&&(jt(r)?r.finally?t=r.finally(n):t=r.then(functio
2024-10-02 10:16:50 UTC	16384	IN	Data Raw: 7b 63 65 28 72 29 5b 5f 66 5d 28 6e 2c 74 29 7d 76 61 72 20 69 61 2c 42 72 2c 58 65 3d 22 74 6f 47 4d 54 53 74 72 69 6e 67 22 2c 4a 65 3d 22 74 6f 55 54 43 53 74 72 69 6e 67 22 2c 73 65 3d 22 63 6f 6f 6b 69 65 22 2c 61 61 3d 22 65 78 70 69 72 65 73 22 2c 51 65 3d 22 69 73 43 6f 6f 6b 69 65 55 73 65 44 69 73 61 62 6c 65 64 22 2c 55 61 3d 22 64 69 73 61 62 6c 65 43 6f 6f 6b 69 65 73 55 73 61 67 65 22 2c 6b 72 3d 22 5f 63 6b 4d 67 72 22 2c 4c 74 3d 6e 75 6c 6c 2c 65 61 3d 6e 75 6c 6c 2c 5a 65 3d 6e 75 6c 6c 2c 67 72 2c 72 6f 3d 7b 7d 2c 73 69 3d 7b 7d 2c 53 73 3d 28 69 61 3d 7b 63 6f 6f 6b 69 65 43 66 67 3a 64 73 28 28 42 72 3d 7b 7d 2c 42 72 5b 4c 61 5d 3d 7b 66 62 3a 22 63 6f 6f 6b 69 65 44 6f 6d 61 69 6e 22 2c 64 66 56 61 6c 3a 6d 61 7d 2c 42 72 2e 70 61 Data Ascii: {ce(r)[_f](n,t)}var ia,Br,Xe="toGMTString",Je="toUTCString",se="cookie",aa="expires",Qe="isCookieUseDisabled",Ua="disableCookiesUsage",kr="_ckMgr",Lt=null,ea=null,Ze=null,gr,ro={},si={},Ss=(ia={cookieCfg:ds((Br={},Br[La]={fb:"cookieDomain",dfVal:ma},Br.pa
2024-10-02 10:16:50 UTC	11378	IN	Data Raw: 54 5b 56 73 5d 3d 65 29 2c 65 7d 2c 54 5b 46 74 5d 3d 66 75 6e 63 74 69 6f 6e 28 5f 29 7b 54 5b 41 6e 5d 28 29 5b 46 74 5d 28 5f 29 7d 2c 54 5b 78 74 5d 3d 66 75 6e 63 74 69 6f 6e 28 5f 29 7b 65 26 26 65 5b 78 74 5d 28 5f 29 7d 2c 54 2e 67 65 74 43 6f 6f 6b 69 65 4d 67 72 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 75 7c 7c 28 75 3d 4b 6e 28 6e 2e 63 66 67 2c 54 5b 59 5d 29 29 2c 75 7d 2c 54 2e 73 65 74 43 6f 6f 6b 69 65 4d 67 72 3d 66 75 6e 63 74 69 6f 6e 28 5f 29 7b 75 21 3d 3d 5f 26 26 28 56 6e 28 75 2c 21 31 29 2c 75 3d 5f 29 7d 2c 54 5b 61 69 5d 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 21 6f 26 26 21 66 26 26 65 6e 28 6e 5b 70 72 5d 28 66 75 6e 63 74 69 6f 6e 28 5f 29 7b 69 66 28 5f 2e 63 66 67 2e 65 6e 61 62 6c 65 50 65 72 Data Ascii: T[Vs]=e),e},T[Ft]=function(_){T[An]()[Ft](_)},T[xt]=function(_){e&&e[xt](_)},T.getCookieMgr=function(){return u\|\|(u=Kn(n.cfg,T[Y])),u},T.setCookieMgr=function(_){u!==_&&(Vn(u,!1),u=_)},T[ai]=function(){return!o&&!f&&en(n[pr](function(_){if(_.cfg.enablePer

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
108	192.168.2.16	49871	13.107.246.40	443	4912	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-02 10:16:50 UTC	666	OUT	GET /assets/js/applicationinsights-core-js-9783d46c.js HTTP/1.1 Host: apps.microsoft.com Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" Origin: https://apps.microsoft.com sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: same-origin Sec-Fetch-Mode: cors Sec-Fetch-Dest: script Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8 Cookie: MSCC=NR; exp-session-id=b6d0ece2-29a7-4143-931c-d621648d7cb8
2024-10-02 10:16:50 UTC	1305	IN	HTTP/1.1 200 OK Date: Wed, 02 Oct 2024 10:16:50 GMT Content-Type: text/javascript Content-Length: 5244 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public,max-age=31536000,immutable ETag: "1db136ef678aa7c" Last-Modified: Mon, 30 Sep 2024 19:28:44 GMT Strict-Transport-Security: max-age=2592000 Request-Context: appId=cid-v1:04e455f9-321c-49bf-8d2c-d79fbf5e8cde MS-CV: UDw9rHEchUuhVHp8.0 X-Content-Type-Options: nosniff Permissions-Policy: unload=() Content-Security-Policy: default-src 'self' data: https://.clarity.ms https://c.bing.com;script-src 'self' wcpstatic.microsoft.com js.monitor.azure.com www.microsoft.com www.clarity.ms get.microsoft.com xvsec.video.microsoft.com bat.bing.com 'unsafe-inline';style-src 'unsafe-inline';connect-src * data: ms-windows-store:;font-src ;img-src data: blob:;media-src 'self' blob: https://sfds-production.azurefd.net https://canvasstorageprodtorus.blob.core.windows.net;frame-src * ms-windows-store:;report-uri https://csp.microsoft.com/report/app-store-web-prod X-Powered-By: ASP.NET x-azure-ref: 20241002T101650Z-15767c5fc55ncqdn59ub6rndq0000000095g000000000dss x-fd-int-roxy-purgeid: 66820190 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-02 10:16:50 UTC	5244	IN	Data Raw: 69 6d 70 6f 72 74 7b 61 5a 20 61 73 20 69 2c 53 20 61 73 20 62 2c 6e 2c 61 5f 20 61 73 20 64 2c 7a 20 61 73 20 67 2c 61 24 20 61 73 20 63 2c 64 20 61 73 20 6c 2c 62 20 61 73 20 75 2c 77 20 61 73 20 6d 7d 66 72 6f 6d 22 2e 2f 49 6e 73 74 72 75 6d 65 6e 74 48 6f 6f 6b 73 2d 63 64 35 36 35 33 34 38 2e 6a 73 22 3b 69 6d 70 6f 72 74 7b 61 4a 20 61 73 20 68 2c 61 66 20 61 73 20 43 2c 62 4a 20 61 73 20 44 2c 61 61 20 61 73 20 4e 2c 61 7a 20 61 73 20 77 2c 62 50 20 61 73 20 49 2c 61 44 20 61 73 20 54 2c 62 4f 20 61 73 20 46 2c 61 56 20 61 73 20 4c 2c 61 59 20 61 73 20 4d 2c 61 57 20 61 73 20 4f 2c 61 58 20 61 73 20 55 2c 62 4b 20 61 73 20 78 2c 62 34 20 61 73 20 6a 2c 61 47 20 61 73 20 56 2c 62 75 20 61 73 20 48 2c 61 48 20 61 73 20 6b 2c 65 20 61 73 20 57 2c 57 Data Ascii: import{aZ as i,S as b,n,a_ as d,z as g,a$ as c,d as l,b as u,w as m}from"./InstrumentHooks-cd565348.js";import{aJ as h,af as C,bJ as D,aa as N,az as w,bP as I,aD as T,bO as F,aV as L,aY as M,aW as O,aX as U,bK as x,b4 as j,aG as V,bu as H,aH as k,e as W,W

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
109	192.168.2.16	49867	13.107.246.40	443	4912	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-02 10:16:50 UTC	647	OUT	GET /shared/cms/lrs1c69a1j/section-videos/3dd826a043744d6cbfe55165a35a8ec8.mp4 HTTP/1.1 Host: edgestatic.azureedge.net Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" Accept-Encoding: identity;q=1, ;q=0 sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: /* Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: video Referer: https://www.microsoft.com/ Accept-Language: en-GB,en;q=0.9,en-US;q=0.8 Range: bytes=0-
2024-10-02 10:16:50 UTC	713	IN	HTTP/1.1 206 Partial Content Date: Wed, 02 Oct 2024 10:16:50 GMT Content-Type: video/mp4 Content-Length: 2823168 Connection: close Access-Control-Allow-Origin: * Cache-Control: public, max-age=31536000, immutable ETag: W/"2b1400-18c5bb7f0e4" Last-Modified: Tue, 12 Dec 2023 01:50:30 GMT Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Origin-Agent-Cluster: ?1 X-Content-Type-Options: nosniff X-Download-Options: noopen X-Frame-Options: SAMEORIGIN X-Permitted-Cross-Domain-Policies: none X-XSS-Protection: 0 x-azure-ref: 20241002T101650Z-15767c5fc55gs96cphvgp5f5vc00000009d0000000000738 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Content-Range: bytes 0-2823167/2823168
2024-10-02 10:16:50 UTC	15671	IN	Data Raw: 00 00 00 20 66 74 79 70 69 73 6f 6d 00 00 02 00 69 73 6f 6d 69 73 6f 32 61 76 63 31 6d 70 34 31 00 00 00 08 66 72 65 65 00 2a d6 17 6d 64 61 74 00 00 02 ca 06 05 ff ff c6 dc 45 e9 bd e6 d9 48 b7 96 2c d8 20 d9 23 ee ef 78 32 36 34 20 2d 20 63 6f 72 65 20 31 36 33 20 2d 20 48 2e 32 36 34 2f 4d 50 45 47 2d 34 20 41 56 43 20 63 6f 64 65 63 20 2d 20 43 6f 70 79 6c 65 66 74 20 32 30 30 33 2d 32 30 32 31 20 2d 20 68 74 74 70 3a 2f 2f 77 77 77 2e 76 69 64 65 6f 6c 61 6e 2e 6f 72 67 2f 78 32 36 34 2e 68 74 6d 6c 20 2d 20 6f 70 74 69 6f 6e 73 3a 20 63 61 62 61 63 3d 31 20 72 65 66 3d 32 20 64 65 62 6c 6f 63 6b 3d 31 3a 30 3a 30 20 61 6e 61 6c 79 73 65 3d 30 78 33 3a 30 78 31 31 33 20 6d 65 3d 68 65 78 20 73 75 62 6d 65 3d 36 20 70 73 79 3d 31 20 70 73 79 5f 72 64 Data Ascii: ftypisomisomiso2avc1mp41free*mdatEH, #x264 - core 163 - H.264/MPEG-4 AVC codec - Copyleft 2003-2021 - http://www.videolan.org/x264.html - options: cabac=1 ref=2 deblock=1:0:0 analyse=0x3:0x113 me=hex subme=6 psy=1 psy_rd
2024-10-02 10:16:50 UTC	16384	IN	Data Raw: 2f b3 bb 96 ba 63 48 32 18 97 c4 9e 9d e8 0b 41 c2 ea 1c 20 56 5e 4c 36 c1 dc 09 f4 a2 70 0c 74 94 bd 23 94 3c dc e3 5b ea 51 d2 5e 67 07 ce 3e 3c 31 7b 29 24 9f 5c 4d 80 6b f5 c2 f2 d1 5e 29 cf 66 f0 ee 93 1a e4 c0 71 80 46 73 e6 ae 94 a2 8d f8 0e b7 e8 09 92 51 37 e0 2d 2f 7d 8a 8c d6 77 35 47 a3 0e 76 c8 7e 48 fe 25 ff 8d 85 83 5c 40 87 04 39 13 79 e6 85 85 4a cc 2a 1d 6b 4b 32 9a 21 d5 fd db 34 1e aa c0 00 00 95 06 f3 74 94 85 a1 f3 0a 53 ff 35 50 7c ec 72 fd 5e e6 9b 71 ed 1c a4 99 85 c3 3e d1 ab 1d ba 2e 6c d5 ad 17 dc fa b7 4c da 0d cd c4 36 78 ee 8d 95 b7 71 72 ef 4b c5 da 36 7c 0b 09 d9 bf 84 1a 30 ee 0e 10 c3 d5 41 1d 50 60 e8 6f e1 07 1f 62 45 67 e6 d4 28 32 ca 7a 11 b7 cc f3 e7 51 c2 e0 97 63 c9 27 5d 5e 99 84 13 17 1a cf 5e f9 a2 88 30 6a 45 Data Ascii: /cH2A V^L6pt#<[Q^g><1{)$\Mk^)fqFsQ7-/}w5Gv~H%\@9yJ*kK2!4tS5P\|r^q>.lL6xqrK6\|0AP`obEg(2zQc']^^0jE
2024-10-02 10:16:50 UTC	16384	IN	Data Raw: 68 b7 03 67 21 10 04 60 8c 1c 21 10 04 60 8c 1c 00 00 00 a1 01 9e e9 74 42 5f 00 00 79 fe 61 41 74 75 00 69 80 00 ee 78 51 66 94 ed 63 60 00 00 03 00 00 03 00 0f be a4 f2 80 67 70 b6 94 00 1a 7a bf c4 40 36 b2 9c 78 00 00 03 00 00 03 00 00 03 00 00 03 00 00 03 00 00 03 00 01 19 00 00 03 00 00 03 00 00 03 00 00 03 00 02 ba 05 f4 00 00 03 00 00 1f 05 6b 55 aa 1f cf 27 41 1c 61 c2 8a c9 59 e9 31 d3 9b 57 cc 28 c3 5b 99 f6 89 6b 1a 9f e6 41 02 9e 6b 6e 16 1a 12 51 9c 00 00 0f 50 00 00 03 00 00 06 80 00 a2 b8 00 00 7d 7d 82 ad 62 10 00 10 f0 21 10 04 60 8c 1c 21 10 04 60 8c 1c 00 00 00 ab 01 9e eb 44 25 ff 00 00 03 00 01 48 fa fd 00 4e 09 00 06 28 90 06 4f af 52 17 d8 db e1 10 00 04 8b 8b 22 f2 c2 01 18 c1 4b 90 00 00 03 00 00 03 00 00 03 00 00 1a d8 2e 96 63 Data Ascii: hg!`!`tB_yaAtuixQfc`gpz@6xkU'AaY1W([kAknQP}}b!`!`D%HN(OR"K.c

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
110	192.168.2.16	49870	13.107.246.40	443	4912	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-02 10:16:50 UTC	709	OUT	GET /assets/js/Index-cbed7ffc.js HTTP/1.1 Host: apps.microsoft.com Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" Origin: https://apps.microsoft.com sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: same-origin Sec-Fetch-Mode: cors Sec-Fetch-Dest: script Referer: https://apps.microsoft.com/assets/js/index-36d30887.js Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8 Cookie: MSCC=NR; exp-session-id=b6d0ece2-29a7-4143-931c-d621648d7cb8
2024-10-02 10:16:50 UTC	1287	IN	HTTP/1.1 200 OK Date: Wed, 02 Oct 2024 10:16:50 GMT Content-Type: text/javascript Content-Length: 186154 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public,max-age=31536000,immutable ETag: "1db136ef67a692a" Last-Modified: Mon, 30 Sep 2024 19:28:44 GMT Strict-Transport-Security: max-age=2592000 Request-Context: appId=cid-v1:04e455f9-321c-49bf-8d2c-d79fbf5e8cde MS-CV: Im6EOFDX+kC8KQCr.0 X-Content-Type-Options: nosniff Permissions-Policy: unload=() Content-Security-Policy: default-src 'self' data: https://.clarity.ms https://c.bing.com;script-src 'self' wcpstatic.microsoft.com js.monitor.azure.com www.microsoft.com www.clarity.ms get.microsoft.com xvsec.video.microsoft.com bat.bing.com 'unsafe-inline';style-src 'unsafe-inline';connect-src * data: ms-windows-store:;font-src ;img-src data: blob:;media-src 'self' blob: https://sfds-production.azurefd.net https://canvasstorageprodtorus.blob.core.windows.net;frame-src * ms-windows-store:;report-uri https://csp.microsoft.com/report/app-store-web-prod X-Powered-By: ASP.NET x-azure-ref: 20241002T101650Z-15767c5fc55rg5b7sh1vuv8t7n00000009r000000000786k x-fd-int-roxy-purgeid: 66820190 X-Cache: TCP_MISS Accept-Ranges: bytes
2024-10-02 10:16:50 UTC	15097	IN	Data Raw: 76 61 72 20 45 61 3d 22 66 75 6e 63 74 69 6f 6e 22 2c 24 74 3d 22 6f 62 6a 65 63 74 22 2c 68 74 3d 22 75 6e 64 65 66 69 6e 65 64 22 2c 49 74 3d 22 70 72 6f 74 6f 74 79 70 65 22 2c 24 63 3d 22 68 61 73 4f 77 6e 50 72 6f 70 65 72 74 79 22 2c 76 72 3d 4f 62 6a 65 63 74 2c 4d 63 3d 76 72 5b 49 74 5d 2c 6c 73 3d 76 72 2e 61 73 73 69 67 6e 2c 69 45 3d 76 72 2e 63 72 65 61 74 65 2c 6a 5f 3d 76 72 2e 64 65 66 69 6e 65 50 72 6f 70 65 72 74 79 2c 42 74 3d 4d 63 5b 24 63 5d 2c 6a 6c 3d 6e 75 6c 6c 3b 66 75 6e 63 74 69 6f 6e 20 70 61 28 6e 29 7b 6e 3d 3d 3d 76 6f 69 64 20 30 26 26 28 6e 3d 21 30 29 3b 76 61 72 20 74 3d 6e 3d 3d 3d 21 31 3f 6e 75 6c 6c 3a 6a 6c 3b 72 65 74 75 72 6e 20 74 7c 7c 28 74 79 70 65 6f 66 20 67 6c 6f 62 61 6c 54 68 69 73 21 3d 3d 68 74 26 26 Data Ascii: var Ea="function",$t="object",ht="undefined",It="prototype",$c="hasOwnProperty",vr=Object,Mc=vr[It],ls=vr.assign,iE=vr.create,j_=vr.defineProperty,Bt=Mc[$c],jl=null;function pa(n){n===void 0&&(n=!0);var t=n===!1?null:jl;return t\|\|(typeof globalThis!==ht&&
2024-10-02 10:16:50 UTC	16384	IN	Data Raw: 5b 73 5d 3b 63 26 26 28 66 2b 3d 63 5b 24 69 5d 29 7d 69 5b 24 69 5d 3d 6e 72 28 29 2d 69 2e 73 74 61 72 74 2c 69 2e 65 78 54 69 6d 65 3d 69 5b 24 69 5d 2d 66 2c 69 5b 70 73 5d 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 7d 2c 21 61 26 26 64 6e 28 72 29 26 26 28 69 2e 70 61 79 6c 6f 61 64 3d 72 28 29 29 7d 7d 72 65 74 75 72 6e 20 6e 2e 50 61 72 65 6e 74 43 6f 6e 74 65 78 74 4b 65 79 3d 22 70 61 72 65 6e 74 22 2c 6e 2e 43 68 69 6c 64 72 65 6e 43 6f 6e 74 65 78 74 4b 65 79 3d 22 63 68 69 6c 64 45 76 74 73 22 2c 6e 7d 28 29 2c 6f 70 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 66 75 6e 63 74 69 6f 6e 20 6e 28 74 29 7b 74 68 69 73 2e 63 74 78 3d 7b 7d 2c 4d 74 28 6e 2c 74 68 69 73 2c 66 75 6e 63 74 69 6f 6e 28 72 29 7b 72 2e 63 72 65 61 74 65 3d 66 75 6e 63 74 69 6f 6e 28 65 Data Ascii: [s];c&&(f+=c[$i])}i[$i]=nr()-i.start,i.exTime=i[$i]-f,i[ps]=function(){},!a&&dn(r)&&(i.payload=r())}}return n.ParentContextKey="parent",n.ChildrenContextKey="childEvts",n}(),op=function(){function n(t){this.ctx={},Mt(n,this,function(r){r.create=function(e
2024-10-02 10:16:50 UTC	16384	IN	Data Raw: 69 66 28 6c 29 74 72 79 7b 69 66 28 6c 2e 66 6e 5b 46 63 5d 28 6e 75 6c 6c 2c 5b 75 5d 29 3d 3d 3d 21 31 29 7b 63 3d 21 30 3b 62 72 65 61 6b 7d 7d 63 61 74 63 68 28 76 29 7b 54 6e 28 73 5b 63 65 5d 28 29 2c 31 2c 36 34 2c 22 4f 6e 65 20 6f 66 20 74 65 6c 65 6d 65 74 72 79 20 69 6e 69 74 69 61 6c 69 7a 65 72 73 20 66 61 69 6c 65 64 2c 20 74 65 6c 65 6d 65 74 72 79 20 69 74 65 6d 20 77 69 6c 6c 20 6e 6f 74 20 62 65 20 73 65 6e 74 3a 20 22 2b 75 67 28 76 29 2c 7b 65 78 63 65 70 74 69 6f 6e 3a 59 6e 28 76 29 7d 2c 21 30 29 7d 7d 63 7c 7c 6f 5b 43 6e 5d 28 75 2c 73 29 7d 2c 6f 5b 5f 73 5d 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 61 28 29 7d 7d 29 3b 66 75 6e 63 74 69 6f 6e 20 61 28 29 7b 65 3d 30 2c 69 3d 5b 5d 7d 72 65 74 75 72 6e 20 72 7d 72 65 74 75 72 6e 20 74 Data Ascii: if(l)try{if(l.fn[Fc](null,[u])===!1){c=!0;break}}catch(v){Tn(s[ce](),1,64,"One of telemetry initializers failed, telemetry item will not be sent: "+ug(v),{exception:Yn(v)},!0)}}c\|\|o[Cn](u,s)},o[_s]=function(){a()}});function a(){e=0,i=[]}return r}return t
2024-10-02 10:16:50 UTC	16384	IN	Data Raw: 78 74 65 6e 64 73 20 76 61 6c 75 65 20 22 2b 53 74 72 69 6e 67 28 74 29 2b 22 20 69 73 20 6e 6f 74 20 61 20 63 6f 6e 73 74 72 75 63 74 6f 72 20 6f 72 20 6e 75 6c 6c 22 29 2c 52 73 28 6e 2c 74 29 3b 66 75 6e 63 74 69 6f 6e 20 72 28 29 7b 74 68 69 73 2e 63 6f 6e 73 74 72 75 63 74 6f 72 3d 6e 7d 6e 5b 44 6f 5d 3d 74 3d 3d 3d 6e 75 6c 6c 3f 6c 53 28 74 29 3a 28 72 5b 44 6f 5d 3d 74 5b 44 6f 5d 2c 6e 65 77 20 72 29 7d 2f 2a 21 0a 20 2a 20 4d 69 63 72 6f 73 6f 66 74 20 44 79 6e 61 6d 69 63 20 50 72 6f 74 6f 20 55 74 69 6c 69 74 79 2c 20 31 2e 31 2e 39 0a 20 2a 20 43 6f 70 79 72 69 67 68 74 20 28 63 29 20 4d 69 63 72 6f 73 6f 66 74 20 61 6e 64 20 63 6f 6e 74 72 69 62 75 74 6f 72 73 2e 20 41 6c 6c 20 72 69 67 68 74 73 20 72 65 73 65 72 76 65 64 2e 0a 20 2a 2f 76 Data Ascii: xtends value "+String(t)+" is not a constructor or null"),Rs(n,t);function r(){this.constructor=n}n[Do]=t===null?lS(t):(r[Do]=t[Do],new r)}/! Microsoft Dynamic Proto Utility, 1.1.9 * Copyright (c) Microsoft and contributors. All rights reserved. */v
2024-10-02 10:16:50 UTC	16384	IN	Data Raw: 70 2e 69 73 53 79 6e 63 29 7d 70 2e 73 69 7a 65 45 78 63 65 65 64 26 26 70 2e 73 69 7a 65 45 78 63 65 65 64 2e 6c 65 6e 67 74 68 3e 30 26 26 6c 74 28 70 2e 73 69 7a 65 45 78 63 65 65 64 2c 38 30 30 33 2c 70 2e 73 65 6e 64 54 79 70 65 29 2c 70 2e 66 61 69 6c 65 64 45 76 74 73 26 26 70 2e 66 61 69 6c 65 64 45 76 74 73 2e 6c 65 6e 67 74 68 3e 30 26 26 6c 74 28 70 2e 66 61 69 6c 65 64 45 76 74 73 2c 38 30 30 32 2c 70 2e 73 65 6e 64 54 79 70 65 29 7d 66 75 6e 63 74 69 6f 6e 20 62 65 28 70 2c 62 29 7b 55 26 26 57 28 70 2c 66 75 6e 63 74 69 6f 6e 28 77 29 7b 76 61 72 20 4d 3d 77 2e 74 69 6d 69 6e 67 73 3d 77 2e 74 69 6d 69 6e 67 73 7c 7c 7b 7d 3b 4d 6e 28 4d 2c 22 73 65 6e 64 45 76 65 6e 74 43 6f 6d 70 6c 65 74 65 64 22 2c 62 29 7d 29 7d 66 75 6e 63 74 69 6f 6e Data Ascii: p.isSync)}p.sizeExceed&&p.sizeExceed.length>0&&lt(p.sizeExceed,8003,p.sendType),p.failedEvts&&p.failedEvts.length>0&&lt(p.failedEvts,8002,p.sendType)}function be(p,b){U&&W(p,function(w){var M=w.timings=w.timings\|\|{};Mn(M,"sendEventCompleted",b)})}function
2024-10-02 10:16:50 UTC	16384	IN	Data Raw: 6f 6d 49 64 3d 72 7d 2c 74 2e 67 65 74 49 64 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 48 6e 28 74 2e 63 75 73 74 6f 6d 49 64 29 3f 74 2e 63 75 73 74 6f 6d 49 64 3a 74 2e 61 75 74 6f 6d 61 74 69 63 49 64 7d 7d 29 7d 72 65 74 75 72 6e 20 6e 2e 5f 73 74 61 74 69 63 49 6e 69 74 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 63 74 28 6e 2e 70 72 6f 74 6f 74 79 70 65 2c 22 69 64 22 2c 4b 49 2c 7a 49 29 7d 28 29 2c 6e 7d 28 29 2c 6d 64 3d 22 61 69 5f 73 65 73 73 69 6f 6e 22 2c 57 49 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 66 75 6e 63 74 69 6f 6e 20 6e 28 74 2c 72 29 7b 76 61 72 20 65 2c 69 3d 43 67 28 74 29 2c 61 3d 64 74 28 74 29 2c 6f 3b 44 74 28 6e 2c 74 68 69 73 2c 66 75 6e 63 74 69 6f 6e 28 66 29 7b 76 61 72 20 75 3d 73 28 72 29 3b 64 6e 28 72 2e 73 65 73 Data Ascii: omId=r},t.getId=function(){return Hn(t.customId)?t.customId:t.automaticId}})}return n._staticInit=function(){ct(n.prototype,"id",KI,zI)}(),n}(),md="ai_session",WI=function(){function n(t,r){var e,i=Cg(t),a=dt(t),o;Dt(n,this,function(f){var u=s(r);dn(r.ses
2024-10-02 10:16:50 UTC	16384	IN	Data Raw: 66 21 3d 3d 6e 6f 26 26 28 6e 3d 73 65 6c 66 29 2c 21 6e 26 26 74 79 70 65 6f 66 20 77 69 6e 64 6f 77 21 3d 3d 6e 6f 26 26 28 6e 3d 77 69 6e 64 6f 77 29 2c 21 6e 26 26 74 79 70 65 6f 66 20 67 6c 6f 62 61 6c 21 3d 3d 6e 6f 26 26 28 6e 3d 67 6c 6f 62 61 6c 29 2c 6e 7c 7c 7b 7d 7d 76 61 72 20 4c 64 3d 78 79 28 29 2c 74 63 3d 4c 64 5b 24 64 5d 7c 7c 28 4c 64 5b 24 64 5d 3d 7b 6f 3a 28 5a 61 3d 7b 7d 2c 5a 61 5b 6e 63 5d 3d 21 30 2c 5a 61 5b 50 6f 5d 3d 21 30 2c 5a 61 29 2c 6e 3a 31 65 33 7d 29 3b 66 75 6e 63 74 69 6f 6e 20 66 72 28 6e 2c 74 29 7b 72 65 74 75 72 6e 20 6e 26 26 4a 75 5b 75 72 5d 2e 68 61 73 4f 77 6e 50 72 6f 70 65 72 74 79 2e 63 61 6c 6c 28 6e 2c 74 29 7d 66 75 6e 63 74 69 6f 6e 20 57 30 28 6e 29 7b 72 65 74 75 72 6e 20 6e 26 26 28 6e 3d 3d 3d Data Ascii: f!==no&&(n=self),!n&&typeof window!==no&&(n=window),!n&&typeof global!==no&&(n=global),n\|\|{}}var Ld=xy(),tc=Ld[$d]\|\|(Ld[$d]={o:(Za={},Za[nc]=!0,Za[Po]=!0,Za),n:1e3});function fr(n,t){return n&&Ju[ur].hasOwnProperty.call(n,t)}function W0(n){return n&&(n===
2024-10-02 10:16:51 UTC	16384	IN	Data Raw: 65 74 75 72 6e 20 77 6e 28 6e 5b 74 5d 29 3f 6e 5b 74 5d 28 29 3a 6e 75 6c 6c 7d 66 75 6e 63 74 69 6f 6e 20 75 5f 28 6e 2c 74 29 7b 76 61 72 20 72 3d 6e 7c 7c 6f 6e 3b 72 65 74 75 72 6e 20 67 72 28 74 2c 66 75 6e 63 74 69 6f 6e 28 65 2c 69 29 7b 72 2b 3d 22 3b 20 22 2b 65 2b 28 45 6e 28 69 29 3f 6f 6e 3a 22 3d 22 2b 69 29 7d 29 2c 72 7d 66 75 6e 63 74 69 6f 6e 20 61 44 28 6e 29 7b 76 61 72 20 74 3d 6f 6e 3b 69 66 28 6c 61 29 7b 76 61 72 20 72 3d 6c 61 5b 24 6c 5d 7c 7c 6f 6e 3b 65 5f 21 3d 3d 72 26 26 28 69 5f 3d 70 54 28 72 29 2c 65 5f 3d 72 29 2c 74 3d 6e 74 28 69 5f 5b 6e 5d 7c 7c 6f 6e 29 7d 72 65 74 75 72 6e 20 74 7d 66 75 6e 63 74 69 6f 6e 20 66 5f 28 6e 2c 74 29 7b 6c 61 26 26 28 6c 61 5b 24 6c 5d 3d 6e 2b 22 3d 22 2b 74 29 7d 66 75 6e 63 74 69 6f Data Ascii: eturn wn(n[t])?n[t]():null}function u_(n,t){var r=n\|\|on;return gr(t,function(e,i){r+="; "+e+(En(i)?on:"="+i)}),r}function aD(n){var t=on;if(la){var r=la[$l]\|\|on;e_!==r&&(i_=pT(r),e_=r),t=nt(i_[n]\|\|on)}return t}function f_(n,t){la&&(la[$l]=n+"="+t)}functio
2024-10-02 10:16:51 UTC	16384	IN	Data Raw: 74 79 70 65 4e 61 6d 65 7c 7c 6e 5b 52 74 5d 7c 7c 22 22 2c 21 74 29 29 74 72 79 7b 76 61 72 20 72 3d 2f 66 75 6e 63 74 69 6f 6e 20 28 2e 7b 31 2c 32 30 30 7d 29 5c 28 2f 2c 65 3d 72 2e 65 78 65 63 28 6e 2e 63 6f 6e 73 74 72 75 63 74 6f 72 5b 4c 72 5d 28 29 29 3b 74 3d 65 26 26 65 5b 75 6e 5d 3e 31 3f 65 5b 31 5d 3a 22 22 7d 63 61 74 63 68 7b 7d 72 65 74 75 72 6e 20 74 7d 66 75 6e 63 74 69 6f 6e 20 5a 66 28 6e 29 7b 69 66 28 6e 29 74 72 79 7b 69 66 28 21 7a 6e 28 6e 29 29 7b 76 61 72 20 74 3d 4f 75 28 6e 29 2c 72 3d 54 63 28 6e 2c 21 31 29 3b 72 65 74 75 72 6e 28 21 72 7c 7c 72 3d 3d 3d 22 7b 7d 22 29 26 26 28 6e 5b 4a 65 5d 26 26 28 6e 3d 6e 5b 4a 65 5d 2c 74 3d 4f 75 28 6e 29 29 2c 72 3d 54 63 28 6e 2c 21 30 29 29 2c 72 5b 62 54 5d 28 74 29 21 3d 3d 30 Data Ascii: typeName\|\|n[Rt]\|\|"",!t))try{var r=/function (.{1,200})\(/,e=r.exec(n.constructor[Lr]());t=e&&e[un]>1?e[1]:""}catch{}return t}function Zf(n){if(n)try{if(!zn(n)){var t=Ou(n),r=Tc(n,!1);return(!r\|\|r==="{}")&&(n[Je]&&(n=n[Je],t=Ou(n)),r=Tc(n,!0)),r[bT](t)!==0
2024-10-02 10:16:51 UTC	16384	IN	Data Raw: 65 6d 65 6e 74 73 3a 5f 6e 7d 29 7d 2c 69 3d 6e 65 77 20 55 5f 28 53 5b 65 74 5d 28 29 2c 22 74 72 61 63 6b 50 61 67 65 56 69 65 77 22 29 2c 69 2e 61 63 74 69 6f 6e 3d 66 75 6e 63 74 69 6f 6e 28 6b 2c 48 2c 7a 2c 51 2c 5f 6e 29 7b 45 6e 28 51 29 26 26 28 51 3d 7b 7d 29 2c 51 2e 64 75 72 61 74 69 6f 6e 3d 7a 5b 68 75 5d 28 29 3b 76 61 72 20 62 6e 3d 7b 6e 61 6d 65 3a 6b 2c 75 72 69 3a 48 2c 70 72 6f 70 65 72 74 69 65 73 3a 51 2c 6d 65 61 73 75 72 65 6d 65 6e 74 73 3a 5f 6e 7d 3b 53 5b 5a 72 5d 28 62 6e 2c 51 29 7d 2c 77 6c 28 29 26 26 28 63 6e 28 41 29 2c 65 6e 28 41 29 29 7d 63 61 74 63 68 28 6b 29 7b 74 68 72 6f 77 20 53 2e 73 65 74 49 6e 69 74 69 61 6c 69 7a 65 64 28 21 31 29 2c 6b 7d 7d 7d 2c 53 2e 5f 64 6f 54 65 61 72 64 6f 77 6e 3d 66 75 6e 63 74 69 Data Ascii: ements:_n})},i=new U_(S[et](),"trackPageView"),i.action=function(k,H,z,Q,_n){En(Q)&&(Q={}),Q.duration=z[hu]();var bn={name:k,uri:H,properties:Q,measurements:_n};S[Zr](bn,Q)},wl()&&(cn(A),en(A))}catch(k){throw S.setInitialized(!1),k}}},S._doTeardown=functi

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
111	192.168.2.16	49872	77.75.76.70	443	3540	C:\Users\user\AppData\Roaming\Seznam.cz\sznsetup.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-02 10:16:50 UTC	114	OUT	GET /update/szn-software-fflisticka-4.0.8-win32.zip HTTP/1.1 Host: download.seznam.cz Connection: Keep-Alive
2024-10-02 10:16:51 UTC	273	IN	HTTP/1.1 200 OK server: envoy date: Wed, 02 Oct 2024 10:16:50 GMT content-type: application/zip content-length: 5865670 last-modified: Tue, 01 Oct 2024 14:17:29 GMT etag: "66fc0479-5980c6" accept-ranges: bytes x-envoy-upstream-service-time: 1 connection: close
2024-10-02 10:16:51 UTC	13629	IN	Data Raw: 50 4b 03 04 14 00 00 00 08 00 18 86 85 4d 96 af af 93 32 02 00 00 15 04 00 00 0b 00 00 00 63 6f 6e 74 72 6f 6c 2e 69 6e 69 85 53 db 8a db 30 10 7d b6 c1 ff 30 b0 14 b6 90 15 9b bd 94 52 c8 6b 9f 4a bb b4 50 0a a5 0f b2 35 d9 55 24 4b 42 97 6c 63 fa 0b fd 80 3e ee 07 e4 13 da 97 34 ff d5 51 ec 38 1b 68 bb 36 58 83 e6 cc 99 cb 19 9f c0 8d 75 32 40 cd b5 6c 54 aa ca 93 7f 3c e4 01 c3 5b 2c 8a 62 d1 a2 b1 fb 08 06 51 b6 77 1a 21 df 62 0b 8b 60 13 01 bb 25 37 08 64 d7 d6 af 60 09 4e dd 66 86 25 fa 20 ad 29 0a 32 3a 7c 94 15 04 3a 34 22 14 45 c0 8e f2 40 c7 97 32 68 1b a2 9c ec 7d 10 10 ac e3 2a 2d 10 9c 15 3a 7f 9b 98 1e 41 33 51 63 cd 9c 58 e3 81 4a ed 6e 54 dc e5 91 26 44 ae 35 39 95 97 2e 82 c1 da 02 77 6e 02 2a a2 5f 51 e9 3d 82 92 f4 e5 a1 82 67 9f fa b6 Data Ascii: PKM2control.iniS0}0RkJP5U$KBlc>4Q8h6Xu2@lT<[,bQw!b`%7d`Nf% )2:\|:4"E@2h}-:A3QcXJnT&D59.wn_Q=g
2024-10-02 10:16:51 UTC	1388	IN	Data Raw: 1b 42 6f 6c 4f c4 ea 89 eb 01 84 bc d3 8d 8f 68 e7 6a 8d 4f c5 76 56 4f 74 cb fd fc b5 fe f4 a8 f7 4e 83 1c 81 10 27 fc f8 b4 6c ea 36 89 e5 cb 04 64 3b c8 61 99 82 0e 2a cd 95 f0 7d 60 74 3a 1a 4f f5 7a 3e 9a 3c d0 cc 23 eb 72 6f 4c b9 c2 e2 fe fb 2a 61 cd 01 35 71 d0 59 98 20 75 db c1 98 ca 1b 8c 33 6c 8b ba a4 ff db 78 b9 07 84 67 91 26 0f d9 2e 14 96 66 f8 55 95 71 61 bd 2a 93 8a 8f 77 24 e4 e5 af d8 8b 83 65 3d f6 60 e5 23 e4 eb b1 d0 9b 59 e3 3e b3 f9 06 b7 62 9e 34 ce 33 47 9f c1 ec 6f ac 21 81 a0 96 38 04 ab 96 06 ca 98 0c f0 f2 22 70 78 7a b5 32 c8 35 66 07 18 db ab 12 30 70 0f 51 12 96 c6 de ee d9 a0 09 cc 4b a9 f5 2d 3c 9d 5a d7 56 28 e6 bc be b5 5e 19 7e ef f7 47 3f 62 c1 53 09 75 08 f1 b2 0c d9 d1 14 ba 9e 5b d9 77 b0 10 10 46 d9 a5 0b 34 50 Data Ascii: BolOhjOvVOtN'l6d;a}`t:Oz><#roLa5qY u3lxg&.fUqa*w$e=`#Y>b43Go!8"pxz25f0pQK-<ZV(^~G?bSu[wF4P
2024-10-02 10:16:51 UTC	11104	IN	Data Raw: d7 38 f7 dd b1 b0 a5 42 a4 86 1f 22 53 70 8f 60 5c 61 95 e2 60 03 13 06 50 93 68 c1 93 e0 f2 8d cc 59 41 f1 d5 05 17 1b e0 3d 1a 72 54 8f 25 a8 f0 ca 27 e0 ea 49 0a 44 5c b3 9c 1d 22 19 97 1c 1a fb 69 ed 67 af 9a 17 d5 0a 87 fd 0f eb a7 23 a1 08 af 56 e4 7a fa 09 a4 35 ed db 79 23 45 2c 42 f2 77 4c 4f d9 36 84 43 a7 62 eb 85 f6 78 84 d9 0d 07 6d 50 26 52 09 9b 13 ed f2 51 ce c7 6d 11 32 62 e2 98 cc 88 24 94 aa 16 f3 47 1f 4e 87 39 8a 34 fd 4d a3 cf 29 00 91 e9 78 34 24 34 79 1b 26 94 ae c5 9e bb 0b d5 0d f7 ad 5c 88 98 b1 ba d6 4c 16 28 a1 f1 13 b4 b9 fc 97 aa af 59 5a fa 5b 35 75 75 cd 9b 41 70 fb 38 c9 0f 76 1c 09 65 b4 22 af a5 a7 9e 74 2d ce 30 7d 16 f8 29 95 fa 43 0c 73 fe 0c 73 5a 22 9c e1 39 d4 45 19 d5 b1 6e f8 77 41 69 e9 6d 94 17 75 7d c7 e6 65 Data Ascii: 8B"Sp`\a`PhYA=rT%'ID\"ig#Vz5y#E,BwLO6CbxmP&RQm2b$GN94M)x4$4y&\L(YZ[5uuAp8ve"t-0})CssZ"9EnwAimu}e
2024-10-02 10:16:51 UTC	15268	IN	Data Raw: ca 57 63 86 5a 85 b1 83 0f 55 6f 40 7e 31 1f b3 e2 e3 56 7c ec 8a 8f 5f 65 e4 74 7a c5 39 f0 73 ed 1c 39 81 8d 28 e1 8b 81 68 f8 0c 34 38 4c 68 78 d6 93 45 21 21 93 89 a2 c3 49 7f e0 a7 22 32 0e 72 c7 9d cf ad 33 e8 08 1b 09 7c fe 0b 8d fa 54 0d f5 1b 98 54 8e 93 13 9e cf af c1 16 07 69 3a fd 73 17 35 a1 23 f8 45 33 b7 b1 6a 80 8b 6b ce 3c 4e af b7 e1 10 9e 56 9f 1b c7 d0 19 c5 7c e0 ad 39 1b ea eb c2 29 17 fb b0 1d 69 18 8f c6 a1 1e 8c 98 26 9f 4a 8d 0d 37 ca 59 67 a0 42 d3 b1 70 ea 83 72 83 7d 11 e2 98 10 29 16 6a 81 a5 b2 45 e2 c7 c7 c7 95 c5 2f 79 f1 09 8f f1 ea d8 6e dd ba bd 80 32 17 68 8d 9a 9d 1a e3 10 ca 14 7e f0 c1 07 7b ed be fb ee 6f a9 32 84 7e 05 55 71 97 c7 e5 8b a3 8b 5f fa c4 e7 97 c5 27 48 3a 3a a8 1a ef a1 ee 03 1c 17 6f 74 4a 2a c7 30 Data Ascii: WcZUo@~1V\|_etz9s9(h48LhxE!!I"2r3\|TTi:s5#E3jk<NV\|9)i&J7YgBpr})jE/yn2h~{o2~Uq_'H::otJ*0
2024-10-02 10:16:51 UTC	1388	IN	Data Raw: ec fa 21 0e a9 9e 7c 56 db 81 73 77 a2 f1 19 12 74 f0 23 57 21 22 1b 49 cd 33 dd 12 20 ff 70 01 f9 8c 90 fb 4d 31 0c 11 90 ba db 2b 55 3c 25 fa 00 1e c0 05 77 70 27 bf 7f 50 3e a9 8a 5c 84 9f ff 80 5a 81 fc 72 87 3b 75 58 6f ab aa 19 a1 5e c1 a5 5a 1e 1d 64 52 7c e9 80 dd 22 0c 79 77 4a bf 29 5e a6 5c 38 21 61 f4 83 0c bf 71 ee 9b 05 e2 ae f6 69 61 88 e3 ab 9e ee 65 08 e4 15 a9 e1 f3 9a cf 25 19 f5 2a 5a 56 3f e5 b0 b0 c5 bc d1 91 6d ee 45 e0 63 b4 c9 64 3b d3 d8 32 39 65 31 b9 99 e3 04 33 7e 5b 7e 72 89 55 c6 08 e7 bc e3 96 c8 83 75 fb 81 3b 03 0c d2 a3 fa 96 a4 d2 4f a4 4c 3d fd a1 46 ff 13 cb 2e 5d e7 39 a0 41 9c 31 ba 77 df 2f 40 d0 74 dd 63 b7 e5 e3 f2 7c d5 c9 e1 03 2e 40 a8 ef 43 4d e9 c3 dc c1 9a da 1c c5 1c 64 b5 ca 63 16 ca 36 a0 70 e4 5d db 1e Data Ascii: !\|Vswt#W!"I3 pM1+U<%wp'P>\Zr;uXo^ZdR\|"ywJ)^\8!aqiae%*ZV?mEcd;29e13~[~rUu;OL=F.]9A1w/@tc\|.@CMdc6p]
2024-10-02 10:16:51 UTC	16384	IN	Data Raw: 04 74 86 f0 1f 71 b5 b2 37 76 f0 90 33 b2 37 b2 f8 db 53 e9 b7 fa a6 fc a6 20 92 cf 8b 86 ac 41 5f 2c b1 84 0f b8 30 03 8a 64 79 45 b9 e8 1e 78 81 b5 89 82 09 aa 85 dd 15 d9 30 f4 9b bb 79 37 82 93 6d 19 19 a6 ea 86 8f 53 43 27 0b 8f cb f1 d4 fa 95 2b 37 02 60 97 1a d5 16 85 48 72 98 1c c7 71 6a 9f 34 e7 50 48 14 35 d0 09 2f 40 7e 81 ca 99 a5 08 b4 c4 a7 e1 8c 4b 68 a0 38 18 96 5f 92 b0 87 79 26 94 d2 f0 98 53 90 44 92 0b 7b 61 46 d5 ff 62 9e 36 59 44 ac fe d1 e4 1b dc e5 74 d0 c8 56 56 89 80 00 f3 c2 c5 66 93 05 39 63 3e 00 b7 5f 15 0e 35 42 68 e8 81 19 2c 78 80 1a 72 75 08 86 39 9c b2 4f e9 fa 0d b6 e8 2f f1 c6 d0 1d b8 cc 92 1c ad 1f 4a 9a ec e7 83 38 07 e8 5f 9f a2 ef 90 a6 9e 0f e4 f6 e2 14 b2 41 c6 f6 e6 03 76 3b 40 cc 32 65 eb 64 a2 46 52 20 bf 16 Data Ascii: tq7v37S A_,0dyEx0y7mSC'+7`Hrqj4PH5/@~Kh8_y&SD{aFb6YDtVVf9c>_5Bh,xru9O/J8_Av;@2edFR
2024-10-02 10:16:51 UTC	1660	IN	Data Raw: ae b9 be 99 eb a0 85 df a3 59 3a 3e ef 8a 25 5f c8 c7 17 bf f8 75 c0 3d 79 34 e3 79 6e 99 cf a5 e2 04 6e df b6 73 7d f7 c0 4f e4 9c e8 2d 06 8d 9c fe e8 e4 c8 83 4c 35 70 d6 ae 4a 64 af 0b 0e 63 a2 8d 81 c7 7e 68 8a e1 02 4f e7 27 20 99 74 f5 fb 2a 25 de e6 f7 71 cb 11 3c 1a ff 93 c2 ac 25 47 7f 5b 51 b2 8a ce f9 7e 1a d9 4c 90 31 d6 b5 f3 38 9b 06 99 d7 93 c4 78 38 26 cc cd 56 32 23 fc 2a 74 2c 55 2c 5a 75 30 a9 a5 5f b4 f0 58 6d 3f 57 1c a3 c6 ba 77 01 22 04 f9 f6 91 a2 d4 51 67 f7 fc f0 ca b4 85 3c e1 82 72 4e 45 28 a3 68 37 d4 c6 bc b1 94 0d 8e 54 f9 03 79 0e cc f7 5b 8d c3 b3 aa 14 dd a7 80 38 94 03 7f 55 8c be 2a 6c 97 63 0f cf 4b 85 24 47 75 8f 99 04 bc d4 68 b9 7b fc ca 2e fb 36 c6 4f b5 b3 bd 90 5f ac 65 a5 85 98 28 14 e7 99 24 2c b2 4b 47 d8 5d Data Ascii: Y:>%_u=y4ynns}O-L5pJdc~hO' t%q<%G[Q~L18x8&V2#t,U,Zu0_Xm?Ww"Qg<rNE(h7Ty[8U*lcK$Guh{.6O_e($,KG]
2024-10-02 10:16:51 UTC	1388	IN	Data Raw: 95 89 84 cf 8b b6 e7 0a 17 56 2f 33 32 17 6a 98 46 7e c7 93 b0 0b 76 3b 62 ea 2e 41 93 0b 78 ed 81 3a 06 e6 e3 b0 95 5c 3f 7c 7a cd 53 96 12 cb 33 31 b3 2b f6 af f2 04 4a 9b 9f 7a 40 96 d5 92 3f b8 3e 7f bf 57 32 92 c6 54 ad a7 58 90 84 23 58 3f 6a 23 d8 f1 cc 5c 0d 59 ee 96 23 93 9c 1f 05 96 d7 47 1c f1 b5 ae 64 a9 63 59 47 02 68 c7 9a f3 f4 e5 b2 af ed 5e b6 e4 78 d6 12 97 e1 80 a6 95 18 3b 9c 02 61 fd bd c1 ce 02 06 ce 19 df d5 67 c9 54 e3 8b e0 0b 7d 32 9d df 26 18 f7 ae 52 4a 69 44 dd ee be 92 83 5d e3 00 91 dc c2 62 6a ac b2 53 7f e2 94 ab 30 3f 4d b4 7c aa 70 6c a3 6a 69 d8 4a 06 7c 0d 61 a8 e8 7a 95 d3 b2 ea 42 2b 8a 9e 7b cd f2 11 2f 82 95 42 72 b9 c6 a7 68 99 34 b8 6a 8f ea 14 46 f7 d3 06 af 0c ff a1 f7 f9 27 78 de 0f 94 da 9e 69 70 94 ce 6c f2 Data Ascii: V/32jF~v;b.Ax:\?\|zS31+Jz@?>W2TX#X?j#\Y#GdcYGh^x;agT}2&RJiD]bjS0?M\|pljiJ\|azB+{/Brh4jF'xipl
2024-10-02 10:16:51 UTC	16384	IN	Data Raw: 95 62 ca 5a 4a 7e d6 04 b0 1d 38 5e 43 a0 49 ee 6d c5 01 7b 37 6a cc 70 d5 fd e3 fb da c4 d4 11 73 75 ea 5a f9 18 e4 da 69 e6 31 b0 1b 07 89 3e 65 81 48 d2 b1 ee b9 e9 e9 00 ca 78 0d 48 8e 88 98 a3 b8 b2 ed 74 d5 38 e1 c3 d4 90 61 3b 29 2a 4f 74 3a 2a f4 dd 01 1d a4 d1 0b e4 3e 94 cc b4 5a 11 48 8c 0c 67 d7 78 7f 37 b0 b9 5f 26 79 b7 0c 22 4f 6b b2 99 45 6e 17 c5 cd f7 30 85 53 11 aa 64 02 e1 c6 61 b8 6a 0e f1 e1 49 f2 e5 31 45 b6 40 b1 82 06 c2 6b a1 f7 a0 2c 19 e9 18 86 2a 95 a0 60 9a 28 9c 72 07 31 a9 7e c4 59 31 34 ff 67 f4 92 30 dd 31 52 b4 f2 04 4a 93 0f 50 5e 98 3c c2 89 94 01 e8 e7 22 2b b7 19 5f e7 bc 74 6f 42 dc 11 9a d4 d4 8f 8e 8e bc d1 04 6e 12 85 9c 38 a9 a0 76 2e 47 88 24 11 1a 65 2e 18 44 15 7c a8 c7 31 56 98 0f 5b 8d f5 3c a1 34 11 f1 91 Data Ascii: bZJ~8^CIm{7jpsuZi1>eHxHt8a;)Ot:>ZHgx7_&y"OkEn0SdajI1E@k,*`(r1~Y14g01RJP^<"+_toBn8v.G$e.D\|1V[<4
2024-10-02 10:16:51 UTC	16384	IN	Data Raw: b9 be 84 63 6a b8 34 87 f7 58 7c 02 f5 e2 62 a4 f6 56 a0 12 21 9f cb c5 a5 a2 b7 b3 0f 57 5a 9b 10 21 52 3d d2 b6 e9 a7 2e 66 2e ec f2 89 00 ed d3 c9 10 f9 51 09 38 bc 1a 61 1f 0b 4a 1e 4b 34 7f 50 3b 1e 75 25 09 ac 92 83 09 d3 0d bb a9 2c 7b c7 85 4a e3 53 3b 6c 71 cd 40 d7 6b 56 e7 27 ef 9d 33 08 33 62 a7 2e 61 51 22 ae 56 e2 19 12 ec 59 c5 7f 49 9a c7 2a 7f 1c 4f 01 75 81 eb 26 6d b0 2d bc 43 0f f9 95 a5 fe 9d 73 bc f8 ce 16 56 95 ca 81 40 bc 63 e3 61 40 5a 18 dd 77 1e 33 13 1e 93 c5 f3 a3 70 8e 30 96 c4 ed 0b 8e 81 87 5a f1 be eb 79 6d 75 87 d9 c4 26 52 ff bb a5 f5 21 9a 83 19 9c cd 47 67 2c 6d 54 fa fc dd 49 b5 a2 68 62 07 4f b0 72 99 af 73 fc f6 ba 06 72 08 49 75 f3 4b af ed a4 16 0d 90 55 80 d9 6a fa 3c a7 02 b8 ad 6f 62 80 e5 6e ea 53 21 e9 d2 ae Data Ascii: cj4X\|bV!WZ!R=.f.Q8aJK4P;u%,{JS;lq@kV'33b.aQ"VYI*Ou&m-CsV@ca@Zw3p0Zymu&R!Gg,mTIhbOrsrIuKUj<obnS!

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
112	192.168.2.16	49873	13.107.246.40	443	4912	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-02 10:16:50 UTC	561	OUT	GET /tag/inyago70pn HTTP/1.1 Host: www.clarity.ms Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://apps.microsoft.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-10-02 10:16:50 UTC	379	IN	HTTP/1.1 200 OK Date: Wed, 02 Oct 2024 10:16:50 GMT Content-Type: application/x-javascript Content-Length: 522 Connection: close Cache-Control: no-cache, no-store Expires: -1 Request-Context: appId=cid-v1:e97341f6-8fff-46a6-9229-fbbfe0892c78 x-azure-ref: 20241002T101650Z-15767c5fc55xgp8c992y5v5w1800000009dg00000000d3tv X-Cache: CONFIG_NOCACHE Accept-Ranges: bytes
2024-10-02 10:16:50 UTC	522	IN	Data Raw: 21 66 75 6e 63 74 69 6f 6e 28 63 2c 6c 2c 61 2c 72 2c 69 2c 74 2c 79 29 7b 69 66 28 61 5b 63 5d 2e 76 7c 7c 61 5b 63 5d 2e 74 29 72 65 74 75 72 6e 20 61 5b 63 5d 28 22 65 76 65 6e 74 22 2c 63 2c 22 64 75 70 2e 22 2b 69 2e 70 72 6f 6a 65 63 74 49 64 29 3b 61 5b 63 5d 2e 74 3d 21 30 2c 28 74 3d 6c 2e 63 72 65 61 74 65 45 6c 65 6d 65 6e 74 28 72 29 29 2e 61 73 79 6e 63 3d 21 30 2c 74 2e 73 72 63 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 63 6c 61 72 69 74 79 2e 6d 73 2f 73 2f 30 2e 37 2e 34 37 2f 63 6c 61 72 69 74 79 2d 65 78 74 65 6e 64 65 64 2e 6a 73 22 2c 28 79 3d 6c 2e 67 65 74 45 6c 65 6d 65 6e 74 73 42 79 54 61 67 4e 61 6d 65 28 72 29 5b 30 5d 29 2e 70 61 72 65 6e 74 4e 6f 64 65 2e 69 6e 73 65 72 74 42 65 66 6f 72 65 28 74 2c 79 29 2c 61 5b 63 5d 28 22 Data Ascii: !function(c,l,a,r,i,t,y){if(a[c].v\|\|a[c].t)return a[c]("event",c,"dup."+i.projectId);a[c].t=!0,(t=l.createElement(r)).async=!0,t.src="https://www.clarity.ms/s/0.7.47/clarity-extended.js",(y=l.getElementsByTagName(r)[0]).parentNode.insertBefore(t,y),a[c]("

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
113	192.168.2.16	49874	13.107.246.40	443	4912	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-02 10:16:50 UTC	560	OUT	GET /tag/edvmnysmkk HTTP/1.1 Host: www.clarity.ms Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://www.microsoft.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-10-02 10:16:50 UTC	528	IN	HTTP/1.1 200 OK Date: Wed, 02 Oct 2024 10:16:50 GMT Content-Type: application/x-javascript Content-Length: 649 Connection: close Cache-Control: no-cache, no-store Expires: -1 Set-Cookie: CLID=c6083d87285244068a54b7c1410cd9fd.20241002.20251002; expires=Thu, 02 Oct 2025 10:16:50 GMT; path=/; secure; samesite=none; httponly Request-Context: appId=cid-v1:3d284f99-f285-495c-ac33-dedd7ecf1ac8 x-azure-ref: 20241002T101650Z-15767c5fc55xsgnlxyxy40f4m000000009cg00000000136n X-Cache: CONFIG_NOCACHE Accept-Ranges: bytes
2024-10-02 10:16:50 UTC	649	IN	Data Raw: 21 66 75 6e 63 74 69 6f 6e 28 63 2c 6c 2c 61 2c 72 2c 69 2c 74 2c 79 29 7b 66 75 6e 63 74 69 6f 6e 20 73 79 6e 63 28 29 7b 28 6e 65 77 20 49 6d 61 67 65 29 2e 73 72 63 3d 22 68 74 74 70 73 3a 2f 2f 63 2e 63 6c 61 72 69 74 79 2e 6d 73 2f 63 2e 67 69 66 22 7d 22 63 6f 6d 70 6c 65 74 65 22 3d 3d 64 6f 63 75 6d 65 6e 74 2e 72 65 61 64 79 53 74 61 74 65 3f 73 79 6e 63 28 29 3a 77 69 6e 64 6f 77 2e 61 64 64 45 76 65 6e 74 4c 69 73 74 65 6e 65 72 28 22 6c 6f 61 64 22 2c 73 79 6e 63 29 3b 69 66 28 61 5b 63 5d 2e 76 7c 7c 61 5b 63 5d 2e 74 29 72 65 74 75 72 6e 20 61 5b 63 5d 28 22 65 76 65 6e 74 22 2c 63 2c 22 64 75 70 2e 22 2b 69 2e 70 72 6f 6a 65 63 74 49 64 29 3b 61 5b 63 5d 2e 74 3d 21 30 2c 28 74 3d 6c 2e 63 72 65 61 74 65 45 6c 65 6d 65 6e 74 28 72 29 29 2e Data Ascii: !function(c,l,a,r,i,t,y){function sync(){(new Image).src="https://c.clarity.ms/c.gif"}"complete"==document.readyState?sync():window.addEventListener("load",sync);if(a[c].v\|\|a[c].t)return a[c]("event",c,"dup."+i.projectId);a[c].t=!0,(t=l.createElement(r)).

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
114	192.168.2.16	49876	13.107.246.40	443	4912	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-02 10:16:50 UTC	646	OUT	GET /assets/js/edgefre-0b65e548.js HTTP/1.1 Host: apps.microsoft.com Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" Origin: https://apps.microsoft.com sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: same-origin Sec-Fetch-Mode: cors Sec-Fetch-Dest: script Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8 Cookie: MSCC=NR; exp-session-id=b6d0ece2-29a7-4143-931c-d621648d7cb8
2024-10-02 10:16:50 UTC	1285	IN	HTTP/1.1 200 OK Date: Wed, 02 Oct 2024 10:16:50 GMT Content-Type: text/javascript Content-Length: 5089 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public,max-age=31536000,immutable ETag: "1db136ef678ade1" Last-Modified: Mon, 30 Sep 2024 19:28:44 GMT Strict-Transport-Security: max-age=2592000 Request-Context: appId=cid-v1:04e455f9-321c-49bf-8d2c-d79fbf5e8cde MS-CV: B7vr/35UTkiSe4lU.0 X-Content-Type-Options: nosniff Permissions-Policy: unload=() Content-Security-Policy: default-src 'self' data: https://.clarity.ms https://c.bing.com;script-src 'self' wcpstatic.microsoft.com js.monitor.azure.com www.microsoft.com www.clarity.ms get.microsoft.com xvsec.video.microsoft.com bat.bing.com 'unsafe-inline';style-src 'unsafe-inline';connect-src * data: ms-windows-store:;font-src ;img-src data: blob:;media-src 'self' blob: https://sfds-production.azurefd.net https://canvasstorageprodtorus.blob.core.windows.net;frame-src * ms-windows-store:;report-uri https://csp.microsoft.com/report/app-store-web-prod X-Powered-By: ASP.NET x-azure-ref: 20241002T101650Z-15767c5fc55kg97hfq5uqyxxaw00000009b000000000945e x-fd-int-roxy-purgeid: 66820190 X-Cache: TCP_MISS Accept-Ranges: bytes
2024-10-02 10:16:50 UTC	5089	IN	Data Raw: 69 6d 70 6f 72 74 7b 69 20 61 73 20 75 2c 6d 20 61 73 20 70 2c 42 20 61 73 20 69 2c 79 20 61 73 20 6d 2c 5f 20 61 73 20 6c 2c 72 20 61 73 20 66 2c 74 20 61 73 20 77 2c 67 20 61 73 20 24 2c 7a 20 61 73 20 62 2c 44 20 61 73 20 79 2c 78 20 61 73 20 6f 2c 66 20 61 73 20 50 2c 45 20 61 73 20 76 2c 46 20 61 73 20 43 2c 6c 20 61 73 20 5f 2c 47 20 61 73 20 67 2c 73 20 61 73 20 6b 2c 61 20 61 73 20 44 7d 66 72 6f 6d 22 2e 2f 69 6e 64 65 78 2d 33 36 64 33 30 38 38 37 2e 6a 73 22 3b 69 6d 70 6f 72 74 7b 50 20 61 73 20 49 7d 66 72 6f 6d 22 2e 2f 70 72 6f 64 75 63 74 2d 63 6f 6c 6c 65 63 74 69 6f 6e 2d 38 36 63 34 61 62 66 33 2e 6a 73 22 3b 69 6d 70 6f 72 74 7b 43 20 61 73 20 53 7d 66 72 6f 6d 22 2e 2f 63 6f 6c 6c 65 63 74 69 6f 6e 2d 74 79 70 65 73 2d 37 37 63 33 38 Data Ascii: import{i as u,m as p,B as i,y as m,_ as l,r as f,t as w,g as $,z as b,D as y,x as o,f as P,E as v,F as C,l as _,G as g,s as k,a as D}from"./index-36d30887.js";import{P as I}from"./product-collection-86c4abf3.js";import{C as S}from"./collection-types-77c38

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
115	192.168.2.16	49878	23.57.90.111	443	4912	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-02 10:16:50 UTC	577	OUT	GET /li.lms-analytics/insight.min.js HTTP/1.1 Host: snap.licdn.com Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://www.microsoft.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-10-02 10:16:51 UTC	310	IN	HTTP/1.1 200 OK Last-Modified: Thu, 22 Aug 2024 11:06:54 GMT x-amz-server-side-encryption: AES256 Content-Type: application/javascript;charset=utf-8 Cache-Control: max-age=55426 Date: Wed, 02 Oct 2024 10:16:50 GMT Content-Length: 41172 Connection: close X-Content-Type-Options: nosniff X-CDN: AKAM
2024-10-02 10:16:51 UTC	16074	IN	Data Raw: 21 66 75 6e 63 74 69 6f 6e 28 29 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 66 75 6e 63 74 69 6f 6e 20 6e 28 6e 2c 74 2c 65 29 7b 72 65 74 75 72 6e 20 74 20 69 6e 20 6e 3f 4f 62 6a 65 63 74 2e 64 65 66 69 6e 65 50 72 6f 70 65 72 74 79 28 6e 2c 74 2c 7b 76 61 6c 75 65 3a 65 2c 65 6e 75 6d 65 72 61 62 6c 65 3a 21 30 2c 63 6f 6e 66 69 67 75 72 61 62 6c 65 3a 21 30 2c 77 72 69 74 61 62 6c 65 3a 21 30 7d 29 3a 6e 5b 74 5d 3d 65 2c 6e 7d 76 61 72 20 74 2c 65 2c 72 2c 69 2c 6f 3d 7b 41 44 56 45 52 54 49 53 49 4e 47 3a 22 41 44 56 45 52 54 49 53 49 4e 47 22 2c 41 4e 41 4c 59 54 49 43 53 5f 41 4e 44 5f 52 45 53 45 41 52 43 48 3a 22 41 4e 41 4c 59 54 49 43 53 5f 41 4e 44 5f 52 45 53 45 41 52 43 48 22 2c 46 55 4e 43 54 49 4f 4e 41 4c 3a 22 46 55 4e 43 54 49 4f 4e 41 Data Ascii: !function(){"use strict";function n(n,t,e){return t in n?Object.defineProperty(n,t,{value:e,enumerable:!0,configurable:!0,writable:!0}):n[t]=e,n}var t,e,r,i,o={ADVERTISING:"ADVERTISING",ANALYTICS_AND_RESEARCH:"ANALYTICS_AND_RESEARCH",FUNCTIONAL:"FUNCTIONA
2024-10-02 10:16:51 UTC	16384	IN	Data Raw: 67 74 68 3b 72 2b 2b 29 7b 21 74 5b 75 3d 69 5b 72 5d 5d 26 26 43 6e 28 75 29 26 26 28 74 5b 75 5d 3d 21 30 2c 65 2e 70 75 73 68 28 75 29 29 7d 69 66 28 6e 2e 5f 6c 69 6e 6b 65 64 69 6e 5f 64 61 74 61 5f 70 61 72 74 6e 65 72 5f 69 64 26 26 21 74 5b 6e 2e 5f 6c 69 6e 6b 65 64 69 6e 5f 64 61 74 61 5f 70 61 72 74 6e 65 72 5f 69 64 5d 26 26 28 74 5b 6e 2e 5f 6c 69 6e 6b 65 64 69 6e 5f 64 61 74 61 5f 70 61 72 74 6e 65 72 5f 69 64 5d 3d 21 30 2c 65 2e 70 75 73 68 28 6e 2e 5f 6c 69 6e 6b 65 64 69 6e 5f 64 61 74 61 5f 70 61 72 74 6e 65 72 5f 69 64 29 29 2c 6e 2e 5f 6c 69 6e 6b 65 64 69 6e 5f 64 61 74 61 5f 70 61 72 74 6e 65 72 5f 69 64 73 29 66 6f 72 28 76 61 72 20 6f 3d 30 2c 61 3d 6e 2e 5f 6c 69 6e 6b 65 64 69 6e 5f 64 61 74 61 5f 70 61 72 74 6e 65 72 5f 69 64 Data Ascii: gth;r++){!t[u=i[r]]&&Cn(u)&&(t[u]=!0,e.push(u))}if(n._linkedin_data_partner_id&&!t[n._linkedin_data_partner_id]&&(t[n._linkedin_data_partner_id]=!0,e.push(n._linkedin_data_partner_id)),n._linkedin_data_partner_ids)for(var o=0,a=n._linkedin_data_partner_id
2024-10-02 10:16:51 UTC	3149	IN	Data Raw: 22 5d 2c 79 65 3d 66 75 6e 63 74 69 6f 6e 28 6e 29 7b 72 65 74 75 72 6e 28 6e 3d 6e 2e 74 61 67 4e 61 6d 65 29 26 26 2d 31 3c 49 65 2e 69 6e 64 65 78 4f 66 28 6e 2e 74 6f 4c 6f 77 65 72 43 61 73 65 28 29 29 7d 2c 41 65 3d 66 75 6e 63 74 69 6f 6e 28 6e 29 7b 72 65 74 75 72 6e 21 21 28 6e 3d 6e 2e 61 74 74 72 69 62 75 74 65 73 29 26 26 4b 74 28 4f 62 6a 65 63 74 2e 6b 65 79 73 28 6e 29 2c 28 66 75 6e 63 74 69 6f 6e 28 6e 29 7b 72 65 74 75 72 6e 20 6e 26 26 2d 31 21 3d 3d 6e 2e 74 6f 4c 6f 77 65 72 43 61 73 65 28 29 2e 69 6e 64 65 78 4f 66 28 22 63 6c 69 63 6b 22 29 7d 29 29 7d 2c 53 65 3d 66 75 6e 63 74 69 6f 6e 28 6e 2c 74 29 7b 72 65 74 75 72 6e 20 4b 74 28 6e 2c 28 66 75 6e 63 74 69 6f 6e 28 6e 29 7b 72 65 74 75 72 6e 2d 31 21 3d 3d 74 2e 74 6f 4c 6f 77 Data Ascii: "],ye=function(n){return(n=n.tagName)&&-1<Ie.indexOf(n.toLowerCase())},Ae=function(n){return!!(n=n.attributes)&&Kt(Object.keys(n),(function(n){return n&&-1!==n.toLowerCase().indexOf("click")}))},Se=function(n,t){return Kt(n,(function(n){return-1!==t.toLow
2024-10-02 10:16:51 UTC	5565	IN	Data Raw: 7d 66 75 6e 63 74 69 6f 6e 20 7a 65 28 6e 29 7b 72 65 74 75 72 6e 20 6e 2e 72 65 70 6c 61 63 65 28 6b 65 2c 6a 65 29 7d 66 75 6e 63 74 69 6f 6e 20 4a 65 28 6e 29 7b 72 65 74 75 72 6e 20 6e 26 26 22 73 74 72 69 6e 67 22 3d 3d 74 79 70 65 6f 66 20 6e 3f 5b 46 65 2c 4b 65 2c 7a 65 2c 71 65 2c 24 65 2c 59 65 2c 57 65 5d 2e 72 65 64 75 63 65 28 28 66 75 6e 63 74 69 6f 6e 28 6e 2c 74 29 7b 72 65 74 75 72 6e 20 74 28 6e 29 7d 29 2c 6e 29 3a 6e 7d 66 75 6e 63 74 69 6f 6e 20 5a 65 28 6e 29 7b 72 65 74 75 72 6e 20 6e 2e 75 72 6c 3d 4a 65 28 6e 2e 75 72 6c 29 2c 6e 2e 68 72 65 66 26 26 28 6e 2e 68 72 65 66 3d 4a 65 28 6e 2e 68 72 65 66 29 29 2c 6e 2e 70 61 67 65 54 69 74 6c 65 26 26 28 6e 2e 70 61 67 65 54 69 74 6c 65 3d 4a 65 28 6e 2e 70 61 67 65 54 69 74 6c 65 29 Data Ascii: }function ze(n){return n.replace(ke,je)}function Je(n){return n&&"string"==typeof n?[Fe,Ke,ze,qe,$e,Ye,We].reduce((function(n,t){return t(n)}),n):n}function Ze(n){return n.url=Je(n.url),n.href&&(n.href=Je(n.href)),n.pageTitle&&(n.pageTitle=Je(n.pageTitle)

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
116	192.168.2.16	49879	68.67.160.114	443	4912	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-02 10:16:51 UTC	623	OUT	GET /pixie/up?pi=e8619ae9-c189-46ef-bfc8-f39e0ac838fd HTTP/1.1 Host: ib.adnxs.com Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: / Origin: https://www.microsoft.com Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://www.microsoft.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-10-02 10:16:51 UTC	460	IN	HTTP/1.1 200 OK Server: nginx/1.23.4 Date: Wed, 02 Oct 2024 10:16:51 GMT Content-Type: application/xml Content-Length: 9 Connection: close Access-Control-Allow-Credentials: true Access-Control-Allow-Headers: Content-Type Access-Control-Allow-Methods: GET, OPTIONS Access-Control-Allow-Origin: https://www.microsoft.com Access-Control-Max-Age: 0 X-Proxy-Origin: 8.46.123.33; 8.46.123.33; 672.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; adnxs.com
2024-10-02 10:16:51 UTC	9	IN	Data Raw: 7b 22 75 70 22 3a 7b 7d 7d Data Ascii: {"up":{}}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
117	192.168.2.16	49877	150.171.28.10	443	4912	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-02 10:16:51 UTC	690	OUT	GET /bat.js HTTP/1.1 Host: bat.bing.com Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: / X-Edge-Shopping-Flag: 1 Sec-MS-GEC: FF699648EBF162654E01182ED0BD24EDB1A2721B7E78C7D8756497D88A893629 Sec-MS-GEC-Version: 1-117.0.2045.47 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://www.microsoft.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-10-02 10:16:51 UTC	651	IN	HTTP/1.1 200 OK Cache-Control: private,max-age=1800 Content-Length: 50523 Content-Type: application/javascript Last-Modified: Thu, 19 Sep 2024 15:43:41 GMT Accept-Ranges: bytes ETag: "803483b3aaadb1:0" Strict-Transport-Security: max-age=31536000; includeSubDomains; preload X-Cache: CONFIG_NOCACHE Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version X-MSEdge-Ref: Ref A: 4A34447B31EF40B3A2C95EE417B7B5B3 Ref B: EWR30EDGE1611 Ref C: 2024-10-02T10:16:51Z Date: Wed, 02 Oct 2024 10:16:50 GMT Connection: close
2024-10-02 10:16:51 UTC	3327	IN	Data Raw: 66 75 6e 63 74 69 6f 6e 20 55 45 54 28 6f 29 7b 74 68 69 73 2e 73 74 72 69 6e 67 45 78 69 73 74 73 3d 66 75 6e 63 74 69 6f 6e 28 6e 29 7b 72 65 74 75 72 6e 20 6e 26 26 6e 2e 6c 65 6e 67 74 68 3e 30 7d 3b 74 68 69 73 2e 64 6f 6d 61 69 6e 3d 22 62 61 74 2e 62 69 6e 67 2e 63 6f 6d 22 3b 74 68 69 73 2e 64 6f 6d 61 69 6e 43 6c 3d 22 62 61 74 2e 62 69 6e 67 2e 6e 65 74 22 3b 74 68 69 73 2e 55 52 4c 4c 45 4e 47 54 48 4c 49 4d 49 54 3d 34 30 39 36 3b 74 68 69 73 2e 70 61 67 65 4c 6f 61 64 45 76 74 3d 22 70 61 67 65 4c 6f 61 64 22 3b 74 68 69 73 2e 63 75 73 74 6f 6d 45 76 74 3d 22 63 75 73 74 6f 6d 22 3b 74 68 69 73 2e 70 61 67 65 56 69 65 77 45 76 74 3d 22 70 61 67 65 5f 76 69 65 77 22 3b 6f 2e 56 65 72 3d 6f 2e 56 65 72 21 3d 3d 75 6e 64 65 66 69 6e 65 64 26 26 Data Ascii: function UET(o){this.stringExists=function(n){return n&&n.length>0};this.domain="bat.bing.com";this.domainCl="bat.bing.net";this.URLLENGTHLIMIT=4096;this.pageLoadEvt="pageLoad";this.customEvt="custom";this.pageViewEvt="page_view";o.Ver=o.Ver!==undefined&&
2024-10-02 10:16:51 UTC	8192	IN	Data Raw: 22 70 72 6f 6d 6f 74 69 6f 6e 73 2e 63 72 65 61 74 69 76 65 5f 73 6c 6f 74 22 3a 7b 7d 2c 22 70 72 6f 6d 6f 74 69 6f 6e 73 2e 69 64 22 3a 7b 7d 2c 22 70 72 6f 6d 6f 74 69 6f 6e 73 2e 6e 61 6d 65 22 3a 7b 7d 2c 70 69 64 3a 7b 74 79 70 65 3a 22 6f 62 6a 65 63 74 22 7d 2c 22 70 69 64 2e 65 6d 22 3a 7b 74 79 70 65 3a 22 70 69 64 22 7d 2c 22 70 69 64 2e 65 6d 61 69 6c 22 3a 7b 74 79 70 65 3a 22 70 69 64 22 2c 62 65 61 63 6f 6e 3a 22 65 6d 22 7d 2c 22 70 69 64 2e 70 68 22 3a 7b 74 79 70 65 3a 22 70 69 64 22 7d 2c 22 70 69 64 2e 70 68 6f 6e 65 5f 6e 75 6d 62 65 72 22 3a 7b 74 79 70 65 3a 22 70 69 64 22 2c 62 65 61 63 6f 6e 3a 22 70 68 22 7d 7d 3b 74 68 69 73 2e 6b 6e 6f 77 6e 45 76 65 6e 74 73 3d 7b 61 64 64 5f 70 61 79 6d 65 6e 74 5f 69 6e 66 6f 3a 5b 5d 2c 61 Data Ascii: "promotions.creative_slot":{},"promotions.id":{},"promotions.name":{},pid:{type:"object"},"pid.em":{type:"pid"},"pid.email":{type:"pid",beacon:"em"},"pid.ph":{type:"pid"},"pid.phone_number":{type:"pid",beacon:"ph"}};this.knownEvents={add_payment_info:[],a
2024-10-02 10:16:51 UTC	4489	IN	Data Raw: 67 74 61 67 50 69 64 3d 21 31 3b 6f 2e 68 61 73 4f 77 6e 50 72 6f 70 65 72 74 79 28 22 70 61 67 65 50 69 64 22 29 26 26 6f 2e 70 61 67 65 50 69 64 26 26 74 79 70 65 6f 66 20 6f 2e 70 61 67 65 50 69 64 3d 3d 22 6f 62 6a 65 63 74 22 3f 74 68 69 73 2e 70 61 67 65 4c 65 76 65 6c 50 61 72 61 6d 73 2e 70 69 64 3d 6f 2e 70 61 67 65 50 69 64 3a 6f 2e 68 61 73 4f 77 6e 50 72 6f 70 65 72 74 79 28 22 67 74 61 67 50 69 64 22 29 26 26 6f 2e 67 74 61 67 50 69 64 3d 3d 3d 21 30 26 26 28 74 68 69 73 2e 75 65 74 43 6f 6e 66 69 67 2e 67 74 61 67 50 69 64 3d 21 30 29 3b 74 68 69 73 2e 75 65 74 43 6f 6e 66 69 67 2e 65 6e 61 62 6c 65 41 75 74 6f 53 70 61 54 72 61 63 6b 69 6e 67 3d 21 31 3b 6f 2e 65 6e 61 62 6c 65 41 75 74 6f 53 70 61 54 72 61 63 6b 69 6e 67 3d 3d 3d 21 30 26 Data Ascii: gtagPid=!1;o.hasOwnProperty("pagePid")&&o.pagePid&&typeof o.pagePid=="object"?this.pageLevelParams.pid=o.pagePid:o.hasOwnProperty("gtagPid")&&o.gtagPid===!0&&(this.uetConfig.gtagPid=!0);this.uetConfig.enableAutoSpaTracking=!1;o.enableAutoSpaTracking===!0&
2024-10-02 10:16:51 UTC	8192	IN	Data Raw: 75 6e 64 65 66 69 6e 65 64 29 72 65 74 75 72 6e 3b 68 3d 75 3d 3d 3d 74 68 69 73 2e 70 61 67 65 56 69 65 77 45 76 74 3f 74 68 69 73 2e 70 61 67 65 4c 6f 61 64 45 76 74 3a 74 68 69 73 2e 63 75 73 74 6f 6d 45 76 74 3b 74 68 69 73 2e 65 76 74 28 68 2c 75 2c 73 2c 6e 5b 32 5d 29 7d 65 6c 73 65 20 69 66 28 6e 5b 30 5d 3d 3d 3d 22 73 65 74 22 29 7b 69 66 28 74 79 70 65 6f 66 20 6e 5b 31 5d 5b 30 5d 21 3d 22 6f 62 6a 65 63 74 22 29 72 65 74 75 72 6e 3b 66 6f 72 28 69 20 69 6e 20 6e 5b 31 5d 5b 30 5d 29 74 68 69 73 2e 6b 6e 6f 77 6e 50 61 72 61 6d 73 2e 68 61 73 4f 77 6e 50 72 6f 70 65 72 74 79 28 69 29 26 26 28 74 68 69 73 2e 70 61 67 65 4c 65 76 65 6c 50 61 72 61 6d 73 5b 69 5d 3d 6e 5b 31 5d 5b 30 5d 5b 69 5d 2c 69 3d 3d 3d 22 70 69 64 22 26 26 74 68 69 73 2e Data Ascii: undefined)return;h=u===this.pageViewEvt?this.pageLoadEvt:this.customEvt;this.evt(h,u,s,n[2])}else if(n[0]==="set"){if(typeof n[1][0]!="object")return;for(i in n[1][0])this.knownParams.hasOwnProperty(i)&&(this.pageLevelParams[i]=n[1][0][i],i==="pid"&&this.
2024-10-02 10:16:51 UTC	8192	IN	Data Raw: 6e 2e 6d 74 70 3d 6e 61 76 69 67 61 74 6f 72 2e 6d 61 78 54 6f 75 63 68 50 6f 69 6e 74 73 29 2c 6e 7d 3b 74 68 69 73 2e 72 65 6d 6f 76 65 54 72 61 69 6c 69 6e 67 41 6d 70 3d 66 75 6e 63 74 69 6f 6e 28 6e 29 7b 76 61 72 20 74 3d 6e 2e 63 68 61 72 41 74 28 6e 2e 6c 65 6e 67 74 68 2d 31 29 3b 72 65 74 75 72 6e 28 74 3d 3d 3d 22 26 22 7c 7c 74 3d 3d 3d 22 3f 22 29 26 26 28 6e 3d 6e 2e 73 75 62 73 74 72 69 6e 67 28 30 2c 6e 2e 6c 65 6e 67 74 68 2d 31 29 29 2c 6e 7d 3b 74 68 69 73 2e 68 65 6c 70 65 72 45 72 72 6f 72 3d 66 75 6e 63 74 69 6f 6e 28 6e 29 7b 69 66 28 74 79 70 65 6f 66 20 43 75 73 74 6f 6d 45 76 65 6e 74 3d 3d 22 66 75 6e 63 74 69 6f 6e 22 29 7b 76 61 72 20 74 3d 7b 65 72 72 4d 73 67 3a 6e 2c 74 61 67 49 64 3a 74 68 69 73 2e 62 65 61 63 6f 6e 50 61 Data Ascii: n.mtp=navigator.maxTouchPoints),n};this.removeTrailingAmp=function(n){var t=n.charAt(n.length-1);return(t==="&"\|\|t==="?")&&(n=n.substring(0,n.length-1)),n};this.helperError=function(n){if(typeof CustomEvent=="function"){var t={errMsg:n,tagId:this.beaconPa
2024-10-02 10:16:51 UTC	8192	IN	Data Raw: 74 2e 68 61 73 4f 77 6e 50 72 6f 70 65 72 74 79 28 22 70 61 67 65 74 79 70 65 22 29 3e 30 3f 28 74 2e 70 61 67 65 74 79 70 65 3d 74 68 69 73 2e 76 61 6c 69 64 61 74 65 50 61 67 65 54 79 70 65 28 74 2e 70 61 67 65 74 79 70 65 2c 74 68 69 73 2e 76 61 6c 69 64 52 65 74 61 69 6c 50 61 67 65 54 79 70 65 56 61 6c 75 65 73 29 2c 74 2e 68 61 73 4f 77 6e 50 72 6f 70 65 72 74 79 28 22 70 72 6f 64 69 64 22 29 3e 30 26 26 28 74 2e 70 72 6f 64 69 64 3d 74 68 69 73 2e 76 61 6c 69 64 61 74 65 50 72 6f 64 49 64 28 74 2e 70 72 6f 64 69 64 29 29 29 3a 74 2e 68 61 73 4f 77 6e 50 72 6f 70 65 72 74 79 28 22 70 72 6f 64 69 64 22 29 3e 30 26 26 74 68 69 73 2e 74 68 72 6f 77 45 72 72 6f 72 28 74 68 69 73 2e 6d 69 73 73 69 6e 67 50 61 67 65 54 79 70 65 45 78 63 65 70 74 69 6f 6e Data Ascii: t.hasOwnProperty("pagetype")>0?(t.pagetype=this.validatePageType(t.pagetype,this.validRetailPageTypeValues),t.hasOwnProperty("prodid")>0&&(t.prodid=this.validateProdId(t.prodid))):t.hasOwnProperty("prodid")>0&&this.throwError(this.missingPageTypeException
2024-10-02 10:16:51 UTC	8192	IN	Data Raw: 75 3c 3d 33 3f 74 5b 69 5d 3d 22 22 3a 64 65 6c 65 74 65 20 74 5b 69 5d 2c 72 3d 74 68 69 73 2e 73 74 72 69 6e 67 69 66 79 54 6f 52 65 71 75 65 73 74 28 74 29 2c 66 3d 74 68 69 73 2e 72 65 6d 6f 76 65 54 72 61 69 6c 69 6e 67 41 6d 70 28 65 2b 72 29 29 3b 74 68 69 73 2e 66 69 72 65 42 65 61 63 6f 6e 49 6d 67 28 66 29 3b 74 68 69 73 2e 73 6e 69 70 70 65 74 45 76 65 6e 74 51 75 65 75 65 2e 70 75 73 68 28 72 29 3b 74 68 69 73 2e 73 6e 69 70 70 65 74 45 76 65 6e 74 51 75 65 75 65 2e 6c 65 6e 67 74 68 3e 32 30 26 26 74 68 69 73 2e 73 6e 69 70 70 65 74 45 76 65 6e 74 51 75 65 75 65 2e 73 68 69 66 74 28 29 3b 74 72 79 7b 74 79 70 65 6f 66 20 43 75 73 74 6f 6d 45 76 65 6e 74 3d 3d 22 66 75 6e 63 74 69 6f 6e 22 26 26 28 73 3d 6e 65 77 20 43 75 73 74 6f 6d 45 76 65 Data Ascii: u<=3?t[i]="":delete t[i],r=this.stringifyToRequest(t),f=this.removeTrailingAmp(e+r));this.fireBeaconImg(f);this.snippetEventQueue.push(r);this.snippetEventQueue.length>20&&this.snippetEventQueue.shift();try{typeof CustomEvent=="function"&&(s=new CustomEve
2024-10-02 10:16:51 UTC	1747	IN	Data Raw: 28 21 74 68 69 73 2e 69 73 41 64 53 74 6f 72 61 67 65 41 6c 6c 6f 77 65 64 28 29 29 72 65 74 75 72 6e 20 6e 75 6c 6c 3b 76 61 72 20 69 3d 6e 3d 3d 3d 30 3f 74 68 69 73 2e 73 65 73 73 69 6f 6e 43 6f 6f 6b 69 65 4e 61 6d 65 3a 74 68 69 73 2e 75 65 74 43 6f 6e 66 69 67 2e 76 69 64 43 6f 6f 6b 69 65 2c 74 3d 74 68 69 73 2e 67 65 74 43 6f 6f 6b 69 65 28 69 2c 22 22 2c 74 68 69 73 2e 69 6e 73 69 67 68 74 73 43 6f 6f 6b 69 65 4d 61 78 4c 65 6e 67 74 68 29 3b 72 65 74 75 72 6e 20 74 68 69 73 2e 73 74 72 69 6e 67 45 78 69 73 74 73 28 74 29 7c 7c 28 74 3d 74 68 69 73 2e 67 65 74 4c 6f 63 61 6c 53 74 6f 72 61 67 65 42 61 63 6b 75 70 28 69 2c 74 68 69 73 2e 69 6e 73 69 67 68 74 73 43 6f 6f 6b 69 65 4d 61 78 4c 65 6e 67 74 68 29 29 2c 74 68 69 73 2e 69 6e 73 69 67 68 Data Ascii: (!this.isAdStorageAllowed())return null;var i=n===0?this.sessionCookieName:this.uetConfig.vidCookie,t=this.getCookie(i,"",this.insightsCookieMaxLength);return this.stringExists(t)\|\|(t=this.getLocalStorageBackup(i,this.insightsCookieMaxLength)),this.insigh

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
118	192.168.2.16	49880	13.107.246.40	443	4912	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-02 10:16:51 UTC	681	OUT	GET /shared/edgeweb/fonts/segoeui-vf-display-bold.3b9304c.woff2 HTTP/1.1 Host: edgestatic.azureedge.net Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" Origin: https://www.microsoft.com sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: font Referer: https://edgestatic.azureedge.net/shared/edgeweb/css/105d560.css Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-10-02 10:16:51 UTC	681	IN	HTTP/1.1 200 OK Date: Wed, 02 Oct 2024 10:16:51 GMT Content-Type: font/woff2 Content-Length: 125520 Connection: close Access-Control-Allow-Origin: * Cache-Control: public, max-age=31536000, immutable ETag: W/"1ea50-18c5bbcbff6" Last-Modified: Tue, 12 Dec 2023 01:55:45 GMT Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Origin-Agent-Cluster: ?1 X-Content-Type-Options: nosniff X-Download-Options: noopen X-Frame-Options: SAMEORIGIN X-Permitted-Cross-Domain-Policies: none X-XSS-Protection: 0 x-azure-ref: 20241002T101651Z-15767c5fc55rg5b7sh1vuv8t7n00000009t0000000003bu0 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-02 10:16:51 UTC	15703	IN	Data Raw: 77 4f 46 32 00 01 00 00 00 01 ea 50 00 12 00 00 00 05 36 78 00 01 e9 e3 00 02 05 1f 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 3f 46 46 54 4d 1c 1a 86 4a 1b 84 94 0a 1c 8a 58 06 60 00 98 7a 08 81 6a 09 9f 03 11 10 0a 8d 94 74 8b 89 66 0b cf 18 00 01 36 02 24 03 cf 10 04 20 05 97 26 07 81 ba 19 0c 84 48 5b 15 88 b4 0e fa 9f 8c dd fb d9 26 73 5b 9a 69 a8 46 8c c8 2a a2 d2 39 c4 64 51 6d 01 15 41 b7 7f a6 24 a2 94 b1 66 0f b1 89 1c 0f b5 f8 aa 87 59 d7 ce 70 07 bf 78 06 dd f6 81 9e 4b 56 20 e7 b6 6d 89 2a e1 2a 41 f6 ff ff ff ff ff ff ff ff ff ff ff b7 98 fc 88 de cd 37 b3 c9 cc ec ee dd e5 73 e1 b8 5c 02 24 48 20 21 24 20 20 86 af 02 82 52 14 b4 6a 3f da da da 2f 11 25 6a a2 3e 44 92 c4 54 33 34 9a f0 01 49 2b 69 4b 08 49 de 41 40 08 4a 96 Data Ascii: wOF2P6x?FFTMJX`zjtf6$ &H[&s[iF9dQmA$fYpxKV m*A7s\$H !$ Rj?/%j>DT34I+iKIA@J
2024-10-02 10:16:51 UTC	16384	IN	Data Raw: 85 3c 53 14 e5 7a 56 9c 49 79 36 a5 3f 06 88 11 8c 7a 66 3a 3d 3f 2c e9 c7 65 ef b7 a7 7a cf 5a ee 45 71 65 76 a3 71 47 b7 10 62 fe 76 61 91 ce e2 00 3e 65 90 26 c6 9e 37 be e1 fd d6 da 30 78 21 4a f6 7d 6a 2b 11 24 a0 d9 25 b2 9a 20 6f 95 8d 84 f4 7f f5 fd 78 4a 89 7c 09 75 d4 66 27 00 5c 02 60 22 5b 0d 8c 1c 46 61 33 25 cc b7 38 5a 98 eb 91 1a a2 51 d3 ea ba 46 6d 6c 26 f6 ae 09 3c 53 93 4b bf 0c d0 bc b0 3e 0a 56 2a 2b 2a 57 56 2d 55 f4 e9 cc b9 3b c1 07 d0 4e 13 1e 6a 91 57 11 da 34 6d ee 76 ff 23 77 73 ae 83 a8 48 59 b9 68 af 1b 07 59 89 13 21 ce 2e 99 20 0a f1 5c b5 af 6c a4 41 d0 de 0f 82 18 82 20 a6 84 23 9c 5c dc 3c d5 47 95 b9 a5 05 a1 63 41 8b 52 a9 54 4e 11 97 4c e9 9d 10 82 11 a5 ba 4e 4f 66 e3 05 ce 30 d3 5b 76 ff b6 d2 f7 88 ba 46 75 56 c7 Data Ascii: <SzVIy6?zf:=?,ezZEqevqGbva>e&70x!J}j+$% oxJ\|uf'\`"[Fa3%8ZQFml&<SK>V+WV-U;NjW4mv#wsHYhY!. \lA #\<GcARTNLNOf0[vFuV
2024-10-02 10:16:51 UTC	16384	IN	Data Raw: 8a 4f 15 d2 08 0a ab 9b 34 54 87 28 62 b6 8a 8e 12 f9 74 a5 e8 b4 20 b9 bc 61 33 86 01 8b f4 40 6b f5 72 16 fc f2 67 f7 8d ef 17 d7 9d 55 cd 3d 60 b6 56 60 00 2f 07 01 c8 a1 a5 66 22 ce e1 c2 6d 30 d7 53 c4 5a 61 3a 59 66 9c ae 6a 8d 49 16 32 74 ee 81 89 12 49 f4 65 cb 7a c2 cc 43 4f 45 4d 24 01 bc 7e 8b 55 f8 d7 4d 3c 66 11 85 2c db 64 81 14 d3 84 bb 4b 52 c9 fe 63 1d 41 56 e3 86 9a 32 ca c1 f0 cf 8d 15 7b 83 05 f4 0d 66 40 64 14 c7 db c5 74 0c 23 6a 6a 28 96 02 b0 5f 87 2b 1e b3 d8 b1 18 c4 0c 7b f3 06 1c 45 bd fe 0d 51 1a 11 31 73 a7 03 de 46 f8 2d d1 02 8d 5a f9 9c 2c 61 28 19 67 8d ca 19 58 0e 41 47 c3 6b 8e 60 60 7c 7b c4 39 a7 04 6b b1 80 3e 2e 73 1d 98 f6 fa b3 da bf 21 4c fd 11 f6 55 d5 3d 30 4c c2 d6 27 30 fe bc 17 f6 10 98 13 f9 ff e4 b6 80 60 Data Ascii: O4T(bt a3@krgU=`V`/f"m0SZa:YfjI2tIezCOEM$~UM<f,dKRcAV2{f@dt#jj(_+{EQ1sF-Z,a(gXAGk``\|{9k>.s!LU=0L'0`
2024-10-02 10:16:51 UTC	16384	IN	Data Raw: a0 51 c0 55 74 75 b8 c1 22 e2 e6 b8 17 77 40 d0 2a 0d 2f b7 4f ff ff be 7c 13 96 4b 35 d1 18 aa 46 49 22 69 21 e7 f8 ea db fc e1 43 b3 73 0c c0 42 b0 93 49 82 ba 44 f0 1c 71 5f c6 c0 31 cb 21 43 10 00 0d 91 8c 54 50 7b 89 53 81 d7 03 f8 6e 8b 9d cd 69 f7 d9 94 35 97 a4 5b 2f 55 fb d5 40 aa cd 2a 96 fe 52 55 c3 13 6e f6 cb d7 1c 0f 42 cd 52 90 d2 df 50 9c 89 17 b2 72 30 28 88 ee 22 51 a1 47 30 4a eb a1 dc 3a e5 9d dd a4 3c 0f 68 59 17 28 49 7d 75 6c b7 5f 87 74 ea 13 f9 94 ab c7 f0 f7 3e 22 a1 32 19 e3 3f f7 91 d3 33 a3 59 a6 ca ba bd ae 45 45 e7 a3 5d 07 6e 5b d3 2b 9a 00 aa 61 20 25 ed a8 5d af 9b 32 64 94 c8 4a 0e 19 6c 7b f7 fc 38 5a 54 eb 6c d5 6d 61 90 e5 13 f6 21 c4 f6 46 9a 8b 4e 93 8d 34 f7 22 12 93 fb a3 bd be 35 99 8a 4b 94 e9 d8 4f 9e ac 9e 0c Data Ascii: QUtu"w@/O\|K5FI"i!CsBIDq_1!CTP{Sni5[/U@RUnBRPr0("QG0J:<hY(I}ul_t>"2?3YEE]n[+a %]2dJl{8ZTlma!FN4"5KO
2024-10-02 10:16:51 UTC	16384	IN	Data Raw: 93 4a 25 11 28 e3 d2 d3 34 86 10 ad b7 a1 24 01 c6 78 8e a0 5d b4 78 91 6d 9f f3 d1 d3 fd 04 e5 3a db 81 38 04 ee 88 0a 5c 60 52 38 79 84 5f 00 40 cc 4b 4a 5c 77 96 45 d2 36 df ae 6e 31 6b bb 29 a3 57 d1 04 77 32 ab eb 9a 7f bd e3 3a 95 57 74 a7 2d e4 31 b2 15 ec 36 ea 83 c2 64 94 b8 f6 de f3 08 5f 81 dc 68 84 31 76 ed fb ba 52 a7 45 80 cb 27 76 42 85 3c c1 e7 72 73 b2 90 0d 64 be 4b 79 5c 74 44 64 10 45 c0 fc 83 3d 8a f3 44 31 3f 84 f7 6a bd 89 94 1d 7a e7 a1 f8 ef 2b c6 06 d4 db 27 8f bf 72 24 22 40 2e 43 83 71 c8 a8 47 05 70 b0 e3 b5 89 c5 49 71 ad 6e 04 f9 3d e3 b3 be 87 27 87 15 c5 92 39 04 ba 97 a0 d2 68 7f d3 c2 7f 7e a3 21 bc a7 80 1d ec 53 40 a8 70 bf 94 b4 3f 63 f1 a2 ba 4e d1 a6 52 77 fc f0 52 30 14 fd 09 70 9b 0b eb ab 7c ab e8 33 bd f9 af 45 Data Ascii: J%(4$x]xm:8\`R8y_@KJ\wE6n1k)Ww2:Wt-16d_h1vRE'vB<rsdKy\tDdE=D1?jz+'r$"@.CqGpIqn='9h~!S@p?cNRwR0p\|3E
2024-10-02 10:16:51 UTC	16384	IN	Data Raw: 58 00 b8 e8 db c0 43 52 90 af 5d f5 45 af 5d 53 67 54 60 f5 9b 09 bf a0 e4 86 41 b8 ce dc 80 90 d3 5d 14 11 49 04 3a 14 61 66 59 41 37 64 64 9e 3e 31 7c ce 17 5b 04 27 3e 87 68 86 d5 27 47 b2 81 f7 da 50 2c 30 55 c0 e3 b7 0b ed 86 a4 1d 19 b5 aa 0b 1b fa db ef 05 b0 6d 5d 29 a2 ee 3f d8 72 0c 06 85 22 e1 18 d3 53 08 63 9a 0f 09 64 ba 70 b3 20 c4 22 5c d3 be 66 b5 a8 e3 08 82 4b d2 f7 0f 39 54 74 e7 db 7b c0 49 e6 1f 47 f9 f9 cf 61 f5 2f 7f 37 93 a5 c5 fc e4 04 31 3b 99 5d dd fb e0 06 5d 57 25 36 ad bb 33 f8 e3 24 60 3f d4 0d 99 9b b7 ee 02 af 0b b8 e0 c2 c6 42 18 ae de 99 c3 b5 af d3 de af ad 4b 36 3a df c1 76 3f 5f 6b 7b 07 83 96 58 bf de e6 a9 ec 17 91 67 ba 3e f8 4c 32 79 bb 1b ce f8 0d 86 f2 33 f4 f4 c6 e6 6d 3d 1d 67 ec f7 5b eb e5 83 d7 e1 9f 89 43 Data Ascii: XCR]E]SgT`A]I:afYA7dd>1\|['>h'GP,0Um])?r"Scdp "\fK9Tt{IGa/71;]]W%63$`?BK6:v?_k{Xg>L2y3m=g[C
2024-10-02 10:16:51 UTC	16384	IN	Data Raw: 7d 25 92 92 24 bd b2 98 ea a4 dc 22 5b aa ae 00 24 e1 50 10 86 11 f4 58 72 de 8c a2 ae 6c e1 d8 28 1a 4d f4 81 48 22 48 46 f4 b6 cb 31 f2 56 7b 50 27 23 26 f0 ee 61 c4 f6 9c 4e f8 ee 09 d0 b3 d3 e6 ac e1 a2 89 83 ec 8b e8 23 c7 e3 ab da a0 4c 54 b6 f8 bd 40 dc af 96 9a 55 83 34 96 08 23 a3 63 ae 3b ca 60 66 35 97 f6 a4 19 e2 f8 c3 31 95 14 25 16 d3 4c 4a 6e 5e 12 d7 0d a4 57 14 6a 08 42 6c 7b 63 bc 84 65 76 93 ae 01 fb 98 ab 05 c5 63 c7 2b bf 07 af 88 73 97 d5 0c f5 a4 0e 78 be b2 43 2e bf 5b 0a 58 37 25 05 55 46 1a ae 6a 06 8e 83 a6 2a 85 96 e4 0c 73 e3 c4 b4 3d c5 73 41 e8 18 f9 2e 34 15 16 0b 46 84 26 eb b9 7a 95 af 2d 7f 27 70 05 2f 15 93 41 48 22 08 76 ed 4c 0b 0f d6 45 a9 30 72 c9 9c 9d 22 6b 49 5a 51 29 70 8b fb e1 09 e2 c3 2c 12 69 c5 64 1b 83 32 Data Ascii: }%$"[$PXrl(MH"HF1V{P'#&aN#LT@U4#c;`f51%LJn^WjBl{cevc+sxC.[X7%UFj*s=sA.4F&z-'p/AH"vLE0r"kIZQ)p,id2
2024-10-02 10:16:51 UTC	11513	IN	Data Raw: 2f ff 42 ee 34 7d 4b 7f fe 23 dc bf df 3a 70 21 3e 5f f6 d2 c1 21 6c ed 79 94 3f 9d fe 6d 75 c4 fe 61 86 cf 45 70 fa f1 29 80 83 4b aa b9 41 36 da c6 00 59 a5 a4 bc ae 5c ef 51 42 3c 36 4b 7e e4 35 1a 5f 36 31 bf bd f1 70 90 7f f9 d8 4f df 6b 2e eb d3 af e8 e0 2d 97 ea dd 67 9c 5e c5 4e 27 03 ec d1 9b 22 85 bd 23 97 f9 58 e1 1a 4d 44 f3 8a e0 b7 05 5e b5 98 5f d0 29 17 5e 02 5b 84 01 80 ce da 55 5b b2 a6 09 bd bf 86 97 56 37 1a 32 0d b8 03 61 90 26 82 e1 8a d3 fe c2 35 bf bc c0 70 64 38 1e f7 c4 2a ed 90 7a eb e5 e5 d6 b1 4b dc 96 e5 f3 41 d7 52 e7 9f 5e 6c 3c bf bc 78 1e ea 09 33 66 ca 8d d6 b2 41 62 30 60 df 88 11 1d d9 74 52 7d 42 96 57 11 0d 0f 39 f9 a6 3c 84 37 ee 3d 56 5e 53 7f 04 ea 35 da 88 6c e0 35 a3 dc 05 49 16 47 35 45 1c fc b0 d1 5f 87 d8 76 Data Ascii: /B4}K#:p!>_!ly?muaEp)KA6Y\QB<6K~5_61pOk.-g^N'"#XMD^_)^[U[V72a&5pd8*zKAR^l<x3fAb0`tR}BW9<7=V^S5l5IG5E_v

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
119	192.168.2.16	49881	13.107.246.40	443	4912	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-02 10:16:51 UTC	657	OUT	GET /assets/js/product-collection-86c4abf3.js HTTP/1.1 Host: apps.microsoft.com Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" Origin: https://apps.microsoft.com sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: same-origin Sec-Fetch-Mode: cors Sec-Fetch-Dest: script Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8 Cookie: MSCC=NR; exp-session-id=b6d0ece2-29a7-4143-931c-d621648d7cb8
2024-10-02 10:16:51 UTC	1307	IN	HTTP/1.1 200 OK Date: Wed, 02 Oct 2024 10:16:51 GMT Content-Type: text/javascript Content-Length: 106710 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public,max-age=31536000,immutable ETag: "1db136ef6791ed6" Last-Modified: Mon, 30 Sep 2024 19:28:44 GMT Strict-Transport-Security: max-age=2592000 Request-Context: appId=cid-v1:04e455f9-321c-49bf-8d2c-d79fbf5e8cde MS-CV: 6pG9BDq4jEyd6Fjt.0 X-Content-Type-Options: nosniff Permissions-Policy: unload=() Content-Security-Policy: default-src 'self' data: https://.clarity.ms https://c.bing.com;script-src 'self' wcpstatic.microsoft.com js.monitor.azure.com www.microsoft.com www.clarity.ms get.microsoft.com xvsec.video.microsoft.com bat.bing.com 'unsafe-inline';style-src 'unsafe-inline';connect-src * data: ms-windows-store:;font-src ;img-src data: blob:;media-src 'self' blob: https://sfds-production.azurefd.net https://canvasstorageprodtorus.blob.core.windows.net;frame-src * ms-windows-store:;report-uri https://csp.microsoft.com/report/app-store-web-prod X-Powered-By: ASP.NET x-azure-ref: 20241002T101651Z-15767c5fc55rg5b7sh1vuv8t7n00000009ug000000000akx x-fd-int-roxy-purgeid: 66820190 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-02 10:16:51 UTC	15077	IN	Data Raw: 69 6d 70 6f 72 74 7b 69 20 61 73 20 24 2c 73 20 61 73 20 65 74 2c 5f 20 61 73 20 6c 2c 68 20 61 73 20 70 2c 74 20 61 73 20 79 2c 61 20 61 73 20 6e 74 2c 78 20 61 73 20 61 2c 6c 20 61 73 20 77 2c 4f 20 61 73 20 62 2c 54 20 61 73 20 6d 2c 49 20 61 73 20 64 74 2c 62 62 20 61 73 20 45 2c 62 63 20 61 73 20 63 74 2c 62 64 20 61 73 20 66 74 2c 62 65 20 61 73 20 70 74 2c 61 38 20 61 73 20 4b 2c 72 20 61 73 20 7a 2c 61 66 20 61 73 20 62 74 2c 42 20 61 73 20 75 2c 61 35 20 61 73 20 72 74 2c 6d 20 61 73 20 63 2c 45 20 61 73 20 66 2c 77 20 61 73 20 78 74 2c 57 20 61 73 20 75 74 2c 48 20 61 73 20 68 74 2c 64 20 61 73 20 43 2c 79 20 61 73 20 77 74 2c 61 36 20 61 73 20 67 74 2c 65 20 61 73 20 24 74 2c 62 20 61 73 20 61 74 2c 6e 20 61 73 20 76 2c 66 20 61 73 20 54 2c 46 Data Ascii: import{i as $,s as et,_ as l,h as p,t as y,a as nt,x as a,l as w,O as b,T as m,I as dt,bb as E,bc as ct,bd as ft,be as pt,a8 as K,r as z,af as bt,B as u,a5 as rt,m as c,E as f,w as xt,W as ut,H as ht,d as C,y as wt,a6 as gt,e as $t,b as at,n as v,f as T,F
2024-10-02 10:16:51 UTC	16384	IN	Data Raw: 61 63 65 3a 20 6e 6f 77 72 61 70 3b 0a 20 20 20 20 20 20 20 20 64 69 73 70 6c 61 79 3a 20 69 6e 6c 69 6e 65 2d 62 6c 6f 63 6b 3b 0a 20 20 20 20 20 20 20 20 74 65 78 74 2d 6f 76 65 72 66 6c 6f 77 3a 20 65 6c 6c 69 70 73 69 73 3b 0a 20 20 20 20 20 20 20 20 64 69 73 70 6c 61 79 3a 20 2d 77 65 62 6b 69 74 2d 62 6f 78 3b 0a 20 20 20 20 20 20 20 20 2d 77 65 62 6b 69 74 2d 6c 69 6e 65 2d 63 6c 61 6d 70 3a 20 34 3b 0a 20 20 20 20 20 20 20 20 6c 69 6e 65 2d 63 6c 61 6d 70 3a 20 34 3b 0a 20 20 20 20 20 20 20 20 6f 76 65 72 66 6c 6f 77 3a 20 68 69 64 64 65 6e 3b 0a 20 20 20 20 20 20 20 20 2d 77 65 62 6b 69 74 2d 62 6f 78 2d 6f 72 69 65 6e 74 3a 20 76 65 72 74 69 63 61 6c 3b 0a 20 20 20 20 20 20 20 20 77 68 69 74 65 2d 73 70 61 63 65 3a 20 6e 6f 72 6d 61 6c 3b 0a 20 Data Ascii: ace: nowrap; display: inline-block; text-overflow: ellipsis; display: -webkit-box; -webkit-line-clamp: 4; line-clamp: 4; overflow: hidden; -webkit-box-orient: vertical; white-space: normal;
2024-10-02 10:16:51 UTC	16384	IN	Data Raw: 6d 61 6c 6c 29 3b 0a 20 20 20 20 7d 0a 0a 20 20 20 20 2e 62 6f 74 74 6f 6d 2d 61 6c 69 67 6e 20 7b 0a 20 20 20 20 20 20 20 20 70 6f 73 69 74 69 6f 6e 3a 20 72 65 6c 61 74 69 76 65 3b 0a 20 20 20 20 20 20 20 20 62 6f 74 74 6f 6d 3a 20 76 61 72 28 2d 2d 73 6c 2d 73 70 61 63 69 6e 67 2d 73 6d 61 6c 6c 29 3b 0a 20 20 20 20 7d 0a 0a 20 20 20 20 40 6d 65 64 69 61 20 28 70 72 65 66 65 72 73 2d 63 6f 6c 6f 72 2d 73 63 68 65 6d 65 3a 20 64 61 72 6b 29 20 7b 0a 20 20 20 20 20 20 20 20 2e 6e 75 6d 62 65 72 2d 6f 76 65 72 6c 61 79 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 63 6f 6c 6f 72 3a 20 23 33 33 37 39 44 39 42 32 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 6d 69 78 2d 62 6c 65 6e 64 2d 6d 6f 64 65 3a 20 6c 69 67 68 74 65 6e 3b 0a 20 20 20 20 20 20 20 20 20 20 Data Ascii: mall); } .bottom-align { position: relative; bottom: var(--sl-spacing-small); } @media (prefers-color-scheme: dark) { .number-overlay { color: #3379D9B2; mix-blend-mode: lighten;
2024-10-02 10:16:51 UTC	16384	IN	Data Raw: 20 7d 0a 0a 20 20 20 20 24 7b 63 28 75 2e 78 73 29 7d 20 7b 0a 20 20 20 20 20 20 20 20 2e 70 72 6f 64 75 63 74 2d 73 71 75 61 72 65 2d 64 65 74 61 69 6c 73 20 2e 73 68 6f 72 74 2d 64 65 73 63 72 69 70 74 69 6f 6e 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 68 65 69 67 68 74 3a 20 33 30 70 78 3b 0a 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 7d 0a 60 3b 76 61 72 20 58 74 3d 4f 62 6a 65 63 74 2e 67 65 74 50 72 6f 74 6f 74 79 70 65 4f 66 2c 5a 74 3d 52 65 66 6c 65 63 74 2e 67 65 74 2c 4a 74 3d 28 74 2c 65 2c 72 29 3d 3e 5a 74 28 58 74 28 74 29 2c 72 2c 65 29 2c 71 3b 6c 65 74 20 5a 3d 28 71 3d 63 6c 61 73 73 20 65 78 74 65 6e 64 73 20 62 7b 72 65 6e 64 65 72 28 29 7b 69 66 28 21 74 68 69 73 2e 70 72 6f 64 75 63 74 29 72 65 74 75 72 6e 20 61 60 60 3b 63 6f 6e Data Ascii: } ${c(u.xs)} { .product-square-details .short-description { height: 30px; } }`;var Xt=Object.getPrototypeOf,Zt=Reflect.get,Jt=(t,e,r)=>Zt(Xt(t),r,e),q;let Z=(q=class extends b{render(){if(!this.product)return a``;con
2024-10-02 10:16:51 UTC	16384	IN	Data Raw: 0a 20 20 20 20 7d 0a 0a 20 20 20 20 2e 63 6f 6c 6c 65 63 74 69 6f 6e 2d 69 6e 66 6f 20 7b 0a 20 20 20 20 20 20 20 20 64 69 73 70 6c 61 79 3a 20 66 6c 65 78 3b 0a 20 20 20 20 20 20 20 20 6a 75 73 74 69 66 79 2d 63 6f 6e 74 65 6e 74 3a 20 73 70 61 63 65 2d 62 65 74 77 65 65 6e 3b 0a 20 20 20 20 20 20 20 20 61 6c 69 67 6e 2d 69 74 65 6d 73 3a 20 63 65 6e 74 65 72 3b 0a 20 20 20 20 7d 0a 0a 20 20 20 20 2e 63 6f 6c 6c 65 63 74 69 6f 6e 2d 74 69 74 6c 65 2c 20 61 2e 63 6f 6c 6c 65 63 74 69 6f 6e 2d 74 69 74 6c 65 20 68 31 2c 20 61 2e 63 6f 6c 6c 65 63 74 69 6f 6e 2d 74 69 74 6c 65 20 68 32 20 7b 0a 20 20 20 20 20 20 20 20 66 6f 6e 74 2d 77 65 69 67 68 74 3a 20 76 61 72 28 2d 2d 73 6c 2d 74 69 74 6c 65 2d 66 6f 6e 74 2d 77 65 69 67 68 74 29 3b 0a 20 20 20 20 20 Data Ascii: } .collection-info { display: flex; justify-content: space-between; align-items: center; } .collection-title, a.collection-title h1, a.collection-title h2 { font-weight: var(--sl-title-font-weight);
2024-10-02 10:16:51 UTC	16384	IN	Data Raw: 7d 0a 20 20 20 20 7d 0a 0a 20 20 20 20 24 7b 63 28 75 2e 73 6d 2d 31 35 30 29 7d 20 7b 0a 20 20 20 20 20 20 20 20 2e 67 72 69 64 2d 63 6f 6e 74 61 69 6e 65 72 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 67 72 69 64 2d 74 65 6d 70 6c 61 74 65 2d 63 6f 6c 75 6d 6e 73 3a 20 72 65 70 65 61 74 28 31 2c 20 31 66 72 29 3b 0a 20 20 20 20 20 20 20 20 7d 0a 0a 20 20 20 20 20 20 20 20 2e 67 72 69 64 2d 69 74 65 6d 2c 20 2e 74 72 65 6e 64 69 6e 67 20 2e 70 72 6f 64 75 63 74 2d 73 6b 65 6c 65 74 6f 6e 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 77 69 64 74 68 3a 20 33 38 30 70 78 3b 0a 20 20 20 20 20 20 20 20 7d 0a 0a 20 20 20 20 20 20 20 20 2e 74 72 65 6e 64 69 6e 67 2d 63 61 72 64 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 64 69 73 70 6c 61 79 3a 20 66 6c 65 78 Data Ascii: } } ${c(u.sm-150)} { .grid-container { grid-template-columns: repeat(1, 1fr); } .grid-item, .trending .product-skeleton { width: 380px; } .trending-card { display: flex
2024-10-02 10:16:51 UTC	9713	IN	Data Raw: 6c 65 6d 65 74 72 79 2d 64 61 74 61 3d 27 7b 20 22 69 74 65 6d 49 64 22 3a 20 22 24 7b 74 2e 70 72 6f 64 75 63 74 49 64 7d 22 2c 20 22 69 74 65 6d 4e 61 6d 65 22 3a 20 22 24 7b 74 2e 74 69 74 6c 65 7d 22 2c 20 22 69 74 65 6d 54 79 70 65 22 3a 20 22 24 7b 74 2e 70 72 6f 64 75 63 74 46 61 6d 69 6c 79 4e 61 6d 65 7d 22 2c 20 22 63 61 72 64 54 79 70 65 22 3a 20 22 73 71 75 61 72 65 22 2c 20 22 73 6c 6f 74 22 3a 20 24 7b 65 2b 31 7d 2c 20 22 72 65 64 69 72 65 63 74 22 3a 20 24 7b 21 21 74 2e 72 65 64 69 72 65 63 74 55 72 6c 7d 2c 20 22 74 79 70 65 22 3a 20 22 70 72 6f 64 75 63 74 22 7d 27 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 40 66 6f 63 75 73 3d 22 24 7b 28 29 3d 3e 74 68 69 73 2e 66 6f 63 75 73 65 64 50 72 6f 64 75 63 74 3d 74 7d 22 0a 20 20 20 Data Ascii: lemetry-data='{ "itemId": "${t.productId}", "itemName": "${t.title}", "itemType": "${t.productFamilyName}", "cardType": "square", "slot": ${e+1}, "redirect": ${!!t.redirectUrl}, "type": "product"}' @focus="${()=>this.focusedProduct=t}"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
120	192.168.2.16	49882	13.107.246.40	443	4912	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-02 10:16:51 UTC	646	OUT	GET /assets/js/nav-bar-ed71552c.js HTTP/1.1 Host: apps.microsoft.com Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" Origin: https://apps.microsoft.com sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: same-origin Sec-Fetch-Mode: cors Sec-Fetch-Dest: script Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8 Cookie: MSCC=NR; exp-session-id=b6d0ece2-29a7-4143-931c-d621648d7cb8
2024-10-02 10:16:51 UTC	1306	IN	HTTP/1.1 200 OK Date: Wed, 02 Oct 2024 10:16:51 GMT Content-Type: text/javascript Content-Length: 20617 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public,max-age=31536000,immutable ETag: "1db136ef678ee89" Last-Modified: Mon, 30 Sep 2024 19:28:44 GMT Strict-Transport-Security: max-age=2592000 Request-Context: appId=cid-v1:04e455f9-321c-49bf-8d2c-d79fbf5e8cde MS-CV: XxGvI4sU80etSvn7.0 X-Content-Type-Options: nosniff Permissions-Policy: unload=() Content-Security-Policy: default-src 'self' data: https://.clarity.ms https://c.bing.com;script-src 'self' wcpstatic.microsoft.com js.monitor.azure.com www.microsoft.com www.clarity.ms get.microsoft.com xvsec.video.microsoft.com bat.bing.com 'unsafe-inline';style-src 'unsafe-inline';connect-src * data: ms-windows-store:;font-src ;img-src data: blob:;media-src 'self' blob: https://sfds-production.azurefd.net https://canvasstorageprodtorus.blob.core.windows.net;frame-src * ms-windows-store:;report-uri https://csp.microsoft.com/report/app-store-web-prod X-Powered-By: ASP.NET x-azure-ref: 20241002T101651Z-15767c5fc552g4w83buhsr3htc000000099000000000dv25 x-fd-int-roxy-purgeid: 66820190 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-02 10:16:51 UTC	15078	IN	Data Raw: 69 6d 70 6f 72 74 7b 69 20 61 73 20 66 2c 6d 20 61 73 20 64 2c 42 20 61 73 20 63 2c 73 20 61 73 20 77 2c 5f 20 61 73 20 73 2c 72 20 61 73 20 68 2c 57 20 61 73 20 62 2c 74 20 61 73 20 78 2c 61 20 61 73 20 79 2c 4c 20 61 73 20 24 2c 4b 20 61 73 20 6b 2c 6a 20 61 73 20 53 2c 77 20 61 73 20 6c 2c 62 20 61 73 20 6d 2c 78 20 61 73 20 61 2c 66 20 61 73 20 4c 2c 54 20 61 73 20 42 2c 6c 20 61 73 20 72 2c 45 20 61 73 20 54 2c 71 20 61 73 20 4d 2c 67 20 61 73 20 4e 2c 62 36 20 61 73 20 45 2c 6b 20 61 73 20 7a 7d 66 72 6f 6d 22 2e 2f 69 6e 64 65 78 2d 33 36 64 33 30 38 38 37 2e 6a 73 22 3b 69 6d 70 6f 72 74 22 2e 2f 61 75 74 6f 2d 63 6f 6d 70 6c 65 74 65 2d 61 70 70 2d 73 65 61 72 63 68 2d 63 38 65 64 35 38 62 30 2e 6a 73 22 3b 63 6f 6e 73 74 20 52 3d 66 60 0a 20 20 Data Ascii: import{i as f,m as d,B as c,s as w,_ as s,r as h,W as b,t as x,a as y,L as $,K as k,j as S,w as l,b as m,x as a,f as L,T as B,l as r,E as T,q as M,g as N,b6 as E,k as z}from"./index-36d30887.js";import"./auto-complete-app-search-c8ed58b0.js";const R=f`
2024-10-02 10:16:51 UTC	5539	IN	Data Raw: 2f 64 69 76 3e 0a 20 20 20 20 20 20 20 20 60 7d 72 65 6e 64 65 72 4d 73 66 74 4c 6f 67 6f 28 29 7b 72 65 74 75 72 6e 20 61 60 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 61 20 68 72 65 66 3d 22 24 7b 74 68 69 73 2e 6d 73 66 74 55 72 6c 7d 22 20 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 74 61 72 67 65 74 3d 22 5f 62 6c 61 6e 6b 22 20 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 72 65 6c 3d 22 6e 6f 6f 70 65 6e 65 72 20 6e 6f 72 65 66 65 72 72 65 72 22 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 74 61 62 69 6e 64 65 78 3d 22 30 22 20 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 61 72 69 61 2d 6c 61 62 65 6c 3d 22 24 7b 72 2e 67 65 74 28 22 4e 61 76 69 67 61 74 69 6f 6e 42 61 72 2e 55 6e 69 76 65 72 73 61 6c 4d 69 63 72 6f 73 6f 66 Data Ascii: /div> `}renderMsftLogo(){return a` <a href="${this.msftUrl}" target="_blank" rel="noopener noreferrer" tabindex="0" aria-label="${r.get("NavigationBar.UniversalMicrosof

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
121	192.168.2.16	49883	13.107.246.40	443	4912	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-02 10:16:51 UTC	630	OUT	GET /s/0.7.47/clarity.js HTTP/1.1 Host: www.clarity.ms Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://www.microsoft.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8 Cookie: CLID=c6083d87285244068a54b7c1410cd9fd.20241002.20251002
2024-10-02 10:16:51 UTC	619	IN	HTTP/1.1 200 OK Date: Wed, 02 Oct 2024 10:16:51 GMT Content-Type: application/javascript;charset=utf-8 Content-Length: 65577 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Last-Modified: Sun, 29 Sep 2024 18:50:31 GMT ETag: "0x8DCE0B797FA7824" x-ms-request-id: 2e46d669-c01e-002b-45b3-12ae17000000 x-ms-version: 2018-03-28 Access-Control-Allow-Origin: * x-azure-ref: 20241002T101651Z-15767c5fc554w2fgapsyvy8ua000000008u000000000bt23 Cache-Control: public, max-age=86400 x-fd-int-roxy-purgeid: 51562430 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-02 10:16:51 UTC	15765	IN	Data Raw: 2f 2a 20 63 6c 61 72 69 74 79 2d 6a 73 20 76 30 2e 37 2e 34 37 3a 20 68 74 74 70 73 3a 2f 2f 67 69 74 68 75 62 2e 63 6f 6d 2f 6d 69 63 72 6f 73 6f 66 74 2f 63 6c 61 72 69 74 79 20 28 4c 69 63 65 6e 73 65 3a 20 4d 49 54 29 20 2a 2f 0d 0a 21 66 75 6e 63 74 69 6f 6e 28 29 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 76 61 72 20 74 3d 4f 62 6a 65 63 74 2e 66 72 65 65 7a 65 28 7b 5f 5f 70 72 6f 74 6f 5f 5f 3a 6e 75 6c 6c 2c 67 65 74 20 71 75 65 75 65 28 29 7b 72 65 74 75 72 6e 20 73 72 7d 2c 67 65 74 20 73 74 61 72 74 28 29 7b 72 65 74 75 72 6e 20 63 72 7d 2c 67 65 74 20 73 74 6f 70 28 29 7b 72 65 74 75 72 6e 20 6c 72 7d 2c 67 65 74 20 74 72 61 63 6b 28 29 7b 72 65 74 75 72 6e 20 61 72 7d 7d 29 2c 65 3d 4f 62 6a 65 63 74 2e 66 72 65 65 7a 65 28 7b 5f 5f 70 72 6f Data Ascii: /* clarity-js v0.7.47: https://github.com/microsoft/clarity (License: MIT) */!function(){"use strict";var t=Object.freeze({__proto__:null,get queue(){return sr},get start(){return cr},get stop(){return lr},get track(){return ar}}),e=Object.freeze({__pro
2024-10-02 10:16:51 UTC	16384	IN	Data Raw: 76 69 6f 75 73 3a 63 2c 63 68 69 6c 64 72 65 6e 3a 5b 5d 2c 64 61 74 61 3a 6e 2c 73 65 6c 65 63 74 6f 72 3a 6e 75 6c 6c 2c 68 61 73 68 3a 6e 75 6c 6c 2c 72 65 67 69 6f 6e 3a 6c 2c 6d 65 74 61 64 61 74 61 3a 7b 61 63 74 69 76 65 3a 21 30 2c 73 75 73 70 65 6e 64 3a 21 31 2c 70 72 69 76 61 63 79 3a 66 2c 70 6f 73 69 74 69 6f 6e 3a 6e 75 6c 6c 2c 66 72 61 75 64 3a 64 2c 73 69 7a 65 3a 6e 75 6c 6c 7d 7d 2c 66 75 6e 63 74 69 6f 6e 28 74 2c 65 2c 6e 29 7b 76 61 72 20 61 3d 65 2e 64 61 74 61 2c 72 3d 65 2e 6d 65 74 61 64 61 74 61 2c 69 3d 72 2e 70 72 69 76 61 63 79 2c 6f 3d 61 2e 61 74 74 72 69 62 75 74 65 73 7c 7c 7b 7d 2c 75 3d 61 2e 74 61 67 2e 74 6f 55 70 70 65 72 43 61 73 65 28 29 3b 73 77 69 74 63 68 28 21 30 29 7b 63 61 73 65 20 50 74 2e 69 6e 64 65 78 4f Data Ascii: vious:c,children:[],data:n,selector:null,hash:null,region:l,metadata:{active:!0,suspend:!1,privacy:f,position:null,fraud:d,size:null}},function(t,e,n){var a=e.data,r=e.metadata,i=r.privacy,o=a.attributes\|\|{},u=a.tag.toUpperCase();switch(!0){case Pt.indexO
2024-10-02 10:16:51 UTC	16384	IN	Data Raw: 72 72 65 6e 63 79 29 2c 47 72 28 31 32 2c 74 2e 73 6b 75 29 2c 57 28 31 33 2c 5a 6e 28 74 2e 70 72 69 63 65 29 29 3b 62 72 65 61 6b 3b 63 61 73 65 22 62 72 61 6e 64 22 3a 47 72 28 36 2c 74 2e 6e 61 6d 65 29 7d 6e 75 6c 6c 21 3d 3d 72 26 26 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 72 26 26 4b 6e 28 72 29 7d 7d 66 75 6e 63 74 69 6f 6e 20 5a 6e 28 74 2c 65 29 7b 69 66 28 76 6f 69 64 20 30 3d 3d 3d 65 26 26 28 65 3d 31 29 2c 6e 75 6c 6c 21 3d 3d 74 29 73 77 69 74 63 68 28 74 79 70 65 6f 66 20 74 29 7b 63 61 73 65 22 6e 75 6d 62 65 72 22 3a 72 65 74 75 72 6e 20 4d 61 74 68 2e 72 6f 75 6e 64 28 74 2a 65 29 3b 63 61 73 65 22 73 74 72 69 6e 67 22 3a 72 65 74 75 72 6e 20 4d 61 74 68 2e 72 6f 75 6e 64 28 70 61 72 73 65 46 6c 6f 61 74 28 74 2e 72 65 70 6c Data Ascii: rrency),Gr(12,t.sku),W(13,Zn(t.price));break;case"brand":Gr(6,t.name)}null!==r&&"object"==typeof r&&Kn(r)}}function Zn(t,e){if(void 0===e&&(e=1),null!==t)switch(typeof t){case"number":return Math.round(t*e);case"string":return Math.round(parseFloat(t.repl
2024-10-02 10:16:51 UTC	16384	IN	Data Raw: 66 75 6e 63 74 69 6f 6e 20 6b 72 28 74 2c 65 2c 6e 2c 61 2c 72 29 7b 76 6f 69 64 20 30 3d 3d 3d 6e 26 26 28 6e 3d 6e 75 6c 6c 29 2c 76 6f 69 64 20 30 3d 3d 3d 61 26 26 28 61 3d 6e 75 6c 6c 29 2c 76 6f 69 64 20 30 3d 3d 3d 72 26 26 28 72 3d 6e 75 6c 6c 29 3b 76 61 72 20 69 3d 6e 3f 22 22 2e 63 6f 6e 63 61 74 28 6e 2c 22 7c 22 29 2e 63 6f 6e 63 61 74 28 61 29 3a 22 22 3b 74 20 69 6e 20 77 72 26 26 77 72 5b 74 5d 2e 69 6e 64 65 78 4f 66 28 69 29 3e 3d 30 7c 7c 28 62 72 3d 7b 63 6f 64 65 3a 74 2c 6e 61 6d 65 3a 6e 2c 6d 65 73 73 61 67 65 3a 61 2c 73 74 61 63 6b 3a 72 2c 73 65 76 65 72 69 74 79 3a 65 7d 2c 74 20 69 6e 20 77 72 3f 77 72 5b 74 5d 2e 70 75 73 68 28 69 29 3a 77 72 5b 74 5d 3d 5b 69 5d 2c 79 72 28 33 33 29 29 7d 76 61 72 20 53 72 2c 45 72 3d 7b 7d Data Ascii: function kr(t,e,n,a,r){void 0===n&&(n=null),void 0===a&&(a=null),void 0===r&&(r=null);var i=n?"".concat(n,"\|").concat(a):"";t in wr&&wr[t].indexOf(i)>=0\|\|(br={code:t,name:n,message:a,stack:r,severity:e},t in wr?wr[t].push(i):wr[t]=[i],yr(33))}var Sr,Er={}
2024-10-02 10:16:51 UTC	660	IN	Data Raw: 5f 5f 70 72 6f 74 6f 5f 5f 3a 6e 75 6c 6c 2c 63 6f 6e 73 65 6e 74 3a 6f 69 2c 65 76 65 6e 74 3a 41 2c 68 61 73 68 54 65 78 74 3a 24 74 2c 69 64 65 6e 74 69 66 79 3a 75 74 2c 6d 65 74 61 64 61 74 61 3a 72 69 2c 70 61 75 73 65 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 50 69 28 29 26 26 28 41 28 22 63 6c 61 72 69 74 79 22 2c 22 70 61 75 73 65 22 29 2c 6e 75 6c 6c 3d 3d 3d 68 65 26 26 28 68 65 3d 6e 65 77 20 50 72 6f 6d 69 73 65 28 28 66 75 6e 63 74 69 6f 6e 28 74 29 7b 70 65 3d 74 7d 29 29 29 29 7d 2c 72 65 73 75 6d 65 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 50 69 28 29 26 26 28 68 65 26 26 28 70 65 28 29 2c 68 65 3d 6e 75 6c 6c 2c 6e 75 6c 6c 3d 3d 3d 66 65 26 26 6d 65 28 29 29 2c 41 28 22 63 6c 61 72 69 74 79 22 2c 22 72 65 73 75 6d 65 22 29 29 7d 2c 73 65 74 3a 6f Data Ascii: __proto__:null,consent:oi,event:A,hashText:$t,identify:ut,metadata:ri,pause:function(){Pi()&&(A("clarity","pause"),null===he&&(he=new Promise((function(t){pe=t}))))},resume:function(){Pi()&&(he&&(pe(),he=null,null===fe&&me()),A("clarity","resume"))},set:o

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
122	192.168.2.16	49885	13.107.246.40	443	4912	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-02 10:16:51 UTC	640	OUT	GET /s/0.7.47/clarity-extended.js HTTP/1.1 Host: www.clarity.ms Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://apps.microsoft.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8 Cookie: CLID=c6083d87285244068a54b7c1410cd9fd.20241002.20251002
2024-10-02 10:16:51 UTC	640	IN	HTTP/1.1 200 OK Date: Wed, 02 Oct 2024 10:16:51 GMT Content-Type: application/javascript;charset=utf-8 Content-Length: 65497 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Last-Modified: Sun, 29 Sep 2024 18:50:24 GMT ETag: "0x8DCE0B793C701E1" x-ms-request-id: 1c763792-f01e-0052-029b-135233000000 x-ms-version: 2018-03-28 Access-Control-Allow-Origin: * x-azure-ref: 20241002T101651Z-15767c5fc55ncqdn59ub6rndq0000000093g000000004bx9 Cache-Control: public, max-age=86400 x-fd-int-roxy-purgeid: 51562430 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-02 10:16:51 UTC	15744	IN	Data Raw: 21 66 75 6e 63 74 69 6f 6e 28 29 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 76 61 72 20 74 3d 4f 62 6a 65 63 74 2e 66 72 65 65 7a 65 28 7b 5f 5f 70 72 6f 74 6f 5f 5f 3a 6e 75 6c 6c 2c 67 65 74 20 71 75 65 75 65 28 29 7b 72 65 74 75 72 6e 20 73 72 7d 2c 67 65 74 20 73 74 61 72 74 28 29 7b 72 65 74 75 72 6e 20 63 72 7d 2c 67 65 74 20 73 74 6f 70 28 29 7b 72 65 74 75 72 6e 20 6c 72 7d 2c 67 65 74 20 74 72 61 63 6b 28 29 7b 72 65 74 75 72 6e 20 61 72 7d 7d 29 2c 65 3d 4f 62 6a 65 63 74 2e 66 72 65 65 7a 65 28 7b 5f 5f 70 72 6f 74 6f 5f 5f 3a 6e 75 6c 6c 2c 67 65 74 20 63 6c 6f 6e 65 28 29 7b 72 65 74 75 72 6e 20 43 72 7d 2c 67 65 74 20 63 6f 6d 70 75 74 65 28 29 7b 72 65 74 75 72 6e 20 44 72 7d 2c 67 65 74 20 64 61 74 61 28 29 7b 72 65 74 75 72 6e 20 45 72 7d Data Ascii: !function(){"use strict";var t=Object.freeze({__proto__:null,get queue(){return sr},get start(){return cr},get stop(){return lr},get track(){return ar}}),e=Object.freeze({__proto__:null,get clone(){return Cr},get compute(){return Dr},get data(){return Er}
2024-10-02 10:16:51 UTC	16384	IN	Data Raw: 6c 2c 6d 65 74 61 64 61 74 61 3a 7b 61 63 74 69 76 65 3a 21 30 2c 73 75 73 70 65 6e 64 3a 21 31 2c 70 72 69 76 61 63 79 3a 66 2c 70 6f 73 69 74 69 6f 6e 3a 6e 75 6c 6c 2c 66 72 61 75 64 3a 64 2c 73 69 7a 65 3a 6e 75 6c 6c 7d 7d 2c 66 75 6e 63 74 69 6f 6e 28 74 2c 65 2c 6e 29 7b 76 61 72 20 61 3d 65 2e 64 61 74 61 2c 72 3d 65 2e 6d 65 74 61 64 61 74 61 2c 69 3d 72 2e 70 72 69 76 61 63 79 2c 6f 3d 61 2e 61 74 74 72 69 62 75 74 65 73 7c 7c 7b 7d 2c 75 3d 61 2e 74 61 67 2e 74 6f 55 70 70 65 72 43 61 73 65 28 29 3b 73 77 69 74 63 68 28 21 30 29 7b 63 61 73 65 20 50 74 2e 69 6e 64 65 78 4f 66 28 75 29 3e 3d 30 3a 76 61 72 20 63 3d 6f 2e 74 79 70 65 2c 73 3d 22 22 2c 6c 3d 5b 22 63 6c 61 73 73 22 2c 22 73 74 79 6c 65 22 5d 3b 4f 62 6a 65 63 74 2e 6b 65 79 73 28 Data Ascii: l,metadata:{active:!0,suspend:!1,privacy:f,position:null,fraud:d,size:null}},function(t,e,n){var a=e.data,r=e.metadata,i=r.privacy,o=a.attributes\|\|{},u=a.tag.toUpperCase();switch(!0){case Pt.indexOf(u)>=0:var c=o.type,s="",l=["class","style"];Object.keys(
2024-10-02 10:16:51 UTC	16384	IN	Data Raw: 72 28 36 2c 74 2e 6e 61 6d 65 29 7d 6e 75 6c 6c 21 3d 3d 72 26 26 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 72 26 26 4b 6e 28 72 29 7d 7d 66 75 6e 63 74 69 6f 6e 20 5a 6e 28 74 2c 65 29 7b 69 66 28 76 6f 69 64 20 30 3d 3d 3d 65 26 26 28 65 3d 31 29 2c 6e 75 6c 6c 21 3d 3d 74 29 73 77 69 74 63 68 28 74 79 70 65 6f 66 20 74 29 7b 63 61 73 65 22 6e 75 6d 62 65 72 22 3a 72 65 74 75 72 6e 20 4d 61 74 68 2e 72 6f 75 6e 64 28 74 2a 65 29 3b 63 61 73 65 22 73 74 72 69 6e 67 22 3a 72 65 74 75 72 6e 20 4d 61 74 68 2e 72 6f 75 6e 64 28 70 61 72 73 65 46 6c 6f 61 74 28 74 2e 72 65 70 6c 61 63 65 28 47 6e 2c 22 22 29 29 2a 65 29 7d 72 65 74 75 72 6e 20 6e 75 6c 6c 7d 76 61 72 20 51 6e 3d 5b 22 74 69 74 6c 65 22 2c 22 61 6c 74 22 2c 22 6f 6e 6c 6f 61 64 22 2c Data Ascii: r(6,t.name)}null!==r&&"object"==typeof r&&Kn(r)}}function Zn(t,e){if(void 0===e&&(e=1),null!==t)switch(typeof t){case"number":return Math.round(te);case"string":return Math.round(parseFloat(t.replace(Gn,""))e)}return null}var Qn=["title","alt","onload",
2024-10-02 10:16:51 UTC	16384	IN	Data Raw: 3d 6e 75 6c 6c 29 2c 76 6f 69 64 20 30 3d 3d 3d 72 26 26 28 72 3d 6e 75 6c 6c 29 3b 76 61 72 20 69 3d 6e 3f 22 22 2e 63 6f 6e 63 61 74 28 6e 2c 22 7c 22 29 2e 63 6f 6e 63 61 74 28 61 29 3a 22 22 3b 74 20 69 6e 20 77 72 26 26 77 72 5b 74 5d 2e 69 6e 64 65 78 4f 66 28 69 29 3e 3d 30 7c 7c 28 62 72 3d 7b 63 6f 64 65 3a 74 2c 6e 61 6d 65 3a 6e 2c 6d 65 73 73 61 67 65 3a 61 2c 73 74 61 63 6b 3a 72 2c 73 65 76 65 72 69 74 79 3a 65 7d 2c 74 20 69 6e 20 77 72 3f 77 72 5b 74 5d 2e 70 75 73 68 28 69 29 3a 77 72 5b 74 5d 3d 5b 69 5d 2c 79 72 28 33 33 29 29 7d 76 61 72 20 53 72 2c 45 72 3d 7b 7d 2c 4f 72 3d 6e 65 77 20 53 65 74 2c 4e 72 3d 7b 7d 2c 54 72 3d 7b 7d 2c 4d 72 3d 7b 7d 2c 78 72 3d 7b 7d 3b 66 75 6e 63 74 69 6f 6e 20 5f 72 28 29 7b 6a 72 28 29 7d 66 75 6e Data Ascii: =null),void 0===r&&(r=null);var i=n?"".concat(n,"\|").concat(a):"";t in wr&&wr[t].indexOf(i)>=0\|\|(br={code:t,name:n,message:a,stack:r,severity:e},t in wr?wr[t].push(i):wr[t]=[i],yr(33))}var Sr,Er={},Or=new Set,Nr={},Tr={},Mr={},xr={};function _r(){jr()}fun
2024-10-02 10:16:51 UTC	601	IN	Data Raw: 6d 65 74 61 64 61 74 61 3a 72 69 2c 70 61 75 73 65 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 50 69 28 29 26 26 28 41 28 22 63 6c 61 72 69 74 79 22 2c 22 70 61 75 73 65 22 29 2c 6e 75 6c 6c 3d 3d 3d 68 65 26 26 28 68 65 3d 6e 65 77 20 50 72 6f 6d 69 73 65 28 28 66 75 6e 63 74 69 6f 6e 28 74 29 7b 70 65 3d 74 7d 29 29 29 29 7d 2c 72 65 73 75 6d 65 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 50 69 28 29 26 26 28 68 65 26 26 28 70 65 28 29 2c 68 65 3d 6e 75 6c 6c 2c 6e 75 6c 6c 3d 3d 3d 66 65 26 26 6d 65 28 29 29 2c 41 28 22 63 6c 61 72 69 74 79 22 2c 22 72 65 73 75 6d 65 22 29 29 7d 2c 73 65 74 3a 6f 74 2c 73 69 67 6e 61 6c 3a 66 75 6e 63 74 69 6f 6e 28 74 29 7b 67 74 3d 74 7d 2c 73 74 61 72 74 3a 74 6f 2c 73 74 6f 70 3a 65 6f 2c 75 70 67 72 61 64 65 3a 65 74 2c 76 65 72 Data Ascii: metadata:ri,pause:function(){Pi()&&(A("clarity","pause"),null===he&&(he=new Promise((function(t){pe=t}))))},resume:function(){Pi()&&(he&&(pe(),he=null,null===fe&&me()),A("clarity","resume"))},set:ot,signal:function(t){gt=t},start:to,stop:eo,upgrade:et,ver

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
123	192.168.2.16	49884	13.107.246.40	443	4912	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-02 10:16:51 UTC	694	OUT	GET /shared/cms/lrs1c69a1j/section-videos/3dd826a043744d6cbfe55165a35a8ec8.mp4 HTTP/1.1 Host: edgestatic.azureedge.net Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" Accept-Encoding: identity;q=1, ;q=0 sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: /* Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: video Referer: https://www.microsoft.com/ Accept-Language: en-GB,en;q=0.9,en-US;q=0.8 Range: bytes=2785280-2823167 If-Range: W/"2b1400-18c5bb7f0e4"
2024-10-02 10:16:51 UTC	682	IN	HTTP/1.1 200 OK Date: Wed, 02 Oct 2024 10:16:51 GMT Content-Type: video/mp4 Content-Length: 2823168 Connection: close Access-Control-Allow-Origin: * Cache-Control: public, max-age=31536000, immutable ETag: W/"2b1400-18c5bb7f0e4" Last-Modified: Tue, 12 Dec 2023 01:50:30 GMT Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Origin-Agent-Cluster: ?1 X-Content-Type-Options: nosniff X-Download-Options: noopen X-Frame-Options: SAMEORIGIN X-Permitted-Cross-Domain-Policies: none X-XSS-Protection: 0 x-azure-ref: 20241002T101651Z-15767c5fc554wklc0x4mc5pq0w00000009pg00000000a332 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-02 10:16:51 UTC	15702	IN	Data Raw: 00 00 00 20 66 74 79 70 69 73 6f 6d 00 00 02 00 69 73 6f 6d 69 73 6f 32 61 76 63 31 6d 70 34 31 00 00 00 08 66 72 65 65 00 2a d6 17 6d 64 61 74 00 00 02 ca 06 05 ff ff c6 dc 45 e9 bd e6 d9 48 b7 96 2c d8 20 d9 23 ee ef 78 32 36 34 20 2d 20 63 6f 72 65 20 31 36 33 20 2d 20 48 2e 32 36 34 2f 4d 50 45 47 2d 34 20 41 56 43 20 63 6f 64 65 63 20 2d 20 43 6f 70 79 6c 65 66 74 20 32 30 30 33 2d 32 30 32 31 20 2d 20 68 74 74 70 3a 2f 2f 77 77 77 2e 76 69 64 65 6f 6c 61 6e 2e 6f 72 67 2f 78 32 36 34 2e 68 74 6d 6c 20 2d 20 6f 70 74 69 6f 6e 73 3a 20 63 61 62 61 63 3d 31 20 72 65 66 3d 32 20 64 65 62 6c 6f 63 6b 3d 31 3a 30 3a 30 20 61 6e 61 6c 79 73 65 3d 30 78 33 3a 30 78 31 31 33 20 6d 65 3d 68 65 78 20 73 75 62 6d 65 3d 36 20 70 73 79 3d 31 20 70 73 79 5f 72 64 Data Ascii: ftypisomisomiso2avc1mp41free*mdatEH, #x264 - core 163 - H.264/MPEG-4 AVC codec - Copyleft 2003-2021 - http://www.videolan.org/x264.html - options: cabac=1 ref=2 deblock=1:0:0 analyse=0x3:0x113 me=hex subme=6 psy=1 psy_rd
2024-10-02 10:16:51 UTC	16384	IN	Data Raw: 74 94 bd 23 94 3c dc e3 5b ea 51 d2 5e 67 07 ce 3e 3c 31 7b 29 24 9f 5c 4d 80 6b f5 c2 f2 d1 5e 29 cf 66 f0 ee 93 1a e4 c0 71 80 46 73 e6 ae 94 a2 8d f8 0e b7 e8 09 92 51 37 e0 2d 2f 7d 8a 8c d6 77 35 47 a3 0e 76 c8 7e 48 fe 25 ff 8d 85 83 5c 40 87 04 39 13 79 e6 85 85 4a cc 2a 1d 6b 4b 32 9a 21 d5 fd db 34 1e aa c0 00 00 95 06 f3 74 94 85 a1 f3 0a 53 ff 35 50 7c ec 72 fd 5e e6 9b 71 ed 1c a4 99 85 c3 3e d1 ab 1d ba 2e 6c d5 ad 17 dc fa b7 4c da 0d cd c4 36 78 ee 8d 95 b7 71 72 ef 4b c5 da 36 7c 0b 09 d9 bf 84 1a 30 ee 0e 10 c3 d5 41 1d 50 60 e8 6f e1 07 1f 62 45 67 e6 d4 28 32 ca 7a 11 b7 cc f3 e7 51 c2 e0 97 63 c9 27 5d 5e 99 84 13 17 1a cf 5e f9 a2 88 30 6a 45 28 8e 3f fc 49 9c 00 90 8a 52 8c c5 57 c2 c4 17 8f 47 1f 19 67 49 42 1d 52 16 1e 3f 80 00 00 Data Ascii: t#<[Q^g><1{)$\Mk^)fqFsQ7-/}w5Gv~H%\@9yJ*kK2!4tS5P\|r^q>.lL6xqrK6\|0AP`obEg(2zQc']^^0jE(?IRWGgIBR?
2024-10-02 10:16:51 UTC	16384	IN	Data Raw: 41 74 75 00 69 80 00 ee 78 51 66 94 ed 63 60 00 00 03 00 00 03 00 0f be a4 f2 80 67 70 b6 94 00 1a 7a bf c4 40 36 b2 9c 78 00 00 03 00 00 03 00 00 03 00 00 03 00 00 03 00 00 03 00 01 19 00 00 03 00 00 03 00 00 03 00 00 03 00 02 ba 05 f4 00 00 03 00 00 1f 05 6b 55 aa 1f cf 27 41 1c 61 c2 8a c9 59 e9 31 d3 9b 57 cc 28 c3 5b 99 f6 89 6b 1a 9f e6 41 02 9e 6b 6e 16 1a 12 51 9c 00 00 0f 50 00 00 03 00 00 06 80 00 a2 b8 00 00 7d 7d 82 ad 62 10 00 10 f0 21 10 04 60 8c 1c 21 10 04 60 8c 1c 00 00 00 ab 01 9e eb 44 25 ff 00 00 03 00 01 48 fa fd 00 4e 09 00 06 28 90 06 4f af 52 17 d8 db e1 10 00 04 8b 8b 22 f2 c2 01 18 c1 4b 90 00 00 03 00 00 03 00 00 03 00 00 1a d8 2e 96 63 24 c7 79 d3 c8 00 00 03 00 02 80 08 23 d8 9b f4 a0 00 00 07 e1 5b 93 a0 01 23 12 ea 84 80 00 Data Ascii: AtuixQfc`gpz@6xkU'AaY1W([kAknQP}}b!`!`D%HN(OR"K.c$y#[#
2024-10-02 10:16:51 UTC	16384	IN	Data Raw: 13 55 b4 aa 3f d9 09 b7 ea 51 8b 6f 82 b3 04 07 92 28 34 41 78 05 f2 68 5a 5a 21 b9 62 7e 3b 80 66 8a 1a ff 9e a3 06 ce 3c 12 e1 e6 07 68 11 f2 b1 16 c8 7b 8a 67 16 30 ca 2a a3 27 fa d0 3b 41 0f d5 88 c0 8f cb fc a6 2f d9 c2 2d bb 7e 36 fe 8d b6 2d a2 59 26 7d 59 79 29 e4 c1 8b 56 1e a1 c5 22 a5 b6 ac e6 a1 bb 3b 8b bb ac 7c d9 ed f6 56 10 11 5d 70 c7 aa 8e 9a c0 48 c6 40 0a 98 38 08 75 d8 32 aa ee 68 24 e7 de 14 a5 54 57 0a 8b fc a2 8b 4a ad b1 fd 8f 8e cd 3c dc 79 39 bd c6 03 fc 45 16 47 40 8c 43 92 52 6f fb ff 90 74 35 77 3b ad 4e cb 77 b4 f8 71 e6 a9 bf d3 ec 8a de 1b 79 29 92 31 7b 0c f9 db 3c 52 45 c5 df fc 4f 12 9f 8e 93 7a ea c3 fe 64 bc 05 4a 31 a0 e9 3b 93 21 0f 3b 11 c5 c0 a7 7a 5b 68 36 e4 38 6f 50 0f 43 24 62 34 5b 8c ac f3 ad 25 2f cf 31 a8 Data Ascii: U?Qo(4AxhZZ!b~;f<h{g0*';A/-~6-Y&}Yy)V";\|V]pH@8u2h$TWJ<y9EG@CRot5w;Nwqy)1{<REOzdJ1;!;z[h68oPC$b4[%/1
2024-10-02 10:16:51 UTC	16384	IN	Data Raw: 84 cc 6f 1a 07 8e d7 87 13 22 7e 52 a6 5e 63 e2 e6 7c 40 6a 03 64 4f 23 a6 3e 25 7d 2d 7e 67 0e 6a d3 f3 fe 19 ba a9 6b f8 e7 f2 65 98 32 b0 7c a5 b6 69 50 d0 bf 27 40 5f da 73 b8 2e 9c 21 09 ff 57 a0 15 a5 c8 81 e1 cc bd 05 8d 6b 1d 3f 9a 36 ab e6 25 f0 24 a3 e2 70 0f ff a2 e3 d8 01 bd ec 02 dc fc 76 be 88 d1 f7 3c a7 72 e0 9e 64 32 6b 86 a8 14 16 34 b6 7a d6 d6 0a 8d d3 8e 3e b2 ed 82 ec a9 f7 1b e0 cb dc 62 f9 b9 92 de 4e b0 64 3c e4 3a 25 93 e3 39 bd 60 11 f2 f7 7b 7a 4c 61 8e 06 97 a1 f3 5b 10 26 2b f6 b1 04 ca d1 99 e7 5d 8f 92 51 37 a2 67 89 56 21 cd 07 41 6e 46 8c e6 0d f6 5c fb b7 2b a3 f6 41 e8 1b 23 6f 23 72 7a 85 16 1a 51 3c 26 f6 55 9c 4b aa f1 1c 68 9d ad 4a 3a e1 ff 61 6d c1 09 1b c2 7b 77 bc 62 a8 17 40 e0 84 cf 8e 92 ef 96 23 f0 9a 92 99 Data Ascii: o"~R^c\|@jdO#>%}-~gjke2\|iP'@_s.!Wk?6%$pv<rd2k4z>bNd<:%9`{zLa[&+]Q7gV!AnF\+A#o#rzQ<&UKhJ:am{wb@#
2024-10-02 10:16:51 UTC	16384	IN	Data Raw: 35 b9 14 c7 1b d3 5f a4 1a 24 aa 58 23 d2 5c 08 83 7c 0c a6 06 84 a4 0c ad 9f 2e 7b 37 6a b9 41 f4 8b 01 a6 3d ef 5c 19 a5 8d 9b ff ca 17 0e 5b a7 e8 44 e8 b2 d0 e1 85 f3 db cc 5d e5 a6 3c 17 6c 8b 58 84 ff ab 81 06 0b c2 ea d8 27 4d 57 71 d0 f8 07 6c 44 f2 a9 c0 74 3d 08 7f db ce 18 90 c1 9c e6 62 c8 40 d2 36 4f 02 52 d8 1c d6 59 f2 55 16 fe 53 00 80 2c 3d a4 15 90 66 fd f5 6e d4 4d b6 21 c6 42 e0 c2 f8 dc 67 e6 45 39 34 ae 5d 6c b2 9e ec 94 1c a1 c1 56 25 ef ba e1 d6 4a 0c bf fe 59 c5 ee 91 ae fd 69 72 77 4e b0 99 1a cb cf 33 ee ba ad a4 f3 d7 8f 13 b3 74 61 97 03 a3 15 78 59 15 ba db 6e c4 ee dc f6 36 c1 21 4c fa 2b 02 1d ff 55 c2 c8 4c 19 14 cf 91 af ae 0f d1 9d ea 9c d0 29 df 59 fb 32 bc 1d fb 85 a3 35 f5 4a bf d8 5b d5 3a 4c 7d ac cb cf b6 0f c0 6f Data Ascii: 5_$X#\\|.{7jA=\[D]<lX'MWqlDt=b@6ORYUS,=fnM!BgE94]lV%JYirwN3taxYn6!L+UL)Y25J[:L}o
2024-10-02 10:16:51 UTC	16384	IN	Data Raw: 00 20 14 71 79 8b 9f e7 a6 af f7 e2 0a 77 2f 96 67 6d de c5 cb 5a 1c 66 fa c2 d7 0b df 7f 8b 41 28 32 b0 2a e0 d1 cf e1 97 36 47 8f 2d 2c f2 c4 b8 e3 48 10 ef 96 3f db 8b 94 a2 e6 a8 83 7c bb 50 a3 9e 25 87 67 2e 25 56 49 6e ed 38 bb 00 42 87 d5 b3 51 31 8a c6 94 17 72 d0 86 6c 53 1f bc b3 fb 0d 76 ce ee 26 69 35 99 61 6e 43 ab 07 1c 02 11 6a 57 be b2 95 2c bf cf f9 4a 3a 2f b6 bf fd 42 c6 26 65 42 b2 b7 c1 84 0b 79 46 32 fd 55 6d 0f a4 1a 9d b3 05 72 16 0b 1c 01 ca b3 10 b5 8a fb ab 59 d9 cd 48 22 30 13 dc d8 5e 51 d6 51 8f 2d b8 96 1c 11 00 b7 9d 4b 80 18 ce db d6 1d 41 4e b7 67 30 94 a0 b8 b5 02 f0 87 3e 74 35 fa ea bf 16 21 96 1b 84 07 c3 e3 1f 10 3a c4 db 86 d7 91 f2 78 c5 62 14 f9 b6 2c eb 51 53 d3 76 5b 63 55 46 e0 43 3d 7d 7c 43 60 dc 1e 7f 55 36 Data Ascii: qyw/gmZfA(2*6G-,H?\|P%g.%VIn8BQ1rlSv&i5anCjW,J:/B&eByF2UmrYH"0^QQ-KANg0>t5!:xb,QSv[cUFC=}\|C`U6
2024-10-02 10:16:51 UTC	16384	IN	Data Raw: 95 93 2e 61 ea 94 7a 1b bc a0 8c d6 3f 49 a2 96 8a a1 70 7c b3 77 17 0e b2 88 34 68 69 bf 3b 01 41 86 d7 72 15 52 a7 29 cb 50 90 3a 49 ee ac e8 e2 e3 30 a0 4c 99 9c 68 1d 87 92 ab 4f 66 0e 22 37 7a e9 03 25 6a f1 94 29 54 34 40 bf 00 8e e8 3a 1c a3 dc ff c0 96 62 7d 87 8e fb ac 35 98 7b 66 37 83 ec cc ae 6f d7 16 fd db 65 57 27 1e ee 5e b2 c5 19 c8 e6 fa 15 6a ee 03 fb 53 85 80 20 4a b8 9e 90 f7 7d 56 04 f4 2a 04 77 9a 5a ba 3f ee be ae 98 49 77 0a eb 61 0c f8 eb be b5 93 f0 75 49 f8 9b c1 0c 52 52 b2 a3 ae 06 6d 6a ed 99 64 f4 35 fa df e4 67 3f f5 77 d4 ec f7 ad f0 50 74 52 63 ac f8 c4 e4 1b b4 44 6b 8a 7d ee 68 79 b4 0f 32 d7 0a d4 b5 bd 20 a8 2b 05 2c eb 99 7d d1 a8 33 50 45 02 58 99 3d ac 9d 19 f3 9a 07 d7 6c 76 8a 36 9b d3 e8 71 51 c8 4b c8 30 8a 67 Data Ascii: .az?Ip\|w4hi;ArR)P:I0LhOf"7z%j)T4@:b}5{f7oeW'^jS J}V*wZ?IwauIRRmjd5g?wPtRcDk}hy2 +,}3PEX=lv6qQK0g
2024-10-02 10:16:51 UTC	16384	IN	Data Raw: 33 84 32 fe 00 07 b8 60 b8 b2 a1 d6 87 82 0f 5f cf 93 3e 55 51 af ca c7 22 89 ab fd b0 0a 3f 01 ab fb aa 86 16 09 82 e4 05 9e 0e 6d a3 b5 3f f1 19 c1 96 2f 03 60 7d 05 f8 ca f5 c5 42 7f db 2a fb 43 00 e5 f2 59 f1 5e 9a 16 9e aa c8 c8 80 cd 14 91 81 c8 91 57 6f 9c b1 6c 4b c9 57 89 d1 75 61 ed 28 a1 f0 58 f7 b9 f1 74 54 10 77 ec 3f 5f dd 66 ad b2 6f e8 8a b4 78 df a8 0b a9 a9 98 c8 37 83 fb e2 72 f9 84 14 4a da 8b 26 52 e2 4c d3 a5 fa 1b b9 92 a0 0f 0f 4b 29 ec 3a a8 57 32 28 ea de 9e 44 92 53 79 44 d9 aa 68 81 5f 25 b2 eb 17 85 66 60 67 ff 43 f3 fe 1f a6 18 3b ab 10 c0 20 57 f8 34 a1 3c 20 21 f7 39 80 ef 3e 00 70 6f 85 41 24 c6 f3 7b f3 1f af ac c1 00 07 86 0a 24 35 ab 6b 89 1d 4a b1 0c 51 61 5d a9 cf 7f e3 73 b1 e5 ed 3e bb 63 ca bf 05 3e 28 0c 59 f2 2d Data Ascii: 32`_>UQ"?m?/`}B*CY^WolKWua(XtTw?_fox7rJ&RLK):W2(DSyDh_%f`gC; W4< !9>poA${$5kJQa]s>c>(Y-
2024-10-02 10:16:51 UTC	16384	IN	Data Raw: db c3 3e f4 e9 30 c6 e5 87 8d e4 d7 35 0e 95 3c 13 8f 13 91 8f 59 9b 12 4c 9f 2f 81 33 a1 f2 74 3d 0e 65 fb c6 3c d3 fc c8 2e 35 34 e5 f9 c0 6c 77 8e 41 e2 41 58 9b e7 1d a3 f1 5b 5b dc 06 2f 56 f3 61 7c 7d 6d ff 23 bb a2 94 c0 6d 16 39 ee 4e 28 f5 fe f8 b5 c3 0c 1a de 27 dd fb 09 b2 1e 1f 19 b2 bd 36 47 ea 1f 66 b4 53 08 77 2f d2 f6 61 ad a4 9c 0d c7 37 c8 f9 fe 4d b1 51 b1 38 bb cb 4a c1 1e 3b b1 57 87 27 6e 76 95 12 5e 16 09 33 48 85 0b 63 05 f0 d4 37 5b 22 37 84 89 13 b6 c7 cb 21 67 fa d5 2a 35 78 dd 4b d9 30 19 44 b4 20 4a 06 33 8c 05 2d 89 d3 16 a4 d0 b1 20 95 08 cd 3a f5 fb ae fd 10 7e 69 1e 8f e8 ae a5 60 43 59 0b 35 cb ef 34 a8 28 1f 60 31 e0 3a 14 4d 6f c1 8f 1d 00 1b 02 a2 78 30 38 fd 13 b2 34 67 ca 02 b2 08 51 80 e6 d9 2c 08 c6 0b ee 8b 69 55 Data Ascii: >05<YL/3t=e<.54lwAAX[[/Va\|}m#m9N('6GfSw/a7MQ8J;W'nv^3Hc7["7!g*5xK0D J3- :~i`CY54(`1:Mox084gQ,iU

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
124	192.168.2.16	49886	13.107.246.40	443	4912	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-02 10:16:51 UTC	663	OUT	GET /assets/js/auto-complete-app-search-c8ed58b0.js HTTP/1.1 Host: apps.microsoft.com Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" Origin: https://apps.microsoft.com sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: same-origin Sec-Fetch-Mode: cors Sec-Fetch-Dest: script Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8 Cookie: MSCC=NR; exp-session-id=b6d0ece2-29a7-4143-931c-d621648d7cb8
2024-10-02 10:16:51 UTC	1286	IN	HTTP/1.1 200 OK Date: Wed, 02 Oct 2024 10:16:51 GMT Content-Type: text/javascript Content-Length: 39435 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public,max-age=31536000,immutable ETag: "1db136ef678240b" Last-Modified: Mon, 30 Sep 2024 19:28:44 GMT Strict-Transport-Security: max-age=2592000 Request-Context: appId=cid-v1:04e455f9-321c-49bf-8d2c-d79fbf5e8cde MS-CV: aL1yik7cw0ucvrMW.0 X-Content-Type-Options: nosniff Permissions-Policy: unload=() Content-Security-Policy: default-src 'self' data: https://.clarity.ms https://c.bing.com;script-src 'self' wcpstatic.microsoft.com js.monitor.azure.com www.microsoft.com www.clarity.ms get.microsoft.com xvsec.video.microsoft.com bat.bing.com 'unsafe-inline';style-src 'unsafe-inline';connect-src * data: ms-windows-store:;font-src ;img-src data: blob:;media-src 'self' blob: https://sfds-production.azurefd.net https://canvasstorageprodtorus.blob.core.windows.net;frame-src * ms-windows-store:;report-uri https://csp.microsoft.com/report/app-store-web-prod X-Powered-By: ASP.NET x-azure-ref: 20241002T101651Z-15767c5fc55472x4k7dmphmadg00000008z000000000ba2b x-fd-int-roxy-purgeid: 66820190 X-Cache: TCP_MISS Accept-Ranges: bytes
2024-10-02 10:16:51 UTC	15098	IN	Data Raw: 69 6d 70 6f 72 74 7b 69 20 61 73 20 66 2c 6d 20 61 73 20 7a 2c 42 20 61 73 20 45 2c 64 20 61 73 20 4c 2c 5f 20 61 73 20 61 2c 72 20 61 73 20 6f 2c 74 20 61 73 20 62 2c 4f 2c 78 20 61 73 20 72 2c 54 20 61 73 20 49 2c 6c 2c 68 20 61 73 20 67 2c 77 20 61 73 20 50 2c 61 35 20 61 73 20 71 2c 73 20 61 73 20 44 2c 61 20 61 73 20 78 2c 62 20 61 73 20 64 2c 66 20 61 73 20 70 2c 45 20 61 73 20 48 2c 67 20 61 73 20 42 2c 6a 20 61 73 20 4d 7d 66 72 6f 6d 22 2e 2f 69 6e 64 65 78 2d 33 36 64 33 30 38 38 37 2e 6a 73 22 3b 63 6f 6e 73 74 20 4b 3d 66 60 0a 20 20 20 20 3a 68 6f 73 74 20 7b 0a 20 20 20 20 20 20 20 20 70 6f 73 69 74 69 6f 6e 3a 20 72 65 6c 61 74 69 76 65 3b 0a 20 20 20 20 20 20 20 20 64 69 73 70 6c 61 79 3a 20 69 6e 6c 69 6e 65 2d 62 6c 6f 63 6b 3b 0a 20 20 Data Ascii: import{i as f,m as z,B as E,d as L,_ as a,r as o,t as b,O,x as r,T as I,l,h as g,w as P,a5 as q,s as D,a as x,b as d,f as p,E as H,g as B,j as M}from"./index-36d30887.js";const K=f` :host { position: relative; display: inline-block;
2024-10-02 10:16:51 UTC	16384	IN	Data Raw: 6b 65 64 22 2c 7b 62 75 62 62 6c 65 73 3a 21 30 2c 63 6f 6d 70 6f 73 65 64 3a 21 30 7d 29 3b 69 66 28 74 68 69 73 2e 64 69 73 70 61 74 63 68 45 76 65 6e 74 28 74 29 2c 65 2e 72 65 64 69 72 65 63 74 55 72 6c 29 77 69 6e 64 6f 77 2e 6f 70 65 6e 28 65 2e 72 65 64 69 72 65 63 74 55 72 6c 2c 22 5f 62 6c 61 6e 6b 22 29 3b 65 6c 73 65 7b 63 6f 6e 73 74 20 73 3d 60 2f 64 65 74 61 69 6c 2f 24 7b 65 2e 70 72 6f 64 75 63 74 49 64 7d 60 3b 50 2e 6e 61 76 69 67 61 74 65 28 73 29 7d 7d 7d 72 65 6e 64 65 72 43 61 72 64 49 6d 61 67 65 28 29 7b 69 66 28 21 74 68 69 73 2e 73 75 67 67 65 73 74 69 6f 6e 50 72 6f 64 75 63 74 29 72 65 74 75 72 6e 20 72 60 60 3b 63 6f 6e 73 74 20 65 3d 74 68 69 73 2e 73 75 67 67 65 73 74 69 6f 6e 50 72 6f 64 75 63 74 3b 69 66 28 65 2e 69 73 47 Data Ascii: ked",{bubbles:!0,composed:!0});if(this.dispatchEvent(t),e.redirectUrl)window.open(e.redirectUrl,"_blank");else{const s=`/detail/${e.productId}`;P.navigate(s)}}}renderCardImage(){if(!this.suggestionProduct)return r``;const e=this.suggestionProduct;if(e.isG
2024-10-02 10:16:51 UTC	7953	IN	Data Raw: 68 2d 69 63 6f 6e 2d 62 67 22 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 73 6c 2d 69 63 6f 6e 20 63 6c 61 73 73 3d 22 72 65 73 75 6c 74 2d 73 65 61 72 63 68 2d 69 63 6f 6e 22 20 73 6c 6f 74 3d 22 70 72 65 66 69 78 22 20 6e 61 6d 65 3d 22 63 6c 6f 63 6b 2d 68 69 73 74 6f 72 79 22 3e 3c 2f 73 6c 2d 69 63 6f 6e 3e 20 20 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 64 69 76 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 70 3e 24 7b 65 7d 3c 2f 70 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 73 70 61 6e 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 73 6c 2d 69 63 6f 6e 2d 62 75 74 74 6f 6e 20 Data Ascii: h-icon-bg"> <sl-icon class="result-search-icon" slot="prefix" name="clock-history"></sl-icon> </div> <p>${e}</p> </span> <sl-icon-button

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
125	192.168.2.16	49887	13.107.246.40	443	4912	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-02 10:16:51 UTC	656	OUT	GET /assets/js/collection-helper-ed90e706.js HTTP/1.1 Host: apps.microsoft.com Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" Origin: https://apps.microsoft.com sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: same-origin Sec-Fetch-Mode: cors Sec-Fetch-Dest: script Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8 Cookie: MSCC=NR; exp-session-id=b6d0ece2-29a7-4143-931c-d621648d7cb8
2024-10-02 10:16:51 UTC	1192	IN	HTTP/1.1 200 OK Date: Wed, 02 Oct 2024 10:16:51 GMT Content-Type: text/javascript Content-Length: 573 Connection: close Cache-Control: public,max-age=31536000,immutable ETag: "1db136ef678bc3d" Last-Modified: Mon, 30 Sep 2024 19:28:44 GMT Strict-Transport-Security: max-age=2592000 Request-Context: appId=cid-v1:04e455f9-321c-49bf-8d2c-d79fbf5e8cde MS-CV: wM2i8+TQDUWmarbb.0 X-Content-Type-Options: nosniff Permissions-Policy: unload=() Content-Security-Policy: default-src 'self' data: https://.clarity.ms https://c.bing.com;script-src 'self' wcpstatic.microsoft.com js.monitor.azure.com www.microsoft.com www.clarity.ms get.microsoft.com xvsec.video.microsoft.com bat.bing.com 'unsafe-inline';style-src 'unsafe-inline';connect-src * data: ms-windows-store:;font-src ;img-src data: blob:;media-src 'self' blob: https://sfds-production.azurefd.net https://canvasstorageprodtorus.blob.core.windows.net;frame-src * ms-windows-store:;report-uri https://csp.microsoft.com/report/app-store-web-prod X-Powered-By: ASP.NET x-azure-ref: 20241002T101651Z-15767c5fc55852fxfeh7csa2dn00000009d00000000000zg x-fd-int-roxy-purgeid: 66820190 X-Cache: TCP_MISS Accept-Ranges: bytes
2024-10-02 10:16:51 UTC	573	IN	Data Raw: 69 6d 70 6f 72 74 7b 50 20 61 73 20 65 7d 66 72 6f 6d 22 2e 2f 70 61 67 65 64 2d 6c 69 73 74 2d 37 37 37 37 35 32 65 39 2e 6a 73 22 3b 66 75 6e 63 74 69 6f 6e 20 69 28 74 29 7b 69 66 28 74 2e 73 74 61 72 74 73 57 69 74 68 28 22 6d 73 2d 77 69 6e 64 6f 77 73 2d 73 74 6f 72 65 3a 22 29 29 7b 63 6f 6e 73 74 20 72 3d 6e 65 77 20 55 52 4c 28 74 29 3b 6c 65 74 20 73 3d 72 2e 73 65 61 72 63 68 50 61 72 61 6d 73 26 26 72 2e 73 65 61 72 63 68 50 61 72 61 6d 73 2e 67 65 74 28 22 6c 69 73 74 69 64 22 29 3b 72 65 74 75 72 6e 20 73 21 3d 3d 6e 75 6c 6c 3f 72 2e 70 61 74 68 6e 61 6d 65 2e 69 6e 64 65 78 4f 66 28 22 76 69 64 65 6f 47 61 6c 6c 65 72 79 22 29 3e 3d 30 3f 60 6d 6f 76 69 65 73 2f 24 7b 73 7d 60 3a 73 3a 28 73 3d 72 2e 73 65 61 72 63 68 50 61 72 61 6d 73 26 Data Ascii: import{P as e}from"./paged-list-777752e9.js";function i(t){if(t.startsWith("ms-windows-store:")){const r=new URL(t);let s=r.searchParams&&r.searchParams.get("listid");return s!==null?r.pathname.indexOf("videoGallery")>=0?`movies/${s}`:s:(s=r.searchParams&

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
126	192.168.2.16	49888	13.107.246.40	443	4912	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-02 10:16:51 UTC	649	OUT	GET /assets/js/paged-list-777752e9.js HTTP/1.1 Host: apps.microsoft.com Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" Origin: https://apps.microsoft.com sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: same-origin Sec-Fetch-Mode: cors Sec-Fetch-Dest: script Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8 Cookie: MSCC=NR; exp-session-id=b6d0ece2-29a7-4143-931c-d621648d7cb8
2024-10-02 10:16:51 UTC	1305	IN	HTTP/1.1 200 OK Date: Wed, 02 Oct 2024 10:16:51 GMT Content-Type: text/javascript Content-Length: 4535 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public,max-age=31536000,immutable ETag: "1db136ef678afb7" Last-Modified: Mon, 30 Sep 2024 19:28:44 GMT Strict-Transport-Security: max-age=2592000 Request-Context: appId=cid-v1:04e455f9-321c-49bf-8d2c-d79fbf5e8cde MS-CV: oKfhVDQJ80yTYE7k.0 X-Content-Type-Options: nosniff Permissions-Policy: unload=() Content-Security-Policy: default-src 'self' data: https://.clarity.ms https://c.bing.com;script-src 'self' wcpstatic.microsoft.com js.monitor.azure.com www.microsoft.com www.clarity.ms get.microsoft.com xvsec.video.microsoft.com bat.bing.com 'unsafe-inline';style-src 'unsafe-inline';connect-src * data: ms-windows-store:;font-src ;img-src data: blob:;media-src 'self' blob: https://sfds-production.azurefd.net https://canvasstorageprodtorus.blob.core.windows.net;frame-src * ms-windows-store:;report-uri https://csp.microsoft.com/report/app-store-web-prod X-Powered-By: ASP.NET x-azure-ref: 20241002T101651Z-15767c5fc554wklc0x4mc5pq0w00000009m000000000efhg x-fd-int-roxy-purgeid: 66820190 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-02 10:16:51 UTC	4535	IN	Data Raw: 69 6d 70 6f 72 74 7b 6a 20 61 73 20 68 2c 77 20 61 73 20 66 2c 56 20 61 73 20 70 7d 66 72 6f 6d 22 2e 2f 69 6e 64 65 78 2d 33 36 64 33 30 38 38 37 2e 6a 73 22 3b 76 61 72 20 63 3b 28 66 75 6e 63 74 69 6f 6e 28 4c 29 7b 4c 5b 4c 2e 49 6e 63 6c 75 64 65 3d 30 5d 3d 22 49 6e 63 6c 75 64 65 22 2c 4c 5b 4c 2e 45 78 63 6c 75 64 65 3d 31 5d 3d 22 45 78 63 6c 75 64 65 22 7d 29 28 63 7c 7c 28 63 3d 7b 7d 29 29 3b 63 6c 61 73 73 20 6c 7b 63 6f 6e 73 74 72 75 63 74 6f 72 28 65 2c 74 2c 72 29 7b 74 68 69 73 2e 66 65 74 63 68 65 72 3d 65 2c 74 68 69 73 2e 69 74 65 6d 47 65 74 74 65 72 3d 74 2c 74 68 69 73 2e 63 75 72 73 6f 72 47 65 74 74 65 72 3d 72 2c 74 68 69 73 2e 68 61 73 4d 6f 72 65 52 65 73 75 6c 74 73 3d 21 30 2c 74 68 69 73 2e 70 61 67 65 3d 31 2c 74 68 69 73 Data Ascii: import{j as h,w as f,V as p}from"./index-36d30887.js";var c;(function(L){L[L.Include=0]="Include",L[L.Exclude=1]="Exclude"})(c\|\|(c={}));class l{constructor(e,t,r){this.fetcher=e,this.itemGetter=t,this.cursorGetter=r,this.hasMoreResults=!0,this.page=1,this

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
127	192.168.2.16	49890	68.67.160.114	443	4912	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-02 10:16:51 UTC	898	OUT	GET /pixie?e=LandingPage&pi=e8619ae9-c189-46ef-bfc8-f39e0ac838fd&it=1727864209441&v=0.0.41&u=https%3A%2F%2Fwww.microsoft.com%2Fen-gb%2Fedge%2Fwelcome%3Fform%3DM10004%26mb03%3Dtrue&st=1727864209440&et=1727864210207&if=0&uetmsmid=ead072c6-87b6-4905-8bcf-231e8931644d&asce=0&ascc=0&tcfhl=0&tcfe=0&tcfgdpr=0&tcfc=0 HTTP/1.1 Host: ib.adnxs.com Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://www.microsoft.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-10-02 10:16:51 UTC	296	IN	HTTP/1.1 200 OK Server: nginx/1.23.4 Date: Wed, 02 Oct 2024 10:16:51 GMT Content-Type: image/gif Content-Length: 42 Connection: close Cache-Control: no-cache, no-store, must-revalidate X-Proxy-Origin: 8.46.123.33; 8.46.123.33; 672.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; adnxs.com
2024-10-02 10:16:51 UTC	42	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 00 00 00 ff ff ff 21 f9 04 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 01 44 00 3b Data Ascii: GIF89a!,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
128	192.168.2.16	49889	13.107.246.40	443	4912	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-02 10:16:51 UTC	660	OUT	GET /assets/js/flip-animation-helper-712a32df.js HTTP/1.1 Host: apps.microsoft.com Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" Origin: https://apps.microsoft.com sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: same-origin Sec-Fetch-Mode: cors Sec-Fetch-Dest: script Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8 Cookie: MSCC=NR; exp-session-id=b6d0ece2-29a7-4143-931c-d621648d7cb8
2024-10-02 10:16:51 UTC	1285	IN	HTTP/1.1 200 OK Date: Wed, 02 Oct 2024 10:16:51 GMT Content-Type: text/javascript Content-Length: 3147 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public,max-age=31536000,immutable ETag: "1db136ef678b24b" Last-Modified: Mon, 30 Sep 2024 19:28:44 GMT Strict-Transport-Security: max-age=2592000 Request-Context: appId=cid-v1:04e455f9-321c-49bf-8d2c-d79fbf5e8cde MS-CV: ijsxNx8ZlEq6EBf2.0 X-Content-Type-Options: nosniff Permissions-Policy: unload=() Content-Security-Policy: default-src 'self' data: https://.clarity.ms https://c.bing.com;script-src 'self' wcpstatic.microsoft.com js.monitor.azure.com www.microsoft.com www.clarity.ms get.microsoft.com xvsec.video.microsoft.com bat.bing.com 'unsafe-inline';style-src 'unsafe-inline';connect-src * data: ms-windows-store:;font-src ;img-src data: blob:;media-src 'self' blob: https://sfds-production.azurefd.net https://canvasstorageprodtorus.blob.core.windows.net;frame-src * ms-windows-store:;report-uri https://csp.microsoft.com/report/app-store-web-prod X-Powered-By: ASP.NET x-azure-ref: 20241002T101651Z-15767c5fc55fdfx81a30vtr1fw00000009qg00000000845k x-fd-int-roxy-purgeid: 66820190 X-Cache: TCP_MISS Accept-Ranges: bytes
2024-10-02 10:16:51 UTC	3147	IN	Data Raw: 63 6c 61 73 73 20 41 7b 63 6f 6e 73 74 72 75 63 74 6f 72 28 74 2c 65 3d 21 31 29 7b 74 68 69 73 2e 66 6c 69 70 43 6f 6e 74 61 69 6e 65 72 3d 6e 75 6c 6c 2c 74 68 69 73 2e 65 6c 73 3d 5b 5d 2c 74 68 69 73 2e 64 65 6c 65 74 65 45 6c 65 6d 65 6e 74 3d 6e 75 6c 6c 2c 74 68 69 73 2e 64 65 6c 74 65 49 64 3d 6e 75 6c 6c 2c 74 68 69 73 2e 63 6f 70 79 4e 6f 64 65 3d 76 6f 69 64 20 30 2c 74 68 69 73 2e 75 73 65 4c 61 73 74 53 74 61 74 65 41 73 49 6e 69 74 69 61 6c 53 74 61 74 65 3d 21 31 2c 74 68 69 73 2e 66 69 72 73 74 53 74 61 74 65 43 6f 6c 6c 65 63 74 69 6f 6e 3d 6e 75 6c 6c 2c 74 68 69 73 2e 66 6c 69 70 43 6f 6e 74 61 69 6e 65 72 3d 74 2c 74 68 69 73 2e 75 73 65 4c 61 73 74 53 74 61 74 65 41 73 49 6e 69 74 69 61 6c 53 74 61 74 65 3d 65 2c 74 26 26 74 68 69 73 Data Ascii: class A{constructor(t,e=!1){this.flipContainer=null,this.els=[],this.deleteElement=null,this.delteId=null,this.copyNode=void 0,this.useLastStateAsInitialState=!1,this.firstStateCollection=null,this.flipContainer=t,this.useLastStateAsInitialState=e,t&&this

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
129	192.168.2.16	49892	150.171.28.10	443	4912	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-02 10:16:51 UTC	705	OUT	GET /p/action/355008692.js HTTP/1.1 Host: bat.bing.com Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: / X-Edge-Shopping-Flag: 1 Sec-MS-GEC: FF699648EBF162654E01182ED0BD24EDB1A2721B7E78C7D8756497D88A893629 Sec-MS-GEC-Version: 1-117.0.2045.47 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://www.microsoft.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-10-02 10:16:51 UTC	569	IN	HTTP/1.1 200 OK Cache-Control: private,max-age=60 Content-Length: 4113 Content-Type: application/javascript; charset=utf-8 Strict-Transport-Security: max-age=31536000; includeSubDomains; preload X-Cache: CONFIG_NOCACHE Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version X-MSEdge-Ref: Ref A: 26039987891E405FB86ED896EA583DD3 Ref B: EWR30EDGE0114 Ref C: 2024-10-02T10:16:51Z Date: Wed, 02 Oct 2024 10:16:51 GMT Connection: close
2024-10-02 10:16:51 UTC	732	IN	Data Raw: 28 66 75 6e 63 74 69 6f 6e 28 77 2c 64 2c 63 2c 6b 2c 61 2c 62 2c 74 2c 65 29 20 7b 0d 0a 20 20 20 20 76 61 72 20 63 73 20 3d 20 64 2e 63 75 72 72 65 6e 74 53 63 72 69 70 74 3b 0d 0a 20 20 20 20 69 66 20 28 63 73 29 20 7b 0d 0a 20 20 20 20 20 20 20 20 76 61 72 20 75 6f 20 3d 20 63 73 2e 67 65 74 41 74 74 72 69 62 75 74 65 28 27 64 61 74 61 2d 75 65 74 6f 27 29 3b 0d 0a 20 20 20 20 20 20 20 20 69 66 20 28 75 6f 20 26 26 20 77 5b 75 6f 5d 20 26 26 20 74 79 70 65 6f 66 20 77 5b 75 6f 5d 2e 73 65 74 55 73 65 72 53 69 67 6e 61 6c 73 20 3d 3d 3d 20 27 66 75 6e 63 74 69 6f 6e 27 29 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 77 5b 75 6f 5d 2e 73 65 74 55 73 65 72 53 69 67 6e 61 6c 73 28 7b 27 63 6f 27 3a 20 63 2c 20 27 6b 63 27 3a 20 6b 2c 20 27 61 74 27 3a Data Ascii: (function(w,d,c,k,a,b,t,e) { var cs = d.currentScript; if (cs) { var uo = cs.getAttribute('data-ueto'); if (uo && w[uo] && typeof w[uo].setUserSignals === 'function') { w[uo].setUserSignals({'co': c, 'kc': k, 'at':
2024-10-02 10:16:51 UTC	3081	IN	Data Raw: 3b 0d 0a 20 20 20 20 6a 2e 6f 6e 6c 6f 61 64 20 3d 20 66 75 6e 63 74 69 6f 6e 20 28 29 20 7b 0d 0a 20 20 20 20 20 20 20 20 69 66 20 28 21 63 29 20 72 65 74 75 72 6e 3b 0d 0a 20 20 20 20 20 20 20 20 76 61 72 20 63 6f 20 3d 20 66 75 6e 63 74 69 6f 6e 28 75 29 20 7b 20 72 65 74 75 72 6e 20 75 20 26 26 20 74 79 70 65 6f 66 20 75 20 3d 3d 3d 20 27 6f 62 6a 65 63 74 27 20 26 26 20 21 28 75 20 69 6e 73 74 61 6e 63 65 6f 66 20 41 72 72 61 79 29 20 26 26 20 75 2e 62 65 61 63 6f 6e 50 61 72 61 6d 73 20 26 26 20 75 2e 62 65 61 63 6f 6e 50 61 72 61 6d 73 2e 6d 69 64 20 26 26 20 77 2e 63 6c 61 72 69 74 79 3b 20 7d 3b 0d 0a 20 20 20 20 20 20 20 20 76 61 72 20 72 20 3d 20 34 30 3b 0d 0a 20 20 20 20 20 20 20 20 76 61 72 20 63 6c 20 3d 20 66 75 6e 63 74 69 6f 6e 28 29 20 Data Ascii: ; j.onload = function () { if (!c) return; var co = function(u) { return u && typeof u === 'object' && !(u instanceof Array) && u.beaconParams && u.beaconParams.mid && w.clarity; }; var r = 40; var cl = function()
2024-10-02 10:16:51 UTC	300	IN	Data Raw: 7d 2c 20 65 2e 6f 72 69 67 69 6e 29 3b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 7d 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 66 2e 70 61 72 65 6e 74 4e 6f 64 65 2e 69 6e 73 65 72 74 42 65 66 6f 72 65 28 65 73 74 2c 66 29 3b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 3b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 66 2e 70 61 72 65 6e 74 4e 6f 64 65 2e 69 6e 73 65 72 74 42 65 66 6f 72 65 28 63 70 2c 66 29 3b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 77 2e 72 65 6d 6f 76 65 45 76 65 6e 74 4c 69 73 74 65 6e 65 72 28 27 6d 65 73 73 61 67 65 27 2c 20 65 76 65 6e 74 4c 69 73 74 65 6e 65 72 29 3b 0d 0a 20 20 20 20 20 20 20 20 7d 29 3b 0d 0a 20 20 20 20 7d 0d 0a 20 20 20 20 6c 61 75 6e 63 68 45 76 65 6e 74 53 65 74 75 70 28 29 3b 0d 0a 7d Data Ascii: }, e.origin); } f.parentNode.insertBefore(est,f); }; f.parentNode.insertBefore(cp,f); w.removeEventListener('message', eventListener); }); } launchEventSetup();}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
130	192.168.2.16	49891	13.107.42.14	443	4912	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-02 10:16:51 UTC	783	OUT	GET /collect?v=2&fmt=js&pid=7850&time=1727864210223&li_adsId=c6366846-7f41-4708-9fb6-3269a23fdc13&url=https%3A%2F%2Fwww.microsoft.com%2Fen-gb%2Fedge%2Fwelcome%3Fform%3DM10004%26mb03%3Dtrue HTTP/1.1 Host: px.ads.linkedin.com Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://www.microsoft.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-10-02 10:16:51 UTC	1111	IN	HTTP/1.1 302 Found Location: /collect?v=2&fmt=js&pid=7850&time=1727864210223&li_adsId=c6366846-7f41-4708-9fb6-3269a23fdc13&url=https%3A%2F%2Fwww.microsoft.com%2Fen-gb%2Fedge%2Fwelcome%3Fform%3DM10004%26mb03%3Dtrue&cookiesTest=true Set-Cookie: li_sugr=d35b3f83-bdbb-45a3-85ce-a0229f826989; Max-Age=7776000; Expires=Tue, 31 Dec 2024 10:16:51 GMT; SameSite=None; Path=/; Domain=.linkedin.com; Secure Set-Cookie: bcookie="v=2&2516b960-85ad-4191-847f-415a33eda43e"; domain=.linkedin.com; Path=/; Secure; Expires=Thu, 02-Oct-2025 10:16:51 GMT; SameSite=None Set-Cookie: lidc="b=TGST06:s=T:r=T:a=T:p=T:g=3013:u=1:x=1:i=1727864211:t=1727950611:v=2:sig=AQG_p4RFuAy5RLp45N0Pq_b0ZbnDEu0_"; Expires=Thu, 03 Oct 2024 10:16:51 GMT; domain=.linkedin.com; Path=/; SameSite=None; Secure LinkedIn-Action: 1 X-Li-Fabric: prod-ltx1 X-Li-Pop: afd-prod-ltx1-x X-Li-Proto: http/1.1 X-LI-UUID: AAYje7yRt4jiWxp30J/tgg== X-Cache: CONFIG_NOCACHE X-MSEdge-Ref: Ref A: A55D21B5511347E192B6141AB9E43E1F Ref B: EWR30EDGE1608 Ref C: 2024-10-02T10:16:51Z Date: Wed, 02 Oct 2024 10:16:51 GMT Connection: close Content-Length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
131	192.168.2.16	49894	13.107.246.40	443	4912	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-02 10:16:52 UTC	655	OUT	GET /assets/js/collection-types-77c388cf.js HTTP/1.1 Host: apps.microsoft.com Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" Origin: https://apps.microsoft.com sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: same-origin Sec-Fetch-Mode: cors Sec-Fetch-Dest: script Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8 Cookie: MSCC=NR; exp-session-id=b6d0ece2-29a7-4143-931c-d621648d7cb8
2024-10-02 10:16:52 UTC	1192	IN	HTTP/1.1 200 OK Date: Wed, 02 Oct 2024 10:16:52 GMT Content-Type: text/javascript Content-Length: 447 Connection: close Cache-Control: public,max-age=31536000,immutable ETag: "1db136ef678bfbf" Last-Modified: Mon, 30 Sep 2024 19:28:44 GMT Strict-Transport-Security: max-age=2592000 Request-Context: appId=cid-v1:04e455f9-321c-49bf-8d2c-d79fbf5e8cde MS-CV: FiR/gyrKiUe8lUsS.0 X-Content-Type-Options: nosniff Permissions-Policy: unload=() Content-Security-Policy: default-src 'self' data: https://.clarity.ms https://c.bing.com;script-src 'self' wcpstatic.microsoft.com js.monitor.azure.com www.microsoft.com www.clarity.ms get.microsoft.com xvsec.video.microsoft.com bat.bing.com 'unsafe-inline';style-src 'unsafe-inline';connect-src * data: ms-windows-store:;font-src ;img-src data: blob:;media-src 'self' blob: https://sfds-production.azurefd.net https://canvasstorageprodtorus.blob.core.windows.net;frame-src * ms-windows-store:;report-uri https://csp.microsoft.com/report/app-store-web-prod X-Powered-By: ASP.NET x-azure-ref: 20241002T101652Z-15767c5fc554wklc0x4mc5pq0w00000009u00000000019b6 x-fd-int-roxy-purgeid: 66820190 X-Cache: TCP_MISS Accept-Ranges: bytes
2024-10-02 10:16:52 UTC	447	IN	Data Raw: 76 61 72 20 69 3b 28 66 75 6e 63 74 69 6f 6e 28 6c 29 7b 6c 2e 57 69 64 65 3d 22 77 69 64 65 22 2c 6c 2e 57 69 64 65 44 65 74 61 69 6c 73 3d 22 77 69 64 65 2d 64 65 74 61 69 6c 73 22 2c 6c 2e 53 71 75 61 72 65 3d 22 73 71 75 61 72 65 22 2c 6c 2e 53 70 6c 69 74 3d 22 73 70 6c 69 74 22 2c 6c 2e 54 61 6c 6c 3d 22 74 61 6c 6c 22 2c 6c 2e 53 71 75 61 72 65 44 65 74 61 69 6c 73 3d 22 73 71 75 61 72 65 2d 64 65 74 61 69 6c 73 22 2c 6c 2e 52 61 6e 6b 65 64 3d 22 72 61 6e 6b 65 64 22 2c 6c 2e 4f 66 66 65 72 3d 22 6f 66 66 65 72 22 2c 6c 2e 54 72 65 6e 64 69 6e 67 3d 22 74 72 65 6e 64 69 6e 67 22 2c 6c 2e 54 61 6c 6c 54 69 6c 65 3d 22 74 61 6c 6c 2d 74 69 6c 65 22 2c 6c 2e 54 6f 70 4c 69 73 74 3d 22 74 6f 70 2d 6c 69 73 74 22 2c 6c 2e 43 6f 6c 6c 65 63 74 69 6f 6e Data Ascii: var i;(function(l){l.Wide="wide",l.WideDetails="wide-details",l.Square="square",l.Split="split",l.Tall="tall",l.SquareDetails="square-details",l.Ranked="ranked",l.Offer="offer",l.Trending="trending",l.TallTile="tall-tile",l.TopList="top-list",l.Collection

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
132	192.168.2.16	49897	157.240.241.35	443	4912	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-02 10:16:52 UTC	898	OUT	GET /tr/?id=1770559986549030&ev=PageView&dl=https%3A%2F%2Fwww.microsoft.com%2Fen-gb%2Fedge%2Fwelcome%3Fform%3DM10004%26mb03%3Dtrue&rl=&if=false&ts=1727864210807&sw=1280&sh=1024&v=2.9.170&r=stable&ec=0&o=4126&fbp=fb.1.1727864210794.836094937724409315&cs_est=true&ler=empty&it=1727864210083&coo=false&rqm=GET HTTP/1.1 Host: www.facebook.com Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://www.microsoft.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-10-02 10:16:52 UTC	468	IN	HTTP/1.1 200 OK Content-Type: text/plain Access-Control-Allow-Origin: Access-Control-Allow-Credentials: true Strict-Transport-Security: max-age=31536000; includeSubDomains cross-origin-resource-policy: cross-origin Server: proxygen-bolt X-FB-Connection-Quality: EXCELLENT; q=0.9, rtt=2, rtx=0, c=10, mss=1392, tbw=3405, tp=-1, tpl=-1, uplat=0, ullat=0 Alt-Svc: h3=":443"; ma=86400 Date: Wed, 02 Oct 2024 10:16:52 GMT Connection: close Content-Length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
133	192.168.2.16	49895	13.107.246.40	443	4912	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-02 10:16:52 UTC	1095	OUT	GET /assets/icons/download-psi.svg HTTP/1.1 Host: apps.microsoft.com Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" traceparent: 00-3b21d183801646059abf60aea5313c9b-493e3c1559104b6e-01 request-id: \|3b21d183801646059abf60aea5313c9b.493e3c1559104b6e sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: same-origin Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://apps.microsoft.com/apppack/edgefre?hl=en-us&gl=US Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8 Cookie: MSCC=NR; exp-session-id=b6d0ece2-29a7-4143-931c-d621648d7cb8; ai_user=gPFm7QcR2pV4O/zkZSC6dC\|2024-10-02T10:16:49.985Z; ai_session=KeivHP7d5TFls18euJ+R3i\|1727864209993\|1727864209993; _fbp=fb.1.1727864210794.836094937724409315; _clck=1x4xmda%7C2%7Cfpo%7C0%7C1736; _uetsid=70ac830080a711efa9fc9be06d42c5d1; _uetvid=70acc12080a711efa4bbe5908cfb5aee
2024-10-02 10:16:52 UTC	1273	IN	HTTP/1.1 200 OK Date: Wed, 02 Oct 2024 10:16:52 GMT Content-Type: image/svg+xml Content-Length: 1698 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=2592000 ETag: "1db136e4014dfa2" Last-Modified: Mon, 30 Sep 2024 19:23:38 GMT Strict-Transport-Security: max-age=2592000 Request-Context: appId=cid-v1:04e455f9-321c-49bf-8d2c-d79fbf5e8cde MS-CV: ISb4vCGtq0CZ4mAl.0 X-Content-Type-Options: nosniff Permissions-Policy: unload=() Content-Security-Policy: default-src 'self' data: https://.clarity.ms https://c.bing.com;script-src 'self' wcpstatic.microsoft.com js.monitor.azure.com www.microsoft.com www.clarity.ms get.microsoft.com xvsec.video.microsoft.com bat.bing.com 'unsafe-inline';style-src 'unsafe-inline';connect-src * data: ms-windows-store:;font-src ;img-src data: blob:;media-src 'self' blob: https://sfds-production.azurefd.net https://canvasstorageprodtorus.blob.core.windows.net;frame-src * ms-windows-store:;report-uri https://csp.microsoft.com/report/app-store-web-prod X-Powered-By: ASP.NET x-azure-ref: 20241002T101652Z-15767c5fc55xsgnlxyxy40f4m00000000990000000007cnd x-fd-int-roxy-purgeid: 66820190 X-Cache: TCP_MISS Accept-Ranges: bytes
2024-10-02 10:16:52 UTC	1698	IN	Data Raw: 3c 73 76 67 20 77 69 64 74 68 3d 22 31 34 22 20 68 65 69 67 68 74 3d 22 31 36 22 20 76 69 65 77 42 6f 78 3d 22 30 20 30 20 31 34 20 31 36 22 20 66 69 6c 6c 3d 22 6e 6f 6e 65 22 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 30 2f 73 76 67 22 3e 0d 0a 3c 70 61 74 68 20 64 3d 22 4d 31 32 2e 37 36 20 31 33 2e 33 39 39 39 48 31 2e 32 34 43 31 2e 30 30 31 33 20 31 33 2e 33 39 39 39 20 30 2e 37 37 32 33 38 33 20 31 33 2e 34 39 34 38 20 30 2e 36 30 33 36 20 31 33 2e 36 36 33 36 43 30 2e 34 33 34 38 31 38 20 31 33 2e 38 33 32 33 20 30 2e 33 33 39 39 39 36 20 31 34 2e 30 36 31 33 20 30 2e 33 33 39 39 39 36 20 31 34 2e 32 39 39 39 43 30 2e 33 33 39 39 39 36 20 31 34 2e 35 33 38 36 20 30 2e 34 33 34 38 31 38 20 31 34 2e 37 36 Data Ascii: <svg width="14" height="16" viewBox="0 0 14 16" fill="none" xmlns="http://www.w3.org/2000/svg"><path d="M12.76 13.3999H1.24C1.0013 13.3999 0.772383 13.4948 0.6036 13.6636C0.434818 13.8323 0.339996 14.0613 0.339996 14.2999C0.339996 14.5386 0.434818 14.76

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
134	192.168.2.16	49896	20.42.73.30	443	4912	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-02 10:16:52 UTC	706	OUT	OPTIONS /OneCollector/1.0/?cors=true&content-type=application/x-json-stream&w=0 HTTP/1.1 Host: browser.events.data.microsoft.com Connection: keep-alive Accept: / Access-Control-Request-Method: POST Access-Control-Request-Headers: apikey,cache-control,client-id,client-version,content-type,time-delta-to-apply-millis,upload-time Origin: https://www.microsoft.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Sec-Fetch-Mode: cors Sec-Fetch-Site: same-site Sec-Fetch-Dest: empty Referer: https://www.microsoft.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-10-02 10:16:52 UTC	606	IN	HTTP/1.1 200 OK Cache-Control: public, 3600 Content-Length: 0 Server: Microsoft-HTTPAPI/2.0 Strict-Transport-Security: max-age=31536000 Access-Control-Allow-Credentials: true Access-Control-Allow-Headers: AuthMsaDeviceTicket,AuthXToken,Content-Encoding,Content-Type,Cache-Control,Client-Id,SDK-Name,sdk-version,apikey,x-apikey,client-version,upload-time,time-delta-to-apply-millis,client-time-epoch-millis,persistence-mode,reliability-mode,NoResponseBody Access-Control-Max-Age: 3600 Access-Control-Allow-Origin: https://www.microsoft.com Date: Wed, 02 Oct 2024 10:16:52 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
135	192.168.2.16	49899	150.171.28.10	443	4912	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-02 10:16:52 UTC	1126	OUT	GET /action/0?ti=355008692&Ver=2&mid=2f7ef59e-c4f4-48b2-910f-313aa21048be&sid=70ac830080a711efa9fc9be06d42c5d1&vid=70acc12080a711efa4bbe5908cfb5aee&vids=1&msclkid=N&uach=pv%3D10.0.0&pi=918639831&lg=en-GB&sw=1280&sh=1024&sc=24&tl=Welcome%20to%20Microsoft%20Edge&p=https%3A%2F%2Fwww.microsoft.com%2Fen-gb%2Fedge%2Fwelcome%3Fform%3DM10004%26mb03%3Dtrue&r=&lt=11581&evt=pageLoad&sv=1&cdb=AQAQ&rn=989132 HTTP/1.1 Host: bat.bing.com Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 X-Edge-Shopping-Flag: 1 Sec-MS-GEC: FF699648EBF162654E01182ED0BD24EDB1A2721B7E78C7D8756497D88A893629 Sec-MS-GEC-Version: 1-117.0.2045.47 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://www.microsoft.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-10-02 10:16:52 UTC	864	IN	HTTP/1.1 204 No Content Cache-Control: no-cache, must-revalidate Pragma: no-cache Expires: Fri, 01 Jan 1990 00:00:00 GMT Set-Cookie: MUID=342C7FBD720A6AA836916AB173786BD6; domain=.bing.com; expires=Mon, 27-Oct-2025 10:16:52 GMT; path=/; SameSite=None; Secure; Priority=High; Set-Cookie: MR=0; domain=bat.bing.com; expires=Wed, 09-Oct-2024 10:16:52 GMT; path=/; SameSite=None; Secure; Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * X-Cache: CONFIG_NOCACHE Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version X-MSEdge-Ref: Ref A: 46F0621335C44BBC99BFD7A19D0F5FA0 Ref B: EWR30EDGE0813 Ref C: 2024-10-02T10:16:52Z Date: Wed, 02 Oct 2024 10:16:52 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
136	192.168.2.16	49900	150.171.28.10	443	4912	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-02 10:16:52 UTC	1039	OUT	GET /action/0?ti=355008692&Ver=2&mid=2f7ef59e-c4f4-48b2-910f-313aa21048be&sid=70ac830080a711efa9fc9be06d42c5d1&vid=70acc12080a711efa4bbe5908cfb5aee&vids=0&msclkid=N&ea=Other-Info-Screenwidth-1280&en=Y&p=https%3A%2F%2Fwww.microsoft.com%2Fen-gb%2Fedge%2Fwelcome&sw=1280&sh=1024&sc=24&evt=custom&cdb=AQAQ&rn=692432 HTTP/1.1 Host: bat.bing.com Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 X-Edge-Shopping-Flag: 1 Sec-MS-GEC: FF699648EBF162654E01182ED0BD24EDB1A2721B7E78C7D8756497D88A893629 Sec-MS-GEC-Version: 1-117.0.2045.47 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://www.microsoft.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-10-02 10:16:52 UTC	864	IN	HTTP/1.1 204 No Content Cache-Control: no-cache, must-revalidate Pragma: no-cache Expires: Fri, 01 Jan 1990 00:00:00 GMT Set-Cookie: MUID=37D014EE9BEA6570098401E29A4264B0; domain=.bing.com; expires=Mon, 27-Oct-2025 10:16:52 GMT; path=/; SameSite=None; Secure; Priority=High; Set-Cookie: MR=0; domain=bat.bing.com; expires=Wed, 09-Oct-2024 10:16:52 GMT; path=/; SameSite=None; Secure; Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * X-Cache: CONFIG_NOCACHE Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version X-MSEdge-Ref: Ref A: F5F09EC9ACCA4E6E9432CC1A6405BC3E Ref B: EWR30EDGE1416 Ref C: 2024-10-02T10:16:52Z Date: Wed, 02 Oct 2024 10:16:52 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
137	192.168.2.16	49902	150.171.28.10	443	4912	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-02 10:16:52 UTC	1040	OUT	GET /action/0?ti=355008692&Ver=2&mid=2f7ef59e-c4f4-48b2-910f-313aa21048be&sid=70ac830080a711efa9fc9be06d42c5d1&vid=70acc12080a711efa4bbe5908cfb5aee&vids=0&msclkid=N&ea=Other-Info-Screenheight-1024&en=Y&p=https%3A%2F%2Fwww.microsoft.com%2Fen-gb%2Fedge%2Fwelcome&sw=1280&sh=1024&sc=24&evt=custom&cdb=AQAQ&rn=591063 HTTP/1.1 Host: bat.bing.com Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 X-Edge-Shopping-Flag: 1 Sec-MS-GEC: FF699648EBF162654E01182ED0BD24EDB1A2721B7E78C7D8756497D88A893629 Sec-MS-GEC-Version: 1-117.0.2045.47 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://www.microsoft.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-10-02 10:16:52 UTC	864	IN	HTTP/1.1 204 No Content Cache-Control: no-cache, must-revalidate Pragma: no-cache Expires: Fri, 01 Jan 1990 00:00:00 GMT Set-Cookie: MUID=3076D10D8E6C6FF30741C4018F456E69; domain=.bing.com; expires=Mon, 27-Oct-2025 10:16:52 GMT; path=/; SameSite=None; Secure; Priority=High; Set-Cookie: MR=0; domain=bat.bing.com; expires=Wed, 09-Oct-2024 10:16:52 GMT; path=/; SameSite=None; Secure; Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * X-Cache: CONFIG_NOCACHE Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version X-MSEdge-Ref: Ref A: 57C51611E9064D89B94D14120C464141 Ref B: EWR30EDGE0206 Ref C: 2024-10-02T10:16:52Z Date: Wed, 02 Oct 2024 10:16:52 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
138	192.168.2.16	49903	150.171.28.10	443	4912	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-02 10:16:52 UTC	1035	OUT	GET /action/0?ti=355008692&Ver=2&mid=2f7ef59e-c4f4-48b2-910f-313aa21048be&sid=70ac830080a711efa9fc9be06d42c5d1&vid=70acc12080a711efa4bbe5908cfb5aee&vids=0&msclkid=N&ea=Other-Info-Pixelratio-1&en=Y&p=https%3A%2F%2Fwww.microsoft.com%2Fen-gb%2Fedge%2Fwelcome&sw=1280&sh=1024&sc=24&evt=custom&cdb=AQAQ&rn=953385 HTTP/1.1 Host: bat.bing.com Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 X-Edge-Shopping-Flag: 1 Sec-MS-GEC: FF699648EBF162654E01182ED0BD24EDB1A2721B7E78C7D8756497D88A893629 Sec-MS-GEC-Version: 1-117.0.2045.47 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://www.microsoft.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-10-02 10:16:52 UTC	864	IN	HTTP/1.1 204 No Content Cache-Control: no-cache, must-revalidate Pragma: no-cache Expires: Fri, 01 Jan 1990 00:00:00 GMT Set-Cookie: MUID=227E17D1256E6EB43BAC02DD24C66F47; domain=.bing.com; expires=Mon, 27-Oct-2025 10:16:52 GMT; path=/; SameSite=None; Secure; Priority=High; Set-Cookie: MR=0; domain=bat.bing.com; expires=Wed, 09-Oct-2024 10:16:52 GMT; path=/; SameSite=None; Secure; Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * X-Cache: CONFIG_NOCACHE Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version X-MSEdge-Ref: Ref A: D42C41DEE3DF4A0F907B282C7A6BA10D Ref B: EWR30EDGE1616 Ref C: 2024-10-02T10:16:52Z Date: Wed, 02 Oct 2024 10:16:51 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
139	192.168.2.16	49901	150.171.28.10	443	4912	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-02 10:16:52 UTC	1037	OUT	GET /action/0?ti=355008692&Ver=2&mid=2f7ef59e-c4f4-48b2-910f-313aa21048be&sid=70ac830080a711efa9fc9be06d42c5d1&vid=70acc12080a711efa4bbe5908cfb5aee&vids=0&msclkid=N&ea=Action-Firstslide-AiIntro&en=Y&p=https%3A%2F%2Fwww.microsoft.com%2Fen-gb%2Fedge%2Fwelcome&sw=1280&sh=1024&sc=24&evt=custom&cdb=AQAQ&rn=399722 HTTP/1.1 Host: bat.bing.com Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 X-Edge-Shopping-Flag: 1 Sec-MS-GEC: FF699648EBF162654E01182ED0BD24EDB1A2721B7E78C7D8756497D88A893629 Sec-MS-GEC-Version: 1-117.0.2045.47 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://www.microsoft.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-10-02 10:16:52 UTC	864	IN	HTTP/1.1 204 No Content Cache-Control: no-cache, must-revalidate Pragma: no-cache Expires: Fri, 01 Jan 1990 00:00:00 GMT Set-Cookie: MUID=2609E576E1796E461EBDF07AE01B6F4F; domain=.bing.com; expires=Mon, 27-Oct-2025 10:16:52 GMT; path=/; SameSite=None; Secure; Priority=High; Set-Cookie: MR=0; domain=bat.bing.com; expires=Wed, 09-Oct-2024 10:16:52 GMT; path=/; SameSite=None; Secure; Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * X-Cache: CONFIG_NOCACHE Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version X-MSEdge-Ref: Ref A: 82E1CC1FDF304AF09EAA3B48D5A65F1A Ref B: EWR30EDGE1005 Ref C: 2024-10-02T10:16:52Z Date: Wed, 02 Oct 2024 10:16:51 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
140	192.168.2.16	49904	13.107.42.14	443	4912	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-02 10:16:52 UTC	1021	OUT	GET /collect?v=2&fmt=js&pid=7850&time=1727864210223&li_adsId=c6366846-7f41-4708-9fb6-3269a23fdc13&url=https%3A%2F%2Fwww.microsoft.com%2Fen-gb%2Fedge%2Fwelcome%3Fform%3DM10004%26mb03%3Dtrue&cookiesTest=true HTTP/1.1 Host: px.ads.linkedin.com Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://www.microsoft.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8 Cookie: li_sugr=d35b3f83-bdbb-45a3-85ce-a0229f826989; bcookie="v=2&2516b960-85ad-4191-847f-415a33eda43e"; lidc="b=TGST06:s=T:r=T:a=T:p=T:g=3013:u=1:x=1:i=1727864211:t=1727950611:v=2:sig=AQG_p4RFuAy5RLp45N0Pq_b0ZbnDEu0_"
2024-10-02 10:16:52 UTC	1486	IN	HTTP/1.1 302 Found Location: https://www.linkedin.com/px/li_sync?redirect=https%3A%2F%2Fpx.ads.linkedin.com%2Fcollect%3Fv%3D2%26fmt%3Djs%26pid%3D7850%26time%3D1727864210223%26li_adsId%3Dc6366846-7f41-4708-9fb6-3269a23fdc13%26url%3Dhttps%253A%252F%252Fwww.microsoft.com%252Fen-gb%252Fedge%252Fwelcome%253Fform%253DM10004%2526mb03%253Dtrue%26cookiesTest%3Dtrue%26liSync%3Dtrue Set-Cookie: li_sugr=d35b3f83-bdbb-45a3-85ce-a0229f826989; Max-Age=7776000; Expires=Tue, 31 Dec 2024 10:16:52 GMT; SameSite=None; Path=/; Domain=.linkedin.com; Secure Set-Cookie: UserMatchHistory=AQIyePVLc9XnZgAAAZJMu4yU2_WgOCBxObdkN0Wk2LpTA7gLTgo39UVR7LkM-ElLklnw9wU5PMNQRQ; Max-Age=2592000; Expires=Fri, 01 Nov 2024 10:16:52 GMT; SameSite=None; Path=/; Domain=.linkedin.com; Secure Set-Cookie: AnalyticsSyncHistory=AQKSK2PlgfRT2AAAAZJMu4yUVhKeSnIwUJNjMHTmLuEK0NvpIjlatlsxaB_7NFCL0oKdIIi5nD5QhsrMvCHBIw; Max-Age=2592000; Expires=Fri, 01 Nov 2024 10:16:52 GMT; SameSite=None; Path=/; Domain=.linkedin.com; Secure Set-Cookie: bcookie="v=2&2516b960-85ad-4191-847f-415a33eda43e"; domain=.linkedin.com; Path=/; Secure; Expires=Thu, 02-Oct-2025 10:16:52 GMT; SameSite=None LinkedIn-Action: 1 X-Li-Fabric: prod-ltx1 X-Li-Pop: afd-prod-ltx1-x X-Li-Proto: http/1.1 X-LI-UUID: AAYje7ydCp0PGx+rpcZApw== X-Cache: CONFIG_NOCACHE X-MSEdge-Ref: Ref A: 441B6E63C3954523A7E67C4529E9B2E9 Ref B: EWR311000102011 Ref C: 2024-10-02T10:16:52Z Date: Wed, 02 Oct 2024 10:16:52 GMT Connection: close Content-Length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
141	192.168.2.16	49898	13.107.246.40	443	4912	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-02 10:16:52 UTC	639	OUT	GET /tag/uet/355008692?insights=1 HTTP/1.1 Host: www.clarity.ms Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://www.microsoft.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8 Cookie: CLID=c6083d87285244068a54b7c1410cd9fd.20241002.20251002
2024-10-02 10:16:52 UTC	379	IN	HTTP/1.1 200 OK Date: Wed, 02 Oct 2024 10:16:52 GMT Content-Type: application/x-javascript Content-Length: 840 Connection: close Cache-Control: no-cache, no-store Expires: -1 Request-Context: appId=cid-v1:3d284f99-f285-495c-ac33-dedd7ecf1ac8 x-azure-ref: 20241002T101652Z-15767c5fc55ncqdn59ub6rndq00000000910000000008b4x X-Cache: CONFIG_NOCACHE Accept-Ranges: bytes
2024-10-02 10:16:52 UTC	840	IN	Data Raw: 21 66 75 6e 63 74 69 6f 6e 28 63 2c 6c 2c 61 2c 72 2c 69 2c 74 2c 79 29 7b 61 5b 63 5d 3d 61 5b 63 5d 7c 7c 66 75 6e 63 74 69 6f 6e 28 29 7b 28 61 5b 63 5d 2e 71 3d 61 5b 63 5d 2e 71 7c 7c 5b 5d 29 2e 70 75 73 68 28 61 72 67 75 6d 65 6e 74 73 29 7d 3b 66 75 6e 63 74 69 6f 6e 20 73 79 6e 63 28 29 7b 28 6e 65 77 20 49 6d 61 67 65 29 2e 73 72 63 3d 22 68 74 74 70 73 3a 2f 2f 63 2e 63 6c 61 72 69 74 79 2e 6d 73 2f 63 2e 67 69 66 22 7d 22 63 6f 6d 70 6c 65 74 65 22 3d 3d 64 6f 63 75 6d 65 6e 74 2e 72 65 61 64 79 53 74 61 74 65 3f 73 79 6e 63 28 29 3a 77 69 6e 64 6f 77 2e 61 64 64 45 76 65 6e 74 4c 69 73 74 65 6e 65 72 28 22 6c 6f 61 64 22 2c 73 79 6e 63 29 3b 61 5b 63 5d 28 22 6d 65 74 61 64 61 74 61 22 2c 28 66 75 6e 63 74 69 6f 6e 28 29 7b 61 5b 63 5d 28 22 Data Ascii: !function(c,l,a,r,i,t,y){a[c]=a[c]\|\|function(){(a[c].q=a[c].q\|\|[]).push(arguments)};function sync(){(new Image).src="https://c.clarity.ms/c.gif"}"complete"==document.readyState?sync():window.addEventListener("load",sync);a[c]("metadata",(function(){a[c]("

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
142	192.168.2.16	49905	20.114.189.70	443	4912	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-02 10:16:52 UTC	627	OUT	POST /collect HTTP/1.1 Host: t.clarity.ms Connection: keep-alive Content-Length: 498 sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" Accept: application/x-clarity-gzip sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Origin: https://www.microsoft.com Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://www.microsoft.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-10-02 10:16:52 UTC	498	OUT	Data Raw: 1f 8b 08 00 00 00 00 00 00 0a 5d 52 db 6a db 40 10 fd 95 65 1f 4a 02 5b 69 6f 92 d6 09 a1 a4 a1 a4 25 75 5e 12 30 45 88 a0 cb da 5e 74 59 23 c9 91 e3 d2 7e 7b 67 2c 87 40 11 88 33 33 3b e7 ec 99 d9 df d4 d2 ab 94 f2 20 09 74 42 99 60 9c 09 29 18 b5 d5 6b db bd 0d 6d 5d 53 46 c5 41 1f da 2a 07 74 34 79 ae d4 7c 8e 67 8c e6 d0 9c 8a 88 19 e8 52 92 2d 04 24 53 1d 33 21 fe 4b 48 c3 e8 ab 1b 5c d1 58 0a 19 d4 50 9a d1 bb 97 1f 4f 94 81 3e cd ce 59 64 4e e9 d2 1f 5d d3 e4 61 14 70 72 b1 72 5d e5 a7 81 3c 3e 13 c1 03 7e 4d 20 11 eb 6b 72 88 f5 25 b9 dd ed 1a bb b2 c5 83 1b c3 48 25 81 8a c9 c5 c3 f7 e7 e5 4f 46 1a 57 5b 72 6f cb da 5f 92 bb 6d ef 5b 1b 0a 91 04 1c 3f f2 94 af f3 de bd b7 7c ab 36 e7 9a e4 3a c2 51 64 70 93 94 6e c7 71 37 5c 85 e1 34 4d 41 eb ca Data Ascii: ]Rj@eJ[io%u^0E^tY#~{g,@33; tB`)km]SFA*t4y\|gR-$S3!KH\XPO>YdN]aprr]<>~M kr%H%OFW[ro_m[?\|6:Qdpnq7\4MA
2024-10-02 10:16:52 UTC	276	IN	HTTP/1.1 204 No Content Server: nginx Date: Wed, 02 Oct 2024 10:16:52 GMT Connection: close Access-Control-Allow-Credentials: true Access-Control-Allow-Origin: https://www.microsoft.com Vary: Origin Request-Context: appId=cid-v1:593e4080-f032-4d00-a652-e17f01252a9d

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
143	192.168.2.16	49906	20.114.189.70	443	4912	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-02 10:16:52 UTC	629	OUT	POST /collect HTTP/1.1 Host: t.clarity.ms Connection: keep-alive Content-Length: 599 sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" Accept: application/x-clarity-gzip sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Origin: https://apps.microsoft.com Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://apps.microsoft.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-10-02 10:16:52 UTC	599	OUT	Data Raw: 1f 8b 08 00 00 00 00 00 00 0a 7d 53 6d 6f d3 30 10 fe 2b 91 3f a0 4d 3a 1c bf 25 71 36 4d 68 4c d3 40 63 fb d2 a1 09 55 d5 94 25 6e 6a 9a 26 59 92 a6 1d 08 7e 3b 77 5d 07 03 04 8a e4 dc 3d 77 8f fd dc d9 f7 95 39 76 34 65 82 27 dc 24 0c 24 08 90 26 05 e6 eb c7 ac 6c 12 d1 d6 0c d8 26 b3 e3 32 47 43 6e 5d e7 8b c5 53 9e 98 01 cb 90 3c 35 1a 2c 68 81 cc 08 b1 a9 49 40 ca df 7d 65 81 8d be f7 f7 95 63 84 58 50 06 d8 f9 b6 3d 6b ea c1 6d 87 89 1b 08 8f 10 4f 21 c5 58 aa 62 64 27 76 bf c4 36 02 99 46 0a 54 a2 35 c4 5a a8 17 8b 04 99 68 8b 7b b2 3a 1b 7d 99 0d 0e 95 2e 86 a1 0d 25 97 8c 82 11 06 9f 7e 78 08 95 a7 f1 f4 b3 bb f7 13 06 53 66 d9 6c 8f 52 51 53 76 d5 7c f1 55 95 85 11 17 c1 c1 ad af 8b 66 d3 07 d7 37 81 14 5c 1c 07 08 c4 e6 38 d8 c6 e6 30 38 6d db Data Ascii: }Smo0+?M:%q6MhL@cU%nj&Y~;w]=w9v4e'$$&l&2GCn]S<5,hI@}ecXP=kmO!Xbd'v6FT5Zh{:}.%~xSflRQSv\|Uf7\808m
2024-10-02 10:16:52 UTC	277	IN	HTTP/1.1 204 No Content Server: nginx Date: Wed, 02 Oct 2024 10:16:52 GMT Connection: close Access-Control-Allow-Credentials: true Access-Control-Allow-Origin: https://apps.microsoft.com Vary: Origin Request-Context: appId=cid-v1:593e4080-f032-4d00-a652-e17f01252a9d

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
144	192.168.2.16	49910	104.118.9.224	443	4912	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-02 10:16:53 UTC	722	OUT	GET /image/apps.8453.13655054093851568.4a371b72-2ce8-4bdb-9d83-be49894d3fa0.7f3687b9-847d-4f86-bb5c-c73259e2b38e?w=75 HTTP/1.1 Host: store-images.s-microsoft.com Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://apps.microsoft.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-10-02 10:16:53 UTC	411	IN	HTTP/1.1 200 OK Cache-Control: public, max-age=7776000, s-maxage=7776000 Content-Type: image/png Last-Modified: Thu, 25 Jan 2024 15:01:40 GMT Accept-Ranges: none ETag: W/"AEArrCz4hLTcinHzgId1x2MT2Nwa4tQgMHg4REMxREI2ODk1REJCODU" MS-CV: tqKjRJnG5U2Lsqeb.0 Access-Control-Expose-Headers: MS-CV Content-Length: 3031 Date: Wed, 02 Oct 2024 10:16:53 GMT Connection: close Access-Control-Allow-Origin: *
2024-10-02 10:16:53 UTC	3031	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 4b 00 00 00 4b 08 06 00 00 00 38 4e 7a ea 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 00 09 70 48 59 73 00 00 0b 12 00 00 0b 12 01 d2 dd 7e fc 00 00 0b 6c 49 44 41 54 78 5e ed 9c 79 70 5d 55 1d c7 fb b7 7f a1 14 da 02 2d 08 6d 10 41 dc 70 77 dc 66 5c b0 2e 48 55 a4 b4 85 22 89 54 4b 41 11 b0 28 42 6b 15 6b 17 40 76 90 16 10 a7 3a 5a 28 58 8b 94 2a 32 8a 30 52 68 f6 66 4f 9b 66 69 92 57 b3 35 4b b3 1d 7f 9f 73 ef 23 37 27 e7 26 77 7b 29 33 de 1f f3 9d c7 bb ef ac df 7b ce 6f 3b 27 9d b1 a0 38 bf 7a 41 e5 8a cc fc e2 82 14 3e 58 50 b1 22 93 57 92 5f 33 43 be 74 9f 5d bf 52 e5 55 ae 48 e1 83 b3 eb 56 aa 05 25 05 3d 90 95 e1 81 7c 49 e1 83 bc 0a f8 c9 3f Data Ascii: PNGIHDRKK8NzsRGBgAMAapHYs~lIDATx^yp]U-mApwf\.HU"TKA(Bkk@v:Z(X*20RhfOfiW5Ks#7'&w{)3{o;'8zA>XP"W_3Ct]RUHV%=\|I?

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
145	192.168.2.16	49911	104.118.9.224	443	4912	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-02 10:16:53 UTC	722	OUT	GET /image/apps.56161.9007199266246365.1d5a6a53-3c49-4f80-95d7-78d76b0e05d0.a3e87fea-e03e-4c0a-8f26-9ecef205fa7b?w=75 HTTP/1.1 Host: store-images.s-microsoft.com Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://apps.microsoft.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-10-02 10:16:53 UTC	411	IN	HTTP/1.1 200 OK Cache-Control: public, max-age=7776000, s-maxage=7776000 Content-Type: image/png Last-Modified: Thu, 08 Oct 2020 21:09:44 GMT Accept-Ranges: none ETag: W/"AEArrCz4hLTcinHzgId1x2MT2Nwa4tQgMHg4RDg2QkNFN0FEQUYyOEU" MS-CV: yRjpEjuKt0m3Jy+L.0 Access-Control-Expose-Headers: MS-CV Content-Length: 1903 Date: Wed, 02 Oct 2024 10:16:53 GMT Connection: close Access-Control-Allow-Origin: *
2024-10-02 10:16:53 UTC	1903	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 4b 00 00 00 4b 08 06 00 00 00 38 4e 7a ea 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 00 09 70 48 59 73 00 00 0e c3 00 00 0e c3 01 c7 6f a8 64 00 00 07 04 49 44 41 54 78 5e ed 9c 69 6c 54 55 14 c7 67 ba 00 65 b1 d0 b2 94 20 88 6c 4a 10 82 46 16 4b 58 ca 56 f6 35 02 0a 11 15 91 28 c8 52 84 82 e2 86 e0 c2 07 bf 10 13 45 14 02 a8 68 40 76 81 80 2c 2d 8b 04 50 11 89 91 52 63 61 96 ce d2 d9 da d9 99 39 9e 73 de 2b ed 94 99 d7 b9 54 63 62 ee 2f b9 a1 f3 bf 77 ee 7b ef f7 ee bb f7 be f9 80 2e 1a 8d 96 60 b1 cb 52 6f b9 41 b2 3c 20 a9 17 f4 54 49 b2 ec ea 67 89 06 e8 a9 42 ca 4a 12 29 4b 00 29 4b 00 29 4b 00 29 4b 00 29 4b 00 29 4b 00 29 4b 00 29 4b 00 29 4b Data Ascii: PNGIHDRKK8NzsRGBgAMAapHYsodIDATx^ilTUge lJFKXV5(REh@v,-PRca9s+Tcb/w{.`RoA< TIgBJ)K)K)K)K)K)K)K)K)K

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
146	192.168.2.16	49912	104.118.9.224	443	4912	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-02 10:16:53 UTC	723	OUT	GET /image/apps.25776.14473651905739879.c2c2c20a-48ca-4b7a-a0c5-392cddcd557e.dbe766f0-50a3-4270-957c-d06415f86f39?w=75 HTTP/1.1 Host: store-images.s-microsoft.com Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://apps.microsoft.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-10-02 10:16:53 UTC	411	IN	HTTP/1.1 200 OK Cache-Control: public, max-age=7776000, s-maxage=7776000 Content-Type: image/png Last-Modified: Wed, 05 Apr 2017 17:39:16 GMT Accept-Ranges: none ETag: W/"AEArrCz4hLTcinHzgId1x2MT2Nwa4tQgMHg4RDQ3QzRBQUU1MkRBNzQ" MS-CV: oJycOGZ8TUm8f0Lt.0 Access-Control-Expose-Headers: MS-CV Content-Length: 2541 Date: Wed, 02 Oct 2024 10:16:53 GMT Connection: close Access-Control-Allow-Origin: *
2024-10-02 10:16:53 UTC	2541	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 4b 00 00 00 4b 08 06 00 00 00 38 4e 7a ea 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 00 09 70 48 59 73 00 00 0e c3 00 00 0e c3 01 c7 6f a8 64 00 00 09 82 49 44 41 54 78 5e ed 5a 7d 6c 1b 67 1d 4e 05 62 d3 ba d2 6d 08 69 1a 13 4c f0 cf a4 55 43 80 56 d8 86 06 d2 b4 4d 42 1a 43 1a a2 7c 4e 8c a9 45 13 1b d5 56 84 10 9d 56 40 43 6d 29 6d 37 d8 aa 42 bb 0c d2 6d 5d 9a 95 7e 97 36 49 63 e7 cb 4d eb 24 4e 1c db 71 12 7f 9f 3f cf 3e db 67 9f ef fc 91 f4 e5 f9 5d de b4 6e ea d2 74 e9 da b8 bd 47 7e 62 c7 f7 be 77 ef ef f1 ef f7 dc ef b5 dc 60 c0 80 01 03 06 0c 18 30 60 c0 80 01 03 06 0c 18 30 60 c0 80 01 03 75 8d 2d 56 e5 ce 65 4d b1 5b f8 bf 06 66 e3 e1 f7 Data Ascii: PNGIHDRKK8NzsRGBgAMAapHYsodIDATx^Z}lgNbmiLUCVMBC\|NEVV@Cm)m7Bm]~6IcM$Nq?>g]ntG~bw`0`0`u-VeM[f

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
147	192.168.2.16	49907	13.107.246.40	443	4912	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-02 10:16:53 UTC	799	OUT	GET /service-worker.js HTTP/1.1 Host: apps.microsoft.com Connection: keep-alive Cache-Control: max-age=0 Accept: / Service-Worker: script User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: same-origin Sec-Fetch-Dest: serviceworker Referer: https://apps.microsoft.com/apppack/edgefre?hl=en-us&gl=US Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8 Cookie: MSCC=NR; exp-session-id=b6d0ece2-29a7-4143-931c-d621648d7cb8; ai_user=gPFm7QcR2pV4O/zkZSC6dC\|2024-10-02T10:16:49.985Z; ai_session=KeivHP7d5TFls18euJ+R3i\|1727864209993\|1727864209993; _fbp=fb.1.1727864210794.836094937724409315; _clck=1x4xmda%7C2%7Cfpo%7C0%7C1736
2024-10-02 10:16:53 UTC	1273	IN	HTTP/1.1 200 OK Date: Wed, 02 Oct 2024 10:16:53 GMT Content-Type: text/javascript Content-Length: 71206 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=3600 ETag: "1db136ef7a8fd26" Last-Modified: Mon, 30 Sep 2024 19:28:46 GMT Strict-Transport-Security: max-age=2592000 Request-Context: appId=cid-v1:04e455f9-321c-49bf-8d2c-d79fbf5e8cde MS-CV: EnWgelFu3U2z73+6.0 X-Content-Type-Options: nosniff Permissions-Policy: unload=() Content-Security-Policy: default-src 'self' data: https://.clarity.ms https://c.bing.com;script-src 'self' wcpstatic.microsoft.com js.monitor.azure.com www.microsoft.com www.clarity.ms get.microsoft.com xvsec.video.microsoft.com bat.bing.com 'unsafe-inline';style-src 'unsafe-inline';connect-src * data: ms-windows-store:;font-src ;img-src data: blob:;media-src 'self' blob: https://sfds-production.azurefd.net https://canvasstorageprodtorus.blob.core.windows.net;frame-src * ms-windows-store:;report-uri https://csp.microsoft.com/report/app-store-web-prod X-Powered-By: ASP.NET x-azure-ref: 20241002T101653Z-15767c5fc55kg97hfq5uqyxxaw00000009fg000000001wwx x-fd-int-roxy-purgeid: 66820190 X-Cache: TCP_MISS Accept-Ranges: bytes
2024-10-02 10:16:53 UTC	15111	IN	Data Raw: 74 72 79 20 7b 0a 20 20 73 65 6c 66 5b 22 77 6f 72 6b 62 6f 78 3a 63 6f 72 65 3a 36 2e 36 2e 30 22 5d 20 26 26 20 5f 28 29 3b 0a 7d 20 63 61 74 63 68 20 7b 0a 7d 0a 63 6f 6e 73 74 20 65 65 20 3d 20 28 73 2c 20 2e 2e 2e 65 29 20 3d 3e 20 7b 0a 20 20 6c 65 74 20 74 20 3d 20 73 3b 0a 20 20 72 65 74 75 72 6e 20 65 2e 6c 65 6e 67 74 68 20 3e 20 30 20 26 26 20 28 74 20 2b 3d 20 60 20 3a 3a 20 24 7b 4a 53 4f 4e 2e 73 74 72 69 6e 67 69 66 79 28 65 29 7d 60 29 2c 20 74 3b 0a 7d 2c 20 74 65 20 3d 20 65 65 3b 0a 63 6c 61 73 73 20 68 20 65 78 74 65 6e 64 73 20 45 72 72 6f 72 20 7b 0a 20 20 2f 2a 2a 0a 20 20 20 2a 0a 20 20 20 2a 20 40 70 61 72 61 6d 20 7b 73 74 72 69 6e 67 7d 20 65 72 72 6f 72 43 6f 64 65 20 54 68 65 20 65 72 72 6f 72 20 63 6f 64 65 20 74 68 61 74 0a Data Ascii: try { self["workbox:core:6.6.0"] && _();} catch {}const ee = (s, ...e) => { let t = s; return e.length > 0 && (t += ` :: ${JSON.stringify(e)}`), t;}, te = ee;class h extends Error { /** * * @param {string} errorCode The error code that
2024-10-02 10:16:53 UTC	16384	IN	Data Raw: 3b 0a 20 20 20 20 61 20 3d 20 61 77 61 69 74 20 63 61 63 68 65 73 2e 6d 61 74 63 68 28 72 2c 20 63 29 3b 0a 20 20 20 20 66 6f 72 20 28 63 6f 6e 73 74 20 6f 20 6f 66 20 74 68 69 73 2e 69 74 65 72 61 74 65 43 61 6c 6c 62 61 63 6b 73 28 22 63 61 63 68 65 64 52 65 73 70 6f 6e 73 65 57 69 6c 6c 42 65 55 73 65 64 22 29 29 0a 20 20 20 20 20 20 61 20 3d 20 61 77 61 69 74 20 6f 28 7b 0a 20 20 20 20 20 20 20 20 63 61 63 68 65 4e 61 6d 65 3a 20 6e 2c 0a 20 20 20 20 20 20 20 20 6d 61 74 63 68 4f 70 74 69 6f 6e 73 3a 20 69 2c 0a 20 20 20 20 20 20 20 20 63 61 63 68 65 64 52 65 73 70 6f 6e 73 65 3a 20 61 2c 0a 20 20 20 20 20 20 20 20 72 65 71 75 65 73 74 3a 20 72 2c 0a 20 20 20 20 20 20 20 20 65 76 65 6e 74 3a 20 74 68 69 73 2e 65 76 65 6e 74 0a 20 20 20 20 20 20 7d 29 Data Ascii: ; a = await caches.match(r, c); for (const o of this.iterateCallbacks("cachedResponseWillBeUsed")) a = await o({ cacheName: n, matchOptions: i, cachedResponse: a, request: r, event: this.event })
2024-10-02 10:16:53 UTC	16384	IN	Data Raw: 20 2f 2a 20 40 5f 5f 50 55 52 45 5f 5f 20 2a 2f 20 6e 65 77 20 57 65 61 6b 4d 61 70 28 29 2c 20 49 20 3d 20 2f 2a 20 40 5f 5f 50 55 52 45 5f 5f 20 2a 2f 20 6e 65 77 20 57 65 61 6b 4d 61 70 28 29 2c 20 59 20 3d 20 2f 2a 20 40 5f 5f 50 55 52 45 5f 5f 20 2a 2f 20 6e 65 77 20 57 65 61 6b 4d 61 70 28 29 2c 20 50 20 3d 20 2f 2a 20 40 5f 5f 50 55 52 45 5f 5f 20 2a 2f 20 6e 65 77 20 57 65 61 6b 4d 61 70 28 29 2c 20 4f 20 3d 20 2f 2a 20 40 5f 5f 50 55 52 45 5f 5f 20 2a 2f 20 6e 65 77 20 57 65 61 6b 4d 61 70 28 29 3b 0a 66 75 6e 63 74 69 6f 6e 20 79 65 28 73 29 20 7b 0a 20 20 63 6f 6e 73 74 20 65 20 3d 20 6e 65 77 20 50 72 6f 6d 69 73 65 28 28 74 2c 20 61 29 20 3d 3e 20 7b 0a 20 20 20 20 63 6f 6e 73 74 20 6e 20 3d 20 28 29 20 3d 3e 20 7b 0a 20 20 20 20 20 20 73 2e Data Ascii: /* @__PURE__ / new WeakMap(), I = / @__PURE__ / new WeakMap(), Y = / @__PURE__ / new WeakMap(), P = / @__PURE__ / new WeakMap(), O = / @__PURE__ */ new WeakMap();function ye(s) { const e = new Promise((t, a) => { const n = () => { s.
2024-10-02 10:16:53 UTC	16384	IN	Data Raw: 31 3b 0a 20 20 20 20 20 20 7d 0a 20 20 20 20 52 20 3d 20 21 31 3b 0a 20 20 7d 0a 20 20 72 65 74 75 72 6e 20 52 3b 0a 7d 0a 61 73 79 6e 63 20 66 75 6e 63 74 69 6f 6e 20 76 65 28 73 2c 20 65 29 20 7b 0a 20 20 6c 65 74 20 74 20 3d 20 6e 75 6c 6c 3b 0a 20 20 69 66 20 28 73 2e 75 72 6c 20 26 26 20 28 74 20 3d 20 6e 65 77 20 55 52 4c 28 73 2e 75 72 6c 29 2e 6f 72 69 67 69 6e 29 2c 20 74 20 21 3d 3d 20 73 65 6c 66 2e 6c 6f 63 61 74 69 6f 6e 2e 6f 72 69 67 69 6e 29 0a 20 20 20 20 74 68 72 6f 77 20 6e 65 77 20 68 28 22 63 72 6f 73 73 2d 6f 72 69 67 69 6e 2d 63 6f 70 79 2d 72 65 73 70 6f 6e 73 65 22 2c 20 7b 20 6f 72 69 67 69 6e 3a 20 74 20 7d 29 3b 0a 20 20 63 6f 6e 73 74 20 61 20 3d 20 73 2e 63 6c 6f 6e 65 28 29 2c 20 6e 20 3d 20 7b 0a 20 20 20 20 68 65 61 64 65 Data Ascii: 1; } R = !1; } return R;}async function ve(s, e) { let t = null; if (s.url && (t = new URL(s.url).origin), t !== self.location.origin) throw new h("cross-origin-copy-response", { origin: t }); const a = s.clone(), n = { heade
2024-10-02 10:16:53 UTC	6943	IN	Data Raw: 3a 6e 75 6c 6c 2c 22 75 72 6c 22 3a 22 61 73 73 65 74 73 2f 6a 73 2f 63 6f 6c 6c 65 63 74 69 6f 6e 2d 72 65 65 6c 2d 67 72 6f 75 70 2d 33 65 63 61 64 33 64 64 2e 6a 73 22 7d 2c 7b 22 72 65 76 69 73 69 6f 6e 22 3a 6e 75 6c 6c 2c 22 75 72 6c 22 3a 22 61 73 73 65 74 73 2f 6a 73 2f 63 6f 6c 6c 65 63 74 69 6f 6e 2d 74 79 70 65 73 2d 37 37 63 33 38 38 63 66 2e 6a 73 22 7d 2c 7b 22 72 65 76 69 73 69 6f 6e 22 3a 6e 75 6c 6c 2c 22 75 72 6c 22 3a 22 61 73 73 65 74 73 2f 6a 73 2f 63 6f 6c 6c 65 63 74 69 6f 6e 73 2d 30 65 66 39 33 63 66 30 2e 6a 73 22 7d 2c 7b 22 72 65 76 69 73 69 6f 6e 22 3a 6e 75 6c 6c 2c 22 75 72 6c 22 3a 22 61 73 73 65 74 73 2f 6a 73 2f 63 6f 6c 6c 65 63 74 69 6f 6e 73 2d 62 72 6f 77 73 65 2d 30 36 64 62 33 64 62 36 2e 6a 73 22 7d 2c 7b 22 72 65 Data Ascii: :null,"url":"assets/js/collection-reel-group-3ecad3dd.js"},{"revision":null,"url":"assets/js/collection-types-77c388cf.js"},{"revision":null,"url":"assets/js/collections-0ef93cf0.js"},{"revision":null,"url":"assets/js/collections-browse-06db3db6.js"},{"re

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
148	192.168.2.16	49909	20.190.152.22	443	4912	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-02 10:16:53 UTC	1305	OUT	GET /consumers/oauth2/v2.0/authorize?client_id=929d973a-a08f-46a0-80b5-3c690ee1ee5f&scope=User.Read%20offline_access%20openid%20profile&redirect_uri=https%3A%2F%2Fapps.microsoft.com%2F&client-request-id=01924cbb-87e4-7744-aa7b-63aaf0118cbd&response_mode=fragment&response_type=code&x-client-SKU=msal.js.browser&x-client-VER=3.18.0&client_info=1&code_challenge=12wPOc1UDIDnCIHouMCWAbj0MmuWrsUyf6M21SmFz-A&code_challenge_method=S256&prompt=none&nonce=01924cbb-8810-75ee-8ce9-2c4082eafda8&state=eyJpZCI6IjAxOTI0Y2JiLTg3ZTQtNzBkZi1iZDFhLWVlMzFlYzFkOWE0YSIsIm1ldGEiOnsiaW50ZXJhY3Rpb25UeXBlIjoic2lsZW50In19 HTTP/1.1 Host: login.microsoftonline.com Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: navigate Sec-Fetch-Dest: iframe Referer: https://apps.microsoft.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-10-02 10:16:53 UTC	2003	IN	HTTP/1.1 302 Found Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: text/html; charset=utf-8 Expires: -1 Location: https://login.live.com/oauth20_authorize.srf?client_id=929d973a-a08f-46a0-80b5-3c690ee1ee5f&scope=User.Read+offline_access+openid+profile&redirect_uri=https%3a%2f%2fapps.microsoft.com%2f&response_type=code&state=eyJpZCI6IjAxOTI0Y2JiLTg3ZTQtNzBkZi1iZDFhLWVlMzFlYzFkOWE0YSIsIm1ldGEiOnsiaW50ZXJhY3Rpb25UeXBlIjoic2lsZW50In19&response_mode=fragment&nonce=01924cbb-8810-75ee-8ce9-2c4082eafda8&prompt=none&code_challenge=NzfLDfZZ9pa9p594AEIvEIVcYy8SF9QRmo7u5zhFThU&code_challenge_method=S256&x-client-SKU=msal.js.browser&x-client-Ver=3.18.0&uaid=01924cbb87e47744aa7b63aaf0118cbd&msproxy=1&issuer=mso&tenant=consumers&ui_locales=en-GB&client_info=1&epct=PAQABDgEAAADW6jl31mB3T7ugrWTT8pFewSlPCygvk1lyVk6poWg0cXhJYK5z7bDUkD84hYnFfpGk3Dqr8p-SQwUSFQo5nwp3L68_LzPzWl5zH1OvuQD7NdyuHDbID_p9Jf4HLB5epgLIUALB3rtkYUSQiYgSVPxYXqac_1W8-J_7c4W3yxQ9bEdyMvnVmMGhSZsTYIASrVH9UgXMbgwz3xj-5Qd_uUH7-FDN9pHWVUPGxJLoz3Q_BSAA&jshs=0# Strict-Transport-Security: max-age=31536000; includeSubDomains X-Content-Type-Options: nosniff P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" x-ms-request-id: 74196a96-32e9-4b3f-a504-7a8de9699300 x-ms-ests-server: 2.1.19005.9 - SCUS ProdSlices report-to: {"group":"network-errors","max_age":86400,"endpoints":[{"url":"https://identity.nel.measure.office.net/api/report?catId=GW+estsfd+bno"}]} nel: {"report_to":"network-errors","max_age":86400,"success_fraction":0.001,"failure_fraction":1.0} x-ms-clitelem: 1,0,0,, x-ms-srs: 1.P Referrer-Policy: strict-origin-when-cross-origin X-XSS-Protection: 0 Set-Cookie: fpc=AnSRjqMGt8xPrluOeTTrz9U; expires=Fri, 01-Nov-2024 10:16:53 GMT; path=/; secure; HttpOnly; SameSite=None Set-Cookie: x-ms-gateway-slice=estsfd; path=/; secure; samesite=none; httponly Set-Cookie: stsservicecookie=estsfd; path=/; secure; samesite=none; httponly Date: Wed, 02 Oct 2024 10:16:53 GMT Connection: close Content-Length: 1096
2024-10-02 10:16:53 UTC	1096	IN	Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 4f 62 6a 65 63 74 20 6d 6f 76 65 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 32 3e 4f 62 6a 65 63 74 20 6d 6f 76 65 64 20 74 6f 20 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 6c 6f 67 69 6e 2e 6c 69 76 65 2e 63 6f 6d 2f 6f 61 75 74 68 32 30 5f 61 75 74 68 6f 72 69 7a 65 2e 73 72 66 3f 63 6c 69 65 6e 74 5f 69 64 3d 39 32 39 64 39 37 33 61 2d 61 30 38 66 2d 34 36 61 30 2d 38 30 62 35 2d 33 63 36 39 30 65 65 31 65 65 35 66 26 61 6d 70 3b 73 63 6f 70 65 3d 55 73 65 72 2e 52 65 61 64 2b 6f 66 66 6c 69 6e 65 5f 61 63 63 65 73 73 2b 6f 70 65 6e 69 64 2b 70 72 6f 66 69 6c 65 26 61 6d 70 3b 72 65 64 69 72 65 63 74 5f 75 72 69 3d 68 74 74 70 73 25 33 61 25 32 66 25 32 Data Ascii: <html><head><title>Object moved</title></head><body><h2>Object moved to <a href="https://login.live.com/oauth20_authorize.srf?client_id=929d973a-a08f-46a0-80b5-3c690ee1ee5f&scope=User.Read+offline_access+openid+profile&redirect_uri=https%3a%2f%2

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
149	192.168.2.16	49913	52.240.245.67	443	4912	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-02 10:16:53 UTC	579	OUT	OPTIONS //v2/track HTTP/1.1 Host: northcentralus-0.in.applicationinsights.azure.com Connection: keep-alive Accept: / Access-Control-Request-Method: POST Access-Control-Request-Headers: content-type Origin: https://apps.microsoft.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Sec-Fetch-Mode: cors Sec-Fetch-Site: cross-site Sec-Fetch-Dest: empty Referer: https://apps.microsoft.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-10-02 10:16:53 UTC	371	IN	HTTP/1.1 204 No Content Server: Microsoft-HTTPAPI/2.0 Strict-Transport-Security: max-age=31536000 Access-Control-Allow-Origin: * Access-Control-Allow-Headers: Origin,X-Requested-With,Content-Name,Content-Type,Accept,Cache-Control,Sdk-Context Access-Control-Allow-Methods: POST Access-Control-Max-Age: 3600 Date: Wed, 02 Oct 2024 10:16:52 GMT Connection: close

Target ID:	0
Start time:	06:15:22
Start date:	02/10/2024
Path:	C:\Windows\System32\rundll32.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
Imagebase:	0x7ff6445c0000
File size:	71'680 bytes
MD5 hash:	EF3179D498793BF4234F708D3BE28633
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	12
Start time:	06:15:50
Start date:	02/10/2024
Path:	C:\Users\user\Desktop\1a4e5ccd35a56d84281a143f831563be.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\Desktop\1a4e5ccd35a56d84281a143f831563be.exe"
Imagebase:	0x400000
File size:	25'121'975 bytes
MD5 hash:	1A4E5CCD35A56D84281A143F831563BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	15
Start time:	06:15:50
Start date:	02/10/2024
Path:	C:\Users\user\Desktop\1a4e5ccd35a56d84281a143f831563be.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\1a4e5ccd35a56d84281a143f831563be.exe"
Imagebase:	0x400000
File size:	25'121'975 bytes
MD5 hash:	1A4E5CCD35A56D84281A143F831563BE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	16
Start time:	06:15:55
Start date:	02/10/2024
Path:	C:\Users\user\AppData\Local\Temp\nsm983C.tmp\setuppicasa39-setup.exe
Wow64 process (32bit):	true
Commandline:	setuppicasa39-setup.exe
Imagebase:	0x400000
File size:	13'675'184 bytes
MD5 hash:	3DF3D3C125D3BB1A5BD55E88F9E48920
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	17
Start time:	06:16:01
Start date:	02/10/2024
Path:	C:\Windows\SysWOW64\GPhotos.scr
Wow64 process (32bit):	true
Commandline:	"C:\Windows\system32\GPhotos.scr" /c /installcheck
Imagebase:	0x7ff714240000
File size:	4'587'520 bytes
MD5 hash:	404C6C3C3A59784456DA52660F86C52B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	18
Start time:	06:16:06
Start date:	02/10/2024
Path:	C:\Program Files (x86)\Google\Picasa3\Picasa3.exe
Wow64 process (32bit):	true
Commandline:	"C:\Program Files (x86)\Google\Picasa3\Picasa3.exe" /register
Imagebase:	0x400000
File size:	10'160'456 bytes
MD5 hash:	6AD50A491F52B1CBECE23B603037FBDF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 0%, ReversingLabs Detection: 0%, Virustotal, Browse
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	20
Start time:	06:16:09
Start date:	02/10/2024
Path:	C:\Program Files (x86)\Google\Picasa3\Picasa3.exe
Wow64 process (32bit):	true
Commandline:	"C:\Program Files (x86)\Google\Picasa3\Picasa3.exe"
Imagebase:	0x400000
File size:	10'160'456 bytes
MD5 hash:	6AD50A491F52B1CBECE23B603037FBDF
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	21
Start time:	06:16:14
Start date:	02/10/2024
Path:	C:\Program Files (x86)\Google\Picasa3\PicasaPhotoViewer.exe
Wow64 process (32bit):	true
Commandline:	/config
Imagebase:	0x400000
File size:	4'806'984 bytes
MD5 hash:	69B20702DEBC005CD1DA0906B4A3C4F5
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 0%, ReversingLabs Detection: 1%, Virustotal, Browse
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	22
Start time:	06:16:17
Start date:	02/10/2024
Path:	C:\Users\user\AppData\Local\Temp\nsm983C.tmp\listicka.exe
Wow64 process (32bit):	true
Commandline:	listicka.exe /S
Imagebase:	0x400000
File size:	11'265'280 bytes
MD5 hash:	B29BFD8EE3A426894B4CA3753E5B62A8
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	23
Start time:	06:16:19
Start date:	02/10/2024
Path:	C:\Users\user\AppData\Roaming\Seznam.cz\sznsetup-lt.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Roaming\Seznam.cz\sznsetup-lt.exe" -T "C:\Users\user\AppData\Roaming\Seznam.cz" -R "$\install" http://download.seznam.cz/update
Imagebase:	0x460000
File size:	1'266'688 bytes
MD5 hash:	9033DBEE427815F396F63928C3273862
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	24
Start time:	06:16:19
Start date:	02/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6684c0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	25
Start time:	06:16:20
Start date:	02/10/2024
Path:	C:\Users\user\AppData\Roaming\Seznam.cz\sznsetup-lt.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Roaming\Seznam.cz\sznsetup-lt.exe" -T "C:\Users\user\AppData\Roaming\Seznam.cz" -i cz.seznam.software.szninstall
Imagebase:	0x460000
File size:	1'266'688 bytes
MD5 hash:	9033DBEE427815F396F63928C3273862
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	26
Start time:	06:16:20
Start date:	02/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6684c0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	28
Start time:	06:16:24
Start date:	02/10/2024
Path:	C:\Program Files\Internet Explorer\iexplore.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Internet Explorer\iexplore.exe" -nohome "http://picasa.google.com/support/bin/answer.py?hl=en&answer=93773"
Imagebase:	0x7ff63c620000
File size:	834'512 bytes
MD5 hash:	CFE2E6942AC1B72981B3105E22D3224E
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	29
Start time:	06:16:25
Start date:	02/10/2024
Path:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
Wow64 process (32bit):	true
Commandline:	"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3720 CREDAT:9474 /prefetch:2
Imagebase:	0x980000
File size:	828'368 bytes
MD5 hash:	6F0F06D6AB125A99E43335427066A4A1
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	30
Start time:	06:16:25
Start date:	02/10/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\BHO\ie_to_edge_stub.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\BHO\ie_to_edge_stub.exe" --from-ie-to-edge=3 --ie-frame-hwnd=602e8
Imagebase:	0x7ff6c3890000
File size:	540'712 bytes
MD5 hash:	89CF8972D683795DAB6901BC9456675D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	31
Start time:	06:16:25
Start date:	02/10/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\BHO\ie_to_edge_stub.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\BHO\ie_to_edge_stub.exe" --from-ie-to-edge=3 --ie-frame-hwnd=602e8
Imagebase:	0x7ff6c3890000
File size:	540'712 bytes
MD5 hash:	89CF8972D683795DAB6901BC9456675D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	32
Start time:	06:16:25
Start date:	02/10/2024
Path:	C:\Program Files (x86)\Java\jre-1.8\bin\ssvagent.exe
Wow64 process (32bit):	false
Commandline:	"C:\PROGRA~2\Java\jre-1.8\bin\ssvagent.exe" -new
Imagebase:	0x920000
File size:	85'632 bytes
MD5 hash:	F9A898A606E7F5A1CD7CFFA8079253A0
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	33
Start time:	06:16:25
Start date:	02/10/2024
Path:	C:\Program Files (x86)\Java\jre-1.8\bin\ssvagent.exe
Wow64 process (32bit):	true
Commandline:	"C:\PROGRA~2\Java\jre-1.8\bin\ssvagent.exe" -new
Imagebase:	0x920000
File size:	85'632 bytes
MD5 hash:	F9A898A606E7F5A1CD7CFFA8079253A0
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	34
Start time:	06:16:25
Start date:	02/10/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --from-ie-to-edge=3 --ie-frame-hwnd=602e8
Imagebase:	0x7ff6487a0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	35
Start time:	06:16:26
Start date:	02/10/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2244 --field-trial-handle=2004,i,1639013666010223883,15040558206664522354,262144 /prefetch:3
Imagebase:	0x7ff6487a0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	38
Start time:	06:16:27
Start date:	02/10/2024
Path:	C:\Users\user\AppData\Local\Temp\~0069FB97.00001B74.sznpkg\UNZIP.EXE
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\~0069FB97.00001B74.sznpkg\unzip.exe -d C:\Users\user\AppData\Local\Temp\~006A18C4.00001B74.sznpkg -o C:\Users\user\AppData\Local\Temp\~0069FB97.00001B74.sznpkg\download\cz.seznam.software.sznsetup-1.2.7-win32.zip
Imagebase:	0x400000
File size:	73'728 bytes
MD5 hash:	3FC25896B5B2FB8E20F28FAB8C0E1143
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	39
Start time:	06:16:28
Start date:	02/10/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	cmd /S /C "install.bat C:\Users\user\AppData\Roaming\Seznam.cz"
Imagebase:	0xf20000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	40
Start time:	06:16:28
Start date:	02/10/2024
Path:	C:\Users\user\AppData\Local\Temp\~0069FB97.00001B74.sznpkg\UNZIP.EXE
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\~0069FB97.00001B74.sznpkg\unzip.exe -d C:\Users\user\AppData\Local\Temp\~006A1AF6.00001B74.sznpkg -o C:\Users\user\AppData\Local\Temp\~0069FB97.00001B74.sznpkg\download\cz.seznam.software.szninstall-1.1.15-win32.zip
Imagebase:	0x400000
File size:	73'728 bytes
MD5 hash:	3FC25896B5B2FB8E20F28FAB8C0E1143
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	41
Start time:	06:16:28
Start date:	02/10/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	cmd /S /C "install.bat C:\Users\user\AppData\Roaming\Seznam.cz"
Imagebase:	0xf20000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Analysis Process: REG.EXEPID: 2576, Parent PID: 6416

General

Target ID:	42
Start time:	06:16:28
Start date:	02/10/2024
Path:	C:\Users\user\AppData\Local\Temp\~0069FB97.00001B74.sznpkg\REG.EXE
Wow64 process (32bit):	true
Commandline:	REG DELETE "HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall\SeznamInstall" /f /va
Imagebase:	0x1000000
File size:	20'480 bytes
MD5 hash:	F0C0D05727A4E1E91F4347C2270500AA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	43
Start time:	06:16:28
Start date:	02/10/2024
Path:	C:\Users\user\AppData\Local\Temp\~0069FB97.00001B74.sznpkg\REG.EXE
Wow64 process (32bit):	true
Commandline:	REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall\SeznamInstall" /f
Imagebase:	0x1000000
File size:	20'480 bytes
MD5 hash:	F0C0D05727A4E1E91F4347C2270500AA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	44
Start time:	06:16:28
Start date:	02/10/2024
Path:	C:\Users\user\AppData\Local\Temp\~0069FB97.00001B74.sznpkg\REG.EXE
Wow64 process (32bit):	true
Commandline:	REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall\SeznamInstall" /f /v "InstallLocation" /d C:\Users\user\AppData\Roaming\Seznam.cz
Imagebase:	0x1000000
File size:	20'480 bytes
MD5 hash:	F0C0D05727A4E1E91F4347C2270500AA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	45
Start time:	06:16:29
Start date:	02/10/2024
Path:	C:\Users\user\AppData\Local\Temp\~0069FB97.00001B74.sznpkg\REG.EXE
Wow64 process (32bit):	true
Commandline:	REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall\SeznamInstall" /f /v "DisplayName" /d "Seznam Software"
Imagebase:	0x1000000
File size:	20'480 bytes
MD5 hash:	F0C0D05727A4E1E91F4347C2270500AA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	46
Start time:	06:16:29
Start date:	02/10/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=1724 --field-trial-handle=2004,i,1639013666010223883,15040558206664522354,262144 /prefetch:8
Imagebase:	0x7ff6487a0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	47
Start time:	06:16:29
Start date:	02/10/2024
Path:	C:\Users\user\AppData\Local\Temp\~0069FB97.00001B74.sznpkg\REG.EXE
Wow64 process (32bit):	true
Commandline:	REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall\SeznamInstall" /f /v "DisplayIcon" /d "C:\Users\user\AppData\Roaming\Seznam.cz\szninstall.exe,0"
Imagebase:	0x1000000
File size:	20'480 bytes
MD5 hash:	F0C0D05727A4E1E91F4347C2270500AA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	48
Start time:	06:16:29
Start date:	02/10/2024
Path:	C:\Users\user\AppData\Local\Temp\~0069FB97.00001B74.sznpkg\REG.EXE
Wow64 process (32bit):	true
Commandline:	REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall\SeznamInstall" /f /v "UninstallString" /d "\"C:\Users\user\AppData\Roaming\Seznam.cz\szninstall.exe\" -X"
Imagebase:	0x1000000
File size:	20'480 bytes
MD5 hash:	F0C0D05727A4E1E91F4347C2270500AA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	49
Start time:	06:16:29
Start date:	02/10/2024
Path:	C:\Users\user\AppData\Local\Temp\~0069FB97.00001B74.sznpkg\REG.EXE
Wow64 process (32bit):	true
Commandline:	REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall\SeznamInstall" /f /v "ModifyPath" /d "C:\Users\user\AppData\Roaming\Seznam.cz\szninstall.exe"
Imagebase:	0x1000000
File size:	20'480 bytes
MD5 hash:	F0C0D05727A4E1E91F4347C2270500AA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	50
Start time:	06:16:29
Start date:	02/10/2024
Path:	C:\Users\user\AppData\Local\Temp\~0069FB97.00001B74.sznpkg\REG.EXE
Wow64 process (32bit):	true
Commandline:	REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall\SeznamInstall" /f /v "Publisher" /d "Seznam.cz"
Imagebase:	0x1000000
File size:	20'480 bytes
MD5 hash:	F0C0D05727A4E1E91F4347C2270500AA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	51
Start time:	06:16:30
Start date:	02/10/2024
Path:	C:\Users\user\AppData\Local\Temp\~0069FB97.00001B74.sznpkg\REG.EXE
Wow64 process (32bit):	true
Commandline:	REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall\SeznamInstall" /f /v "URLInfoAbout" /d "http://software.seznam.cz"
Imagebase:	0x1000000
File size:	20'480 bytes
MD5 hash:	F0C0D05727A4E1E91F4347C2270500AA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	52
Start time:	06:16:30
Start date:	02/10/2024
Path:	C:\Users\user\AppData\Local\Temp\~0069FB97.00001B74.sznpkg\REG.EXE
Wow64 process (32bit):	true
Commandline:	REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall\SeznamInstall" /f /v "HelpLink" /d "http://napoveda.seznam.cz/cz/software.html"
Imagebase:	0x1000000
File size:	20'480 bytes
MD5 hash:	F0C0D05727A4E1E91F4347C2270500AA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	53
Start time:	06:16:30
Start date:	02/10/2024
Path:	C:\Users\user\AppData\Local\Temp\~0069FB97.00001B74.sznpkg\REG.EXE
Wow64 process (32bit):	true
Commandline:	REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall\SeznamInstall" /f /v "Comments" /d "Vsechny aplikace spolecnosti Seznam.cz a.s."
Imagebase:	0x1000000
File size:	20'480 bytes
MD5 hash:	F0C0D05727A4E1E91F4347C2270500AA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	54
Start time:	06:16:30
Start date:	02/10/2024
Path:	C:\Users\user\AppData\Local\Temp\~0069FB97.00001B74.sznpkg\REG.EXE
Wow64 process (32bit):	true
Commandline:	REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall\SeznamInstall" /f /v "NoRepair" /t REG_DWORD /d 1
Imagebase:	0x1000000
File size:	20'480 bytes
MD5 hash:	F0C0D05727A4E1E91F4347C2270500AA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	55
Start time:	06:16:30
Start date:	02/10/2024
Path:	C:\Users\user\AppData\Local\Temp\~0069FB97.00001B74.sznpkg\REG.EXE
Wow64 process (32bit):	true
Commandline:	REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall\SeznamInstall" /f /v "NoModify" /t REG_DWORD /d 0
Imagebase:	0x1000000
File size:	20'480 bytes
MD5 hash:	F0C0D05727A4E1E91F4347C2270500AA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	56
Start time:	06:16:31
Start date:	02/10/2024
Path:	C:\Users\user\AppData\Roaming\Seznam.cz\szninstall.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Roaming\Seznam.cz\szninstall.exe" -s -u -i cz.seznam.software.autoupdate szn-software-listicka
Imagebase:	0x4d0000
File size:	1'069'296 bytes
MD5 hash:	C73E94B86ED9B6BDFF199BB7E8BF9D77
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	57
Start time:	06:16:31
Start date:	02/10/2024
Path:	C:\Users\user\AppData\Roaming\Seznam.cz\sznsetup.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Roaming\Seznam.cz\sznsetup.exe -V
Imagebase:	0xe40000
File size:	2'596'080 bytes
MD5 hash:	D0F5D99C74D568EB9909C7582A775DC7
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	58
Start time:	06:16:32
Start date:	02/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6684c0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	59
Start time:	06:16:32
Start date:	02/10/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=6596 --field-trial-handle=2004,i,1639013666010223883,15040558206664522354,262144 /prefetch:8
Imagebase:	0x7ff6487a0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	60
Start time:	06:16:32
Start date:	02/10/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-GB --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --mojo-platform-channel-handle=3720 --field-trial-handle=2004,i,1639013666010223883,15040558206664522354,262144 /prefetch:8
Imagebase:	0x7ff6487a0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	61
Start time:	06:16:33
Start date:	02/10/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\cookie_exporter.exe
Wow64 process (32bit):	false
Commandline:	cookie_exporter.exe --cookie-json=1188
Imagebase:	0x7ff671890000
File size:	120'360 bytes
MD5 hash:	3DD7152D6D33725EA5958D7DE2586B97
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	62
Start time:	06:16:33
Start date:	02/10/2024
Path:	C:\Users\user\AppData\Roaming\Seznam.cz\sznsetup.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Roaming\Seznam.cz\sznsetup.exe -T C:\Users\user\AppData\Roaming\Seznam.cz -i -u cz.seznam.software.autoupdate szn-software-listicka -p
Imagebase:	0xe40000
File size:	2'596'080 bytes
MD5 hash:	D0F5D99C74D568EB9909C7582A775DC7
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	63
Start time:	06:16:33
Start date:	02/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6684c0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	64
Start time:	06:16:34
Start date:	02/10/2024
Path:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
Wow64 process (32bit):	true
Commandline:	"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3720 CREDAT:202066 /prefetch:2
Imagebase:	0x980000
File size:	828'368 bytes
MD5 hash:	6F0F06D6AB125A99E43335427066A4A1
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	69
Start time:	06:16:52
Start date:	02/10/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-GB --service-sandbox-type=audio --mojo-platform-channel-handle=4984 --field-trial-handle=2004,i,1639013666010223883,15040558206664522354,262144 /prefetch:8
Imagebase:	0x7ff6487a0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	73
Start time:	06:16:54
Start date:	02/10/2024
Path:	C:\Users\user\AppData\Local\Temp\~006A2DE2.00000DD4.sznpkg\UNZIP.EXE
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\~006A2DE2.00000DD4.sznpkg\unzip.exe -d C:\Users\user\AppData\Local\Temp\~006A81A0.00000DD4.sznpkg -o C:\Users\user\AppData\Roaming\Seznam.cz\install\cz.seznam.software.autoupdate-1.0.8-win32.zip
Imagebase:	0x400000
File size:	73'728 bytes
MD5 hash:	3FC25896B5B2FB8E20F28FAB8C0E1143
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	74
Start time:	06:16:54
Start date:	02/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6684c0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	75
Start time:	06:16:54
Start date:	02/10/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	cmd /S /C "install.bat C:\Users\user\AppData\Roaming\Seznam.cz"
Imagebase:	0xf20000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Analysis Process: conhost.exePID: 2188, Parent PID: 4956

General

Target ID:	76
Start time:	06:16:54
Start date:	02/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6684c0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	77
Start time:	06:16:55
Start date:	02/10/2024
Path:	C:\Users\user\AppData\Local\Temp\~006A2DE2.00000DD4.sznpkg\REG.EXE
Wow64 process (32bit):	true
Commandline:	REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "cz.seznam.software.autoupdate" /d "\"C:\Users\user\AppData\Roaming\Seznam.cz\szninstall.exe\" -c"
Imagebase:	0x1000000
File size:	20'480 bytes
MD5 hash:	F0C0D05727A4E1E91F4347C2270500AA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	78
Start time:	06:16:55
Start date:	02/10/2024
Path:	C:\Users\user\AppData\Local\Temp\~006A2DE2.00000DD4.sznpkg\UNZIP.EXE
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\~006A2DE2.00000DD4.sznpkg\unzip.exe -d C:\Users\user\AppData\Local\Temp\~006A8374.00000DD4.sznpkg -o C:\Users\user\AppData\Roaming\Seznam.cz\install\szn-software-base-1.0.0-win32.zip
Imagebase:	0x400000
File size:	73'728 bytes
MD5 hash:	3FC25896B5B2FB8E20F28FAB8C0E1143
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	79
Start time:	06:16:55
Start date:	02/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6684c0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	80
Start time:	06:16:55
Start date:	02/10/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	cmd /S /C "install.bat C:\Users\user\AppData\Roaming\Seznam.cz"
Imagebase:	0xf20000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Analysis Process: conhost.exePID: 7452, Parent PID: 7420

General

Target ID:	81
Start time:	06:16:55
Start date:	02/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6684c0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	82
Start time:	06:16:55
Start date:	02/10/2024
Path:	C:\Users\user\AppData\Local\Temp\~006A2DE2.00000DD4.sznpkg\UNZIP.EXE
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\~006A2DE2.00000DD4.sznpkg\unzip.exe -d C:\Users\user\AppData\Local\Temp\~006A848E.00000DD4.sznpkg -o C:\Users\user\AppData\Roaming\Seznam.cz\install\com.microsoft.msdn.msvcr110-11.0.51106.1-win32.zip
Imagebase:	0x400000
File size:	73'728 bytes
MD5 hash:	3FC25896B5B2FB8E20F28FAB8C0E1143
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	83
Start time:	06:16:55
Start date:	02/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6684c0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	84
Start time:	06:16:55
Start date:	02/10/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	cmd /S /C "install.bat C:\Users\user\AppData\Roaming\Seznam.cz"
Imagebase:	0xf20000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Analysis Process: conhost.exePID: 304, Parent PID: 932

General

Target ID:	85
Start time:	06:16:55
Start date:	02/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6684c0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	86
Start time:	06:16:55
Start date:	02/10/2024
Path:	C:\Users\user\AppData\Local\Temp\~006A2DE2.00000DD4.sznpkg\CPY.EXE
Wow64 process (32bit):	true
Commandline:	cpy msvcp110.dll "C:\Users\user\AppData\Roaming\Seznam.cz\bin"
Imagebase:	0x5e0000
File size:	201'728 bytes
MD5 hash:	68F44C9CCFF3A00B357BD2006F536AA1
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	87
Start time:	06:16:56
Start date:	02/10/2024
Path:	C:\Users\user\AppData\Local\Temp\~006A2DE2.00000DD4.sznpkg\CPY.EXE
Wow64 process (32bit):	true
Commandline:	cpy msvcr110.dll "C:\Users\user\AppData\Roaming\Seznam.cz\bin"
Imagebase:	0x5e0000
File size:	201'728 bytes
MD5 hash:	68F44C9CCFF3A00B357BD2006F536AA1
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	88
Start time:	06:16:56
Start date:	02/10/2024
Path:	C:\Users\user\AppData\Local\Temp\~006A2DE2.00000DD4.sznpkg\UNZIP.EXE
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\~006A2DE2.00000DD4.sznpkg\unzip.exe -d C:\Users\user\AppData\Local\Temp\~006A8960.00000DD4.sznpkg -o C:\Users\user\AppData\Local\Temp\~006A2DE2.00000DD4.sznpkg\download\cz.seznam.software.lightspeed-1210-12.10.18-win32.zip
Imagebase:	0x7ff66aaa0000
File size:	73'728 bytes
MD5 hash:	3FC25896B5B2FB8E20F28FAB8C0E1143
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	89
Start time:	06:16:56
Start date:	02/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6684c0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	90
Start time:	06:16:56
Start date:	02/10/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	cmd /S /C "install.bat C:\Users\user\AppData\Roaming\Seznam.cz"
Imagebase:	0xf20000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Analysis Process: conhost.exePID: 3616, Parent PID: 6292

General

Target ID:	91
Start time:	06:16:56
Start date:	02/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6684c0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	92
Start time:	06:16:56
Start date:	02/10/2024
Path:	C:\Users\user\AppData\Local\Temp\~006A2DE2.00000DD4.sznpkg\CPY.EXE
Wow64 process (32bit):	true
Commandline:	cpy lightspeed.dll "C:\Users\user\AppData\Roaming\Seznam.cz\bin"
Imagebase:	0x5e0000
File size:	201'728 bytes
MD5 hash:	68F44C9CCFF3A00B357BD2006F536AA1
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	93
Start time:	06:16:57
Start date:	02/10/2024
Path:	C:\Users\user\AppData\Local\Temp\~006A2DE2.00000DD4.sznpkg\UNZIP.EXE
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\~006A2DE2.00000DD4.sznpkg\unzip.exe -d C:\Users\user\AppData\Local\Temp\~006A8B64.00000DD4.sznpkg -o C:\Users\user\AppData\Local\Temp\~006A2DE2.00000DD4.sznpkg\download\cz.seznam.software.libszndesktop-2.1.35-win32.zip
Imagebase:	0x400000
File size:	73'728 bytes
MD5 hash:	3FC25896B5B2FB8E20F28FAB8C0E1143
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	94
Start time:	06:16:57
Start date:	02/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6684c0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	95
Start time:	06:16:57
Start date:	02/10/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	cmd /S /C "install.bat C:\Users\user\AppData\Roaming\Seznam.cz"
Imagebase:	0xf20000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Analysis Process: conhost.exePID: 2080, Parent PID: 2136

General

Target ID:	96
Start time:	06:16:57
Start date:	02/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6684c0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	97
Start time:	06:16:57
Start date:	02/10/2024
Path:	C:\Users\user\AppData\Local\Temp\~006A2DE2.00000DD4.sznpkg\CPY.EXE
Wow64 process (32bit):	true
Commandline:	cpy "szndesktop.exe" "C:\Users\user\AppData\Roaming\Seznam.cz\bin"
Imagebase:	0x5e0000
File size:	201'728 bytes
MD5 hash:	68F44C9CCFF3A00B357BD2006F536AA1
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	98
Start time:	06:16:57
Start date:	02/10/2024
Path:	C:\Users\user\AppData\Local\Temp\~006A2DE2.00000DD4.sznpkg\CPY.EXE
Wow64 process (32bit):	true
Commandline:	cpy "szndesktop.conf" "C:\Users\user\AppData\Roaming\Seznam.cz\conf"
Imagebase:	0x5e0000
File size:	201'728 bytes
MD5 hash:	68F44C9CCFF3A00B357BD2006F536AA1
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	99
Start time:	06:16:58
Start date:	02/10/2024
Path:	C:\Users\user\AppData\Local\Temp\~006A2DE2.00000DD4.sznpkg\CPY.EXE
Wow64 process (32bit):	true
Commandline:	cpy "szndesktop.webpak" "C:\Users\user\AppData\Roaming\Seznam.cz\data"
Imagebase:	0x5e0000
File size:	201'728 bytes
MD5 hash:	68F44C9CCFF3A00B357BD2006F536AA1
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	100
Start time:	06:16:58
Start date:	02/10/2024
Path:	C:\Users\user\AppData\Local\Temp\~006A2DE2.00000DD4.sznpkg\CPY.EXE
Wow64 process (32bit):	true
Commandline:	cpy "sznpp.exe" "C:\Users\user\AppData\Roaming\Seznam.cz\bin"
Imagebase:	0x5e0000
File size:	201'728 bytes
MD5 hash:	68F44C9CCFF3A00B357BD2006F536AA1
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	101
Start time:	06:16:58
Start date:	02/10/2024
Path:	C:\Users\user\AppData\Local\Temp\~006A2DE2.00000DD4.sznpkg\REG.EXE
Wow64 process (32bit):	true
Commandline:	reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall\SeznamInstall" /v DisplayVersion /t REG_SZ /d "2.1.35" /f
Imagebase:	0x1000000
File size:	20'480 bytes
MD5 hash:	F0C0D05727A4E1E91F4347C2270500AA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	102
Start time:	06:16:58
Start date:	02/10/2024
Path:	C:\Users\user\AppData\Local\Temp\~006A2DE2.00000DD4.sznpkg\UNZIP.EXE
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\~006A2DE2.00000DD4.sznpkg\unzip.exe -d C:\Users\user\AppData\Local\Temp\~006A9140.00000DD4.sznpkg -o C:\Users\user\AppData\Local\Temp\~006A2DE2.00000DD4.sznpkg\download\cz.seznam.software.szndesktop-2.0.32-win32.zip
Imagebase:	0x400000
File size:	73'728 bytes
MD5 hash:	3FC25896B5B2FB8E20F28FAB8C0E1143
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	103
Start time:	06:16:58
Start date:	02/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6684c0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	104
Start time:	06:16:58
Start date:	02/10/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	cmd /S /C "install.bat C:\Users\user\AppData\Roaming\Seznam.cz"
Imagebase:	0xf20000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Analysis Process: conhost.exePID: 7872, Parent PID: 7856

General

Target ID:	105
Start time:	06:16:59
Start date:	02/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6684c0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	106
Start time:	06:16:59
Start date:	02/10/2024
Path:	C:\Users\user\AppData\Local\Temp\~006A2DE2.00000DD4.sznpkg\CPY.EXE
Wow64 process (32bit):	true
Commandline:	cpy "wszndesktop.exe" "C:\Users\user\AppData\Roaming\Seznam.cz\bin"
Imagebase:	0x5e0000
File size:	201'728 bytes
MD5 hash:	68F44C9CCFF3A00B357BD2006F536AA1
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	107
Start time:	06:16:59
Start date:	02/10/2024
Path:	C:\Users\user\AppData\Local\Temp\~006A2DE2.00000DD4.sznpkg\REG.EXE
Wow64 process (32bit):	true
Commandline:	REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "cz.seznam.software.szndesktop" /d "\"C:\Users\user\AppData\Roaming\Seznam.cz\bin\wszndesktop.exe\" -q"
Imagebase:	0x1000000
File size:	20'480 bytes
MD5 hash:	F0C0D05727A4E1E91F4347C2270500AA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	108
Start time:	06:16:59
Start date:	02/10/2024
Path:	C:\Users\user\AppData\Local\Temp\~006A2DE2.00000DD4.sznpkg\UNZIP.EXE
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\~006A2DE2.00000DD4.sznpkg\unzip.exe -d C:\Users\user\AppData\Local\Temp\~006A93FF.00000DD4.sznpkg -o C:\Users\user\AppData\Local\Temp\~006A2DE2.00000DD4.sznpkg\download\cz.seznam.software.libfoxcub-3.3.8-win32.zip
Imagebase:	0x400000
File size:	73'728 bytes
MD5 hash:	3FC25896B5B2FB8E20F28FAB8C0E1143
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	109
Start time:	06:16:59
Start date:	02/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6684c0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	110
Start time:	06:16:59
Start date:	02/10/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	cmd /S /C "install.bat C:\Users\user\AppData\Roaming\Seznam.cz"
Imagebase:	0xf20000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Analysis Process: conhost.exePID: 6608, Parent PID: 424

General

Target ID:	111
Start time:	06:16:59
Start date:	02/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6684c0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	112
Start time:	06:16:59
Start date:	02/10/2024
Path:	C:\Users\user\AppData\Local\Temp\~006A2DE2.00000DD4.sznpkg\CPY.EXE
Wow64 process (32bit):	true
Commandline:	cpy libfoxcub.dll "C:\Users\user\AppData\Roaming\Seznam.cz\bin"
Imagebase:	0x5e0000
File size:	201'728 bytes
MD5 hash:	68F44C9CCFF3A00B357BD2006F536AA1
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	113
Start time:	06:17:00
Start date:	02/10/2024
Path:	C:\Users\user\AppData\Local\Temp\~006A2DE2.00000DD4.sznpkg\CPY.EXE
Wow64 process (32bit):	true
Commandline:	cpy libfoxcub-x64.dll "C:\Users\user\AppData\Roaming\Seznam.cz\bin"
Imagebase:	0x5e0000
File size:	201'728 bytes
MD5 hash:	68F44C9CCFF3A00B357BD2006F536AA1
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	114
Start time:	06:17:00
Start date:	02/10/2024
Path:	C:\Users\user\AppData\Local\Temp\~006A2DE2.00000DD4.sznpkg\CPY.EXE
Wow64 process (32bit):	true
Commandline:	cpy libfoxcub.conf "C:\Users\user\AppData\Roaming\Seznam.cz\conf\szndesktop.d"
Imagebase:	0x5e0000
File size:	201'728 bytes
MD5 hash:	68F44C9CCFF3A00B357BD2006F536AA1
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	115
Start time:	06:17:00
Start date:	02/10/2024
Path:	C:\Users\user\AppData\Local\Temp\~006A2DE2.00000DD4.sznpkg\CPY.EXE
Wow64 process (32bit):	true
Commandline:	cpy foxcub.conf "C:\Users\user\AppData\Roaming\Seznam.cz\conf\libfoxcub"
Imagebase:	0x5e0000
File size:	201'728 bytes
MD5 hash:	68F44C9CCFF3A00B357BD2006F536AA1
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	116
Start time:	06:17:00
Start date:	02/10/2024
Path:	C:\Users\user\AppData\Local\Temp\~006A2DE2.00000DD4.sznpkg\CPY.EXE
Wow64 process (32bit):	true
Commandline:	cpy remote.conf "C:\Users\user\AppData\Roaming\Seznam.cz\conf\libfoxcub"
Imagebase:	0x5e0000
File size:	201'728 bytes
MD5 hash:	68F44C9CCFF3A00B357BD2006F536AA1
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	117
Start time:	06:17:00
Start date:	02/10/2024
Path:	C:\Users\user\AppData\Local\Temp\~006A2DE2.00000DD4.sznpkg\CPY.EXE
Wow64 process (32bit):	true
Commandline:	cpy listickaconfig.webpak "C:\Users\user\AppData\Roaming\Seznam.cz\data"
Imagebase:	0x5e0000
File size:	201'728 bytes
MD5 hash:	68F44C9CCFF3A00B357BD2006F536AA1
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	118
Start time:	06:17:00
Start date:	02/10/2024
Path:	C:\Users\user\AppData\Local\Temp\~006A2DE2.00000DD4.sznpkg\CPY.EXE
Wow64 process (32bit):	true
Commandline:	cpy listickanastaveni.webpak "C:\Users\user\AppData\Roaming\Seznam.cz\data"
Imagebase:	0x5e0000
File size:	201'728 bytes
MD5 hash:	68F44C9CCFF3A00B357BD2006F536AA1
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	119
Start time:	06:17:01
Start date:	02/10/2024
Path:	C:\Users\user\AppData\Local\Temp\~006A2DE2.00000DD4.sznpkg\CPY.EXE
Wow64 process (32bit):	true
Commandline:	cpy speeddial.webpak "C:\Users\user\AppData\Roaming\Seznam.cz\data"
Imagebase:	0x5e0000
File size:	201'728 bytes
MD5 hash:	68F44C9CCFF3A00B357BD2006F536AA1
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	120
Start time:	06:17:01
Start date:	02/10/2024
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	rundll32.exe libfoxcub.dll,UpgradeListicka
Imagebase:	0x250000
File size:	61'440 bytes
MD5 hash:	889B99C52A60DD49227C5E485A016679
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	121
Start time:	06:17:01
Start date:	02/10/2024
Path:	C:\Users\user\AppData\Local\Temp\~006A2DE2.00000DD4.sznpkg\REG.EXE
Wow64 process (32bit):	true
Commandline:	REG QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\szn-software-listicka" /v "UninstallString"
Imagebase:	0x1000000
File size:	20'480 bytes
MD5 hash:	F0C0D05727A4E1E91F4347C2270500AA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	122
Start time:	06:17:01
Start date:	02/10/2024
Path:	C:\Users\user\AppData\Local\Temp\~006A2DE2.00000DD4.sznpkg\REG.EXE
Wow64 process (32bit):	true
Commandline:	REG QUERY "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\szn-software-listicka" /v "UninstallString"
Imagebase:	0x1000000
File size:	20'480 bytes
MD5 hash:	F0C0D05727A4E1E91F4347C2270500AA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	123
Start time:	06:17:01
Start date:	02/10/2024
Path:	C:\Users\user\AppData\Local\Temp\~006A2DE2.00000DD4.sznpkg\REG.EXE
Wow64 process (32bit):	true
Commandline:	REG DELETE "HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Explorer Bars\{EA837F48-5AD1-443E-AE34-FFE03CBF3099}" /F
Imagebase:	0x1000000
File size:	20'480 bytes
MD5 hash:	F0C0D05727A4E1E91F4347C2270500AA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	124
Start time:	06:17:02
Start date:	02/10/2024
Path:	C:\Users\user\AppData\Roaming\Seznam.cz\bin\sznpp.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Roaming\Seznam.cz\bin\sznpp.exe" -v report-ielisticka-install --status=0
Imagebase:	0xac0000
File size:	1'592'048 bytes
MD5 hash:	62DF7B2F443CBB0284CB7959AD2228C1
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	125
Start time:	06:17:04
Start date:	02/10/2024
Path:	C:\Users\user\AppData\Local\Temp\~006A2DE2.00000DD4.sznpkg\UNZIP.EXE
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\~006A2DE2.00000DD4.sznpkg\unzip.exe -d C:\Users\user\AppData\Local\Temp\~006AA61F.00000DD4.sznpkg -o C:\Users\user\AppData\Roaming\Seznam.cz\install\cz.seznam.software.libfoxloader-3.2.7-win32.zip
Imagebase:	0x400000
File size:	73'728 bytes
MD5 hash:	3FC25896B5B2FB8E20F28FAB8C0E1143
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	126
Start time:	06:17:04
Start date:	02/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6684c0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	127
Start time:	06:17:04
Start date:	02/10/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	cmd /S /C "install.bat C:\Users\user\AppData\Roaming\Seznam.cz"
Imagebase:	0xf20000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Analysis Process: conhost.exePID: 7460, Parent PID: 1864

General

Target ID:	128
Start time:	06:17:04
Start date:	02/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6684c0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	129
Start time:	06:17:04
Start date:	02/10/2024
Path:	C:\Users\user\AppData\Local\Temp\~006A2DE2.00000DD4.sznpkg\UNZIP.EXE
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\~006A2DE2.00000DD4.sznpkg\unzip.exe -d C:\Users\user\AppData\Local\Temp\~006AA7B6.00000DD4.sznpkg -o C:\Users\user\AppData\Local\Temp\~006A2DE2.00000DD4.sznpkg\download\cz.seznam.software.libfoxcub64-3.3.8-win32.zip
Imagebase:	0x400000
File size:	73'728 bytes
MD5 hash:	3FC25896B5B2FB8E20F28FAB8C0E1143
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	130
Start time:	06:17:04
Start date:	02/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6684c0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	131
Start time:	06:17:04
Start date:	02/10/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	cmd /S /C "install.bat C:\Users\user\AppData\Roaming\Seznam.cz"
Imagebase:	0xf20000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Analysis Process: conhost.exePID: 5488, Parent PID: 6496

General

Target ID:	132
Start time:	06:17:04
Start date:	02/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6684c0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	133
Start time:	06:17:04
Start date:	02/10/2024
Path:	C:\Users\user\AppData\Local\Temp\~006A2DE2.00000DD4.sznpkg\CPY.EXE
Wow64 process (32bit):	true
Commandline:	cpy libfoxcub-x64.dll "C:\Users\user\AppData\Roaming\Seznam.cz\bin"
Imagebase:	0x5e0000
File size:	201'728 bytes
MD5 hash:	68F44C9CCFF3A00B357BD2006F536AA1
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	134
Start time:	06:17:05
Start date:	02/10/2024
Path:	C:\Users\user\AppData\Local\Temp\~006A2DE2.00000DD4.sznpkg\CPY.EXE
Wow64 process (32bit):	true
Commandline:	cpy listicka-x64.exe "C:\Users\user\AppData\Roaming\Seznam.cz\bin"
Imagebase:	0x5e0000
File size:	201'728 bytes
MD5 hash:	68F44C9CCFF3A00B357BD2006F536AA1
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	135
Start time:	06:17:05
Start date:	02/10/2024
Path:	C:\Users\user\AppData\Roaming\Seznam.cz\bin\szndesktop.exe
Wow64 process (32bit):	true
Commandline:	szndesktop.exe default restart
Imagebase:	0x820000
File size:	506'064 bytes
MD5 hash:	DAC25BB758D6C17C5A8D64CF63702B4E
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	4.5%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	5.1%
Total number of Nodes:	805
Total number of Limit Nodes:	17

Executed Functions

Function 741C1A8C Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 98
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetDlgItem.USER32 ref: 741C1AF0
GetWindowRect.USER32 ref: 741C1AFF
MapWindowPoints.USER32(?,?), ref: 741C1B1E
CreateDialogParamW.USER32 ref: 741C1B4B
SetWindowPos.USER32 ref: 741C1BA1
SetWindowLongW.USER32 ref: 741C1BBD
GetProcessHeap.KERNEL32 ref: 741C1BDF
HeapAlloc.KERNEL32 ref: 741C1BF8

Part of subcall function 741C2438: GlobalAlloc.KERNEL32 ref: 741C245D
Part of subcall function 741C2438: lstrcpynW.KERNEL32 ref: 741C247D

Strings

error, xrefs: 741C1B5D

Memory Dump Source

Source File: 0000000F.00000002.2452253210.00000000741C1000.00000020.00000001.01000000.00000007.sdmp, Offset: 741C0000, based on PE: true

Associated: 0000000F.00000002.2452137412.00000000741C0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.2452433176.00000000741C3000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.2452774762.00000000741C7000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.2452892666.00000000741C8000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.2453009865.00000000741CA000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_741c0000_1a4e5ccd35a56d84281a143f831563be.jbxd

Similarity

API ID: Window$AllocHeap$CreateDialogGlobalItemLongParamPointsProcessRectlstrcpyn
String ID: error
API String ID: 1928716940-1574812785
Opcode ID: 82a2351c5a60380bb70d7471897680a8d01c2b22a16f575921c0a372ea83607a
Instruction ID: d66440c772cbc3e6acdad72b634ecbf608e85c33a2ebf24319816190dacf77ec
Opcode Fuzzy Hash: 82a2351c5a60380bb70d7471897680a8d01c2b22a16f575921c0a372ea83607a
Instruction Fuzzy Hash: C641C3B6A183049FD700AF6AC98879ABFF4FB88711F21891DF889A7340D3749554CF96

Function 741C1C26 Relevance: 52.8, APIs: 19, Strings: 11, Instructions: 268
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcessHeap.KERNEL32 ref: 741C1C44
HeapAlloc.KERNEL32 ref: 741C1C55
GetProcessHeap.KERNEL32(?), ref: 741C1CF4
HeapFree.KERNEL32 ref: 741C2012

Part of subcall function 741C2438: GlobalAlloc.KERNEL32 ref: 741C245D
Part of subcall function 741C2438: lstrcpynW.KERNEL32 ref: 741C247D

Strings

NSIS: nsControl pointer property, xrefs: 741C1F5A
LISTBOX, xrefs: 741C1DBF
COMBOBOX, xrefs: 741C1D9A
error, xrefs: 741C1C62, 741C1CE7
0, xrefs: 741C1FAF
STATIC, xrefs: 741C1E28
RICHEDIT_CLASS, xrefs: 741C1E06
BUTTON, xrefs: 741C1D47, 741C1EE9
RichEdit, xrefs: 741C1DE4
LINK, xrefs: 741C1E4A, 741C1EC3
EDIT, xrefs: 741C1D75

Memory Dump Source

Source File: 0000000F.00000002.2452253210.00000000741C1000.00000020.00000001.01000000.00000007.sdmp, Offset: 741C0000, based on PE: true

Associated: 0000000F.00000002.2452137412.00000000741C0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.2452433176.00000000741C3000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.2452774762.00000000741C7000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.2452892666.00000000741C8000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.2453009865.00000000741CA000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_741c0000_1a4e5ccd35a56d84281a143f831563be.jbxd

Similarity

API ID: Heap$AllocProcess$FreeGloballstrcpyn
String ID: 0$BUTTON$COMBOBOX$EDIT$LINK$LISTBOX$NSIS: nsControl pointer property$RICHEDIT_CLASS$RichEdit$STATIC$error
API String ID: 1913068523-2191183267
Opcode ID: 40fe0dba7c7599035faba0d17b4bbeb489cf05fd3ed9cf0468f00bcfa98901e7
Instruction ID: 5015a69f6825943de9c4ed60abfb02cdf534fb776c322259da5070467455f680
Opcode Fuzzy Hash: 40fe0dba7c7599035faba0d17b4bbeb489cf05fd3ed9cf0468f00bcfa98901e7
Instruction Fuzzy Hash: E2C1C0B1A18705DFD701EFAAC984A9EBBF4FB98704F11882DE489A7200D734D955CF52

Function 741C21CA Relevance: 12.1, APIs: 8, Instructions: 65
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SendMessageW.USER32 ref: 741C21F2
ShowWindow.USER32 ref: 741C220B
KiUserCallbackDispatcher.NTDLL ref: 741C223A
IsDialogMessageW.USER32 ref: 741C2255
IsDialogMessageW.USER32 ref: 741C2269
TranslateMessage.USER32 ref: 741C2274
DispatchMessageW.USER32(00000000), ref: 741C227E
SetWindowLongW.USER32 ref: 741C229B

Memory Dump Source

Source File: 0000000F.00000002.2452253210.00000000741C1000.00000020.00000001.01000000.00000007.sdmp, Offset: 741C0000, based on PE: true

Associated: 0000000F.00000002.2452137412.00000000741C0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.2452433176.00000000741C3000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.2452774762.00000000741C7000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.2452892666.00000000741C8000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.2453009865.00000000741CA000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_741c0000_1a4e5ccd35a56d84281a143f831563be.jbxd

Similarity

API ID: Message$DialogWindow$CallbackDispatchDispatcherLongSendShowTranslateUser
String ID:
API String ID: 4159918924-0
Opcode ID: bbdf52b13c3780ae5e4e7756941f231b43e577a9a0652d243b1db6f76d0741ee
Instruction ID: 28e7f9c8c094062f3c8c83045a9ead027b69dcd509ea9e41562ebe134ccd1830
Opcode Fuzzy Hash: bbdf52b13c3780ae5e4e7756941f231b43e577a9a0652d243b1db6f76d0741ee
Instruction Fuzzy Hash: 6121D8B6A19701AFD700BF6AC988B5ABFF4FB84755F21881CF48997200D7749458CF92

Function 73A33299 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 117
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 73A32077: GlobalFree.KERNEL32 ref: 73A3245D
Part of subcall function 73A32077: GlobalFree.KERNEL32(00000000), ref: 73A32466
Part of subcall function 73A32077: GlobalFree.KERNEL32(00000000), ref: 73A3246F

GlobalFree.KERNEL32 ref: 73A33363
FreeLibrary.KERNEL32 ref: 73A333F7
GlobalFree.KERNEL32 ref: 73A33420

Part of subcall function 73A32B9E: GlobalAlloc.KERNEL32 ref: 73A32BDC

Part of subcall function 73A3381B: GlobalFree.KERNEL32(?), ref: 73A33873

Part of subcall function 73A33088: GlobalAlloc.KERNEL32 ref: 73A33145

Strings

, xrefs: 73A333FE

Memory Dump Source

Source File: 0000000F.00000002.2450698839.0000000073A31000.00000020.00000001.01000000.00000008.sdmp, Offset: 73A30000, based on PE: true

Associated: 0000000F.00000002.2450404385.0000000073A30000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.2451124818.0000000073A37000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.2451267619.0000000073A39000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.2451804857.0000000073A3A000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.2452029568.0000000073A3D000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_73a30000_1a4e5ccd35a56d84281a143f831563be.jbxd

Similarity

API ID: Global$Free$Alloc$Library
String ID:
API String ID: 331511742-3916222277
Opcode ID: c5d2942f6d8cc9ec8fb4123bd413b37982c4a1c311365900ecbb16e55c9dd969
Instruction ID: e370d3f422702e15cf7ab21776ccec79b1f26ffd3a22e31e9aab36b2c502ffdd
Opcode Fuzzy Hash: c5d2942f6d8cc9ec8fb4123bd413b37982c4a1c311365900ecbb16e55c9dd969
Instruction Fuzzy Hash: 30417371908744CBDB11AF25C9C67997BF4FF06300F88886EE98A8B2DDDB758485CB52

Function 741C153A Relevance: 6.1, APIs: 4, Instructions: 61
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CallWindowProcW.USER32 ref: 741C157A
DestroyWindow.USER32 ref: 741C1595
GetProcessHeap.KERNEL32(00000000), ref: 741C15A2
HeapFree.KERNEL32 ref: 741C15B7

Memory Dump Source

Source File: 0000000F.00000002.2452253210.00000000741C1000.00000020.00000001.01000000.00000007.sdmp, Offset: 741C0000, based on PE: true

Associated: 0000000F.00000002.2452137412.00000000741C0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.2452433176.00000000741C3000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.2452774762.00000000741C7000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.2452892666.00000000741C8000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.2453009865.00000000741CA000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_741c0000_1a4e5ccd35a56d84281a143f831563be.jbxd

Similarity

API ID: HeapWindow$CallDestroyFreeProcProcess
String ID:
API String ID: 1278960361-0
Opcode ID: 99717c37e546eb2cfc196908e0fab57e91a43059da742d5ff81575ff078b539c
Instruction ID: 3e4918a0083639f24b76c62ed680d8c172869ba7784073e2cd38065a15d60659
Opcode Fuzzy Hash: 99717c37e546eb2cfc196908e0fab57e91a43059da742d5ff81575ff078b539c
Instruction Fuzzy Hash: F121E3B6A146059FC700EF6ACA8879ABFF4FB49361F118529F88AD3240D734D9588F51

Function 73A3342F Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 24
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualProtect.KERNELBASE ref: 73A33462

Strings

@, xrefs: 73A3344B

Memory Dump Source

Source File: 0000000F.00000002.2450698839.0000000073A31000.00000020.00000001.01000000.00000008.sdmp, Offset: 73A30000, based on PE: true

Associated: 0000000F.00000002.2450404385.0000000073A30000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.2451124818.0000000073A37000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.2451267619.0000000073A39000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.2451804857.0000000073A3A000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.2452029568.0000000073A3D000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_73a30000_1a4e5ccd35a56d84281a143f831563be.jbxd

Similarity

API ID: ProtectVirtual
String ID: @
API String ID: 544645111-2766056989
Opcode ID: 17ccd629d95fbba1d83eb9b6b1d3755748990a13ff211fe340d78692a16238a0
Instruction ID: 9640c25ba0fbd1f384653cb89de1ef3850ecca0cf8b05ef4bcadf641fcb64066
Opcode Fuzzy Hash: 17ccd629d95fbba1d83eb9b6b1d3755748990a13ff211fe340d78692a16238a0
Instruction Fuzzy Hash: 2FF097B6404300DAD701AF16C95A38A7BA8E717398F60854DE5884A284C3FA864ECF95

Function 6CC310E0 Relevance: 3.0, APIs: 2, Instructions: 47
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetDlgItem.USER32(?), ref: 6CC31105

Part of subcall function 6CC31000: PostMessageA.USER32(?,00000408,00000001,00000001), ref: 6CC31049

CallWindowProcA.USER32(?,?,?,?,?), ref: 6CC31153

Memory Dump Source

Source File: 0000000F.00000002.2449643534.000000006CC31000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CC30000, based on PE: true

Associated: 0000000F.00000002.2449500426.000000006CC30000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000F.00000002.2449758745.000000006CC32000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000F.00000002.2449900572.000000006CC34000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_6cc30000_1a4e5ccd35a56d84281a143f831563be.jbxd

Similarity

API ID: CallItemMessagePostProcWindow
String ID:
API String ID: 3221298011-0
Opcode ID: 773051f2d4b901e117391c399cf5d979ce0b443100117e511f4f7d83ad14269a
Instruction ID: cbe3416da4732b85d7cdd46767e3a84452b60b1e35ab210fb3ae3f34024146ea
Opcode Fuzzy Hash: 773051f2d4b901e117391c399cf5d979ce0b443100117e511f4f7d83ad14269a
Instruction Fuzzy Hash: 44017C75700224AFDB108E0BFD84EDBBB7DEB4A765B144115F90DC7240EA39E846C7A4

Function 73A33590 Relevance: 1.6, APIs: 1, Instructions: 143
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateWindowExW.USER32(00000000), ref: 73A3364F

Memory Dump Source

Source File: 0000000F.00000002.2450698839.0000000073A31000.00000020.00000001.01000000.00000008.sdmp, Offset: 73A30000, based on PE: true

Associated: 0000000F.00000002.2450404385.0000000073A30000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.2451124818.0000000073A37000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.2451267619.0000000073A39000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.2451804857.0000000073A3A000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.2452029568.0000000073A3D000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_73a30000_1a4e5ccd35a56d84281a143f831563be.jbxd

Similarity

API ID: CreateWindow
String ID:
API String ID: 716092398-0
Opcode ID: a0cef3a0f1957f3cef153556fcba38a24853689d9494dc2c6959e190d72d6f72
Instruction ID: 5a16309003ea185ac0fa15efd2c6ab9d8750323461b6df1a7dd28b11fb7eaf34
Opcode Fuzzy Hash: a0cef3a0f1957f3cef153556fcba38a24853689d9494dc2c6959e190d72d6f72
Instruction Fuzzy Hash: E1419072D08304EFEB02AF65ED83B897779EB1B351F70442BE40A862E4D776D5898B50

Non-executed Functions

Function 73A32077 Relevance: 20.1, APIs: 13, Instructions: 631stringmemorylibraryCOMMON

Download Yara Rule

APIs

Part of subcall function 73A31700: GlobalAlloc.KERNEL32(?,?,?,?,?,73A31734), ref: 73A31718

GlobalAlloc.KERNEL32 ref: 73A321C9
GlobalFree.KERNEL32 ref: 73A32232
lstrcpyW.KERNEL32 ref: 73A322A5
lstrcpyW.KERNEL32 ref: 73A322BD
GlobalFree.KERNEL32 ref: 73A3245D
GlobalFree.KERNEL32(00000000), ref: 73A32466
GlobalFree.KERNEL32(00000000), ref: 73A3246F
GetModuleHandleW.KERNEL32 ref: 73A32531
LoadLibraryW.KERNEL32(00000000), ref: 73A32545
lstrlenW.KERNEL32(00000000), ref: 73A3258D

Memory Dump Source

Source File: 0000000F.00000002.2450698839.0000000073A31000.00000020.00000001.01000000.00000008.sdmp, Offset: 73A30000, based on PE: true

Associated: 0000000F.00000002.2450404385.0000000073A30000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.2451124818.0000000073A37000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.2451267619.0000000073A39000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.2451804857.0000000073A3A000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.2452029568.0000000073A3D000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_73a30000_1a4e5ccd35a56d84281a143f831563be.jbxd

Similarity

API ID: Global$Free$Alloclstrcpy$HandleLibraryLoadModulelstrlen
String ID:
API String ID: 779088104-0
Opcode ID: 15318e53e654f871c28a721ecd11b962d729e3733de6b4df2a1f2746ce8c96a9
Instruction ID: 16592fb11adbbcf60513ee9b29cbe22a98a47c58677f7f29b07e920a602401f2
Opcode Fuzzy Hash: 15318e53e654f871c28a721ecd11b962d729e3733de6b4df2a1f2746ce8c96a9
Instruction Fuzzy Hash: 32424C71D0421CDBDB119FA4C5863DEB7F5FF0A314F99812BD8469B288D7B88885CB91

Function 73A34010 Relevance: 7.6, APIs: 5, Instructions: 55COMMON

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32 ref: 73A3405F
UnhandledExceptionFilter.KERNEL32 ref: 73A3406F
GetCurrentProcess.KERNEL32 ref: 73A34078
TerminateProcess.KERNEL32 ref: 73A34089
abort.MSVCRT ref: 73A34092

Memory Dump Source

Source File: 0000000F.00000002.2450698839.0000000073A31000.00000020.00000001.01000000.00000008.sdmp, Offset: 73A30000, based on PE: true

Associated: 0000000F.00000002.2450404385.0000000073A30000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.2451124818.0000000073A37000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.2451267619.0000000073A39000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.2451804857.0000000073A3A000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.2452029568.0000000073A3D000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_73a30000_1a4e5ccd35a56d84281a143f831563be.jbxd

Similarity

API ID: ExceptionFilterProcessUnhandled$CurrentTerminateabort
String ID:
API String ID: 520269711-0
Opcode ID: 4ae3ae110b69366d70b3c2ad461041b12d9159b7f99a477bd8eedb318879ae0c
Instruction ID: fe6dbad1016c5ab56d2365fa0c692c5d71baf3fd775d338d1ca75c0f3584a9b1
Opcode Fuzzy Hash: 4ae3ae110b69366d70b3c2ad461041b12d9159b7f99a477bd8eedb318879ae0c
Instruction Fuzzy Hash: 9011B2B69043048FD700EF6ADA4675ABBF4FB4A300F608929E88987314E77599458F92

Function 73A33F50 Relevance: 7.6, APIs: 5, Instructions: 55timethreadCOMMON

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32 ref: 73A33F8F
GetCurrentProcessId.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,73A313E5), ref: 73A33FA0
GetCurrentThreadId.KERNEL32 ref: 73A33FA8
GetTickCount.KERNEL32 ref: 73A33FB0
QueryPerformanceCounter.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,73A313E5), ref: 73A33FBF

Memory Dump Source

Source File: 0000000F.00000002.2450698839.0000000073A31000.00000020.00000001.01000000.00000008.sdmp, Offset: 73A30000, based on PE: true

Associated: 0000000F.00000002.2450404385.0000000073A30000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.2451124818.0000000073A37000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.2451267619.0000000073A39000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.2451804857.0000000073A3A000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.2452029568.0000000073A3D000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_73a30000_1a4e5ccd35a56d84281a143f831563be.jbxd

Similarity

API ID: CurrentTime$CountCounterFilePerformanceProcessQuerySystemThreadTick
String ID:
API String ID: 1445889803-0
Opcode ID: 20b99bdaf0068d03beecf6979dcbe2d1c02a15b0f75ae4413bfaf96299998a3b
Instruction ID: be10bdf37340c7861d66187bbd7f7617fc8106cbf19a86672acd581d47ac6720
Opcode Fuzzy Hash: 20b99bdaf0068d03beecf6979dcbe2d1c02a15b0f75ae4413bfaf96299998a3b
Instruction Fuzzy Hash: BD1154769043008BC300EF7AE98A74BBBF4FB89355F55493AE449C6210D736D44A8B92

Function 73A3400C Relevance: 7.5, APIs: 5, Instructions: 47COMMON

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32 ref: 73A3405F
UnhandledExceptionFilter.KERNEL32 ref: 73A3406F
GetCurrentProcess.KERNEL32 ref: 73A34078
TerminateProcess.KERNEL32 ref: 73A34089
abort.MSVCRT ref: 73A34092

Memory Dump Source

Source File: 0000000F.00000002.2450698839.0000000073A31000.00000020.00000001.01000000.00000008.sdmp, Offset: 73A30000, based on PE: true

Associated: 0000000F.00000002.2450404385.0000000073A30000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.2451124818.0000000073A37000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.2451267619.0000000073A39000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.2451804857.0000000073A3A000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.2452029568.0000000073A3D000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_73a30000_1a4e5ccd35a56d84281a143f831563be.jbxd

Similarity

API ID: ExceptionFilterProcessUnhandled$CurrentTerminateabort
String ID:
API String ID: 520269711-0
Opcode ID: 0d1c12b9fb1497001cc3ced06344d3eaa6667dc509caff233c2236025ea00bec
Instruction ID: 5cd0da3f1b52b509503f403062026cc40170e620d1b72cd78f86cab4f90657c4
Opcode Fuzzy Hash: 0d1c12b9fb1497001cc3ced06344d3eaa6667dc509caff233c2236025ea00bec
Instruction Fuzzy Hash: 9211E2B2904214CFD700FFAADA4B359BBF4FB0A300F608529E84987204E774994A8F92

Function 73A34F30 Relevance: .2, Instructions: 170COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.2450698839.0000000073A31000.00000020.00000001.01000000.00000008.sdmp, Offset: 73A30000, based on PE: true

Associated: 0000000F.00000002.2450404385.0000000073A30000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.2451124818.0000000073A37000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.2451267619.0000000073A39000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.2451804857.0000000073A3A000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.2452029568.0000000073A3D000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_73a30000_1a4e5ccd35a56d84281a143f831563be.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2b5804087585192f813d71f4bb37d70b28fb3dca4e73a290ba4263639e132702
Instruction ID: fe21b5f7f585e9619f6e5fea5ee5b978bfac50f7b5ad2cf6e9ed9767eeeafdda
Opcode Fuzzy Hash: 2b5804087585192f813d71f4bb37d70b28fb3dca4e73a290ba4263639e132702
Instruction Fuzzy Hash: E2516F71B083154FD305CE2EC89035BFBE6ABC9260F58C92EE899C7398D671DC458B82

Function 73A34C40 Relevance: .1, Instructions: 124COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.2450698839.0000000073A31000.00000020.00000001.01000000.00000008.sdmp, Offset: 73A30000, based on PE: true

Associated: 0000000F.00000002.2450404385.0000000073A30000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.2451124818.0000000073A37000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.2451267619.0000000073A39000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.2451804857.0000000073A3A000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.2452029568.0000000073A3D000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_73a30000_1a4e5ccd35a56d84281a143f831563be.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 70ca0c03b2bdca0b430991930dad9ed53e8a8e47c4c5e3eb2449b6685b17080f
Instruction ID: 31e308d99e4e52143f2f47c318de9cecd729d94fe98df7431481b97a0226db9c
Opcode Fuzzy Hash: 70ca0c03b2bdca0b430991930dad9ed53e8a8e47c4c5e3eb2449b6685b17080f
Instruction Fuzzy Hash: DE31A1317093254BC709DE6ED8C531AF7E7ABC9350F9A863EE54AC73C8EA718C458681

Function 741C113F Relevance: 26.4, APIs: 12, Strings: 3, Instructions: 122
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 741C23D5: lstrcpynW.KERNEL32 ref: 741C2413
Part of subcall function 741C23D5: GlobalFree.KERNEL32 ref: 741C2428

lstrcmpiW.KERNEL32(00000000,00000000,00000000,00000000,?,?), ref: 741C11E4
GetFileAttributesW.KERNEL32 ref: 741C11F5
lstrcpyW.KERNEL32 ref: 741C1214
lstrcpyW.KERNEL32 ref: 741C1245
CharNextW.USER32 ref: 741C126D
GetCurrentDirectoryW.KERNEL32 ref: 741C128E
GetSaveFileNameW.COMDLG32(00000000,00000000), ref: 741C129D
GetOpenFileNameW.COMDLG32(00000000,00000000), ref: 741C12A5
CommDlgExtendedError.COMDLG32(?), ref: 741C12B9
GetSaveFileNameW.COMDLG32 ref: 741C12D6
GetOpenFileNameW.COMDLG32 ref: 741C12DE
SetCurrentDirectoryW.KERNEL32(00000000), ref: 741C12FD

Strings

save, xrefs: 741C11DC
All Files|*.*, xrefs: 741C1236
X, xrefs: 741C1158

Memory Dump Source

Source File: 0000000F.00000002.2452253210.00000000741C1000.00000020.00000001.01000000.00000007.sdmp, Offset: 741C0000, based on PE: true

Associated: 0000000F.00000002.2452137412.00000000741C0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.2452433176.00000000741C3000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.2452774762.00000000741C7000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.2452892666.00000000741C8000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.2453009865.00000000741CA000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_741c0000_1a4e5ccd35a56d84281a143f831563be.jbxd

Similarity

API ID: File$Name$CurrentDirectoryOpenSavelstrcpy$AttributesCharCommErrorExtendedFreeGlobalNextlstrcmpilstrcpyn
String ID: All Files|*.*$X$save
API String ID: 3853173656-3147001704
Opcode ID: ed8bd9a016ff294e28ead0cfcd414bb0cd9ef49aaaece72c1a31a57896c9dad3
Instruction ID: 86850d1be893f74c873988a7105c5aee49858475d87f42dcf5bee143f74a34d6
Opcode Fuzzy Hash: ed8bd9a016ff294e28ead0cfcd414bb0cd9ef49aaaece72c1a31a57896c9dad3
Instruction Fuzzy Hash: 724135B2558210EFD701BF96CC886AABBF8FF64301F62841CE585E7680D730C640CB66

Function 741C16C7 Relevance: 19.5, APIs: 10, Strings: 1, Instructions: 269
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetWindowLongW.USER32(?,00000000,00000000), ref: 741C1898
GetWindowTextW.USER32 ref: 741C18FB
DrawTextW.USER32 ref: 741C1928
GetWindowLongW.USER32 ref: 741C1997
GetSysColor.USER32 ref: 741C19AA
SetTextColor.GDI32 ref: 741C19C4
DrawTextW.USER32 ref: 741C19EF
DrawFocusRect.USER32 ref: 741C1A23
RemovePropW.USER32 ref: 741C1A78

Strings

NSIS: nsControl pointer property, xrefs: 741C1A6A

Memory Dump Source

Source File: 0000000F.00000002.2452253210.00000000741C1000.00000020.00000001.01000000.00000007.sdmp, Offset: 741C0000, based on PE: true

Associated: 0000000F.00000002.2452137412.00000000741C0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.2452433176.00000000741C3000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.2452774762.00000000741C7000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.2452892666.00000000741C8000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.2453009865.00000000741CA000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_741c0000_1a4e5ccd35a56d84281a143f831563be.jbxd

Similarity

API ID: Text$DrawWindow$ColorLong$FocusPropRectRemove
String ID: NSIS: nsControl pointer property
API String ID: 1604851823-1714965683
Opcode ID: f154271d04515eec4ce2daa19f7770d92c17a6f3cf298998e7244ef5849c99e5
Instruction ID: 02be0f081e9f935efa1ddc87834c411e8975f58e708771ec6588685541078d7c
Opcode Fuzzy Hash: f154271d04515eec4ce2daa19f7770d92c17a6f3cf298998e7244ef5849c99e5
Instruction Fuzzy Hash: E9B138B5A447059FDB00AF69C8C479ABBF4FF58310F0289A9E88A97654D734DA80CF91

Function 6CC31180 Relevance: 15.8, APIs: 7, Strings: 2, Instructions: 97
memorystringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GlobalAlloc.KERNEL32(00000040,?), ref: 6CC311D1

Part of subcall function 6CC31414: lstrcpyA.KERNEL32(?,?,?,6CC311DF,00000000), ref: 6CC31433
Part of subcall function 6CC31414: GlobalFree.KERNEL32(?), ref: 6CC31443

lstrcmpiA.KERNEL32(00000000,/NOTIFY), ref: 6CC3122E
SetWindowLongA.USER32(?,00000004,6CC310E0), ref: 6CC3127F
GetDlgItem.USER32(?,00000000), ref: 6CC3128B
FindWindowExA.USER32(?,00000000,#32770,00000000), ref: 6CC3129D
SetWindowLongA.USER32(00000000,00000004,6CC31080), ref: 6CC312B8
GlobalFree.KERNEL32(00000000), ref: 6CC312C1

Strings

/NOTIFY, xrefs: 6CC31221
#32770, xrefs: 6CC31296

Memory Dump Source

Source File: 0000000F.00000002.2449643534.000000006CC31000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CC30000, based on PE: true

Associated: 0000000F.00000002.2449500426.000000006CC30000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000F.00000002.2449758745.000000006CC32000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000F.00000002.2449900572.000000006CC34000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_6cc30000_1a4e5ccd35a56d84281a143f831563be.jbxd

Similarity

API ID: GlobalWindow$FreeLong$AllocFindItemlstrcmpilstrcpy
String ID: #32770$/NOTIFY
API String ID: 1156966252-2748884102
Opcode ID: ae3e869e1664da9321d9deb4c81d6a190662c8762701fa88ff995386732e1925
Instruction ID: 16e6a648c1aa5e8a0223b26448cb9883d7d875582bd3099faa431ff7f074b575
Opcode Fuzzy Hash: ae3e869e1664da9321d9deb4c81d6a190662c8762701fa88ff995386732e1925
Instruction Fuzzy Hash: 1B319EB0304620EFEF20DF69F984A9677B8EB0A3557085115EA0DD3601E73DD407CBA8

Function 73A341A0 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 124
filememoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

fwrite.MSVCRT ref: 73A341CF
vfprintf.MSVCRT ref: 73A341EF
abort.MSVCRT ref: 73A341F4
VirtualQuery.KERNEL32 ref: 73A34287
VirtualProtect.KERNEL32 ref: 73A342DD
GetLastError.KERNEL32 ref: 73A342EA

Strings

@, xrefs: 73A342CE

Memory Dump Source

Source File: 0000000F.00000002.2450698839.0000000073A31000.00000020.00000001.01000000.00000008.sdmp, Offset: 73A30000, based on PE: true

Associated: 0000000F.00000002.2450404385.0000000073A30000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.2451124818.0000000073A37000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.2451267619.0000000073A39000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.2451804857.0000000073A3A000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.2452029568.0000000073A3D000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_73a30000_1a4e5ccd35a56d84281a143f831563be.jbxd

Similarity

API ID: Virtual$ErrorLastProtectQueryabortfwritevfprintf
String ID: @
API String ID: 1616349570-2766056989
Opcode ID: 0b69dc975d3fb76015a179258d7aef7af0354d715022d115a3ebc53d517c3bb0
Instruction ID: 95d174388d118236e6f3e53912e3df214d807740135f02431845647ab679e30b
Opcode Fuzzy Hash: 0b69dc975d3fb76015a179258d7aef7af0354d715022d115a3ebc53d517c3bb0
Instruction Fuzzy Hash: 9C4169B29083118FD701EF69D98670AFBF4FF86314F95891EE88987358E730E4058B92

Function 741C1038 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 69
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 741C23D5: lstrcpynW.KERNEL32 ref: 741C2413
Part of subcall function 741C23D5: GlobalFree.KERNEL32 ref: 741C2428

SHBrowseForFolderW.SHELL32 ref: 741C10F7
SHGetPathFromIDListW.SHELL32(?), ref: 741C110F
CoTaskMemFree.OLE32 ref: 741C1130

Part of subcall function 741C2438: GlobalAlloc.KERNEL32 ref: 741C245D
Part of subcall function 741C2438: lstrcpynW.KERNEL32 ref: 741C247D

Strings

error, xrefs: 741C1078, 741C1120
0v,v, xrefs: 741C110F
E, xrefs: 741C10D6

Memory Dump Source

Source File: 0000000F.00000002.2452253210.00000000741C1000.00000020.00000001.01000000.00000007.sdmp, Offset: 741C0000, based on PE: true

Associated: 0000000F.00000002.2452137412.00000000741C0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.2452433176.00000000741C3000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.2452774762.00000000741C7000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.2452892666.00000000741C8000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.2453009865.00000000741CA000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_741c0000_1a4e5ccd35a56d84281a143f831563be.jbxd

Similarity

API ID: FreeGloballstrcpyn$AllocBrowseFolderFromListPathTask
String ID: 0v,v$E$error
API String ID: 3273179968-3279817700
Opcode ID: e5136f03e2dbf2991eb8dbe27ae83f1d718d72de26093330f8f63bf11bc4da50
Instruction ID: a58f91e55908b9c499e18a0e2f39b83524cca980d2c74f607863bc16525e88ec
Opcode Fuzzy Hash: e5136f03e2dbf2991eb8dbe27ae83f1d718d72de26093330f8f63bf11bc4da50
Instruction Fuzzy Hash: 872119B19143299BEB10AF26CCC4A9ABBF8FF58340F114599E449A3640DB74D694CFA2

Function 73A32C47 Relevance: 9.1, APIs: 6, Instructions: 113
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 73A31700: GlobalAlloc.KERNEL32(?,?,?,?,?,73A31734), ref: 73A31718

GlobalFree.KERNEL32 ref: 73A32D7A
GlobalFree.KERNEL32 ref: 73A32DB5

Memory Dump Source

Source File: 0000000F.00000002.2450698839.0000000073A31000.00000020.00000001.01000000.00000008.sdmp, Offset: 73A30000, based on PE: true

Associated: 0000000F.00000002.2450404385.0000000073A30000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.2451124818.0000000073A37000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.2451267619.0000000073A39000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.2451804857.0000000073A3A000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.2452029568.0000000073A3D000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_73a30000_1a4e5ccd35a56d84281a143f831563be.jbxd

Similarity

API ID: Global$Free$Alloc
String ID:
API String ID: 1780285237-0
Opcode ID: f196a8a3864bc86a999ceaffed7ff26fe8b9fbb1b194221b9fa5eb3228b243cc
Instruction ID: 0b043c39700d2013ab194116ec59b9b4c37548e5bee7b01006c1caefd1d4a7af
Opcode Fuzzy Hash: f196a8a3864bc86a999ceaffed7ff26fe8b9fbb1b194221b9fa5eb3228b243cc
Instruction Fuzzy Hash: 13412471904705DFD741EF29C58A71ABBF4FB4A780F908A1EE889C7358D33498818B42

Function 73A31020 Relevance: 9.1, APIs: 6, Instructions: 108
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNEL32 ref: 73A31057
_amsg_exit.MSVCRT ref: 73A31085

Memory Dump Source

Source File: 0000000F.00000002.2450698839.0000000073A31000.00000020.00000001.01000000.00000008.sdmp, Offset: 73A30000, based on PE: true

Associated: 0000000F.00000002.2450404385.0000000073A30000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.2451124818.0000000073A37000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.2451267619.0000000073A39000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.2451804857.0000000073A3A000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.2452029568.0000000073A3D000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_73a30000_1a4e5ccd35a56d84281a143f831563be.jbxd

Similarity

API ID: Sleep_amsg_exit
String ID:
API String ID: 1015461914-0
Opcode ID: b2944dc9f1c517122fab8b7a1aa97f4e75c1fba06729a8ae63c9fd1dc8956d0c
Instruction ID: c1e2ea10427a9a31e54c0f5cf08c26b81da761b3217c05efb1da95247fc9aed1
Opcode Fuzzy Hash: b2944dc9f1c517122fab8b7a1aa97f4e75c1fba06729a8ae63c9fd1dc8956d0c
Instruction Fuzzy Hash: DD418EB26083018BE702BF1ACA8379AB7E9EB46340FA1452FD45D8B34CD6758485CBD2

Function 73A32E4A Relevance: 7.7, APIs: 5, Instructions: 156COMMON

Download Yara Rule

APIs

GlobalFree.KERNEL32(00000000), ref: 73A33060

Part of subcall function 73A31722: lstrcpynW.KERNEL32 ref: 73A31742

Memory Dump Source

Source File: 0000000F.00000002.2450698839.0000000073A31000.00000020.00000001.01000000.00000008.sdmp, Offset: 73A30000, based on PE: true

Associated: 0000000F.00000002.2450404385.0000000073A30000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.2451124818.0000000073A37000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.2451267619.0000000073A39000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.2451804857.0000000073A3A000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.2452029568.0000000073A3D000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_73a30000_1a4e5ccd35a56d84281a143f831563be.jbxd

Similarity

API ID: FreeGloballstrcpyn
String ID:
API String ID: 1459762280-0
Opcode ID: 99f4b3e8053e785f3d66f0a7d8ae561579ab362c3e00fe97af0d8910211dc8e5
Instruction ID: a7c45b5d237d06410a8b96b3791b0b7ef2a6743987f760cd8c42e3f5e8c970ca
Opcode Fuzzy Hash: 99f4b3e8053e785f3d66f0a7d8ae561579ab362c3e00fe97af0d8910211dc8e5
Instruction Fuzzy Hash: E55199B1909315CFD700DF64C8867A9BBF4FF8A340F95892ED4A98B388D7798542CB91

Function 73A35420 Relevance: 7.6, APIs: 5, Instructions: 61COMMON

Download Yara Rule

APIs

_lock.MSVCRT ref: 73A35439
_unlock.MSVCRT ref: 73A35461
calloc.MSVCRT ref: 73A354AF

Memory Dump Source

Source File: 0000000F.00000002.2450698839.0000000073A31000.00000020.00000001.01000000.00000008.sdmp, Offset: 73A30000, based on PE: true

Associated: 0000000F.00000002.2450404385.0000000073A30000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.2451124818.0000000073A37000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.2451267619.0000000073A39000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.2451804857.0000000073A3A000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.2452029568.0000000073A3D000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_73a30000_1a4e5ccd35a56d84281a143f831563be.jbxd

Similarity

API ID: _lock_unlockcalloc
String ID:
API String ID: 3876498383-0
Opcode ID: 55275c6338139925b3e0bedfe2b2fd48658d0545673ba63bdefe7d89d882d870
Instruction ID: 480896b8367d67a4b9a0afbd06029f1478592b38267effcc561d64234107392b
Opcode Fuzzy Hash: 55275c6338139925b3e0bedfe2b2fd48658d0545673ba63bdefe7d89d882d870
Instruction Fuzzy Hash: DF211AB06043018BDB44DF2DD58171A7FE6BF96310F98C66AD4898B39DEB74D840CBA2

Function 73A31C11 Relevance: 7.6, APIs: 5, Instructions: 53memorylibraryloaderCOMMON

Download Yara Rule

APIs

WideCharToMultiByte.KERNEL32 ref: 73A31C5E
GlobalAlloc.KERNEL32 ref: 73A31C70
WideCharToMultiByte.KERNEL32 ref: 73A31CB0
GetProcAddress.KERNEL32 ref: 73A31CBF
GlobalFree.KERNEL32 ref: 73A31CCC

Memory Dump Source

Source File: 0000000F.00000002.2450698839.0000000073A31000.00000020.00000001.01000000.00000008.sdmp, Offset: 73A30000, based on PE: true

Associated: 0000000F.00000002.2450404385.0000000073A30000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.2451124818.0000000073A37000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.2451267619.0000000073A39000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.2451804857.0000000073A3A000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.2452029568.0000000073A3D000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_73a30000_1a4e5ccd35a56d84281a143f831563be.jbxd

Similarity

API ID: ByteCharGlobalMultiWide$AddressAllocFreeProc
String ID:
API String ID: 1148316912-0
Opcode ID: aa68f16c1dbadfb1ea6a9b03b7ad767811ccf43f9587434238ecde99cec4def5
Instruction ID: ea1667f7437af10935cbbd292a6e12426e8b2962eecc15d2ed60eb1efbd789aa
Opcode Fuzzy Hash: aa68f16c1dbadfb1ea6a9b03b7ad767811ccf43f9587434238ecde99cec4def5
Instruction Fuzzy Hash: 5711C6B1408305AFD310EF6AD94871BBFF4EF88760F108A1DF9A887290D37985488F92

Function 741C130C Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 73stringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(?,?,?,?,?,?,?,?,?,?,741C143C), ref: 741C1321
CharPrevW.USER32(?,?,?,?,?,?,?,?,?,?,?,741C143C), ref: 741C1332
MapDialogRect.USER32(00000000), ref: 741C13A0

Strings

d, xrefs: 741C1356

Memory Dump Source

Source File: 0000000F.00000002.2452253210.00000000741C1000.00000020.00000001.01000000.00000007.sdmp, Offset: 741C0000, based on PE: true

Associated: 0000000F.00000002.2452137412.00000000741C0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.2452433176.00000000741C3000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.2452774762.00000000741C7000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.2452892666.00000000741C8000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.2453009865.00000000741CA000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_741c0000_1a4e5ccd35a56d84281a143f831563be.jbxd

Similarity

API ID: CharDialogPrevRectlstrlen
String ID: d
API String ID: 3411278111-2564639436
Opcode ID: c7e25156f7d593b279640f3df6f27c44679b3c125f13415560474c858d2595e3
Instruction ID: e9c692bb332f27095bad475565e7246844f5cdff2e4af7072627684681b5ca2d
Opcode Fuzzy Hash: c7e25156f7d593b279640f3df6f27c44679b3c125f13415560474c858d2595e3
Instruction Fuzzy Hash: 272107B6A006049FCB01AFAADDC46DEBBF9FB58324F11952AE94597704E331D650CFA0

Function 73A31B96 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 31stringCOMMON

Download Yara Rule

APIs

wsprintfW.USER32 ref: 73A31BCE
lstrcpyW.KERNEL32 ref: 73A31BEC

Strings

callback%d, xrefs: 73A31BC3
error, xrefs: 73A31BD8

Memory Dump Source

Source File: 0000000F.00000002.2450698839.0000000073A31000.00000020.00000001.01000000.00000008.sdmp, Offset: 73A30000, based on PE: true

Associated: 0000000F.00000002.2450404385.0000000073A30000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.2451124818.0000000073A37000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.2451267619.0000000073A39000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.2451804857.0000000073A3A000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.2452029568.0000000073A3D000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_73a30000_1a4e5ccd35a56d84281a143f831563be.jbxd

Similarity

API ID: lstrcpywsprintf
String ID: callback%d$error
API String ID: 2408954437-1307476583
Opcode ID: 515f90a8a4b527a21f809b1155b8f0e79d906ee20631204c4aa1e23c3edefdb4
Instruction ID: 4416ed9c8c17d61d4f1cde9266d5c43840787d7e080a525cabc4093ef97f71a6
Opcode Fuzzy Hash: 515f90a8a4b527a21f809b1155b8f0e79d906ee20631204c4aa1e23c3edefdb4
Instruction Fuzzy Hash: 52F062706043049FC700EF19C58AA96BBE6AF8A304F95C5ADE4498731AD671CC418B50

Function 73A31D5A Relevance: 6.2, APIs: 3, Strings: 1, Instructions: 215COMMON

Download Yara Rule

APIs

GlobalFree.KERNEL32 ref: 73A31DB9
GlobalFree.KERNEL32(?), ref: 73A31FD5
GlobalFree.KERNEL32(00000000), ref: 73A31FDE

Strings

/, xrefs: 73A31EA0

Memory Dump Source

Source File: 0000000F.00000002.2450698839.0000000073A31000.00000020.00000001.01000000.00000008.sdmp, Offset: 73A30000, based on PE: true

Associated: 0000000F.00000002.2450404385.0000000073A30000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.2451124818.0000000073A37000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.2451267619.0000000073A39000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.2451804857.0000000073A3A000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.2452029568.0000000073A3D000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_73a30000_1a4e5ccd35a56d84281a143f831563be.jbxd

Similarity

API ID: FreeGlobal
String ID: /
API String ID: 2979337801-2043925204
Opcode ID: e155a9e7d5342507ab100061c9d157b12cc2461533901427b95c7ff25fb4ae18
Instruction ID: 4df09bf03f4cbd8225ab0a5dfddb9a72cf64c1d4cea7c8ab65572a1d2840aa77
Opcode Fuzzy Hash: e155a9e7d5342507ab100061c9d157b12cc2461533901427b95c7ff25fb4ae18
Instruction Fuzzy Hash: AB715035E103188FCB00EFA9C48269DB7F6EB8A350F99851BD849AB359D7749D42CB80

Function 73A32ACE Relevance: 6.1, APIs: 3, Strings: 1, Instructions: 67COMMON

Download Yara Rule

APIs

Part of subcall function 73A32077: GlobalFree.KERNEL32 ref: 73A3245D
Part of subcall function 73A32077: GlobalFree.KERNEL32(00000000), ref: 73A32466
Part of subcall function 73A32077: GlobalFree.KERNEL32(00000000), ref: 73A3246F

GlobalFree.KERNEL32 ref: 73A32B4E

Strings

error, xrefs: 73A32B16

Memory Dump Source

Source File: 0000000F.00000002.2450698839.0000000073A31000.00000020.00000001.01000000.00000008.sdmp, Offset: 73A30000, based on PE: true

Associated: 0000000F.00000002.2450404385.0000000073A30000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.2451124818.0000000073A37000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.2451267619.0000000073A39000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.2451804857.0000000073A3A000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.2452029568.0000000073A3D000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_73a30000_1a4e5ccd35a56d84281a143f831563be.jbxd

Similarity

API ID: FreeGlobal
String ID: error
API String ID: 2979337801-1574812785
Opcode ID: f4ec0202ed0bbc04d62a26cfa63a422d79097a360f3896338dea9885706eff33
Instruction ID: e473524e1c197bb293898ab56d05d1b6c5f18859f5ebe8a046600e9a9455e6bb
Opcode Fuzzy Hash: f4ec0202ed0bbc04d62a26cfa63a422d79097a360f3896338dea9885706eff33
Instruction Fuzzy Hash: 6C213AB1804748DFDB01BFA5D98A799BFF8EB06360F55486FE98987218E3349480CF91

Function 73A31562 Relevance: 5.1, APIs: 4, Instructions: 115memoryCOMMON

Download Yara Rule

APIs

GlobalAlloc.KERNEL32 ref: 73A31624
GlobalFree.KERNEL32 ref: 73A31689
GlobalFree.KERNEL32 ref: 73A316E0
GlobalFree.KERNEL32 ref: 73A316F1

Memory Dump Source

Source File: 0000000F.00000002.2450698839.0000000073A31000.00000020.00000001.01000000.00000008.sdmp, Offset: 73A30000, based on PE: true

Associated: 0000000F.00000002.2450404385.0000000073A30000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.2451124818.0000000073A37000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.2451267619.0000000073A39000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.2451804857.0000000073A3A000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.2452029568.0000000073A3D000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_73a30000_1a4e5ccd35a56d84281a143f831563be.jbxd

Similarity

API ID: Global$Free$Alloc
String ID:
API String ID: 1780285237-0
Opcode ID: 6a70f8c874100477f2d209d753b61ef84b9568d8a1d3e897c18f4ab4cb0ddbf5
Instruction ID: a701ffcb87449fafd8dcfa42300db60c9399bb6e93ee425b6fa2f2a20df0b927
Opcode Fuzzy Hash: 6a70f8c874100477f2d209d753b61ef84b9568d8a1d3e897c18f4ab4cb0ddbf5
Instruction Fuzzy Hash: 9E411FB5904301CFC710FFA5C646B5ABBF4FB4A300B99C52FE88987258D3389446CB91

Function 73A345C0 Relevance: 5.0, APIs: 4, Instructions: 39COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?,?,?,?,?,?,73A3478B,?,?,?,?,?,73A340D8), ref: 73A345CE
TlsGetValue.KERNEL32(?,?,?,?,?,?,?,73A3478B,?,?,?,?,?,73A340D8), ref: 73A345F5
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,73A3478B,?,?,?,?,?,73A340D8), ref: 73A345FC
LeaveCriticalSection.KERNEL32(?,?,?,?,?,?,?,73A3478B,?,?,?,?,?,73A340D8), ref: 73A3461C

Memory Dump Source

Source File: 0000000F.00000002.2450698839.0000000073A31000.00000020.00000001.01000000.00000008.sdmp, Offset: 73A30000, based on PE: true

Associated: 0000000F.00000002.2450404385.0000000073A30000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.2451124818.0000000073A37000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.2451267619.0000000073A39000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.2451804857.0000000073A3A000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.2452029568.0000000073A3D000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_73a30000_1a4e5ccd35a56d84281a143f831563be.jbxd

Similarity

API ID: CriticalSection$EnterErrorLastLeaveValue
String ID:
API String ID: 682475483-0
Opcode ID: bd4fe2acf1e2a712dabf2d7045626930b878a3ca50ada8c41ff28628bec70d26
Instruction ID: 592c219c9c07f1e1199a36245f7160199f58b05df79a774872774d144d41b090
Opcode Fuzzy Hash: bd4fe2acf1e2a712dabf2d7045626930b878a3ca50ada8c41ff28628bec70d26
Instruction Fuzzy Hash: 69F031725007308BC7007F69D98A71ABBB8EA46750B55056DDD4947309E730E90ACBA3

Analysis Process: setuppicasa39-setup.exePID: 6028, Parent PID: 7100COMMON

Execution Graph

Execution Coverage:	0.5%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	1.2%
Total number of Nodes:	942
Total number of Limit Nodes:	4

Executed Functions

Function 04C987DB Relevance: 3.0, APIs: 2, Instructions: 28
memoryCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

HeapCreate.KERNELBASE(00000000,00001000,00000000,04C964C2,00000001,?,?,00000001,?,?,04C96640,00000001,?,?,04CA5E00,0000000C), ref: 04C987EC
HeapDestroy.KERNEL32(?,?,00000001,?,?,04C96640,00000001,?,?,04CA5E00,0000000C,04C966FA,?), ref: 04C98822

Memory Dump Source

Source File: 00000010.00000002.1704544207.0000000004C91000.00000020.00000001.01000000.0000000C.sdmp, Offset: 04C90000, based on PE: true

Associated: 00000010.00000002.1704469452.0000000004C90000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.1704699696.0000000004CA3000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.1704799671.0000000004CA8000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.1704860125.0000000004CAC000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_4c90000_setuppicasa39-setup.jbxd

Similarity

API ID: Heap$CreateDestroy
String ID:
API String ID: 3296620671-0
Opcode ID: 4b9d484d72b3b79d8f77def2824283cf6d3f794d8028ff4260afeb361e43c12a
Instruction ID: 35b38538c88e7bdfc32a262691546e3d0ecc3bcd3412b48c6340814cf75703fe
Opcode Fuzzy Hash: 4b9d484d72b3b79d8f77def2824283cf6d3f794d8028ff4260afeb361e43c12a
Instruction Fuzzy Hash: 37E06D79B60300AAEF107B36990E72A3AE9F70568EF000835F501C7094FB78DD60D629

Non-executed Functions

Function 04C92CA0 Relevance: 21.2, APIs: 10, Strings: 2, Instructions: 230
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetLocaleInfoW.KERNEL32(00000400,00000059,0000000A,0000000A), ref: 04C92CEF
GetLocaleInfoW.KERNEL32(00000400,0000005A,?,0000000A), ref: 04C92CFF

Strings

utos-%s-%s.txt, xrefs: 04C92E8B
utos_%s.txt, xrefs: 04C92E9F

Memory Dump Source

Source File: 00000010.00000002.1704544207.0000000004C91000.00000020.00000001.01000000.0000000C.sdmp, Offset: 04C90000, based on PE: true

Associated: 00000010.00000002.1704469452.0000000004C90000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.1704699696.0000000004CA3000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.1704799671.0000000004CA8000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.1704860125.0000000004CAC000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_4c90000_setuppicasa39-setup.jbxd

Similarity

API ID: InfoLocale
String ID: utos-%s-%s.txt$utos_%s.txt
API String ID: 2299586839-2999509453
Opcode ID: 3a800646d00bd7f016baaeea140ce4b7cdf06e50d51724d30ba2374fd5d50c66
Instruction ID: e87e7d78c29da41e9648c4c1c4c68a18585f5fddc2c80093b7d5176d30da0652
Opcode Fuzzy Hash: 3a800646d00bd7f016baaeea140ce4b7cdf06e50d51724d30ba2374fd5d50c66
Instruction Fuzzy Hash: 6E81C176500202BADB20DF24C885BB2B3F6FFA4718F488959EA8587290F775FE45C791

Function 04C920F0 Relevance: 19.4, APIs: 6, Strings: 5, Instructions: 159windowCOMMON

Download Yara Rule

APIs

MessageBoxW.USER32(?,?,?,00000004), ref: 04C92121
GetVersion.KERNEL32(?,00000000,757305F0), ref: 04C9213A
GetFileAttributesW.KERNEL32(?), ref: 04C921B4
SHGetSpecialFolderPathW.SHELL32(00000000,?,00000028,00000000), ref: 04C921F8
SHGetSpecialFolderPathW.SHELL32(00000000,?,0000001C,00000000), ref: 04C92211
_wcsrchr.LIBCMT ref: 04C92311

Strings

Google\Picasa2, xrefs: 04C921A3, 04C92301
\, xrefs: 04C9226F
Local AppData, xrefs: 04C92148
AppData, xrefs: 04C92166
\, xrefs: 04C9223F

Memory Dump Source

Source File: 00000010.00000002.1704544207.0000000004C91000.00000020.00000001.01000000.0000000C.sdmp, Offset: 04C90000, based on PE: true

Associated: 00000010.00000002.1704469452.0000000004C90000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.1704699696.0000000004CA3000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.1704799671.0000000004CA8000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.1704860125.0000000004CAC000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_4c90000_setuppicasa39-setup.jbxd

Similarity

API ID: FolderPathSpecial$AttributesFileMessageVersion_wcsrchr
String ID: AppData$Google\Picasa2$Local AppData$\$\
API String ID: 2784554002-269935364
Opcode ID: c76341819e79103c9e899ecc160e65a19ebf7e75cb430f49a37b42ff7f6bd01e
Instruction ID: ecdb1cd79ceabf680b9fe7fce4e46b49ff535134dcb346e332d5774d094514d8
Opcode Fuzzy Hash: c76341819e79103c9e899ecc160e65a19ebf7e75cb430f49a37b42ff7f6bd01e
Instruction Fuzzy Hash: DC512275504205BBDB38EF58D849AABB3E6FF84318F44CD29D68947190E730BB59CB82

Function 04C915F0 Relevance: 17.8, APIs: 3, Strings: 7, Instructions: 251COMMON

Download Yara Rule

APIs

Part of subcall function 04C913B0: RegOpenKeyExW.ADVAPI32(80000001,SOFTWARE\Clients\StartMenuInternet,00000000,000F003F,?,?,?,00000000,04C91629,?,7576F860,757305F0,04C93EE3), ref: 04C913FD
Part of subcall function 04C913B0: RegQueryValueExW.ADVAPI32(?,00000000,00000000,?,00000400,?), ref: 04C9142C
Part of subcall function 04C913B0: RegCloseKey.ADVAPI32(?), ref: 04C91446
Part of subcall function 04C913B0: RegOpenKeyExW.ADVAPI32(80000002,SOFTWARE\Clients\StartMenuInternet,00000000,000F003F,?), ref: 04C91479
Part of subcall function 04C913B0: RegQueryValueExW.ADVAPI32(?,00000000,00000000,?,00000400,?), ref: 04C914A8
Part of subcall function 04C913B0: RegCloseKey.ADVAPI32(?), ref: 04C914B7
Part of subcall function 04C913B0: RegOpenKeyExW.ADVAPI32 ref: 04C9151B

GetLocaleInfoW.KERNEL32(00000400,00000059,?,00000010,?), ref: 04C91708
GetLocaleInfoW.KERNEL32(00000400,0000005A,?,00000010), ref: 04C91718

Strings

iexplore, xrefs: 04C9168E
open, xrefs: 04C91922
"http://picasa.google.com/support/bin/request.py?contact_type=uninstall, xrefs: 04C916EA
.EXE, xrefs: 04C91674
&hl=, xrefs: 04C9188F
.exe, xrefs: 04C9165B
iexplore.exe, xrefs: 04C91614, 04C91693

Memory Dump Source

Source File: 00000010.00000002.1704544207.0000000004C91000.00000020.00000001.01000000.0000000C.sdmp, Offset: 04C90000, based on PE: true

Associated: 00000010.00000002.1704469452.0000000004C90000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.1704699696.0000000004CA3000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.1704799671.0000000004CA8000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.1704860125.0000000004CAC000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_4c90000_setuppicasa39-setup.jbxd

Similarity

API ID: Open$CloseInfoLocaleQueryValue
String ID: "http://picasa.google.com/support/bin/request.py?contact_type=uninstall$&hl=$.EXE$.exe$iexplore$iexplore.exe$open
API String ID: 1844087072-4062934115
Opcode ID: 9f61bc99583c6b4303fb499a5b5adc22720af4a067052ce1aca056b9d6210f9a
Instruction ID: f2d39295416dbfd694d5f654c5bb7e39e0ac86452806d5688787de32207cc0bc
Opcode Fuzzy Hash: 9f61bc99583c6b4303fb499a5b5adc22720af4a067052ce1aca056b9d6210f9a
Instruction Fuzzy Hash: 06912162910203AAEF34AF24CC166A7B3E3FF80714F9D8919D45687280EF71FA44D71A

Function 04C92490 Relevance: 15.9, APIs: 5, Strings: 4, Instructions: 130libraryCOMMON

Download Yara Rule

APIs

GetVersion.KERNEL32 ref: 04C9249E
LoadLibraryW.KERNEL32(Advapi32), ref: 04C924C3

Strings

AllocateAndInitializeSid, xrefs: 04C924EC
FreeSid, xrefs: 04C92512
Advapi32, xrefs: 04C924BE
CheckTokenMembership, xrefs: 04C924FE

Memory Dump Source

Source File: 00000010.00000002.1704544207.0000000004C91000.00000020.00000001.01000000.0000000C.sdmp, Offset: 04C90000, based on PE: true

Associated: 00000010.00000002.1704469452.0000000004C90000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.1704699696.0000000004CA3000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.1704799671.0000000004CA8000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.1704860125.0000000004CAC000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_4c90000_setuppicasa39-setup.jbxd

Similarity

API ID: LibraryLoadVersion
String ID: Advapi32$AllocateAndInitializeSid$CheckTokenMembership$FreeSid
API String ID: 3209957514-3818512974
Opcode ID: 9bf064735dda79e18f5be5e835858dc7ab8a8921e3188e4681b2e958b8165d72
Instruction ID: cbd0ae686023cf7c75ed1906919b9fdd5b41b342a135b63dfb3e725e9f3b89b5
Opcode Fuzzy Hash: 9bf064735dda79e18f5be5e835858dc7ab8a8921e3188e4681b2e958b8165d72
Instruction Fuzzy Hash: 383109726043417BE710EF649C99A6FB7E9EFD8608F844C5EF18197141E625ED088BA3

Function 04C91F30 Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 131fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(?,?,04CA9AA8,Google\Picasa2,00000000), ref: 04C91FAA
GetLastError.KERNEL32 ref: 04C91FB9

Strings

Google\Picasa2, xrefs: 04C91F4B
*.*, xrefs: 04C91F8C
., xrefs: 04C91FEE

Memory Dump Source

Source File: 00000010.00000002.1704544207.0000000004C91000.00000020.00000001.01000000.0000000C.sdmp, Offset: 04C90000, based on PE: true

Associated: 00000010.00000002.1704469452.0000000004C90000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.1704699696.0000000004CA3000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.1704799671.0000000004CA8000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.1704860125.0000000004CAC000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_4c90000_setuppicasa39-setup.jbxd

Similarity

API ID: ErrorFileFindFirstLast
String ID: *.*$.$Google\Picasa2
API String ID: 873889042-2507253294
Opcode ID: 8254f2d7d67f4d6d32ceec8de8a4ae589a9ee3b5008fd0e4e5de86b9c6eb61e2
Instruction ID: 2b547a0569ef20034473d4b82ce40e0bad0d9bd5f2012ae4212473098b4b027d
Opcode Fuzzy Hash: 8254f2d7d67f4d6d32ceec8de8a4ae589a9ee3b5008fd0e4e5de86b9c6eb61e2
Instruction Fuzzy Hash: F141EA31504309ABCB24DF28C86A7ABB3F2FFC4364F444A59EC9687690E775AD14D781

Function 04C91B90 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 116fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(?,?,?,00000000,757305F0), ref: 04C91C0A
GetLastError.KERNEL32(?,00000000,757305F0), ref: 04C91C1B

Strings

*.*, xrefs: 04C91BEC
., xrefs: 04C91C4B

Memory Dump Source

Source File: 00000010.00000002.1704544207.0000000004C91000.00000020.00000001.01000000.0000000C.sdmp, Offset: 04C90000, based on PE: true

Associated: 00000010.00000002.1704469452.0000000004C90000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.1704699696.0000000004CA3000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.1704799671.0000000004CA8000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.1704860125.0000000004CAC000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_4c90000_setuppicasa39-setup.jbxd

Similarity

API ID: ErrorFileFindFirstLast
String ID: *.*$.
API String ID: 873889042-358234090
Opcode ID: de64d8df1ee2085be982ec603416c643bf61218408fa04ab1d98d05f8e08e56b
Instruction ID: 71a70ee66325bd21e702ba2beea16236180f89495c3da01e6ec477103cda08ba
Opcode Fuzzy Hash: de64d8df1ee2085be982ec603416c643bf61218408fa04ab1d98d05f8e08e56b
Instruction Fuzzy Hash: F441C7355083469BCB24DF68C45A6EBB3F1FFC4358F044A59E85687390EB34AE15C791

Function 04C910B0 Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 44stringCOMMON

Download Yara Rule

APIs

lstrcpyW.KERNEL32(?,?,?,04C93ED7,?), ref: 04C910D6
lstrcatW.KERNEL32(?,runtime\defaults.ini), ref: 04C910E6
GetPrivateProfileStringW.KERNEL32(TrayHelperUpdater,vendorCode,04CA4CC4,?,00000800,?), ref: 04C9110F

Part of subcall function 04C95686: _strtol.LIBCMT ref: 04C9567D

Strings

vendorCode, xrefs: 04C91103
runtime\defaults.ini, xrefs: 04C910DC
TrayHelperUpdater, xrefs: 04C91108

Memory Dump Source

Source File: 00000010.00000002.1704544207.0000000004C91000.00000020.00000001.01000000.0000000C.sdmp, Offset: 04C90000, based on PE: true

Associated: 00000010.00000002.1704469452.0000000004C90000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.1704699696.0000000004CA3000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.1704799671.0000000004CA8000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.1704860125.0000000004CAC000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_4c90000_setuppicasa39-setup.jbxd

Similarity

API ID: PrivateProfileString_strtollstrcatlstrcpy
String ID: TrayHelperUpdater$runtime\defaults.ini$vendorCode
API String ID: 2353663838-3411319217
Opcode ID: 35e87b7949a2b39023e24fbe963f6389c589402dd430b08ed94e5a2a1370e41c
Instruction ID: deac286fc7f0934458d830b2399478d0c259e73ac4913e93d66a9765cff07f1f
Opcode Fuzzy Hash: 35e87b7949a2b39023e24fbe963f6389c589402dd430b08ed94e5a2a1370e41c
Instruction Fuzzy Hash: 4901717A6003417BF628DB64D89EBDB77E6AB8860CF404919B64D83140EB74A914CBA6

Function 04C9519A Relevance: 7.6, APIs: 5, Instructions: 57COMMONLIBRARYCODE

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32 ref: 04C967B7
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 04C967CC
UnhandledExceptionFilter.KERNEL32(04CA32D8), ref: 04C967D7
GetCurrentProcess.KERNEL32(C0000409), ref: 04C967F3
TerminateProcess.KERNEL32(00000000), ref: 04C967FA

Memory Dump Source

Source File: 00000010.00000002.1704544207.0000000004C91000.00000020.00000001.01000000.0000000C.sdmp, Offset: 04C90000, based on PE: true

Associated: 00000010.00000002.1704469452.0000000004C90000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.1704699696.0000000004CA3000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.1704799671.0000000004CA8000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.1704860125.0000000004CAC000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_4c90000_setuppicasa39-setup.jbxd

Similarity

API ID: ExceptionFilterProcessUnhandled$CurrentDebuggerPresentTerminate
String ID:
API String ID: 2579439406-0
Opcode ID: 11bba8509e5dadd2be0e24ebf2e53e5fbd2dd7cb84d7e3922f34431ac3f99a5a
Instruction ID: 3fca3180a70adacb7e762eabcc220b3bff716ef43cfaaff0b9ae8db160f68c1b
Opcode Fuzzy Hash: 11bba8509e5dadd2be0e24ebf2e53e5fbd2dd7cb84d7e3922f34431ac3f99a5a
Instruction Fuzzy Hash: 3A219EFCD00205ABDB01DF58E18E7A43BB4FB0831CB10495AEA1A87250E7B85EA18F55

Function 04C926E0 Relevance: 4.5, APIs: 2, Strings: 1, Instructions: 30memorystringCOMMON

Download Yara Rule

APIs

Part of subcall function 04C92490: GetVersion.KERNEL32 ref: 04C9249E

GlobalAlloc.KERNEL32(00000040,?), ref: 04C9271D
lstrcpynW.KERNEL32(00000004,usercaninstall,?), ref: 04C92735

Strings

usercaninstall, xrefs: 04C9272C

Memory Dump Source

Source File: 00000010.00000002.1704544207.0000000004C91000.00000020.00000001.01000000.0000000C.sdmp, Offset: 04C90000, based on PE: true

Associated: 00000010.00000002.1704469452.0000000004C90000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.1704699696.0000000004CA3000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.1704799671.0000000004CA8000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.1704860125.0000000004CAC000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_4c90000_setuppicasa39-setup.jbxd

Similarity

API ID: AllocGlobalVersionlstrcpyn
String ID: usercaninstall
API String ID: 709146503-2834939541
Opcode ID: e0d093f42c93f8797b40320c9e0844ded127328ec4dca9929945467fbb72736b
Instruction ID: caabed63924c84452f886d3bf23c68144240c5712ac47f1b4392afa24c166f90
Opcode Fuzzy Hash: e0d093f42c93f8797b40320c9e0844ded127328ec4dca9929945467fbb72736b
Instruction Fuzzy Hash: 89F0E7BD901200AFC714DF54E548A76B7E6FB48309B04895DFA4583360EB38BC50CF11

Function 04C91D20 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 55comCOMMON

Download Yara Rule

APIs

CoCreateInstance.OLE32(04CA329C,00000000,00000001,04CA328C), ref: 04C91D35

Strings

PBw, xrefs: 04C91D35

Memory Dump Source

Source File: 00000010.00000002.1704544207.0000000004C91000.00000020.00000001.01000000.0000000C.sdmp, Offset: 04C90000, based on PE: true

Associated: 00000010.00000002.1704469452.0000000004C90000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.1704699696.0000000004CA3000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.1704799671.0000000004CA8000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.1704860125.0000000004CAC000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_4c90000_setuppicasa39-setup.jbxd

Similarity

API ID: CreateInstance
String ID: PBw
API String ID: 542301482-2473657293
Opcode ID: 9dce749d09580d92d9c6ca99482912ee8c24e131a230ea0325e88de36876fbff
Instruction ID: 5cd5f1229fcecfa5361bea0c787e7d820d0eff732390372b323c184dea95cc36
Opcode Fuzzy Hash: 9dce749d09580d92d9c6ca99482912ee8c24e131a230ea0325e88de36876fbff
Instruction Fuzzy Hash: F4110975600211AFD650EB58CC91E6AB3EAAFC9B04F148A68F949DB361D631EC05CBA1

Function 04C937A0 Relevance: 56.3, APIs: 21, Strings: 11, Instructions: 281
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegCreateKeyExW.ADVAPI32(80000001,Software\Microsoft\Internet Explorer\SearchScopes\,00000000,00000000,00000000,000F003F,00000000,?,00000000), ref: 04C937DB
RegQueryInfoKeyW.ADVAPI32(?,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 04C937FF
RegEnumKeyExW.ADVAPI32 ref: 04C9384A
_memset.LIBCMT ref: 04C9386E
_memset.LIBCMT ref: 04C93883
RegOpenKeyExW.ADVAPI32 ref: 04C938AF
RegQueryValueExW.ADVAPI32(?,URL,00000000,?,?,?), ref: 04C938E5
RegCloseKey.ADVAPI32(?), ref: 04C938FB
RegOpenKeyExW.ADVAPI32(?,?,00000000,000F003F,?), ref: 04C93925
RegQueryValueExW.ADVAPI32(?,DisplayName,00000000,?,?,?), ref: 04C93958
RegCloseKey.ADVAPI32(?), ref: 04C9396D
RegCreateKeyExW.ADVAPI32(80000001,Software\Microsoft\Internet Explorer\SearchScopes,00000000,00000000,00000000,000F003F,00000000,00000000,00000000), ref: 04C939F0
RegSetValueExW.ADVAPI32(?,DefaultScope,00000000,00000001,{6A1806CD-94D4-4689-BA73-E35EA1EA9990},00000026), ref: 04C93A10
RegCloseKey.ADVAPI32(?), ref: 04C93A1D
RegCreateKeyExW.ADVAPI32(80000001,Software\Microsoft\Internet Explorer\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990},00000000,00000000,00000000,000F003F,00000000,00000000,00000000), ref: 04C93A69
RegSetValueExW.ADVAPI32(?,DisplayName,00000000,00000001,Google,00000006), ref: 04C93A83
RegCloseKey.ADVAPI32(?), ref: 04C93A8A
RegCreateKeyExW.ADVAPI32(80000001,Software\Microsoft\Internet Explorer\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990},00000000,00000000,00000000,000F003F,00000000,00000000,00000000), ref: 04C93AA5
RegSetValueExW.ADVAPI32(?,URL,00000000,00000001,http://www.google.com/search?q={searchTerms}&rls=com.microsoft:{language},00000049), ref: 04C93ABF
RegCloseKey.ADVAPI32(?), ref: 04C93AC6
RegCloseKey.ADVAPI32(?), ref: 04C93AD1

Strings

.google., xrefs: 04C9397A
URL, xrefs: 04C938D7, 04C93AB9
{6A1806CD-94D4-4689-BA73-E35EA1EA9990}, xrefs: 04C93A02
Software\Microsoft\Internet Explorer\SearchScopes\, xrefs: 04C937CD
Software\Microsoft\Internet Explorer\SearchScopes, xrefs: 04C939E6, 04C93A21
http://www.google.com/search?q={searchTerms}&rls=com.microsoft:{language}, xrefs: 04C93AB1
Software\Microsoft\Internet Explorer\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}, xrefs: 04C93A5F, 04C93A9B
DisplayName, xrefs: 04C9394A, 04C93A7D
0_w, xrefs: 04C939D1
Google, xrefs: 04C9398C, 04C93A75
DefaultScope, xrefs: 04C93A0A, 04C93A2B

Memory Dump Source

Source File: 00000010.00000002.1704544207.0000000004C91000.00000020.00000001.01000000.0000000C.sdmp, Offset: 04C90000, based on PE: true

Associated: 00000010.00000002.1704469452.0000000004C90000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.1704699696.0000000004CA3000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.1704799671.0000000004CA8000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.1704860125.0000000004CAC000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_4c90000_setuppicasa39-setup.jbxd

Similarity

API ID: Close$Value$Create$Query$Open_memset$EnumInfo
String ID: .google.$0_w$DefaultScope$DisplayName$Google$Software\Microsoft\Internet Explorer\SearchScopes$Software\Microsoft\Internet Explorer\SearchScopes\$Software\Microsoft\Internet Explorer\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}$URL$http://www.google.com/search?q={searchTerms}&rls=com.microsoft:{language}${6A1806CD-94D4-4689-BA73-E35EA1EA9990}
API String ID: 1296880510-3452464744
Opcode ID: 927256b3a3498f3a58cf63e008fa396ec54e1441795bf87d6f1e7968c3b557ca
Instruction ID: 8acccf127bfaf567ecce28eb2978eb238149d1778635d6b9f3e83d8e96396f37
Opcode Fuzzy Hash: 927256b3a3498f3a58cf63e008fa396ec54e1441795bf87d6f1e7968c3b557ca
Instruction Fuzzy Hash: 38919D71604382BBD720DF55CC89E6BBBEAEBC9B08F40491CFA4597150E771E908CB62

Function 04C947D0 Relevance: 52.8, APIs: 21, Strings: 9, Instructions: 344
memoryfilestringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GlobalAlloc.KERNEL32(00000040,?), ref: 04C9483D
lstrcpyW.KERNEL32(00000000,?), ref: 04C9484C
GlobalFree.KERNEL32 ref: 04C94858
GlobalAlloc.KERNEL32(00000040,?), ref: 04C948A3
lstrcpyW.KERNEL32(00000000,?), ref: 04C948AC
GlobalFree.KERNEL32 ref: 04C948B9
GetFileAttributesW.KERNEL32(?), ref: 04C94981
_memset.LIBCMT ref: 04C949EB
SHFileOperationW.SHELL32(?,?,?,?,?,?,?,?,?,?), ref: 04C94A56
RemoveDirectoryW.KERNEL32(?), ref: 04C94A64

Part of subcall function 04C94570: _wcsrchr.LIBCMT ref: 04C945C9
Part of subcall function 04C94570: CreateDirectoryW.KERNEL32(00000000,00000000), ref: 04C945E2

GetFileAttributesW.KERNEL32(?), ref: 04C94AEB
GetFileAttributesW.KERNEL32(?), ref: 04C94AFE
GetLastError.KERNEL32 ref: 04C94B29
wsprintfW.USER32 ref: 04C94B39
MessageBoxW.USER32(00000000,?,Picasa3 Installer,00001000), ref: 04C94B52
GetLastError.KERNEL32 ref: 04C94B61
DeleteFileW.KERNEL32(?), ref: 04C94BD9
GetLastError.KERNEL32 ref: 04C94BE3
wsprintfW.USER32 ref: 04C94BF3
MessageBoxW.USER32(00000000,?,Picasa3 Installer,00001000), ref: 04C94C0C
DeleteFileW.KERNEL32(?), ref: 04C94CC2

Strings

upgradedirectory delete failed (%d), xrefs: 04C94BE6
PicasaMediaDetector.exe, xrefs: 04C94C17
Picasa3 Installer, xrefs: 04C94B43, 04C94BFD
Unable to install upgrade, Please close all Explorer windows and click OK to retry(%d), xrefs: 04C94B33
*.*, xrefs: 04C94A2E
upgradedirectory rename failed (%d), xrefs: 04C94B64
\, xrefs: 04C94925
\, xrefs: 04C94951
Picasa2.exe, xrefs: 04C94AAE, 04C94B9C

Memory Dump Source

Source File: 00000010.00000002.1704544207.0000000004C91000.00000020.00000001.01000000.0000000C.sdmp, Offset: 04C90000, based on PE: true

Associated: 00000010.00000002.1704469452.0000000004C90000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.1704699696.0000000004CA3000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.1704799671.0000000004CA8000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.1704860125.0000000004CAC000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_4c90000_setuppicasa39-setup.jbxd

Similarity

API ID: File$Global$AttributesErrorLast$AllocDeleteDirectoryFreeMessagelstrcpywsprintf$CreateOperationRemove_memset_wcsrchr
String ID: *.*$Picasa2.exe$Picasa3 Installer$PicasaMediaDetector.exe$Unable to install upgrade, Please close all Explorer windows and click OK to retry(%d)$\$\$upgradedirectory delete failed (%d)$upgradedirectory rename failed (%d)
API String ID: 2368998033-3637034776
Opcode ID: de3fdeacbd3bcfdb7944ab0853ca81704011f1a9a6f86c70df96c38c0cdd77f6
Instruction ID: 534e87452464385b88dbcf2ee9ec78540c9b1f9c13c478272e3e118bf744664f
Opcode Fuzzy Hash: de3fdeacbd3bcfdb7944ab0853ca81704011f1a9a6f86c70df96c38c0cdd77f6
Instruction Fuzzy Hash: 75D1B175909301AFC728DF24D859BA7B3F5FF88758F048A2DE88587250E734AE11CB99

Function 04C92920 Relevance: 44.0, APIs: 23, Strings: 2, Instructions: 248
windowmemorystringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GlobalAlloc.KERNEL32(00000040,?), ref: 04C9298F
lstrcpyW.KERNEL32(00000000,?), ref: 04C9299C
GlobalFree.KERNEL32 ref: 04C929AC
GetDlgItem.USER32(?,00000001), ref: 04C929FD
GetWindowRect.USER32(00000000,?), ref: 04C92A0F
MapWindowPoints.USER32(00000000,?,?,00000002), ref: 04C92A1F
GetUserDefaultLCID.KERNEL32 ref: 04C92A2D
GetClientRect.USER32(?,?), ref: 04C92A43
CreateWindowExW.USER32(00000000,BUTTON,?,50010000,0000000A,000000E1,000000E1,?,?,00000000,04C90000,00000000), ref: 04C92A8E
SendMessageW.USER32(00000000,00000031,00000000,00000000), ref: 04C92AAC
SendMessageW.USER32(00000000,00000030,00000000), ref: 04C92AB7
SetWindowLongW.USER32(?,000000FC,04C92750), ref: 04C92AC1
FindWindowExW.USER32(?,00000000,#32770,00000000), ref: 04C92AD6
GetDlgItem.USER32(00000000,000003E8), ref: 04C92AE2
_fseek.LIBCMT ref: 04C92B16
_ftell.LIBCMT ref: 04C92B1C
_fseek.LIBCMT ref: 04C92B28

Part of subcall function 04C95A54: __fseek_nolock.LIBCMT ref: 04C95AAF

_malloc.LIBCMT ref: 04C92B31

Part of subcall function 04C95DB9: __FF_MSGBANNER.LIBCMT ref: 04C95DDC
Part of subcall function 04C95DB9: HeapAlloc.KERNEL32(00000000,?,00000001,00000000,00000000,?,04C9C737,?,00000001,?,04C989A9,00000018,04CA5E80,0000000C,04C98A38,?), ref: 04C95E31

__fread_nolock.LIBCMT ref: 04C92B48
MultiByteToWideChar.KERNEL32(0000FDE9,00000000,00000000,000000FF,00000000,00000000), ref: 04C92BA9
_malloc.LIBCMT ref: 04C92BBA
MultiByteToWideChar.KERNEL32(0000FDE9,00000000,00000000,000000FF,00000000,00000000), ref: 04C92BD0
SendMessageW.USER32(?,0000000C,00000000,00000000), ref: 04C92BE5

Strings

#32770, xrefs: 04C92ACE
BUTTON, xrefs: 04C92A83

Memory Dump Source

Source File: 00000010.00000002.1704544207.0000000004C91000.00000020.00000001.01000000.0000000C.sdmp, Offset: 04C90000, based on PE: true

Associated: 00000010.00000002.1704469452.0000000004C90000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.1704699696.0000000004CA3000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.1704799671.0000000004CA8000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.1704860125.0000000004CAC000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_4c90000_setuppicasa39-setup.jbxd

Similarity

API ID: Window$MessageSend$AllocByteCharGlobalItemMultiRectWide_fseek_malloc$ClientCreateDefaultFindFreeHeapLongPointsUser__fread_nolock__fseek_nolock_ftelllstrcpy
String ID: #32770$BUTTON
API String ID: 1681213535-386778912
Opcode ID: 40a8da45d77f0e47c8b0d8f7d55f5289df649a8d65ad7f5dd25e4fdc18c30b43
Instruction ID: 7a7274276c9b1f99ebb18a55bac6b74d17e1752c2c8b1c1e620285c74cd840e5
Opcode Fuzzy Hash: 40a8da45d77f0e47c8b0d8f7d55f5289df649a8d65ad7f5dd25e4fdc18c30b43
Instruction Fuzzy Hash: F7812675A40301BFEB209F64DC49F2BB7EAEB48718F044A18FA959B1D0E778BD018751

Function 04C9BAC1 Relevance: 33.4, APIs: 15, Strings: 4, Instructions: 156
fileCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_strcpy_s.LIBCMT ref: 04C9BB2D
__invoke_watson.LIBCMT ref: 04C9BB3E
GetModuleFileNameA.KERNEL32(00000000,04CA9639,00000104), ref: 04C9BB5A
_strcpy_s.LIBCMT ref: 04C9BB6F
__invoke_watson.LIBCMT ref: 04C9BB82
_strlen.LIBCMT ref: 04C9BB8B
_strlen.LIBCMT ref: 04C9BB98
__invoke_watson.LIBCMT ref: 04C9BBC5
_strcat_s.LIBCMT ref: 04C9BBD8
__invoke_watson.LIBCMT ref: 04C9BBE9
_strcat_s.LIBCMT ref: 04C9BBFA
__invoke_watson.LIBCMT ref: 04C9BC0B
GetStdHandle.KERNEL32(000000F4,?,?,00000000,776B5E70,00000003,04C9BC8D,000000FC,04C95DE1,00000001,00000000,00000000,?,04C9C737,?,00000001), ref: 04C9BC2A
_strlen.LIBCMT ref: 04C9BC4B
WriteFile.KERNEL32(00000000,00000000,00000000,?,00000000,?,04C9C737,?,00000001,?,04C989A9,00000018,04CA5E80,0000000C,04C98A38,?), ref: 04C9BC55

Strings

..., xrefs: 04C9BBA9
Runtime Error!Program: , xrefs: 04C9BB1C
Microsoft Visual C++ Runtime Library, xrefs: 04C9BC18
<program name unknown>, xrefs: 04C9BB64

Memory Dump Source

Source File: 00000010.00000002.1704544207.0000000004C91000.00000020.00000001.01000000.0000000C.sdmp, Offset: 04C90000, based on PE: true

Associated: 00000010.00000002.1704469452.0000000004C90000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.1704699696.0000000004CA3000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.1704799671.0000000004CA8000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.1704860125.0000000004CAC000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_4c90000_setuppicasa39-setup.jbxd

Similarity

API ID: __invoke_watson$_strlen$File_strcat_s_strcpy_s$HandleModuleNameWrite
String ID: ...$<program name unknown>$Microsoft Visual C++ Runtime Library$Runtime Error!Program:
API String ID: 1879448924-4022980321
Opcode ID: 80c7e4c1ce5dbc52dae2b49047be3c329a52da4a835f2f7fefa616b327bf17a7
Instruction ID: d5504089508072c9632a9668810f6dd9c2959b30f2d2a879d639154a9a55b2af
Opcode Fuzzy Hash: 80c7e4c1ce5dbc52dae2b49047be3c329a52da4a835f2f7fefa616b327bf17a7
Instruction Fuzzy Hash: 8631E2B2A002167AFE207925AC5DF6B368FEB1175CF040524ED05A11C2FA66FF2552F6

Function 04C913B0 Relevance: 31.7, APIs: 13, Strings: 5, Instructions: 179
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegOpenKeyExW.ADVAPI32(80000001,SOFTWARE\Clients\StartMenuInternet,00000000,000F003F,?,?,?,00000000,04C91629,?,7576F860,757305F0,04C93EE3), ref: 04C913FD
RegQueryValueExW.ADVAPI32(?,00000000,00000000,?,00000400,?), ref: 04C9142C
RegCloseKey.ADVAPI32(?), ref: 04C91446
RegOpenKeyExW.ADVAPI32(80000002,SOFTWARE\Clients\StartMenuInternet,00000000,000F003F,?), ref: 04C91479
RegQueryValueExW.ADVAPI32(?,00000000,00000000,?,00000400,?), ref: 04C914A8
RegCloseKey.ADVAPI32(?), ref: 04C914B7
RegCloseKey.ADVAPI32(?), ref: 04C914CC
RegOpenKeyExW.ADVAPI32 ref: 04C9151B
RegQueryValueExW.ADVAPI32(?,00000000,00000000,?,?,?), ref: 04C91546
RegCloseKey.ADVAPI32(00000000), ref: 04C9155F
RegOpenKeyExW.ADVAPI32(80000000,http\shell\open\command,00000000,000F003F,00000000), ref: 04C9158B
RegQueryValueExW.ADVAPI32(?,00000000,00000000,?,?,?), ref: 04C915B6
RegCloseKey.ADVAPI32(00000000), ref: 04C915D0

Strings

SOFTWARE\Clients\StartMenuInternet, xrefs: 04C913DE, 04C91462, 04C914E2
%s\%s\shell\open\command, xrefs: 04C914E7
http\shell\open\command, xrefs: 04C91575
_w0_w, xrefs: 04C9142C, 04C914A8, 04C91546, 04C915B6
iexplore.exe, xrefs: 04C914E1

Memory Dump Source

Source File: 00000010.00000002.1704544207.0000000004C91000.00000020.00000001.01000000.0000000C.sdmp, Offset: 04C90000, based on PE: true

Associated: 00000010.00000002.1704469452.0000000004C90000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.1704699696.0000000004CA3000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.1704799671.0000000004CA8000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.1704860125.0000000004CAC000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_4c90000_setuppicasa39-setup.jbxd

Similarity

API ID: Close$OpenQueryValue
String ID: %s\%s\shell\open\command$SOFTWARE\Clients\StartMenuInternet$http\shell\open\command$iexplore.exe$_w0_w
API String ID: 1607946009-3707843617
Opcode ID: c4b72a143ec6a64db540ec0cf2473c1fc7ad15b1885f3460021a3dd9a7fbc863
Instruction ID: 6bded2b1ba9c4ac8aa7b47c58853d127ce4ee6d09d0f51269af7362c5beea455
Opcode Fuzzy Hash: c4b72a143ec6a64db540ec0cf2473c1fc7ad15b1885f3460021a3dd9a7fbc863
Instruction Fuzzy Hash: CB614C71508342BBD720CF45D849EABBBE9FF88748F04490CF18997150EB74EA49CBA2

Function 04C9A680 Relevance: 29.9, APIs: 12, Strings: 5, Instructions: 109
libraryloadermemoryCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleA.KERNEL32(KERNEL32.DLL,?,04C964D0,?,?,00000001,?,?,04C96640,00000001,?,?,04CA5E00,0000000C,04C966FA,?), ref: 04C9A686
__mtterm.LIBCMT ref: 04C9A692

Part of subcall function 04C9A36B: TlsFree.KERNEL32(0000002C,04C9656C,?,?,00000001,?,?,04C96640,00000001,?,?,04CA5E00,0000000C,04C966FA,?), ref: 04C9A396

GetProcAddress.KERNEL32(00000000,FlsAlloc), ref: 04C9A6A8
GetProcAddress.KERNEL32(00000000,FlsGetValue), ref: 04C9A6B5
GetProcAddress.KERNEL32(00000000,FlsSetValue), ref: 04C9A6C2
GetProcAddress.KERNEL32(00000000,FlsFree), ref: 04C9A6CF
TlsAlloc.KERNEL32(?,?,00000001,?,?,04C96640,00000001,?,?,04CA5E00,0000000C,04C966FA,?), ref: 04C9A71F
TlsSetValue.KERNEL32(00000000,?,?,00000001,?,?,04C96640,00000001,?,?,04CA5E00,0000000C,04C966FA,?), ref: 04C9A73A
__init_pointers.LIBCMT ref: 04C9A744
__calloc_crt.LIBCMT ref: 04C9A7B9
GetCurrentThreadId.KERNEL32 ref: 04C9A7E9

Strings

FlsAlloc, xrefs: 04C9A6A2
FlsFree, xrefs: 04C9A6C4
FlsGetValue, xrefs: 04C9A6AA
FlsSetValue, xrefs: 04C9A6B7
KERNEL32.DLL, xrefs: 04C9A681

Memory Dump Source

Source File: 00000010.00000002.1704544207.0000000004C91000.00000020.00000001.01000000.0000000C.sdmp, Offset: 04C90000, based on PE: true

Associated: 00000010.00000002.1704469452.0000000004C90000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.1704699696.0000000004CA3000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.1704799671.0000000004CA8000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.1704860125.0000000004CAC000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_4c90000_setuppicasa39-setup.jbxd

Similarity

API ID: AddressProc$AllocCurrentFreeHandleModuleThreadValue__calloc_crt__init_pointers__mtterm
String ID: FlsAlloc$FlsFree$FlsGetValue$FlsSetValue$KERNEL32.DLL
API String ID: 630932248-3819984048
Opcode ID: c04b77a3b9fd7124a215d225c5460987d946c23c405a5b16672125a1b8a258ca
Instruction ID: 1906a11268e092e352b25e0f3ebdc44f32633930e9041607db8089c706868f56
Opcode Fuzzy Hash: c04b77a3b9fd7124a215d225c5460987d946c23c405a5b16672125a1b8a258ca
Instruction Fuzzy Hash: 793150B9D00781BFDF10AF74A80F7553EE2EB457587108E26E91187190EB3AAD61EF50

Function 04C94E50 Relevance: 26.4, APIs: 10, Strings: 5, Instructions: 124
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleA.KERNEL32(kernel32.dll,76975540), ref: 04C94E75
GetProcAddress.KERNEL32(00000000,CreateToolhelp32Snapshot), ref: 04C94EA9
GetProcAddress.KERNEL32(00000000,Process32First), ref: 04C94EB3
GetProcAddress.KERNEL32(00000000,Process32Next), ref: 04C94EBD
GetCurrentProcessId.KERNEL32 ref: 04C94F08
OpenProcess.KERNEL32(00000001,00000000,?,?,?,?,76969530), ref: 04C94F6D
TerminateProcess.KERNEL32(00000000,00000001,?,?,?,76969530), ref: 04C94F7C
GetExitCodeProcess.KERNEL32(00000000,?), ref: 04C94F84
CloseHandle.KERNEL32(00000000,?,?,?,76969530), ref: 04C94F8B
CloseHandle.KERNEL32(00000000), ref: 04C94FB4

Strings

Process32Next, xrefs: 04C94EB5
CreateToolhelp32Snapshot, xrefs: 04C94EA3
$, xrefs: 04C94F20
kernel32.dll, xrefs: 04C94E6C
Process32First, xrefs: 04C94EAB

Memory Dump Source

Source File: 00000010.00000002.1704544207.0000000004C91000.00000020.00000001.01000000.0000000C.sdmp, Offset: 04C90000, based on PE: true

Associated: 00000010.00000002.1704469452.0000000004C90000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.1704699696.0000000004CA3000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.1704799671.0000000004CA8000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.1704860125.0000000004CAC000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_4c90000_setuppicasa39-setup.jbxd

Similarity

API ID: Process$AddressHandleProc$Close$CodeCurrentExitModuleOpenTerminate
String ID: $$CreateToolhelp32Snapshot$Process32First$Process32Next$kernel32.dll
API String ID: 50073011-1548775838
Opcode ID: 8be194fb20714cf99bad19d8972702a0f3caeac98fbf7b0fd014ee0d8a674204
Instruction ID: ec9d293e888bcb28281cd1acff7ac4d57ceccd15c3be68e938c0522bb7b28959
Opcode Fuzzy Hash: 8be194fb20714cf99bad19d8972702a0f3caeac98fbf7b0fd014ee0d8a674204
Instruction Fuzzy Hash: 1C41C631908312BFD7249F649C49B6FB3D6EF89718F000A19F95897280E774FE058B96

Function 04C950A0 Relevance: 26.3, APIs: 10, Strings: 5, Instructions: 79
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FindWindowA.USER32(ytWindow,Picasa2), ref: 04C950B4
EnumWindows.USER32(04C94D30,04C93241), ref: 04C950D4
SendMessageW.USER32(00000000,00000010,00000000,00000000), ref: 04C950E5
FindWindowA.USER32(ytWindow,Picasa Media Detector), ref: 04C950F1
SendMessageW.USER32(00000000,00000010,00000000,00000000), ref: 04C95102
SendMessageW.USER32(04C93241,00000002,00000000,00000000), ref: 04C9510F
FindWindowA.USER32(ytWindow,Picasa Photo Viewer), ref: 04C9511B
EnumWindows.USER32(04C94DC0,04C93241), ref: 04C9512F
SendMessageW.USER32(00000000,00000010,00000000,00000000), ref: 04C95140
SendMessageW.USER32(04C93241,00000002,00000000,00000000), ref: 04C9514D

Strings

ytWindow, xrefs: 04C950AF, 04C950EC, 04C95116
Picasa Media Detector, xrefs: 04C950E7, 04C95168
Picasa Photo Viewer, xrefs: 04C95111
Slingshot, xrefs: 04C95172
Picasa2, xrefs: 04C950AA, 04C95154

Memory Dump Source

Source File: 00000010.00000002.1704544207.0000000004C91000.00000020.00000001.01000000.0000000C.sdmp, Offset: 04C90000, based on PE: true

Associated: 00000010.00000002.1704469452.0000000004C90000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.1704699696.0000000004CA3000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.1704799671.0000000004CA8000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.1704860125.0000000004CAC000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_4c90000_setuppicasa39-setup.jbxd

Similarity

API ID: MessageSend$FindWindow$EnumWindows
String ID: Picasa Media Detector$Picasa Photo Viewer$Picasa2$Slingshot$ytWindow
API String ID: 337429809-1706115120
Opcode ID: e73c0e20412483379d3411ff6ea08c4bda0335ee83a48b5f2d3b4bd9d6b39d4a
Instruction ID: 634768fd87c0db3ea704a4b15eaf3d012f224914925553e60b9e89b04cdf4fca
Opcode Fuzzy Hash: e73c0e20412483379d3411ff6ea08c4bda0335ee83a48b5f2d3b4bd9d6b39d4a
Instruction Fuzzy Hash: C421A27AB843057FEA20AB65AC4AF1F67DA9B44B6DF10C425B644E71C0C6B4FC108F69

Function 04C940F0 Relevance: 24.7, APIs: 12, Strings: 2, Instructions: 172
memorystringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GlobalAlloc.KERNEL32(00000040,?), ref: 04C9414C
lstrcpyW.KERNEL32(00000000,?), ref: 04C9415F
GlobalFree.KERNEL32 ref: 04C9416B
GlobalAlloc.KERNEL32(00000040,?), ref: 04C941B3
lstrcpyW.KERNEL32(00000000,?), ref: 04C941C0
GlobalFree.KERNEL32 ref: 04C941CD
_sscanf.LIBCMT ref: 04C94240
GetFileVersionInfoSizeW.VERSION(?,?), ref: 04C94272
GlobalAlloc.KERNEL32(00000040,00000000,?,?), ref: 04C94284
GetFileVersionInfoW.VERSION(?,00000000,00000000,00000000), ref: 04C94295
VerQueryValueW.VERSION(00000000,04CA4FDC,?,?,?,00000000,00000000,00000000), ref: 04C942AE

Strings

%d.%d.%d.%d, xrefs: 04C9421A
filenewer, xrefs: 04C942F2

Memory Dump Source

Source File: 00000010.00000002.1704544207.0000000004C91000.00000020.00000001.01000000.0000000C.sdmp, Offset: 04C90000, based on PE: true

Associated: 00000010.00000002.1704469452.0000000004C90000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.1704699696.0000000004CA3000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.1704799671.0000000004CA8000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.1704860125.0000000004CAC000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_4c90000_setuppicasa39-setup.jbxd

Similarity

API ID: Global$Alloc$FileFreeInfoVersionlstrcpy$QuerySizeValue_sscanf
String ID: %d.%d.%d.%d$filenewer
API String ID: 822543558-1856426262
Opcode ID: fea525b17a5837ae7507ed25d70b49dd53d83fec06ccedded5c32a4440197cf0
Instruction ID: d1ab1b96d83b71954516a52b39fbd4b6cf347e4c0106f9754cb4270ee8931679
Opcode Fuzzy Hash: fea525b17a5837ae7507ed25d70b49dd53d83fec06ccedded5c32a4440197cf0
Instruction Fuzzy Hash: 2D517D75908301AFC725DF29C884A6AB7E9FFC8654F44461EF58587210EB74EE01CB95

Function 04CA20E1 Relevance: 24.2, APIs: 16, Instructions: 235
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LCMapStringW.KERNEL32(00000000,00000100,04CA3404,00000001,00000000,00000000,04C97AB2,00000000,00000000,?,?,?,?,00000001,?,?), ref: 04CA2115
GetLastError.KERNEL32(?,?), ref: 04CA2127
LCMapStringW.KERNEL32(?,?,?,00000000,00000000,04C97AB2,04C97AB2,00000000,00000000,?,?,?,?,00000001,?,?), ref: 04CA217A
___ansicp.LIBCMT ref: 04CA21AA
WideCharToMultiByte.KERNEL32(00000000,00000000,?,00000000,00000000,00000000,00000000,00000000,04C97AB2,00000000,00000000,?,?,?,?,00000001), ref: 04CA21D1
__alloca_probe_16.LIBCMT ref: 04CA21FB
_malloc.LIBCMT ref: 04CA220F
WideCharToMultiByte.KERNEL32(?,00000000,?,?,?,00000000,00000000,00000000,?,?), ref: 04CA223F
LCMapStringA.KERNEL32(?,?,?,00000000,00000000,00000000,?,?), ref: 04CA225B
__alloca_probe_16.LIBCMT ref: 04CA227F
_malloc.LIBCMT ref: 04CA2293
LCMapStringA.KERNEL32(?,?,?,?,00000000,00000000,?,?), ref: 04CA22BA
__invoke_watson.LIBCMT ref: 04CA22F2
MultiByteToWideChar.KERNEL32(?,00000001,00000000,00000000,?,?), ref: 04CA2314
__freea.LIBCMT ref: 04CA231E
__freea.LIBCMT ref: 04CA2327

Memory Dump Source

Source File: 00000010.00000002.1704544207.0000000004C91000.00000020.00000001.01000000.0000000C.sdmp, Offset: 04C90000, based on PE: true

Associated: 00000010.00000002.1704469452.0000000004C90000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.1704699696.0000000004CA3000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.1704799671.0000000004CA8000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.1704860125.0000000004CAC000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_4c90000_setuppicasa39-setup.jbxd

Similarity

API ID: String$ByteCharMultiWide$__alloca_probe_16__freea_malloc$ErrorLast___ansicp__invoke_watson
String ID:
API String ID: 2975081050-0
Opcode ID: dafc9ff3993aef71815fe60116cc548f77fdcaca7a50e328d7519ca4e2d2af94
Instruction ID: b1f45f5b4ba45f9639608f6b19e57939d8c48ebce22da53067d38b774e5b2a9f
Opcode Fuzzy Hash: dafc9ff3993aef71815fe60116cc548f77fdcaca7a50e328d7519ca4e2d2af94
Instruction Fuzzy Hash: 7871C07590012AAFEF119F90CC849BE7BABEB0436CF0449A5FA1496260D335EE719B61

Function 04C92350 Relevance: 22.8, APIs: 8, Strings: 5, Instructions: 92
processsynchronizationwindowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_memset.LIBCMT ref: 04C923C1
CreateProcessW.KERNEL32 ref: 04C92404
WaitForSingleObject.KERNEL32(?,00007530), ref: 04C92418
CloseHandle.KERNEL32(?), ref: 04C9242B
CloseHandle.KERNEL32(00000000), ref: 04C92432
GetLastError.KERNEL32 ref: 04C92439
wsprintfW.USER32 ref: 04C9244E
MessageBoxW.USER32(?,?,Uninstall Picasa Photo Viewer failed,00000000), ref: 04C92469

Strings

PicasaPhotoViewer.exe, xrefs: 04C923B9
Error uninstalling Picasa Photo Viewer (%d), xrefs: 04C92448
/uninstall, xrefs: 04C923EF
Uninstall Picasa Photo Viewer failed, xrefs: 04C9245E
D, xrefs: 04C923FC

Memory Dump Source

Source File: 00000010.00000002.1704544207.0000000004C91000.00000020.00000001.01000000.0000000C.sdmp, Offset: 04C90000, based on PE: true

Associated: 00000010.00000002.1704469452.0000000004C90000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.1704699696.0000000004CA3000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.1704799671.0000000004CA8000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.1704860125.0000000004CAC000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_4c90000_setuppicasa39-setup.jbxd

Similarity

API ID: CloseHandle$CreateErrorLastMessageObjectProcessSingleWait_memsetwsprintf
String ID: /uninstall$D$Error uninstalling Picasa Photo Viewer (%d)$PicasaPhotoViewer.exe$Uninstall Picasa Photo Viewer failed
API String ID: 2621727595-542939724
Opcode ID: 8cc98004454b014f4e57b64512eb0f8104e9eef8b555ee89d07cd6164ad61d3b
Instruction ID: 43ea66fcf152e37b0b42a7727b5109651817ebcc5dd838c37c5cccf9b51be814
Opcode Fuzzy Hash: 8cc98004454b014f4e57b64512eb0f8104e9eef8b555ee89d07cd6164ad61d3b
Instruction Fuzzy Hash: 3B318379A04341BFD710DB64DC49BAB77EAFB84718F00891DFA95C7280EB74A9048B62

Function 04C92F90 Relevance: 21.2, APIs: 14, Instructions: 208memorystringCOMMON

Download Yara Rule

APIs

GlobalAlloc.KERNEL32(00000040,?), ref: 04C92FF6
lstrcpyW.KERNEL32(00000000,?), ref: 04C92FFF
GlobalFree.KERNEL32 ref: 04C9300F
_wcstok.LIBCMT ref: 04C9305E
_wcstok.LIBCMT ref: 04C93090
_wcstok.LIBCMT ref: 04C930C0
GlobalAlloc.KERNEL32(00000040,?), ref: 04C93111
lstrcpynW.KERNEL32(00000004,04CA4C74,?), ref: 04C93121
GlobalAlloc.KERNEL32(00000040,?), ref: 04C9314C

Memory Dump Source

Source File: 00000010.00000002.1704544207.0000000004C91000.00000020.00000001.01000000.0000000C.sdmp, Offset: 04C90000, based on PE: true

Associated: 00000010.00000002.1704469452.0000000004C90000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.1704699696.0000000004CA3000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.1704799671.0000000004CA8000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.1704860125.0000000004CAC000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_4c90000_setuppicasa39-setup.jbxd

Similarity

API ID: Global$Alloc_wcstok$Freelstrcpylstrcpyn
String ID:
API String ID: 3227266963-0
Opcode ID: e811961fa6a40c8796be785ff376602f24ad343a398231f61078f7d91f292482
Instruction ID: f57c6d3d4690dc3100cb68dd80445c6811c62b01e0fbcdb40cb23c74acf6a9d9
Opcode Fuzzy Hash: e811961fa6a40c8796be785ff376602f24ad343a398231f61078f7d91f292482
Instruction Fuzzy Hash: 4171937A600305AFC724DF58D8C5A66B3E6EF8C704B458629EA45C7220EB74FE14CB95

Function 04CA0B0A Relevance: 21.2, APIs: 8, Strings: 4, Instructions: 164libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(USER32.DLL,00000000,00000000,00000314,?,?,?,04CA9620,04C9BC23,04CA9620,Microsoft Visual C++ Runtime Library,00012010), ref: 04CA0B37
GetProcAddress.KERNEL32(00000000,MessageBoxA), ref: 04CA0B53

Part of subcall function 04C9A24B: TlsGetValue.KERNEL32(00000000,04C9A2C0,00000000,04CA0B18,00000000,00000000,00000314,?,?,?,04CA9620,04C9BC23,04CA9620,Microsoft Visual C++ Runtime Library,00012010), ref: 04C9A258
Part of subcall function 04C9A24B: TlsGetValue.KERNEL32(00000007,?,?,?,04CA9620,04C9BC23,04CA9620,Microsoft Visual C++ Runtime Library,00012010), ref: 04C9A26F

GetProcAddress.KERNEL32(00000000,00000000), ref: 04CA0B70

Part of subcall function 04C9A24B: GetModuleHandleA.KERNEL32(KERNEL32.DLL,?,?,?,04CA9620,04C9BC23,04CA9620,Microsoft Visual C++ Runtime Library,00012010), ref: 04C9A284
Part of subcall function 04C9A24B: GetProcAddress.KERNEL32(00000000,EncodePointer), ref: 04C9A29F

GetProcAddress.KERNEL32(00000000,00000000), ref: 04CA0B85
__invoke_watson.LIBCMT ref: 04CA0BA6

Part of subcall function 04C9680C: _memset.LIBCMT ref: 04C96898
Part of subcall function 04C9680C: IsDebuggerPresent.KERNEL32(?,?,00000000), ref: 04C968B6
Part of subcall function 04C9680C: SetUnhandledExceptionFilter.KERNEL32(00000000,?,?,00000000), ref: 04C968C0
Part of subcall function 04C9680C: UnhandledExceptionFilter.KERNEL32(?,?,?,00000000), ref: 04C968CA
Part of subcall function 04C9680C: GetCurrentProcess.KERNEL32(C000000D,?,?,00000000), ref: 04C968E5
Part of subcall function 04C9680C: TerminateProcess.KERNEL32(00000000,?,?,00000000), ref: 04C968EC

Part of subcall function 04C9A2C2: TlsGetValue.KERNEL32(00000000,04C9A357), ref: 04C9A2CF
Part of subcall function 04C9A2C2: TlsGetValue.KERNEL32(00000007), ref: 04C9A2E6

Part of subcall function 04C9A2C2: GetModuleHandleA.KERNEL32(KERNEL32.DLL), ref: 04C9A2FB
Part of subcall function 04C9A2C2: GetProcAddress.KERNEL32(00000000,DecodePointer), ref: 04C9A316

GetProcAddress.KERNEL32(00000000,GetUserObjectInformationA), ref: 04CA0BBA
GetProcAddress.KERNEL32(00000000,GetProcessWindowStation), ref: 04CA0BD2
__invoke_watson.LIBCMT ref: 04CA0C45

Strings

MessageBoxA, xrefs: 04CA0B4D
GetProcessWindowStation, xrefs: 04CA0BCC
GetUserObjectInformationA, xrefs: 04CA0BB4
USER32.DLL, xrefs: 04CA0B32

Memory Dump Source

Source File: 00000010.00000002.1704544207.0000000004C91000.00000020.00000001.01000000.0000000C.sdmp, Offset: 04C90000, based on PE: true

Associated: 00000010.00000002.1704469452.0000000004C90000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.1704699696.0000000004CA3000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.1704799671.0000000004CA8000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.1704860125.0000000004CAC000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_4c90000_setuppicasa39-setup.jbxd

Similarity

API ID: AddressProc$Value$ExceptionFilterHandleModuleProcessUnhandled__invoke_watson$CurrentDebuggerLibraryLoadPresentTerminate_memset
String ID: GetProcessWindowStation$GetUserObjectInformationA$MessageBoxA$USER32.DLL
API String ID: 2940365033-1046234306
Opcode ID: d1d72efdf8088cbb39fd056f8d80c28ddd466f698f60e82b3e0121cf60347db1
Instruction ID: c1511dc257d546cb641e1e39152b20fdd293c10fb57d997272d51b6903b0fb8f
Opcode Fuzzy Hash: d1d72efdf8088cbb39fd056f8d80c28ddd466f698f60e82b3e0121cf60347db1
Instruction Fuzzy Hash: CD4198B5E01206BEDF14AFA59D89A6E7BF7FB0438CF24083AD005D3140DA75BE649B16

Function 04C93340 Relevance: 19.4, APIs: 8, Strings: 3, Instructions: 140registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.ADVAPI32(80000002,SYSTEM\CurrentControlSet\Control\StillImage\Events\STIProxyEvent\,00000000,000F003F,?,?), ref: 04C93373
RegQueryInfoKeyW.ADVAPI32(?,00000000,00000000,00000000,?,00000000,00000000,00000000,00000000,00000000,00000000,00000000,7576F860,757305F0), ref: 04C9339B
RegEnumKeyExW.ADVAPI32(?,00000000,?,?,00000000,00000000,00000000,?), ref: 04C933D8
_memset.LIBCMT ref: 04C933F6
RegOpenKeyExW.ADVAPI32(?,?,00000000,000F003F,?), ref: 04C93417
RegQueryValueExW.ADVAPI32 ref: 04C9344E
RegCloseKey.ADVAPI32(?), ref: 04C93468
RegCloseKey.ADVAPI32(?), ref: 04C934C8

Strings

Name, xrefs: 04C93440
SYSTEM\CurrentControlSet\Control\StillImage\Events\STIProxyEvent\, xrefs: 04C93362
_w0_w, xrefs: 04C9344E

Memory Dump Source

Source File: 00000010.00000002.1704544207.0000000004C91000.00000020.00000001.01000000.0000000C.sdmp, Offset: 04C90000, based on PE: true

Associated: 00000010.00000002.1704469452.0000000004C90000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.1704699696.0000000004CA3000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.1704799671.0000000004CA8000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.1704860125.0000000004CAC000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_4c90000_setuppicasa39-setup.jbxd

Similarity

API ID: CloseOpenQuery$EnumInfoValue_memset
String ID: Name$SYSTEM\CurrentControlSet\Control\StillImage\Events\STIProxyEvent\$_w0_w
API String ID: 3528284267-1428768118
Opcode ID: 701164f156a8871e99c09893e4ccaf84dc721706ba43ce06382b77f61c567126
Instruction ID: 54ec3a390ecf342640150b658e3db0f851d2eb834324b800c48bf78979913750
Opcode Fuzzy Hash: 701164f156a8871e99c09893e4ccaf84dc721706ba43ce06382b77f61c567126
Instruction Fuzzy Hash: 21415C71605351BBC721DF51D888E6BBBEAFF88B54F40490CF94982150E734EE44C7A2

Function 04C935C0 Relevance: 17.7, APIs: 8, Strings: 2, Instructions: 151memorystringCOMMON

Download Yara Rule

APIs

GlobalAlloc.KERNEL32(00000040), ref: 04C93600
lstrcpyW.KERNEL32(00000000,?), ref: 04C9360F
GlobalFree.KERNEL32 ref: 04C9361C
GlobalAlloc.KERNEL32(00000040,?), ref: 04C93664
lstrcpyW.KERNEL32(00000000,?), ref: 04C9366D
GlobalFree.KERNEL32 ref: 04C93679
GetModuleHandleW.KERNEL32(00000000,01000002,?), ref: 04C936E5
StiCreateInstanceW.STI(00000000), ref: 04C936EC

Strings

doregister, xrefs: 04C93705
Picasa2, xrefs: 04C93769

Memory Dump Source

Source File: 00000010.00000002.1704544207.0000000004C91000.00000020.00000001.01000000.0000000C.sdmp, Offset: 04C90000, based on PE: true

Associated: 00000010.00000002.1704469452.0000000004C90000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.1704699696.0000000004CA3000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.1704799671.0000000004CA8000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.1704860125.0000000004CAC000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_4c90000_setuppicasa39-setup.jbxd

Similarity

API ID: Global$AllocFreelstrcpy$CreateHandleInstanceModule
String ID: Picasa2$doregister
API String ID: 1987716619-3759874833
Opcode ID: 5f7a9124a7271375798702db709f6244726ecdc0782498246f46cb6519109377
Instruction ID: 12aa565e14d39885725d8667ef2bfc7c1f18705a674f8c077c058d57e0f5b9ce
Opcode Fuzzy Hash: 5f7a9124a7271375798702db709f6244726ecdc0782498246f46cb6519109377
Instruction Fuzzy Hash: 375190B9600241AFDB20DF68C985B76B3E6FF88744F444548ED458B260EB34FE05CBA1

Function 04C92E58 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 95memorystringCOMMON

Download Yara Rule

APIs

wsprintfW.USER32 ref: 04C92E91
wsprintfW.USER32 ref: 04C92EA5
GlobalAlloc.KERNEL32(00000040,?), ref: 04C92EE3
lstrcpynW.KERNEL32(00000004,?,?), ref: 04C92EFD
GlobalAlloc.KERNEL32(00000040,?), ref: 04C92F16
lstrcpynW.KERNEL32(00000004,?,?), ref: 04C92F2D
GlobalAlloc.KERNEL32(00000040,?), ref: 04C92F46
lstrcpynW.KERNEL32(00000004,?,?), ref: 04C92F5D

Strings

utos-%s-%s.txt, xrefs: 04C92E8B
utos_%s.txt, xrefs: 04C92E9F

Memory Dump Source

Source File: 00000010.00000002.1704544207.0000000004C91000.00000020.00000001.01000000.0000000C.sdmp, Offset: 04C90000, based on PE: true

Associated: 00000010.00000002.1704469452.0000000004C90000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.1704699696.0000000004CA3000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.1704799671.0000000004CA8000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.1704860125.0000000004CAC000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_4c90000_setuppicasa39-setup.jbxd

Similarity

API ID: AllocGloballstrcpyn$wsprintf
String ID: utos-%s-%s.txt$utos_%s.txt
API String ID: 3636084571-2999509453
Opcode ID: 5234d8cc3d70738b1485bde0f5242469515be769b955fdb1dbe74fe77625285d
Instruction ID: a92c49e05b7359f512ed7a13eeb1177fcc53160cfb9d412f5aa86aa5cbc0fe7a
Opcode Fuzzy Hash: 5234d8cc3d70738b1485bde0f5242469515be769b955fdb1dbe74fe77625285d
Instruction Fuzzy Hash: A5312D7A500305AFC724DF54D891EA7F3F9FF98608F04891DE68583250EA74BD14CB51

Function 04C93200 Relevance: 15.8, APIs: 7, Strings: 2, Instructions: 90memorystringfileCOMMON

Download Yara Rule

APIs

Part of subcall function 04C950A0: FindWindowA.USER32(ytWindow,Picasa2), ref: 04C950B4
Part of subcall function 04C950A0: EnumWindows.USER32(04C94D30,04C93241), ref: 04C950D4
Part of subcall function 04C950A0: SendMessageW.USER32(00000000,00000010,00000000,00000000), ref: 04C950E5
Part of subcall function 04C950A0: FindWindowA.USER32(ytWindow,Picasa Media Detector), ref: 04C950F1
Part of subcall function 04C950A0: SendMessageW.USER32(00000000,00000010,00000000,00000000), ref: 04C95102
Part of subcall function 04C950A0: SendMessageW.USER32(04C93241,00000002,00000000,00000000), ref: 04C9510F
Part of subcall function 04C950A0: FindWindowA.USER32(ytWindow,Picasa Photo Viewer), ref: 04C9511B
Part of subcall function 04C950A0: EnumWindows.USER32(04C94DC0,04C93241), ref: 04C9512F
Part of subcall function 04C950A0: SendMessageW.USER32(00000000,00000010,00000000,00000000), ref: 04C95140
Part of subcall function 04C950A0: SendMessageW.USER32(04C93241,00000002,00000000,00000000), ref: 04C9514D

GlobalAlloc.KERNEL32(00000040,?), ref: 04C9325C
lstrcpyW.KERNEL32(00000000,?), ref: 04C93260
GetFileAttributesW.KERNEL32(?), ref: 04C932AF
CreateFileW.KERNEL32(40000000,40000000,00000000,00000000,00000003,04000000,00000000), ref: 04C932D2
CloseHandle.KERNEL32(00000000), ref: 04C932DE
GlobalAlloc.KERNEL32(00000040,?), ref: 04C932F9
lstrcpynW.KERNEL32(00000004,appopencheck,?), ref: 04C9330D

Strings

appopencheck, xrefs: 04C93304
\Picasa3.exe, xrefs: 04C932A1

Memory Dump Source

Source File: 00000010.00000002.1704544207.0000000004C91000.00000020.00000001.01000000.0000000C.sdmp, Offset: 04C90000, based on PE: true

Associated: 00000010.00000002.1704469452.0000000004C90000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.1704699696.0000000004CA3000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.1704799671.0000000004CA8000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.1704860125.0000000004CAC000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_4c90000_setuppicasa39-setup.jbxd

Similarity

API ID: MessageSend$FindWindow$AllocEnumFileGlobalWindows$AttributesCloseCreateHandlelstrcpylstrcpyn
String ID: \Picasa3.exe$appopencheck
API String ID: 315319293-3239355095
Opcode ID: d796fa4e29db0089454ffe7acdc1800b9b936fba5350e1b92c722b3c6d20c2c4
Instruction ID: bb71d048be042a5f3d9a274c054002051c900c3b35dc8b000de3b8209b873147
Opcode Fuzzy Hash: d796fa4e29db0089454ffe7acdc1800b9b936fba5350e1b92c722b3c6d20c2c4
Instruction Fuzzy Hash: 9531F579A00244AFD724CF68D849B76B3E6FB8C318F444618FA0997290EB78BD54CB54

Function 04C9A3A8 Relevance: 15.8, APIs: 6, Strings: 3, Instructions: 49libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(KERNEL32.DLL,04CA5EC8,0000000C,04C9A4B9,00000000,00000000), ref: 04C9A3B9
GetProcAddress.KERNEL32(?,EncodePointer), ref: 04C9A3ED
GetProcAddress.KERNEL32(?,DecodePointer), ref: 04C9A3FD
InterlockedIncrement.KERNEL32(04CA8590), ref: 04C9A41F
__lock.LIBCMT ref: 04C9A427
___addlocaleref.LIBCMT ref: 04C9A446

Strings

EncodePointer, xrefs: 04C9A3DF
DecodePointer, xrefs: 04C9A3F5
KERNEL32.DLL, xrefs: 04C9A3B4

Memory Dump Source

Source File: 00000010.00000002.1704544207.0000000004C91000.00000020.00000001.01000000.0000000C.sdmp, Offset: 04C90000, based on PE: true

Associated: 00000010.00000002.1704469452.0000000004C90000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.1704699696.0000000004CA3000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.1704799671.0000000004CA8000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.1704860125.0000000004CAC000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_4c90000_setuppicasa39-setup.jbxd

Similarity

API ID: AddressProc$HandleIncrementInterlockedModule___addlocaleref__lock
String ID: DecodePointer$EncodePointer$KERNEL32.DLL
API String ID: 1036688887-2843748187
Opcode ID: d1c1aab0755cb532d18f6205412be4e8f35fd6d478b476b1615f48cf46fcaa77
Instruction ID: 4e9944835611aa59885a785313bde8abf641ceb79ce54e6696d0bf39919381e3
Opcode Fuzzy Hash: d1c1aab0755cb532d18f6205412be4e8f35fd6d478b476b1615f48cf46fcaa77
Instruction Fuzzy Hash: 41118F75901782FFEB10AF759809B5ABBE1EF04308F004429D99997650DB75FD11DF21

Function 04C91220 Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 70registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.ADVAPI32 ref: 04C91283
RegQueryValueExW.ADVAPI32(?,AppPath,00000000,?,?,?), ref: 04C912BD
RegCloseKey.ADVAPI32(?), ref: 04C912CC
_wcsrchr.LIBCMT ref: 04C912DF
RegCloseKey.ADVAPI32(?), ref: 04C912FA

Strings

AppPath, xrefs: 04C912AF
_w0_w, xrefs: 04C912BD
SOFTWARE\Google\Picasa\Picasa2\Runtime\, xrefs: 04C9123D

Memory Dump Source

Source File: 00000010.00000002.1704544207.0000000004C91000.00000020.00000001.01000000.0000000C.sdmp, Offset: 04C90000, based on PE: true

Associated: 00000010.00000002.1704469452.0000000004C90000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.1704699696.0000000004CA3000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.1704799671.0000000004CA8000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.1704860125.0000000004CAC000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_4c90000_setuppicasa39-setup.jbxd

Similarity

API ID: Close$OpenQueryValue_wcsrchr
String ID: AppPath$SOFTWARE\Google\Picasa\Picasa2\Runtime\$_w0_w
API String ID: 213811329-1474999361
Opcode ID: c5058ba08fc34e4654ad9cd69b4faa4291df784da352e2919fdd6cf947788917
Instruction ID: 3d081c2e31fddbc911de25cd73ec10d5eb9d8287e876c05d1d8d4c6413940405
Opcode Fuzzy Hash: c5058ba08fc34e4654ad9cd69b4faa4291df784da352e2919fdd6cf947788917
Instruction Fuzzy Hash: 0A217174504302ABE714EF14D855BABB7F9EF84708F04881CF589D7290EBB4A949CBA2

Function 04C98379 Relevance: 13.7, APIs: 9, Instructions: 186COMMONLIBRARYCODE

Download Yara Rule

APIs

GetStartupInfoA.KERNEL32(?), ref: 04C9838E
__calloc_crt.LIBCMT ref: 04C983A1

Part of subcall function 04C9C76A: __calloc_impl.LIBCMT ref: 04C9C778
Part of subcall function 04C9C76A: Sleep.KERNEL32(00000000), ref: 04C9C78F

__calloc_crt.LIBCMT ref: 04C98424
GetFileType.KERNEL32(00000038,?,?,00000001,?,?,04C96640,00000001,?,?,04CA5E00,0000000C,04C966FA,?), ref: 04C984A4
___crtInitCritSecAndSpinCount.LIBCMT ref: 04C984D8
GetStdHandle.KERNEL32(-000000F6,?,?,00000001,?,?,04C96640,00000001,?,?,04CA5E00,0000000C,04C966FA,?), ref: 04C9852E
GetFileType.KERNEL32(00000000,?,?,00000001,?,?,04C96640,00000001,?,?,04CA5E00,0000000C,04C966FA,?), ref: 04C98540
___crtInitCritSecAndSpinCount.LIBCMT ref: 04C9856E
SetHandleCount.KERNEL32 ref: 04C98598

Memory Dump Source

Source File: 00000010.00000002.1704544207.0000000004C91000.00000020.00000001.01000000.0000000C.sdmp, Offset: 04C90000, based on PE: true

Associated: 00000010.00000002.1704469452.0000000004C90000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.1704699696.0000000004CA3000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.1704799671.0000000004CA8000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.1704860125.0000000004CAC000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_4c90000_setuppicasa39-setup.jbxd

Similarity

API ID: Count$CritFileHandleInitSpinType___crt__calloc_crt$InfoSleepStartup__calloc_impl
String ID:
API String ID: 1318386821-0
Opcode ID: eb77a25e56e4ea269a1a4033f1035a7bb3dba49e03cdc81ce316bc3cabddf760
Instruction ID: 862029e6ecd619e45761f9ac10198fbf6b7ff367d529af9d27395f51c8400a47
Opcode Fuzzy Hash: eb77a25e56e4ea269a1a4033f1035a7bb3dba49e03cdc81ce316bc3cabddf760
Instruction Fuzzy Hash: 12613475A14341AEDF209B68C85CB257BE2EF07738F188359D4669B2E1D738ED05CB21

Function 04C94320 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 86memorystringCOMMON

Download Yara Rule

APIs

GlobalAlloc.KERNEL32(00000040,?), ref: 04C94381
lstrcpyW.KERNEL32(00000000,?), ref: 04C9438E
GlobalFree.KERNEL32 ref: 04C9439E
GetCommandLineW.KERNEL32 ref: 04C943C3
WritePrivateProfileStringW.KERNEL32(Picasa,distro,?,?), ref: 04C94430

Strings

Picasa, xrefs: 04C9442B
distro, xrefs: 04C94426

Memory Dump Source

Source File: 00000010.00000002.1704544207.0000000004C91000.00000020.00000001.01000000.0000000C.sdmp, Offset: 04C90000, based on PE: true

Associated: 00000010.00000002.1704469452.0000000004C90000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.1704699696.0000000004CA3000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.1704799671.0000000004CA8000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.1704860125.0000000004CAC000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_4c90000_setuppicasa39-setup.jbxd

Similarity

API ID: Global$AllocCommandFreeLinePrivateProfileStringWritelstrcpy
String ID: Picasa$distro
API String ID: 3956974375-1203374740
Opcode ID: 80986836d87e8ff3c6911b7bb2d4afab45fb0aab58b617ae1f78abe79dfb3030
Instruction ID: 773dbeaaa63686ce37f1ea416957c87ec332789adc25d35d292b1193df08b12f
Opcode Fuzzy Hash: 80986836d87e8ff3c6911b7bb2d4afab45fb0aab58b617ae1f78abe79dfb3030
Instruction Fuzzy Hash: 2131CF35A04202AFDB38DB18D958B76B3F6FF88709F44891CE98987250EB38AD51CB55

Function 04C926B0 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 67registryCOMMON

Download Yara Rule

APIs

Part of subcall function 04C91220: RegOpenKeyExW.ADVAPI32 ref: 04C91283
Part of subcall function 04C91220: RegQueryValueExW.ADVAPI32(?,AppPath,00000000,?,?,?), ref: 04C912BD
Part of subcall function 04C91220: RegCloseKey.ADVAPI32(?), ref: 04C912CC
Part of subcall function 04C91220: _wcsrchr.LIBCMT ref: 04C912DF
Part of subcall function 04C91220: RegCloseKey.ADVAPI32(?), ref: 04C912FA

RegOpenKeyExW.ADVAPI32(80000001,SOFTWARE\Google\Picasa\Picasa2\Preferences\,00000000,000F003F,?), ref: 04C92629
RegQueryValueExW.ADVAPI32(?,ytHLocal::lang,00000000,?,?,?), ref: 04C92660
RegCloseKey.ADVAPI32(?), ref: 04C9266F
RegCloseKey.ADVAPI32(?), ref: 04C9268D

Strings

SOFTWARE\Google\Picasa\Picasa2\Preferences\, xrefs: 04C92617
ytHLocal::lang, xrefs: 04C9265A
_w0_w, xrefs: 04C92660

Memory Dump Source

Source File: 00000010.00000002.1704544207.0000000004C91000.00000020.00000001.01000000.0000000C.sdmp, Offset: 04C90000, based on PE: true

Associated: 00000010.00000002.1704469452.0000000004C90000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.1704699696.0000000004CA3000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.1704799671.0000000004CA8000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.1704860125.0000000004CAC000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_4c90000_setuppicasa39-setup.jbxd

Similarity

API ID: Close$OpenQueryValue$_wcsrchr
String ID: SOFTWARE\Google\Picasa\Picasa2\Preferences\$ytHLocal::lang$_w0_w
API String ID: 1462067318-2753988759
Opcode ID: 8bb71a4e46e94b6c27f291e8774c8bc0bd36fb803f6f85e704ab038c4d5188be
Instruction ID: 4810da5c81c2e8ad48b6557e8b40c66b47e32a484447f33e5d081a5f78876023
Opcode Fuzzy Hash: 8bb71a4e46e94b6c27f291e8774c8bc0bd36fb803f6f85e704ab038c4d5188be
Instruction Fuzzy Hash: C5213CB5A08302BBD714DF14D844A6BBBE9FB84B44F04891DF58993610EB34ED45CBA2

Function 04C93289 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 53filememorystringCOMMON

Download Yara Rule

APIs

GetFileAttributesW.KERNEL32(?), ref: 04C932AF
CreateFileW.KERNEL32(40000000,40000000,00000000,00000000,00000003,04000000,00000000), ref: 04C932D2
CloseHandle.KERNEL32(00000000), ref: 04C932DE
GlobalAlloc.KERNEL32(00000040,?), ref: 04C932F9
lstrcpynW.KERNEL32(00000004,appopencheck,?), ref: 04C9330D

Strings

appopencheck, xrefs: 04C93304
\Picasa3.exe, xrefs: 04C932A1

Memory Dump Source

Source File: 00000010.00000002.1704544207.0000000004C91000.00000020.00000001.01000000.0000000C.sdmp, Offset: 04C90000, based on PE: true

Associated: 00000010.00000002.1704469452.0000000004C90000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.1704699696.0000000004CA3000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.1704799671.0000000004CA8000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.1704860125.0000000004CAC000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_4c90000_setuppicasa39-setup.jbxd

Similarity

API ID: File$AllocAttributesCloseCreateGlobalHandlelstrcpyn
String ID: \Picasa3.exe$appopencheck
API String ID: 3719912110-3239355095
Opcode ID: 4eec010f096a26303a83efcea94049358126d39b826d6a6f2710224ea9c0080c
Instruction ID: 5bb6a6eca6344fc5483006d02d07caf9ec04b49fb06e15a9ff291e891d20b368
Opcode Fuzzy Hash: 4eec010f096a26303a83efcea94049358126d39b826d6a6f2710224ea9c0080c
Instruction Fuzzy Hash: BA112579900600BFD7248B64E84AF76B3E6FB88718F804608FB19872E0EB74BD10CB54

Function 04C93AF0 Relevance: 12.2, APIs: 6, Strings: 2, Instructions: 150memorystringCOMMON

Download Yara Rule

APIs

GlobalAlloc.KERNEL32(00000040), ref: 04C93B34
lstrcpyW.KERNEL32(00000000,?), ref: 04C93B43
GlobalFree.KERNEL32 ref: 04C93B50
GlobalAlloc.KERNEL32(00000040,?), ref: 04C93BA2
lstrcpyW.KERNEL32(00000000,?), ref: 04C93BAB
GlobalFree.KERNEL32 ref: 04C93BB7

Strings

Icon, xrefs: 04C93CB5
Desc, xrefs: 04C93CD2

Memory Dump Source

Source File: 00000010.00000002.1704544207.0000000004C91000.00000020.00000001.01000000.0000000C.sdmp, Offset: 04C90000, based on PE: true

Associated: 00000010.00000002.1704469452.0000000004C90000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.1704699696.0000000004CA3000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.1704799671.0000000004CA8000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.1704860125.0000000004CAC000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_4c90000_setuppicasa39-setup.jbxd

Similarity

API ID: Global$AllocFreelstrcpy
String ID: Desc$Icon
API String ID: 592839796-2118094597
Opcode ID: bd50c0f24c8722df67b1853d91bf023583743c036bf2005151b7df06d994a99a
Instruction ID: 08af3d61c5f666c7022df9eeff56f711095d1529fa63836d8f17c4e2b2909266
Opcode Fuzzy Hash: bd50c0f24c8722df67b1853d91bf023583743c036bf2005151b7df06d994a99a
Instruction Fuzzy Hash: 9D51C435A007519BCB20DF28C85ABA7B3E2FF88744F458618ED4687260FB74BE25C791

Function 04C9AC34 Relevance: 10.7, APIs: 7, Instructions: 158COMMONLIBRARYCODE

Download Yara Rule

APIs

getSystemCP.LIBCMT ref: 04C9AC4D

Part of subcall function 04C9ABBA: _LocaleUpdate::_LocaleUpdate.LIBCMT ref: 04C9ABC7
Part of subcall function 04C9ABBA: GetOEMCP.KERNEL32(00000000,?,04C9CAD8,?,00000000,7572F380), ref: 04C9ABE1

setSBCS.LIBCMT ref: 04C9AC5F

Part of subcall function 04C9A937: _memset.LIBCMT ref: 04C9A94A

IsValidCodePage.KERNEL32(-00000030,00000000,?,00000000,04CA5F50), ref: 04C9ACA5
GetCPInfo.KERNEL32(00000000,04C9AFB7), ref: 04C9ACB8
_memset.LIBCMT ref: 04C9ACD0
setSBUpLow.LIBCMT ref: 04C9ADA3

Memory Dump Source

Source File: 00000010.00000002.1704544207.0000000004C91000.00000020.00000001.01000000.0000000C.sdmp, Offset: 04C90000, based on PE: true

Associated: 00000010.00000002.1704469452.0000000004C90000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.1704699696.0000000004CA3000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.1704799671.0000000004CA8000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.1704860125.0000000004CAC000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_4c90000_setuppicasa39-setup.jbxd

Similarity

API ID: Locale_memset$CodeInfoPageSystemUpdateUpdate::_Valid
String ID:
API String ID: 2658552758-0
Opcode ID: fb971af215c71be70a109d4efcf83fd5a0eb619533f067c16956bd5e88e74851
Instruction ID: 6a1edc6b3bdd21cfcdda23e54b4dc8f10b734783293561a44e88f16d8faf5c34
Opcode Fuzzy Hash: fb971af215c71be70a109d4efcf83fd5a0eb619533f067c16956bd5e88e74851
Instruction Fuzzy Hash: DE510572D00294ABDF15CF25C4882BABBF2EF45305F08806AD8869F242D676ED46CB90

Function 04C9F0E6 Relevance: 10.6, APIs: 7, Instructions: 124COMMONLIBRARYCODE

Download Yara Rule

APIs

__mtinitlocknum.LIBCMT ref: 04C9F0FD

Part of subcall function 04C9895C: __FF_MSGBANNER.LIBCMT ref: 04C98978

__lock.LIBCMT ref: 04C9F111
__lock.LIBCMT ref: 04C9F15A
___crtInitCritSecAndSpinCount.LIBCMT ref: 04C9F175
EnterCriticalSection.KERNEL32(?,04CA60B0,00000018,04C9E06F,?,00000000,00000109), ref: 04C9F19B
LeaveCriticalSection.KERNEL32(?), ref: 04C9F1A8

Memory Dump Source

Source File: 00000010.00000002.1704544207.0000000004C91000.00000020.00000001.01000000.0000000C.sdmp, Offset: 04C90000, based on PE: true

Associated: 00000010.00000002.1704469452.0000000004C90000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.1704699696.0000000004CA3000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.1704799671.0000000004CA8000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.1704860125.0000000004CAC000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_4c90000_setuppicasa39-setup.jbxd

Similarity

API ID: CriticalSection__lock$CountCritEnterInitLeaveSpin___crt__mtinitlocknum
String ID:
API String ID: 2236623020-0
Opcode ID: 27e4dfa0ac0b45ba9a1dd13d0580f8bfe90c6157a53593af184700e79f322063
Instruction ID: bb0adef7e1038f8d8913354e0ca5ca81d88da2773e511a93ae02dafd2f45b606
Opcode Fuzzy Hash: 27e4dfa0ac0b45ba9a1dd13d0580f8bfe90c6157a53593af184700e79f322063
Instruction Fuzzy Hash: D941E435E04706AAEF249FA9D80C7ADBBE2AF01338F14825ED165D71D0DB74AE41CB50

Function 04C92870 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 54COMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,00000003), ref: 04C9289F
GetWindowRect.USER32(00000000,?), ref: 04C928B1
MapWindowPoints.USER32(00000000,?,00000002,00000002), ref: 04C928C1
GetUserDefaultLCID.KERNEL32 ref: 04C928C7
MoveWindow.USER32(00000000,?,?,?,?,00000001), ref: 04C92908

Strings

2, xrefs: 04C928E5

Memory Dump Source

Source File: 00000010.00000002.1704544207.0000000004C91000.00000020.00000001.01000000.0000000C.sdmp, Offset: 04C90000, based on PE: true

Associated: 00000010.00000002.1704469452.0000000004C90000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.1704699696.0000000004CA3000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.1704799671.0000000004CA8000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.1704860125.0000000004CAC000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_4c90000_setuppicasa39-setup.jbxd

Similarity

API ID: Window$DefaultItemMovePointsRectUser
String ID: 2
API String ID: 403720317-450215437
Opcode ID: 0c997b1bf8318a27119f0ffffb11eecab5673c66dd2a6a45220f770d9eea0886
Instruction ID: d21c1e4520938152c47173f24d8d49768a3bfa6a8f826bd91cd5173a362fe39d
Opcode Fuzzy Hash: 0c997b1bf8318a27119f0ffffb11eecab5673c66dd2a6a45220f770d9eea0886
Instruction Fuzzy Hash: 3B118C7AA04341AFD311DF28D949A6BBBF8FBC4700F00891DF99483250E778ED158B62

Function 04C927D0 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 52COMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,00000001), ref: 04C927FF
GetWindowRect.USER32(00000000,?), ref: 04C92811
MapWindowPoints.USER32(00000000,?,00000002,00000002), ref: 04C92821
GetUserDefaultLCID.KERNEL32 ref: 04C92827
MoveWindow.USER32(00000000,?,?,?,?,00000001), ref: 04C92860

Strings

2, xrefs: 04C92844

Memory Dump Source

Source File: 00000010.00000002.1704544207.0000000004C91000.00000020.00000001.01000000.0000000C.sdmp, Offset: 04C90000, based on PE: true

Associated: 00000010.00000002.1704469452.0000000004C90000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.1704699696.0000000004CA3000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.1704799671.0000000004CA8000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.1704860125.0000000004CAC000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_4c90000_setuppicasa39-setup.jbxd

Similarity

API ID: Window$DefaultItemMovePointsRectUser
String ID: 2
API String ID: 403720317-450215437
Opcode ID: 88f32e71d89d723b95969e212e3054eea29a4659c219625b2fc2f6f546ab1744
Instruction ID: 1d5d4c51ee052561b92e4fd2137eb6e37a9d1111646c24690e2228b3ecbdda7e
Opcode Fuzzy Hash: 88f32e71d89d723b95969e212e3054eea29a4659c219625b2fc2f6f546ab1744
Instruction Fuzzy Hash: 6911457AA04341BFD314CF19D849A7BBBA9FBC4700F00891DFA9583250EB78AD158B62

Function 04C9A2C2 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 36libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

TlsGetValue.KERNEL32(00000000,04C9A357), ref: 04C9A2CF
TlsGetValue.KERNEL32(00000007), ref: 04C9A2E6
GetModuleHandleA.KERNEL32(KERNEL32.DLL), ref: 04C9A2FB
GetProcAddress.KERNEL32(00000000,DecodePointer), ref: 04C9A316

Strings

DecodePointer, xrefs: 04C9A310
KERNEL32.DLL, xrefs: 04C9A2F6

Memory Dump Source

Source File: 00000010.00000002.1704544207.0000000004C91000.00000020.00000001.01000000.0000000C.sdmp, Offset: 04C90000, based on PE: true

Associated: 00000010.00000002.1704469452.0000000004C90000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.1704699696.0000000004CA3000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.1704799671.0000000004CA8000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.1704860125.0000000004CAC000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_4c90000_setuppicasa39-setup.jbxd

Similarity

API ID: Value$AddressHandleModuleProc
String ID: DecodePointer$KERNEL32.DLL
API String ID: 1929421221-629428536
Opcode ID: 8c18f965814da0d1043693aea34160899ac594e42e234403f67020c8a8835f8a
Instruction ID: dc58a7a648f94a992b7a1cd8e62da2882ccec587d51813b3cddea9a343e0dab5
Opcode Fuzzy Hash: 8c18f965814da0d1043693aea34160899ac594e42e234403f67020c8a8835f8a
Instruction Fuzzy Hash: 23F09634E015D3FB9F11AB38ED09A6A7BD6EF083947048131EC18D7160EB26EE618A60

Function 04C9A24B Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 36libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

TlsGetValue.KERNEL32(00000000,04C9A2C0,00000000,04CA0B18,00000000,00000000,00000314,?,?,?,04CA9620,04C9BC23,04CA9620,Microsoft Visual C++ Runtime Library,00012010), ref: 04C9A258
TlsGetValue.KERNEL32(00000007,?,?,?,04CA9620,04C9BC23,04CA9620,Microsoft Visual C++ Runtime Library,00012010), ref: 04C9A26F
GetModuleHandleA.KERNEL32(KERNEL32.DLL,?,?,?,04CA9620,04C9BC23,04CA9620,Microsoft Visual C++ Runtime Library,00012010), ref: 04C9A284
GetProcAddress.KERNEL32(00000000,EncodePointer), ref: 04C9A29F

Strings

EncodePointer, xrefs: 04C9A299
KERNEL32.DLL, xrefs: 04C9A27F

Memory Dump Source

Source File: 00000010.00000002.1704544207.0000000004C91000.00000020.00000001.01000000.0000000C.sdmp, Offset: 04C90000, based on PE: true

Associated: 00000010.00000002.1704469452.0000000004C90000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.1704699696.0000000004CA3000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.1704799671.0000000004CA8000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.1704860125.0000000004CAC000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_4c90000_setuppicasa39-setup.jbxd

Similarity

API ID: Value$AddressHandleModuleProc
String ID: EncodePointer$KERNEL32.DLL
API String ID: 1929421221-3682587211
Opcode ID: 96e4197ea2eb0195b285ae3f6bdf2207f54b7f6a26febc92afc9331f9a500727
Instruction ID: aaca5774af717ea6f298731afacd18bb2363153a72c21827a4b2b2b6530e254d
Opcode Fuzzy Hash: 96e4197ea2eb0195b285ae3f6bdf2207f54b7f6a26febc92afc9331f9a500727
Instruction Fuzzy Hash: 06F0C238F05993BF9E14AB34ED09A7A7AD6DF017947054021AC18D7170EB32EE21CA60

Function 04C91160 Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 30registryCOMMON

Download Yara Rule

APIs

RegCreateKeyExW.ADVAPI32 ref: 04C91189
RegSetValueExW.ADVAPI32(?,ytHLocal::lang,00000000,00000004,00000000,00000004), ref: 04C911A6
RegCloseKey.ADVAPI32(00000000,?,ytHLocal::lang,00000000,00000004,00000000,00000004), ref: 04C911B0

Strings

0_w, xrefs: 04C91189
SOFTWARE\Google\Picasa\Picasa2\Preferences\, xrefs: 04C91177
ytHLocal::lang, xrefs: 04C911A0

Memory Dump Source

Source File: 00000010.00000002.1704544207.0000000004C91000.00000020.00000001.01000000.0000000C.sdmp, Offset: 04C90000, based on PE: true

Associated: 00000010.00000002.1704469452.0000000004C90000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.1704699696.0000000004CA3000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.1704799671.0000000004CA8000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.1704860125.0000000004CAC000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_4c90000_setuppicasa39-setup.jbxd

Similarity

API ID: CloseCreateValue
String ID: 0_w$SOFTWARE\Google\Picasa\Picasa2\Preferences\$ytHLocal::lang
API String ID: 1818849710-2312736875
Opcode ID: 99602db10f35bf38c6862d188d1bd2b9e2f43b831b060d6e4de7b60eedb0c1e3
Instruction ID: a86372e4cfbbb81fd5c7eea63ba23e901f7f9de7ad4064020391f167e6e1c9e1
Opcode Fuzzy Hash: 99602db10f35bf38c6862d188d1bd2b9e2f43b831b060d6e4de7b60eedb0c1e3
Instruction Fuzzy Hash: 5AF065B47C0301BBE2209B60DC4BF6677A8EB44F19F504618BB54EA1D0D6B8F954CB66

Function 04C93D10 Relevance: 10.2, APIs: 8, Instructions: 156memorystringCOMMON

Download Yara Rule

APIs

GlobalAlloc.KERNEL32 ref: 04C93D72
lstrcpyW.KERNEL32(00000000), ref: 04C93D7C
GlobalAlloc.KERNEL32(00000040), ref: 04C93DBE
lstrcpyW.KERNEL32(00000000,?), ref: 04C93DC7
GlobalFree.KERNEL32 ref: 04C93DD4
GlobalAlloc.KERNEL32(00000040,?), ref: 04C93E66
lstrcpyW.KERNEL32(00000000,?), ref: 04C93E6F
GlobalFree.KERNEL32(00000006), ref: 04C93E7B

Part of subcall function 04C910B0: lstrcpyW.KERNEL32(?,?,?,04C93ED7,?), ref: 04C910D6
Part of subcall function 04C910B0: lstrcatW.KERNEL32(?,runtime\defaults.ini), ref: 04C910E6
Part of subcall function 04C910B0: GetPrivateProfileStringW.KERNEL32(TrayHelperUpdater,vendorCode,04CA4CC4,?,00000800,?), ref: 04C9110F

Part of subcall function 04C915F0: GetLocaleInfoW.KERNEL32(00000400,00000059,?,00000010,?), ref: 04C91708
Part of subcall function 04C915F0: GetLocaleInfoW.KERNEL32(00000400,0000005A,?,00000010), ref: 04C91718

Memory Dump Source

Source File: 00000010.00000002.1704544207.0000000004C91000.00000020.00000001.01000000.0000000C.sdmp, Offset: 04C90000, based on PE: true

Associated: 00000010.00000002.1704469452.0000000004C90000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.1704699696.0000000004CA3000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.1704799671.0000000004CA8000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.1704860125.0000000004CAC000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_4c90000_setuppicasa39-setup.jbxd

Similarity

API ID: Global$lstrcpy$Alloc$FreeInfoLocale$PrivateProfileStringlstrcat
String ID:
API String ID: 277877882-0
Opcode ID: e5a9efd4c514bd2987096464587aa12af329bc7e64d90250c1e4bc67929f306a
Instruction ID: c9e92b3c9aefa269ac73e051a20699de6c18af3e0c41dd0c53a01d22ec7925e5
Opcode Fuzzy Hash: e5a9efd4c514bd2987096464587aa12af329bc7e64d90250c1e4bc67929f306a
Instruction Fuzzy Hash: F051A276900246AFDB20DF24DC49BA7B3EAFF89704F084518E90587350EB75BE15CBA2

Function 04C9D36C Relevance: 9.2, APIs: 6, Instructions: 162COMMONLIBRARYCODE

Download Yara Rule

APIs

__filbuf.LIBCMT ref: 04C9D3D7
__filbuf.LIBCMT ref: 04C9D3FE
__filbuf.LIBCMT ref: 04C9D478
__filbuf.LIBCMT ref: 04C9D4A8
_ungetc.LIBCMT ref: 04C9D4B9
__filwbuf.LIBCMT ref: 04C9D508

Memory Dump Source

Source File: 00000010.00000002.1704544207.0000000004C91000.00000020.00000001.01000000.0000000C.sdmp, Offset: 04C90000, based on PE: true

Associated: 00000010.00000002.1704469452.0000000004C90000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.1704699696.0000000004CA3000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.1704799671.0000000004CA8000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.1704860125.0000000004CAC000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_4c90000_setuppicasa39-setup.jbxd

Similarity

API ID: __filbuf$__filwbuf_ungetc
String ID:
API String ID: 716107490-0
Opcode ID: 90bf75a7c777e0599d9c1c40fead7ed61a1f424bedafe43261a0307f0d5a7879
Instruction ID: 3712d45a0ea3807bcfbf38c41d21f0e761f4522e2a3264f7dd682d87960b9b81
Opcode Fuzzy Hash: 90bf75a7c777e0599d9c1c40fead7ed61a1f424bedafe43261a0307f0d5a7879
Instruction Fuzzy Hash: B1416C72015601BECF255F39E84C5793BEAAF03338724865EE4A7A71D0EA24FE41A760

Function 04C92750 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 41COMMON

Download Yara Rule

APIs

ShellExecuteW.SHELL32(00000000,open,wordpad.exe,04CA9FC0,00000000,00000001), ref: 04C9278A
ShellExecuteW.SHELL32(00000000,open,04CA9FC0,00000000,00000000,00000001), ref: 04C927A3
CallWindowProcW.USER32(?,?,?,?,?), ref: 04C927B9

Strings

wordpad.exe, xrefs: 04C9277E
open, xrefs: 04C92783, 04C9279C

Memory Dump Source

Source File: 00000010.00000002.1704544207.0000000004C91000.00000020.00000001.01000000.0000000C.sdmp, Offset: 04C90000, based on PE: true

Associated: 00000010.00000002.1704469452.0000000004C90000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.1704699696.0000000004CA3000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.1704799671.0000000004CA8000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.1704860125.0000000004CAC000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_4c90000_setuppicasa39-setup.jbxd

Similarity

API ID: ExecuteShell$CallProcWindow
String ID: open$wordpad.exe
API String ID: 57124744-1353489216
Opcode ID: 9a7838c48c715dbb1718d3cc83e932867c566b004dd8b3bca14bfa119361f946
Instruction ID: f794f2c637f0b3b4fb7c5b54d707423c35c68bb59651a04ffa7f2f350b91d4d0
Opcode Fuzzy Hash: 9a7838c48c715dbb1718d3cc83e932867c566b004dd8b3bca14bfa119361f946
Instruction Fuzzy Hash: 09F0967A7843007BEA209A44DCC7F57A7AFE7C4F28F108815F640B71C182F0BC508A61

Function 04C91A40 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 40registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.ADVAPI32(80000001,Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders,00000000,00000001,?,?,04C92159,Local AppData), ref: 04C91A5E
RegQueryValueExW.ADVAPI32 ref: 04C91A82
RegCloseKey.ADVAPI32(00000000), ref: 04C91A8D

Strings

Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders, xrefs: 04C91A4F
_w0_w, xrefs: 04C91A82

Memory Dump Source

Source File: 00000010.00000002.1704544207.0000000004C91000.00000020.00000001.01000000.0000000C.sdmp, Offset: 04C90000, based on PE: true

Associated: 00000010.00000002.1704469452.0000000004C90000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.1704699696.0000000004CA3000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.1704799671.0000000004CA8000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.1704860125.0000000004CAC000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_4c90000_setuppicasa39-setup.jbxd

Similarity

API ID: CloseOpenQueryValue
String ID: Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders$_w0_w
API String ID: 3677997916-4110521321
Opcode ID: 0341d6ae795e73dc86e537e75a68e765ce1137a43f8790dc3e812bc5e3cc8f84
Instruction ID: 54969eb9656ed664c80c387414e24bb49473d47922af17ec56c299a846ee4b77
Opcode Fuzzy Hash: 0341d6ae795e73dc86e537e75a68e765ce1137a43f8790dc3e812bc5e3cc8f84
Instruction Fuzzy Hash: 56016D79504282BBE714DF04DC09B67B7F9FBC4708F104618F95983290EB74AD68CB62

Function 04C911C0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 37registryCOMMON

Download Yara Rule

APIs

RegCreateKeyExW.ADVAPI32(80000001,DefaultScope,00000000,00000000,00000000,000F003F,00000000,?,00000000,DefaultScope,04C93A3C,Software\Microsoft\Internet Explorer\SearchScopes,000F003F,?,00000000,?), ref: 04C911D7
RegSetValueExW.ADVAPI32(?,?,00000000,00000001,?,?), ref: 04C91204
RegCloseKey.ADVAPI32(?,?,?,00000000,00000001,?,?), ref: 04C9120E

Strings

0_w, xrefs: 04C911D7
DefaultScope, xrefs: 04C911C0, 04C911D5

Memory Dump Source

Source File: 00000010.00000002.1704544207.0000000004C91000.00000020.00000001.01000000.0000000C.sdmp, Offset: 04C90000, based on PE: true

Associated: 00000010.00000002.1704469452.0000000004C90000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.1704699696.0000000004CA3000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.1704799671.0000000004CA8000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.1704860125.0000000004CAC000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_4c90000_setuppicasa39-setup.jbxd

Similarity

API ID: CloseCreateValue
String ID: 0_w$DefaultScope
API String ID: 1818849710-761824296
Opcode ID: e030589fae787d6a35d2b30dead847e80999fd7e24c65df6e010b8241d871a0f
Instruction ID: 9998aa217eb2211470648bf26aebf49b88ffce5d2b2734430430581bb7999ea3
Opcode Fuzzy Hash: e030589fae787d6a35d2b30dead847e80999fd7e24c65df6e010b8241d871a0f
Instruction Fuzzy Hash: E9F05EB83542017FE6249B64CC5AF6776A9EB88B10F148908BA42DB1C0EAB4F900D720

Function 04C94FE0 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 35sleepCOMMON

Download Yara Rule

APIs

OpenMutexA.KERNEL32(001F0001,00000000,Picasa2), ref: 04C94FEF
CloseHandle.KERNEL32(00000000,?,76969530,?,?,?,?,04C93241), ref: 04C95004
Sleep.KERNEL32(000003E8,?,76969530,?,?,?,?,04C93241), ref: 04C9501D
OpenMutexA.KERNEL32(001F0001,00000000,Picasa2), ref: 04C95027

Strings

Picasa2, xrefs: 04C94FE7, 04C9501F

Memory Dump Source

Source File: 00000010.00000002.1704544207.0000000004C91000.00000020.00000001.01000000.0000000C.sdmp, Offset: 04C90000, based on PE: true

Associated: 00000010.00000002.1704469452.0000000004C90000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.1704699696.0000000004CA3000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.1704799671.0000000004CA8000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.1704860125.0000000004CAC000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_4c90000_setuppicasa39-setup.jbxd

Similarity

API ID: MutexOpen$CloseHandleSleep
String ID: Picasa2
API String ID: 2623640588-785131727
Opcode ID: ef83411fdb684dce0180d7ef5f67f27e48857aa9111465313b68779abd57fb5a
Instruction ID: 9531035ad83ad2ff80adc1de51373fff3db2da41af4f0cc384e08a3cf323f28d
Opcode Fuzzy Hash: ef83411fdb684dce0180d7ef5f67f27e48857aa9111465313b68779abd57fb5a
Instruction Fuzzy Hash: 6AF0E577740308BAEB219BB9BC89F56B798EB44A94F400111F608C3081DA66FD50C574

Function 04C95FF8 Relevance: 7.7, APIs: 5, Instructions: 188COMMONLIBRARYCODE

Download Yara Rule

APIs

_memset.LIBCMT ref: 04C96058
_memcpy_s.LIBCMT ref: 04C960CB
__filbuf.LIBCMT ref: 04C96156
_memset.LIBCMT ref: 04C9619C
_memset.LIBCMT ref: 04C961C7

Memory Dump Source

Source File: 00000010.00000002.1704544207.0000000004C91000.00000020.00000001.01000000.0000000C.sdmp, Offset: 04C90000, based on PE: true

Associated: 00000010.00000002.1704469452.0000000004C90000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.1704699696.0000000004CA3000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.1704799671.0000000004CA8000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.1704860125.0000000004CAC000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_4c90000_setuppicasa39-setup.jbxd

Similarity

API ID: _memset$__filbuf_memcpy_s
String ID:
API String ID: 2885843685-0
Opcode ID: dcf0939acb8061fb28fce272149c3bea1d854b9c6c9d292495045defa7a45d21
Instruction ID: 9010810df79231c71c0aac69b39a0de2adf20fafc40cfb12ff27327faadb1c3c
Opcode Fuzzy Hash: dcf0939acb8061fb28fce272149c3bea1d854b9c6c9d292495045defa7a45d21
Instruction Fuzzy Hash: F351BF75B00204FBDF218F6A888C99EBBF7AF41364F14862AE425961D1E731BE50DB50

Function 04C9FB65 Relevance: 7.7, APIs: 5, Instructions: 188COMMONLIBRARYCODE

Download Yara Rule

APIs

__flsbuf.LIBCMT ref: 04C9FC33
__flsbuf.LIBCMT ref: 04C9FC60
_wctomb_s.LIBCMT ref: 04C9FCC3
__flsbuf.LIBCMT ref: 04C9FCF8
__flswbuf.LIBCMT ref: 04C9FD2D

Memory Dump Source

Source File: 00000010.00000002.1704544207.0000000004C91000.00000020.00000001.01000000.0000000C.sdmp, Offset: 04C90000, based on PE: true

Associated: 00000010.00000002.1704469452.0000000004C90000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.1704699696.0000000004CA3000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.1704799671.0000000004CA8000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.1704860125.0000000004CAC000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_4c90000_setuppicasa39-setup.jbxd

Similarity

API ID: __flsbuf$__flswbuf_wctomb_s
String ID:
API String ID: 3257920507-0
Opcode ID: 0a1f1eb7924418bada8c4a8f3bb6171318df89fe2a5e8fed850c6c0e986c3517
Instruction ID: 02aa4691667900ab109785f07c829e1c7066f1ae8d52d35aaf876fc172c73df1
Opcode Fuzzy Hash: 0a1f1eb7924418bada8c4a8f3bb6171318df89fe2a5e8fed850c6c0e986c3517
Instruction Fuzzy Hash: 4D51E972115515BECF256F29D84C8AA77DADF033383384A4EE4A1C72D0EA25FE42D674

Function 04C94600 Relevance: 7.6, APIs: 6, Instructions: 133memorystringCOMMON

Download Yara Rule

APIs

Part of subcall function 04C91AC0: SHGetSpecialFolderPathW.SHELL32(00000000,?,-00000023,00000000,?,?,04C94654), ref: 04C91AF8
Part of subcall function 04C91AC0: _wcsrchr.LIBCMT ref: 04C91B35
Part of subcall function 04C91AC0: _wcsrchr.LIBCMT ref: 04C91B75

GlobalAlloc.KERNEL32(00000040), ref: 04C94680
lstrcpyW.KERNEL32(00000000,?), ref: 04C9468F
GlobalFree.KERNEL32 ref: 04C9469C
GlobalAlloc.KERNEL32(00000040), ref: 04C946E3
lstrcpyW.KERNEL32(00000000,?), ref: 04C946EC
GlobalFree.KERNEL32 ref: 04C946F9

Memory Dump Source

Source File: 00000010.00000002.1704544207.0000000004C91000.00000020.00000001.01000000.0000000C.sdmp, Offset: 04C90000, based on PE: true

Associated: 00000010.00000002.1704469452.0000000004C90000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.1704699696.0000000004CA3000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.1704799671.0000000004CA8000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.1704860125.0000000004CAC000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_4c90000_setuppicasa39-setup.jbxd

Similarity

API ID: Global$AllocFree_wcsrchrlstrcpy$FolderPathSpecial
String ID:
API String ID: 1848539264-0
Opcode ID: cd1551a03aae41bf79874767062ea0fc4ef89ce2275937305d69f94605a81a54
Instruction ID: c69c574d37ff6a3553af4362130897cfa067e1ee78c2c4f7e37fd1f93e24ca34
Opcode Fuzzy Hash: cd1551a03aae41bf79874767062ea0fc4ef89ce2275937305d69f94605a81a54
Instruction Fuzzy Hash: 1141B0399042459FCB24DF68C955AB6B3E6FF89704F088908EA45CB314FB74BE46CB94

Function 04C97B5A Relevance: 7.6, APIs: 5, Instructions: 98COMMONLIBRARYCODE

Download Yara Rule

APIs

__lock.LIBCMT ref: 04C97B6F

Part of subcall function 04C98A1F: __mtinitlocknum.LIBCMT ref: 04C98A33
Part of subcall function 04C98A1F: __amsg_exit.LIBCMT ref: 04C98A3F
Part of subcall function 04C98A1F: EnterCriticalSection.KERNEL32(?,?,?,04CA0E74,00000004,04CA6198,0000000C,04C9C77D,?,?,00000000,00000000,00000000,04C9A490,00000001,00000214), ref: 04C98A47

__mtinitlocknum.LIBCMT ref: 04C97BAF
__malloc_crt.LIBCMT ref: 04C97BF0
___crtInitCritSecAndSpinCount.LIBCMT ref: 04C97C15
EnterCriticalSection.KERNEL32(?,04CA5E20,00000010,04C95290,04CA5D20,0000000C,04C9530B,?,?,00000040,04C92B00,04CA9FC0,04CA5310), ref: 04C97C3F

Memory Dump Source

Source File: 00000010.00000002.1704544207.0000000004C91000.00000020.00000001.01000000.0000000C.sdmp, Offset: 04C90000, based on PE: true

Associated: 00000010.00000002.1704469452.0000000004C90000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.1704699696.0000000004CA3000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.1704799671.0000000004CA8000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.1704860125.0000000004CAC000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_4c90000_setuppicasa39-setup.jbxd

Similarity

API ID: CriticalEnterSection__mtinitlocknum$CountCritInitSpin___crt__amsg_exit__lock__malloc_crt
String ID:
API String ID: 1486408876-0
Opcode ID: 0b5bd329fb4f611583a025eedad01357788a82e65d09d84cdfbffa07c0917e85
Instruction ID: 2ddef8ac60f9c20b5745d0ed9862ef7c78ea14802a1c014763ea53be4acc4874
Opcode Fuzzy Hash: 0b5bd329fb4f611583a025eedad01357788a82e65d09d84cdfbffa07c0917e85
Instruction Fuzzy Hash: 5231E036A27701EFDB22DFA8D488A19B7E6FF093287808169E45497290CB34FD51DF44

Function 04C93F10 Relevance: 7.6, APIs: 2, Strings: 3, Instructions: 95memorystringCOMMON

Download Yara Rule

APIs

GlobalAlloc.KERNEL32(00000040,?), ref: 04C93F65
lstrcpyW.KERNEL32(00000000,?), ref: 04C93F6D

Strings

\Google\Picasa3, xrefs: 04C93FA8, 04C9400B
\Google\Photo Lab, xrefs: 04C93FF9
\Picasa2, xrefs: 04C93F96

Memory Dump Source

Source File: 00000010.00000002.1704544207.0000000004C91000.00000020.00000001.01000000.0000000C.sdmp, Offset: 04C90000, based on PE: true

Associated: 00000010.00000002.1704469452.0000000004C90000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.1704699696.0000000004CA3000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.1704799671.0000000004CA8000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.1704860125.0000000004CAC000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_4c90000_setuppicasa39-setup.jbxd

Similarity

API ID: AllocGloballstrcpy
String ID: \Google\Photo Lab$\Google\Picasa3$\Picasa2
API String ID: 3676821115-1520028973
Opcode ID: fc7e7cd118e32793eb306e04d3efee7651b06497f348889d5e5abd7e60fd12ec
Instruction ID: 8c487954b2049f64f4d64b81e4ff968ecd562a818048cb66a738b3a8edcc95e5
Opcode Fuzzy Hash: fc7e7cd118e32793eb306e04d3efee7651b06497f348889d5e5abd7e60fd12ec
Instruction Fuzzy Hash: C731F079A14301ABCB289F28C5697B673E2EF88708F40841EE9068B351FB38AD05C791

Function 04C94450 Relevance: 7.5, APIs: 5, Instructions: 45sleepCOMMON

Download Yara Rule

APIs

MoveFileExW.KERNEL32(?,?,00000008,757305F0,?,04C94B19), ref: 04C9445C
GetLastError.KERNEL32(7576F860,?,04C94B19), ref: 04C94468
Sleep.KERNEL32(000001F4), ref: 04C94486
MoveFileExW.KERNEL32(?,?,00000008), ref: 04C9448C
GetLastError.KERNEL32 ref: 04C94492

Memory Dump Source

Source File: 00000010.00000002.1704544207.0000000004C91000.00000020.00000001.01000000.0000000C.sdmp, Offset: 04C90000, based on PE: true

Associated: 00000010.00000002.1704469452.0000000004C90000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.1704699696.0000000004CA3000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.1704799671.0000000004CA8000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.1704860125.0000000004CAC000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_4c90000_setuppicasa39-setup.jbxd

Similarity

API ID: ErrorFileLastMove$Sleep
String ID:
API String ID: 2573717875-0
Opcode ID: 4996013892d804b6fc8be1b0d82ea853586aed6caf25bea1816a7c1a5fcc4ee2
Instruction ID: ad0dbd520ab2be96d7631ddce6b8fabbd50c9aec5c89ee68aa39121b849c0806
Opcode Fuzzy Hash: 4996013892d804b6fc8be1b0d82ea853586aed6caf25bea1816a7c1a5fcc4ee2
Instruction Fuzzy Hash: A6F0BB71B493027BEB184A61ACD873BBBE9FB8165EF20811DF907C6290DF39DC118625

Function 04C95891 Relevance: 7.5, APIs: 5, Instructions: 44memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

__lock.LIBCMT ref: 04C958AF

Part of subcall function 04C98A1F: __mtinitlocknum.LIBCMT ref: 04C98A33
Part of subcall function 04C98A1F: __amsg_exit.LIBCMT ref: 04C98A3F
Part of subcall function 04C98A1F: EnterCriticalSection.KERNEL32(?,?,?,04CA0E74,00000004,04CA6198,0000000C,04C9C77D,?,?,00000000,00000000,00000000,04C9A490,00000001,00000214), ref: 04C98A47

___sbh_find_block.LIBCMT ref: 04C958BA
___sbh_free_block.LIBCMT ref: 04C958C9
HeapFree.KERNEL32(00000000,?,04CA5D60,0000000C,04C98A00,00000000,04CA5E80,0000000C,04C98A38,?,?,?,04CA0E74,00000004,04CA6198,0000000C), ref: 04C958F9
GetLastError.KERNEL32(?,04CA0E74,00000004,04CA6198,0000000C,04C9C77D,?,?,00000000,00000000,00000000,04C9A490,00000001,00000214), ref: 04C9590A

Memory Dump Source

Source File: 00000010.00000002.1704544207.0000000004C91000.00000020.00000001.01000000.0000000C.sdmp, Offset: 04C90000, based on PE: true

Associated: 00000010.00000002.1704469452.0000000004C90000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.1704699696.0000000004CA3000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.1704799671.0000000004CA8000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.1704860125.0000000004CAC000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_4c90000_setuppicasa39-setup.jbxd

Similarity

API ID: CriticalEnterErrorFreeHeapLastSection___sbh_find_block___sbh_free_block__amsg_exit__lock__mtinitlocknum
String ID:
API String ID: 2714421763-0
Opcode ID: 940a0c9e723d7abd29c0645fbc6512359114ffcbe6c9d81cd6302d9aca5ed003
Instruction ID: e8a525f1161e842ffd911493b79f367874f9c3adb4d181b46b33d9baa42f9a2a
Opcode Fuzzy Hash: 940a0c9e723d7abd29c0645fbc6512359114ffcbe6c9d81cd6302d9aca5ed003
Instruction Fuzzy Hash: 0B018F32E51311BAFF217B70980DB597BE6AF0072CF140528E404AB080CE39BE50AB98

Function 04C91DB0 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 116fileCOMMON

Download Yara Rule

APIs

GetFileAttributesW.KERNEL32(?), ref: 04C91E95
DeleteFileW.KERNEL32(?), ref: 04C91EA5

Strings

\Application Data\Microsoft\Internet Explorer\Quick Launch\, xrefs: 04C91E31
\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\, xrefs: 04C91E13

Memory Dump Source

Source File: 00000010.00000002.1704544207.0000000004C91000.00000020.00000001.01000000.0000000C.sdmp, Offset: 04C90000, based on PE: true

Associated: 00000010.00000002.1704469452.0000000004C90000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.1704699696.0000000004CA3000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.1704799671.0000000004CA8000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.1704860125.0000000004CAC000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_4c90000_setuppicasa39-setup.jbxd

Similarity

API ID: File$AttributesDelete
String ID: \AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\$\Application Data\Microsoft\Internet Explorer\Quick Launch\
API String ID: 2910425767-1774953440
Opcode ID: 89a2ef423876d380703f31dc45273e1acf36aa9bb4064920951f48685427754b
Instruction ID: b1fbfd9d9a7616763ad5e14f357ce5da2037b7a0840445018338dcb99b02c913
Opcode Fuzzy Hash: 89a2ef423876d380703f31dc45273e1acf36aa9bb4064920951f48685427754b
Instruction Fuzzy Hash: 4241873650424697DB249F24C86A7E7B3E6FFC4364F488628DC568B680FF34AE15C791

Function 04C91FD6 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 84fileCOMMON

Download Yara Rule

APIs

GetFileAttributesW.KERNEL32(?), ref: 04C92094
FindNextFileW.KERNEL32(?,00000010), ref: 04C920B9
FindClose.KERNEL32(?), ref: 04C920C8

Strings

., xrefs: 04C91FEE

Memory Dump Source

Source File: 00000010.00000002.1704544207.0000000004C91000.00000020.00000001.01000000.0000000C.sdmp, Offset: 04C90000, based on PE: true

Associated: 00000010.00000002.1704469452.0000000004C90000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.1704699696.0000000004CA3000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.1704799671.0000000004CA8000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.1704860125.0000000004CAC000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_4c90000_setuppicasa39-setup.jbxd

Similarity

API ID: FileFind$AttributesCloseNext
String ID: .
API String ID: 730532403-248832578
Opcode ID: 31c34fb2a9981caf3ee45dbcd846ea85b017a31aff21a82e22d4637cdb3dc287
Instruction ID: 1f2a32f35a2b09d4850513b019dce1ce75ea749c82004bd26bbaa26089f3ce5b
Opcode Fuzzy Hash: 31c34fb2a9981caf3ee45dbcd846ea85b017a31aff21a82e22d4637cdb3dc287
Instruction Fuzzy Hash: 6321B631604205BBCF24DF28886D3ABB3E2FFC4354F448A58EC9687690E775AE15D781

Function 04C91FD4 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 83fileCOMMON

Download Yara Rule

APIs

GetFileAttributesW.KERNEL32(?), ref: 04C92094
FindNextFileW.KERNEL32(?,00000010), ref: 04C920B9
FindClose.KERNEL32(?), ref: 04C920C8

Strings

., xrefs: 04C91FEE

Memory Dump Source

Source File: 00000010.00000002.1704544207.0000000004C91000.00000020.00000001.01000000.0000000C.sdmp, Offset: 04C90000, based on PE: true

Associated: 00000010.00000002.1704469452.0000000004C90000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.1704699696.0000000004CA3000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.1704799671.0000000004CA8000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.1704860125.0000000004CAC000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_4c90000_setuppicasa39-setup.jbxd

Similarity

API ID: FileFind$AttributesCloseNext
String ID: .
API String ID: 730532403-248832578
Opcode ID: 8911f7f2858bc149084ad902c4b71ec964f5429615244eab51de697c67e7a0cf
Instruction ID: cbca93965ab9ca4f1885c17dee98e3cdbfc875c51539c076e4bd8a0c2e85e5b5
Opcode Fuzzy Hash: 8911f7f2858bc149084ad902c4b71ec964f5429615244eab51de697c67e7a0cf
Instruction Fuzzy Hash: 8321A632604205BBCF24DF28886D3AB73E2FFC4354F458A58EC9687690E775AE15D781

Function 04C91950 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 57COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 04C91977
SHFileOperationW.SHELL32(?,?,?,?,?,00000000), ref: 04C91A15
RemoveDirectoryW.KERNEL32(?), ref: 04C91A1C

Strings

\*.*, xrefs: 04C919B2

Memory Dump Source

Source File: 00000010.00000002.1704544207.0000000004C91000.00000020.00000001.01000000.0000000C.sdmp, Offset: 04C90000, based on PE: true

Associated: 00000010.00000002.1704469452.0000000004C90000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.1704699696.0000000004CA3000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.1704799671.0000000004CA8000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.1704860125.0000000004CAC000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_4c90000_setuppicasa39-setup.jbxd

Similarity

API ID: DirectoryFileOperationRemove_memset
String ID: \*.*
API String ID: 306963571-1173974218
Opcode ID: 6795dfb803c8ff8090bb4efc7e3c11cccddba8c3fa92f834b01a58a2859f88cd
Instruction ID: 7ab5b549490a6eb5824d4308c5480790eee667bdd4103d34787e0e746ef92cdb
Opcode Fuzzy Hash: 6795dfb803c8ff8090bb4efc7e3c11cccddba8c3fa92f834b01a58a2859f88cd
Instruction Fuzzy Hash: 722147B48083019FC304DF28D45576ABBE0FF88708F44992DE599C7360F778AA18CB9A

Function 04C944C0 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 49fileCOMMON

Download Yara Rule

APIs

SHGetSpecialFolderPathW.SHELL32 ref: 04C944E6
DeleteFileW.KERNEL32(0000001C,?,?), ref: 04C9454D

Strings

\, xrefs: 04C9450F
\Google\Picasa2\update\LifescapeUpdater\setup.exe, xrefs: 04C94541

Memory Dump Source

Source File: 00000010.00000002.1704544207.0000000004C91000.00000020.00000001.01000000.0000000C.sdmp, Offset: 04C90000, based on PE: true

Associated: 00000010.00000002.1704469452.0000000004C90000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.1704699696.0000000004CA3000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.1704799671.0000000004CA8000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.1704860125.0000000004CAC000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_4c90000_setuppicasa39-setup.jbxd

Similarity

API ID: DeleteFileFolderPathSpecial
String ID: \$\Google\Picasa2\update\LifescapeUpdater\setup.exe
API String ID: 325411977-1895577731
Opcode ID: 87b3436a7dafd07d1b889d88738ae11f73144634184cdfc1bb91c57fb7a39efe
Instruction ID: fc93f9330ed5cb176d652b05b79925f0b974ca1ab24b12cb5bfa6be7753445c4
Opcode Fuzzy Hash: 87b3436a7dafd07d1b889d88738ae11f73144634184cdfc1bb91c57fb7a39efe
Instruction Fuzzy Hash: 40112579508305EBDB24AF58E8097EB73E2FFC4308F404918D9458B190F3B4AA55C796

Function 04C94DC0 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 39COMMON

Download Yara Rule

APIs

GetClassNameA.USER32(?,00000200,00000200), ref: 04C94DF1
GetWindowLongW.USER32(?,00000000), ref: 04C94E15

Strings

ytWindow, xrefs: 04C94DF7
1sSG, xrefs: 04C94E1B

Memory Dump Source

Source File: 00000010.00000002.1704544207.0000000004C91000.00000020.00000001.01000000.0000000C.sdmp, Offset: 04C90000, based on PE: true

Associated: 00000010.00000002.1704469452.0000000004C90000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.1704699696.0000000004CA3000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.1704799671.0000000004CA8000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.1704860125.0000000004CAC000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_4c90000_setuppicasa39-setup.jbxd

Similarity

API ID: ClassLongNameWindow
String ID: 1sSG$ytWindow
API String ID: 1147815241-1390048948
Opcode ID: f5c1d227b8f982ee3e66bb2ad12f7fb15d385704e46dbf8f92c1ab5cd1389963
Instruction ID: 62e2296f7a34efbb044c0651959a7d5a213529ae1f7689b1e06d9c51d389563b
Opcode Fuzzy Hash: f5c1d227b8f982ee3e66bb2ad12f7fb15d385704e46dbf8f92c1ab5cd1389963
Instruction Fuzzy Hash: 59F0C8B6B08384AFE734DE15EC8CBABF7DAF788301F408825EA5587141D734AC158762

Function 04C94D30 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 39COMMON

Download Yara Rule

APIs

GetClassNameA.USER32(?,00000200,00000200), ref: 04C94D61
GetWindowLongW.USER32(?,00000000), ref: 04C94D85

Strings

ytWindow, xrefs: 04C94D67
2cPG, xrefs: 04C94D8B

Memory Dump Source

Source File: 00000010.00000002.1704544207.0000000004C91000.00000020.00000001.01000000.0000000C.sdmp, Offset: 04C90000, based on PE: true

Associated: 00000010.00000002.1704469452.0000000004C90000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.1704699696.0000000004CA3000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.1704799671.0000000004CA8000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.1704860125.0000000004CAC000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_4c90000_setuppicasa39-setup.jbxd

Similarity

API ID: ClassLongNameWindow
String ID: 2cPG$ytWindow
API String ID: 1147815241-2062193031
Opcode ID: fb6fc371836c22e3c6ec6fa98904b5f5d3ef34fd5677bff96e5b28387c7c3a10
Instruction ID: 16f18c2f381deb292713f7ec47df6bd2a82c6678d296964a245295919ae5895a
Opcode Fuzzy Hash: fb6fc371836c22e3c6ec6fa98904b5f5d3ef34fd5677bff96e5b28387c7c3a10
Instruction Fuzzy Hash: EEF0C8BAB043847BE734EE14DC8CBABB7DAF788304F448825E655C7141D734AD158762

Function 04C9DC5C Relevance: 6.1, APIs: 4, Instructions: 101COMMONLIBRARYCODE

Download Yara Rule

APIs

_LocaleUpdate::_LocaleUpdate.LIBCMT ref: 04C9DC8C
__isleadbyte_l.LIBCMT ref: 04C9DCC0
MultiByteToWideChar.KERNEL32(840FFFF8,00000009,?,A045FF98,?,00000000,?,?,?,04C9F5E2,?,?,00000002), ref: 04C9DCF1
MultiByteToWideChar.KERNEL32(840FFFF8,00000009,?,00000001,?,00000000,?,?,?,04C9F5E2,?,?,00000002), ref: 04C9DD5F

Memory Dump Source

Source File: 00000010.00000002.1704544207.0000000004C91000.00000020.00000001.01000000.0000000C.sdmp, Offset: 04C90000, based on PE: true

Associated: 00000010.00000002.1704469452.0000000004C90000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.1704699696.0000000004CA3000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.1704799671.0000000004CA8000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.1704860125.0000000004CAC000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_4c90000_setuppicasa39-setup.jbxd

Similarity

API ID: ByteCharLocaleMultiWide$UpdateUpdate::___isleadbyte_l
String ID:
API String ID: 3058430110-0
Opcode ID: 82e9309cef64b39eaed73bfee71e215c255188702ac32f6d887246ce0ccdcc6a
Instruction ID: 2323e134f5a4760c92bc3cfa2bb03cd5f2c39addfcf757ad45ceaf179229a365
Opcode Fuzzy Hash: 82e9309cef64b39eaed73bfee71e215c255188702ac32f6d887246ce0ccdcc6a
Instruction Fuzzy Hash: 45319331A00245FFDF10DFA4C888DAE7BE6BF01311F0945A9E452AB190E370EE90DB51

Function 04C9AB16 Relevance: 6.0, APIs: 4, Instructions: 47COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 04C9A4DE: __amsg_exit.LIBCMT ref: 04C9A4EC

__amsg_exit.LIBCMT ref: 04C9AB42
__lock.LIBCMT ref: 04C9AB52
InterlockedDecrement.KERNEL32(?), ref: 04C9AB6F
InterlockedIncrement.KERNEL32(04D714D8), ref: 04C9AB9A

Memory Dump Source

Source File: 00000010.00000002.1704544207.0000000004C91000.00000020.00000001.01000000.0000000C.sdmp, Offset: 04C90000, based on PE: true

Associated: 00000010.00000002.1704469452.0000000004C90000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.1704699696.0000000004CA3000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.1704799671.0000000004CA8000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.1704860125.0000000004CAC000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_4c90000_setuppicasa39-setup.jbxd

Similarity

API ID: Interlocked__amsg_exit$DecrementIncrement__lock
String ID:
API String ID: 4129207761-0
Opcode ID: d03af3c79c775c428b128c7a2d585561d18f42a78a056ef647fe4d4ff769d368
Instruction ID: be78dbb6565b721a7f2beeeeaba48d9e54a07a830be7784188f2f11d17c6ef0e
Opcode Fuzzy Hash: d03af3c79c775c428b128c7a2d585561d18f42a78a056ef647fe4d4ff769d368
Instruction Fuzzy Hash: 7F01C036D02651BBEF20ABA8940D74973E3BF04B68F040155D80467680CB39BE61DBE2

Function 04C9A467 Relevance: 6.0, APIs: 4, Instructions: 45threadCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,00000000,04C9696C,04C9525A,04CA5D20,0000000C,04C9530B,?,?,00000040,04C92B00,04CA9FC0,04CA5310), ref: 04C9A469

Part of subcall function 04C9A339: TlsGetValue.KERNEL32(00000000,04C9A47C), ref: 04C9A340
Part of subcall function 04C9A339: TlsSetValue.KERNEL32(00000000), ref: 04C9A361

__calloc_crt.LIBCMT ref: 04C9A48B

Part of subcall function 04C9C76A: __calloc_impl.LIBCMT ref: 04C9C778
Part of subcall function 04C9C76A: Sleep.KERNEL32(00000000), ref: 04C9C78F

Part of subcall function 04C9A2C2: TlsGetValue.KERNEL32(00000000,04C9A357), ref: 04C9A2CF
Part of subcall function 04C9A2C2: TlsGetValue.KERNEL32(00000007), ref: 04C9A2E6

Part of subcall function 04C9A3A8: GetModuleHandleA.KERNEL32(KERNEL32.DLL,04CA5EC8,0000000C,04C9A4B9,00000000,00000000), ref: 04C9A3B9
Part of subcall function 04C9A3A8: GetProcAddress.KERNEL32(?,EncodePointer), ref: 04C9A3ED
Part of subcall function 04C9A3A8: GetProcAddress.KERNEL32(?,DecodePointer), ref: 04C9A3FD
Part of subcall function 04C9A3A8: InterlockedIncrement.KERNEL32(04CA8590), ref: 04C9A41F
Part of subcall function 04C9A3A8: __lock.LIBCMT ref: 04C9A427
Part of subcall function 04C9A3A8: ___addlocaleref.LIBCMT ref: 04C9A446

GetCurrentThreadId.KERNEL32 ref: 04C9A4BB
SetLastError.KERNEL32(00000000), ref: 04C9A4D3

Memory Dump Source

Source File: 00000010.00000002.1704544207.0000000004C91000.00000020.00000001.01000000.0000000C.sdmp, Offset: 04C90000, based on PE: true

Associated: 00000010.00000002.1704469452.0000000004C90000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.1704699696.0000000004CA3000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.1704799671.0000000004CA8000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.1704860125.0000000004CAC000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_4c90000_setuppicasa39-setup.jbxd

Similarity

API ID: Value$AddressErrorLastProc$CurrentHandleIncrementInterlockedModuleSleepThread___addlocaleref__calloc_crt__calloc_impl__lock
String ID:
API String ID: 1081334783-0
Opcode ID: 61e90f73c2cf08c38d8684bcf1252db0450ab8484317cc358133d4cb16776ea8
Instruction ID: e90d0d7e7833880e75454993df633f22a44dcbbd2e8cf5419489ce0ea1afc780
Opcode Fuzzy Hash: 61e90f73c2cf08c38d8684bcf1252db0450ab8484317cc358133d4cb16776ea8
Instruction Fuzzy Hash: 00F02237A00761BBEE363B786C0D75A3BE2DF417B4B108618E844D7490CF2AEC2167A4

Function 04C91E1E Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 86fileCOMMON

Download Yara Rule

APIs

GetFileAttributesW.KERNEL32(?), ref: 04C91E95
DeleteFileW.KERNEL32(?), ref: 04C91EA5

Strings

\Application Data\Microsoft\Internet Explorer\Quick Launch\, xrefs: 04C91E31

Memory Dump Source

Source File: 00000010.00000002.1704544207.0000000004C91000.00000020.00000001.01000000.0000000C.sdmp, Offset: 04C90000, based on PE: true

Associated: 00000010.00000002.1704469452.0000000004C90000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.1704699696.0000000004CA3000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.1704799671.0000000004CA8000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.1704860125.0000000004CAC000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_4c90000_setuppicasa39-setup.jbxd

Similarity

API ID: File$AttributesDelete
String ID: \Application Data\Microsoft\Internet Explorer\Quick Launch\
API String ID: 2910425767-1435975391
Opcode ID: 474c16dee051c897eb7819c0330c2abd7eff40a621ef846cf28d7aa1198ad46a
Instruction ID: e0218bfb80913722f85421cdfed76405be05db5234355b7efeba26bda8cb51be
Opcode Fuzzy Hash: 474c16dee051c897eb7819c0330c2abd7eff40a621ef846cf28d7aa1198ad46a
Instruction Fuzzy Hash: 3E21543650420657DB249B24C46A7EBB3E6FBC0264F18C629EC5B8B680FF34AE15D790

Function 04C91C38 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 68fileCOMMON

Download Yara Rule

APIs

FindNextFileW.KERNEL32(00000000,00000010), ref: 04C91CEA
FindClose.KERNEL32(00000000), ref: 04C91CF9

Strings

., xrefs: 04C91C4B

Memory Dump Source

Source File: 00000010.00000002.1704544207.0000000004C91000.00000020.00000001.01000000.0000000C.sdmp, Offset: 04C90000, based on PE: true

Associated: 00000010.00000002.1704469452.0000000004C90000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.1704699696.0000000004CA3000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.1704799671.0000000004CA8000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.1704860125.0000000004CAC000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_4c90000_setuppicasa39-setup.jbxd

Similarity

API ID: Find$CloseFileNext
String ID: .
API String ID: 2066263336-248832578
Opcode ID: bc9bc9b36527557bbbd5eb06b334dc59ec3869350ebfa919b11c026097ebd01a
Instruction ID: 13612e6a2d3d61d3f95909f99a191b8778c8355ead2a8e826c41a595bd47470e
Opcode Fuzzy Hash: bc9bc9b36527557bbbd5eb06b334dc59ec3869350ebfa919b11c026097ebd01a
Instruction Fuzzy Hash: 3121C2356083469BCB24CF64C45A3ABB3E2FFC4258F144A08E85687290EB34BE25C782

Function 04C91C36 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 67fileCOMMON

Download Yara Rule

APIs

FindNextFileW.KERNEL32(00000000,00000010), ref: 04C91CEA
FindClose.KERNEL32(00000000), ref: 04C91CF9

Strings

., xrefs: 04C91C4B

Memory Dump Source

Source File: 00000010.00000002.1704544207.0000000004C91000.00000020.00000001.01000000.0000000C.sdmp, Offset: 04C90000, based on PE: true

Associated: 00000010.00000002.1704469452.0000000004C90000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.1704699696.0000000004CA3000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.1704799671.0000000004CA8000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.1704860125.0000000004CAC000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_4c90000_setuppicasa39-setup.jbxd

Similarity

API ID: Find$CloseFileNext
String ID: .
API String ID: 2066263336-248832578
Opcode ID: eddbcf3fcb899e13009cfc87c621bacfb251929e9168aca9611d3ec5f36bea0b
Instruction ID: a654c96669dfcc8a1aab04c1e0425f74e9430840f545e146d737ec48bfd07894
Opcode Fuzzy Hash: eddbcf3fcb899e13009cfc87c621bacfb251929e9168aca9611d3ec5f36bea0b
Instruction Fuzzy Hash: 4D21D4356082469BCB24CF64C45A2ABB3E2FFC4258F084A08EC5687390EB34BE15C781

Function 04C936B9 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 63COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000,01000002,?), ref: 04C936E5
StiCreateInstanceW.STI(00000000), ref: 04C936EC

Strings

doregister, xrefs: 04C93705

Memory Dump Source

Source File: 00000010.00000002.1704544207.0000000004C91000.00000020.00000001.01000000.0000000C.sdmp, Offset: 04C90000, based on PE: true

Associated: 00000010.00000002.1704469452.0000000004C90000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.1704699696.0000000004CA3000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.1704799671.0000000004CA8000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.1704860125.0000000004CAC000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_4c90000_setuppicasa39-setup.jbxd

Similarity

API ID: CreateHandleInstanceModule
String ID: doregister
API String ID: 998693751-2189892980
Opcode ID: 130fd4b2cc517126e1b8860d9c2abb065a55f04745f228eff483f0a6b0481ce5
Instruction ID: 21654ef5f72bc3462dd0457e5a1aa677e79051ae3846afe305daed0f3958da5d
Opcode Fuzzy Hash: 130fd4b2cc517126e1b8860d9c2abb065a55f04745f228eff483f0a6b0481ce5
Instruction Fuzzy Hash: 0311E4B9204282BBEB20DF10D9497BBB3E2FF88608F444448ED425B250E730FE46C762

Function 04C91989 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 43COMMON

Download Yara Rule

APIs

SHFileOperationW.SHELL32(?,?,?,?,?,00000000), ref: 04C91A15
RemoveDirectoryW.KERNEL32(?), ref: 04C91A1C

Strings

\*.*, xrefs: 04C919B2

Memory Dump Source

Source File: 00000010.00000002.1704544207.0000000004C91000.00000020.00000001.01000000.0000000C.sdmp, Offset: 04C90000, based on PE: true

Associated: 00000010.00000002.1704469452.0000000004C90000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.1704699696.0000000004CA3000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.1704799671.0000000004CA8000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.1704860125.0000000004CAC000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_4c90000_setuppicasa39-setup.jbxd

Similarity

API ID: DirectoryFileOperationRemove
String ID: \*.*
API String ID: 1280017784-1173974218
Opcode ID: a45451ce2ffe6bbc4cd176c73c9e304e3b80cb84cd48eefb6b9856016ae6baa8
Instruction ID: eb86c68faa6796f5f6381181c6821c76a1d4532bbe6ca1362544b9919cc438a7
Opcode Fuzzy Hash: a45451ce2ffe6bbc4cd176c73c9e304e3b80cb84cd48eefb6b9856016ae6baa8
Instruction Fuzzy Hash: FE1103B88083419FC754DF28D45576ABBF0FF88308F05992DE49AC7360E7789A54CB8A

Function 04C94570 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 42COMMON

Download Yara Rule

APIs

_wcsrchr.LIBCMT ref: 04C945C9
CreateDirectoryW.KERNEL32(00000000,00000000), ref: 04C945E2

Strings

\, xrefs: 04C945B4

Memory Dump Source

Source File: 00000010.00000002.1704544207.0000000004C91000.00000020.00000001.01000000.0000000C.sdmp, Offset: 04C90000, based on PE: true

Associated: 00000010.00000002.1704469452.0000000004C90000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.1704699696.0000000004CA3000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.1704799671.0000000004CA8000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.1704860125.0000000004CAC000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_4c90000_setuppicasa39-setup.jbxd

Similarity

API ID: CreateDirectory_wcsrchr
String ID: \
API String ID: 1784747672-2967466578
Opcode ID: 04efdbca9c36b6165bceae0c8acfd48c60dc68d1271d9c1366aecb3f0200365a
Instruction ID: 67aa66168e32768efb495bbda3fb95b988a7b337f0fad825a7e843acce90f103
Opcode Fuzzy Hash: 04efdbca9c36b6165bceae0c8acfd48c60dc68d1271d9c1366aecb3f0200365a
Instruction Fuzzy Hash: 2E01B5709143059EDB24EF68D85AB9B73F5EF88304F448C28D541CB150F7B4EA48C756

Function 04C949F7 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 36COMMON

Download Yara Rule

APIs

SHFileOperationW.SHELL32(?,?,?,?,?,?,?,?,?,?), ref: 04C94A56
RemoveDirectoryW.KERNEL32(?), ref: 04C94A64

Strings

*.*, xrefs: 04C94A2E

Memory Dump Source

Source File: 00000010.00000002.1704544207.0000000004C91000.00000020.00000001.01000000.0000000C.sdmp, Offset: 04C90000, based on PE: true

Associated: 00000010.00000002.1704469452.0000000004C90000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.1704699696.0000000004CA3000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.1704799671.0000000004CA8000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.1704860125.0000000004CAC000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_4c90000_setuppicasa39-setup.jbxd

Similarity

API ID: DirectoryFileOperationRemove
String ID: *.*
API String ID: 1280017784-438819550
Opcode ID: dab803190eac3254379748638ba9508c73808961d8bb92314a892931e9afd9fd
Instruction ID: 9b7eaba66a940e43c3fd520ef5ee4d6ab3f7244a50129be66971bc91db198e2d
Opcode Fuzzy Hash: dab803190eac3254379748638ba9508c73808961d8bb92314a892931e9afd9fd
Instruction Fuzzy Hash: 6901A2394193418FC728DF08E559BAAF3F5FFC4358F04492EE49A87251EB34AA15CB4A

Analysis Process: Picasa3.exePID: 6516, Parent PID: 4380COMMON

Execution Graph

Execution Coverage:	0.8%
Dynamic/Decrypted Code Coverage:	7.3%
Signature Coverage:	0.1%
Total number of Nodes:	1264
Total number of Limit Nodes:	17

Executed Functions

Function 04838D40 Relevance: 32.3, APIs: 11, Strings: 7, Instructions: 841COMMON

Download Yara Rule

APIs

InterlockedIncrement.KERNEL32(00000000), ref: 04838D88
InterlockedIncrement.KERNEL32(00000000), ref: 04838DE0
GetLocaleInfoA.KERNEL32(00000400,00000059,00000000,00000007,?,00000008,00000000), ref: 04838E26
GetLocaleInfoA.KERNEL32(00000400,0000005A,00000000,00000006), ref: 04838E47
GetLocaleInfoA.KERNEL32(00000400,00000059,00000000,00000007,?,00000008,00000000), ref: 04838E81

Part of subcall function 047E3430: InterlockedDecrement.KERNEL32(00000000), ref: 047E3442
Part of subcall function 047E3430: InterlockedIncrement.KERNEL32(00000000), ref: 047E345E

InterlockedIncrement.KERNEL32(00000000), ref: 04838F2E
InterlockedIncrement.KERNEL32(00000007), ref: 04838F84
GetLocaleInfoA.KERNEL32(00000400,0000005A,00000000,00000006,00000000,00000007,00000000), ref: 04838FC5
InterlockedIncrement.KERNEL32(00000007), ref: 0483906E
InterlockedIncrement.KERNEL32(?), ref: 04839567
InterlockedIncrement.KERNEL32(?), ref: 048396E8

Strings

ytHLocal::lang, xrefs: 04839713
pt-BR, xrefs: 04839443
zh-TW, xrefs: 048391F2
fil, xrefs: 048394B4
en-GB, xrefs: 048393A4
zh-CN, xrefs: 04839165
pt-PT, xrefs: 0483944D

Memory Dump Source

Source File: 00000014.00000002.2526268174.00000000047E1000.00000020.00000001.01000000.00000016.sdmp, Offset: 047E0000, based on PE: true

Associated: 00000014.00000002.2526187657.00000000047E0000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000014.00000002.2533437740.000000000488F000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000014.00000002.2535246598.00000000048AB000.00000004.00000001.01000000.00000016.sdmpDownload File
Associated: 00000014.00000002.2535569716.00000000048B3000.00000008.00000001.01000000.00000016.sdmpDownload File
Associated: 00000014.00000002.2535640427.00000000048B5000.00000004.00000001.01000000.00000016.sdmpDownload File
Associated: 00000014.00000002.2536317728.00000000048C0000.00000002.00000001.01000000.00000016.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_47e0000_Picasa3.jbxd

Similarity

API ID: Interlocked$Increment$InfoLocale$Decrement
String ID: en-GB$fil$pt-BR$pt-PT$ytHLocal::lang$zh-CN$zh-TW
API String ID: 2703594137-2291249626
Opcode ID: e8e8e06d430ee4d6f992fbc34f19cebcfa3ec83166bc143ef7ec20afc3f638a9
Instruction ID: b981fc7170564361eff195d1ac53d6bd237c3505281dfa11dbdeea4b2d956abc
Opcode Fuzzy Hash: e8e8e06d430ee4d6f992fbc34f19cebcfa3ec83166bc143ef7ec20afc3f638a9
Instruction Fuzzy Hash: 845226B26042454BFB219F18C9A473976D2AF81346F4D8F6CE945EB290DBB4FC4987C1

Function 033F18F0 Relevance: 1.5, APIs: 1, Instructions: 8COMMON

Download Yara Rule

APIs

GetSystemInfo.KERNEL32 ref: 033F18F7

Memory Dump Source

Source File: 00000014.00000002.2494020967.00000000033B1000.00000020.00000001.01000000.00000015.sdmp, Offset: 033B0000, based on PE: true

Associated: 00000014.00000002.2493917908.00000000033B0000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000014.00000002.2497615129.00000000033F3000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000014.00000002.2498110795.0000000003400000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000014.00000002.2498410969.0000000003406000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000014.00000002.2498556459.0000000003408000.00000008.00000001.01000000.00000015.sdmpDownload File
Associated: 00000014.00000002.2498718201.000000000340A000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000014.00000002.2499166516.0000000003411000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_33b0000_Picasa3.jbxd

Similarity

API ID: InfoSystem
String ID:
API String ID: 31276548-0
Opcode ID: e154defd25c76d6bbbbdbf1a52325287f2f0cba1e4a395c758a6382bf3b670f1
Instruction ID: 88170cbb9a2e2af04daf96bde79a475961e15b9be38a0d424b483f259446dfab
Opcode Fuzzy Hash: e154defd25c76d6bbbbdbf1a52325287f2f0cba1e4a395c758a6382bf3b670f1
Instruction Fuzzy Hash: 00C04CB89082009FC608FF51D58644677F8F788310F840829D85693344D739D598CF52

Function 0483A980 Relevance: 21.2, APIs: 14, Instructions: 243
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

InterlockedIncrement.KERNEL32(?), ref: 0483A9BA
InterlockedDecrement.KERNEL32(?), ref: 0483AA05
InterlockedIncrement.KERNEL32(?), ref: 0483AA1D
GetLastError.KERNEL32 ref: 0483AA44
InterlockedDecrement.KERNEL32(?), ref: 0483AAAB
InterlockedIncrement.KERNEL32(?), ref: 0483AAC2
InterlockedDecrement.KERNEL32(?), ref: 0483AB08
InterlockedIncrement.KERNEL32(?), ref: 0483AB1F
InterlockedDecrement.KERNEL32(?), ref: 0483AB65
InterlockedIncrement.KERNEL32(?), ref: 0483AB7C
InterlockedDecrement.KERNEL32(?), ref: 0483ABC2
InterlockedIncrement.KERNEL32(?), ref: 0483ABD9
InterlockedDecrement.KERNEL32(?), ref: 0483AC1C
InterlockedIncrement.KERNEL32(?), ref: 0483AC33

Memory Dump Source

Source File: 00000014.00000002.2526268174.00000000047E1000.00000020.00000001.01000000.00000016.sdmp, Offset: 047E0000, based on PE: true

Associated: 00000014.00000002.2526187657.00000000047E0000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000014.00000002.2533437740.000000000488F000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000014.00000002.2535246598.00000000048AB000.00000004.00000001.01000000.00000016.sdmpDownload File
Associated: 00000014.00000002.2535569716.00000000048B3000.00000008.00000001.01000000.00000016.sdmpDownload File
Associated: 00000014.00000002.2535640427.00000000048B5000.00000004.00000001.01000000.00000016.sdmpDownload File
Associated: 00000014.00000002.2536317728.00000000048C0000.00000002.00000001.01000000.00000016.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_47e0000_Picasa3.jbxd

Similarity

API ID: Interlocked$Increment$Decrement$ErrorLast
String ID:
API String ID: 1785395282-0
Opcode ID: 83d272f6879be9e26c3f04b984e9fd875fd73ba355d25eea6c385ef3a911ed50
Instruction ID: f415fe496f36af0c2fde86f096dcf84989f3b7a3ab856fe38cca631cbc69cbb5
Opcode Fuzzy Hash: 83d272f6879be9e26c3f04b984e9fd875fd73ba355d25eea6c385ef3a911ed50
Instruction Fuzzy Hash: 11713A736042914BEB3A9E24D88077EB396EF81216F580F79F4D1C6181EA2CFD44A3D6

Function 0481B210 Relevance: 17.7, APIs: 5, Strings: 5, Instructions: 231
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 04830CA0: CreateEventA.KERNEL32(00000000,00000001,00000000,00000000,00000000,00000000,047E8B35), ref: 04830CB7
Part of subcall function 04830CA0: InterlockedExchange.KERNEL32 ref: 04830CD0
Part of subcall function 04830CA0: InitializeCriticalSection.KERNEL32(00000090), ref: 04830CE0

QueryPerformanceCounter.KERNEL32(?,?,?,00000000,?,?,?,?,?,?,?,?,0481BD10,00000000,?,00000000), ref: 0481B25D
InterlockedIncrement.KERNEL32(00000000), ref: 0481B2C7
LoadLibraryA.KERNEL32(netprofm.dll), ref: 0481B342
InterlockedIncrement.KERNEL32(00000000), ref: 0481B37F
InterlockedIncrement.KERNEL32(?), ref: 0481B43D

Strings

AutoBandwidthThrottle, xrefs: 0481B2FD
ConnNoRetry, xrefs: 0481B476
FlushImmediately, xrefs: 0481B4E7
netprofm.dll, xrefs: 0481B33D
Picasa, xrefs: 0481B3FB

Memory Dump Source

Source File: 00000014.00000002.2526268174.00000000047E1000.00000020.00000001.01000000.00000016.sdmp, Offset: 047E0000, based on PE: true

Associated: 00000014.00000002.2526187657.00000000047E0000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000014.00000002.2533437740.000000000488F000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000014.00000002.2535246598.00000000048AB000.00000004.00000001.01000000.00000016.sdmpDownload File
Associated: 00000014.00000002.2535569716.00000000048B3000.00000008.00000001.01000000.00000016.sdmpDownload File
Associated: 00000014.00000002.2535640427.00000000048B5000.00000004.00000001.01000000.00000016.sdmpDownload File
Associated: 00000014.00000002.2536317728.00000000048C0000.00000002.00000001.01000000.00000016.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_47e0000_Picasa3.jbxd

Similarity

API ID: Interlocked$Increment$CounterCreateCriticalEventExchangeInitializeLibraryLoadPerformanceQuerySection
String ID: AutoBandwidthThrottle$ConnNoRetry$FlushImmediately$Picasa$netprofm.dll
API String ID: 1429448606-4123518126
Opcode ID: 3dbb253503373ebfab153973083acec4c5528791962c3b46db35be15e0659471
Instruction ID: a22369ee09b0d9a6593ab8a5e97a877d8051532f12d198a0d42e27391b9712fa
Opcode Fuzzy Hash: 3dbb253503373ebfab153973083acec4c5528791962c3b46db35be15e0659471
Instruction Fuzzy Hash: 37A15F714083818FE711DF29C48475ABBE8BF85304F448EAEEC999B255D774F909CBA2

Function 04036760 Relevance: 16.0, APIs: 7, Strings: 2, Instructions: 218
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleFileNameA.KERNEL32(?,?,00000104), ref: 040367CB
GetLongPathNameA.KERNEL32(?,?,00000104), ref: 040367E1
InterlockedIncrement.KERNEL32(?), ref: 040369C3

Strings

:, xrefs: 04036987
ru, xrefs: 040369C3

Memory Dump Source

Source File: 00000014.00000002.2502041842.0000000004031000.00000020.00000001.01000000.00000017.sdmp, Offset: 04030000, based on PE: true

Associated: 00000014.00000002.2501986218.0000000004030000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000014.00000002.2504208079.0000000004079000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000014.00000002.2504943590.0000000004086000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000014.00000002.2505148754.000000000408E000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000014.00000002.2505282171.0000000004090000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000014.00000002.2505501725.0000000004097000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_4030000_Picasa3.jbxd

Similarity

API ID: Name$FileIncrementInterlockedLongModulePath
String ID: :$ru
API String ID: 240378316-1990876225
Opcode ID: 98a6cbdb87feee696e4d49764a1b6b1aba194e981bddaf7a9246b7f5e56a457d
Instruction ID: 2ba1b3cbec304760de692d5d9dbb6b8a8c64bfc0818dd210a3960498b09ed16b
Opcode Fuzzy Hash: 98a6cbdb87feee696e4d49764a1b6b1aba194e981bddaf7a9246b7f5e56a457d
Instruction Fuzzy Hash: 0671AF71508351ABE320DF20C844AAFBFEDAB8971DF440E2AE585B6140D776FA05C7A2

Function 0482F8A0 Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 218
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleFileNameA.KERNEL32(00000001,?,00000104), ref: 0482F90B
GetLongPathNameA.KERNEL32(?,?,00000104), ref: 0482F921
InterlockedIncrement.KERNEL32(?), ref: 0482FB03

Strings

:, xrefs: 0482FAC7

Memory Dump Source

Source File: 00000014.00000002.2526268174.00000000047E1000.00000020.00000001.01000000.00000016.sdmp, Offset: 047E0000, based on PE: true

Associated: 00000014.00000002.2526187657.00000000047E0000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000014.00000002.2533437740.000000000488F000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000014.00000002.2535246598.00000000048AB000.00000004.00000001.01000000.00000016.sdmpDownload File
Associated: 00000014.00000002.2535569716.00000000048B3000.00000008.00000001.01000000.00000016.sdmpDownload File
Associated: 00000014.00000002.2535640427.00000000048B5000.00000004.00000001.01000000.00000016.sdmpDownload File
Associated: 00000014.00000002.2536317728.00000000048C0000.00000002.00000001.01000000.00000016.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_47e0000_Picasa3.jbxd

Similarity

API ID: Name$FileIncrementInterlockedLongModulePath
String ID: :
API String ID: 240378316-336475711
Opcode ID: 30eb9ff1e75d6252454e2b5dd100c43b5bd2a75d3f4d7a05aafa40a5076e08bb
Instruction ID: c2a8493a08e195cbe0f6727a813e20a223f15db904686cd6c12915c2cfc332f7
Opcode Fuzzy Hash: 30eb9ff1e75d6252454e2b5dd100c43b5bd2a75d3f4d7a05aafa40a5076e08bb
Instruction Fuzzy Hash: C071EF71108365ABD321DF24CA44A6FBBE4AF84B48F440E19F786D7140D374FA85DBA2

Function 04833F11 Relevance: 10.6, APIs: 7, Instructions: 108
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,000000FF,00000000,00000000), ref: 04833F3E
MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,000000FF,00000000,00000000), ref: 04833F5C
MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,000000FF,?,00000000), ref: 04833F79
MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,000000FF,00000000,00000000), ref: 04833F94
MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,000000FF,00000000,00000000), ref: 04833FBB
MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,000000FF,?,00000000), ref: 04833FD8
RegCreateKeyExW.KERNELBASE(00000000,00000000,?,00000000,?,?,?,?,?), ref: 04833FFE

Memory Dump Source

Source File: 00000014.00000002.2526268174.00000000047E1000.00000020.00000001.01000000.00000016.sdmp, Offset: 047E0000, based on PE: true

Associated: 00000014.00000002.2526187657.00000000047E0000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000014.00000002.2533437740.000000000488F000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000014.00000002.2535246598.00000000048AB000.00000004.00000001.01000000.00000016.sdmpDownload File
Associated: 00000014.00000002.2535569716.00000000048B3000.00000008.00000001.01000000.00000016.sdmpDownload File
Associated: 00000014.00000002.2535640427.00000000048B5000.00000004.00000001.01000000.00000016.sdmpDownload File
Associated: 00000014.00000002.2536317728.00000000048C0000.00000002.00000001.01000000.00000016.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_47e0000_Picasa3.jbxd

Similarity

API ID: ByteCharMultiWide$Create
String ID:
API String ID: 1150895397-0
Opcode ID: 8a0628fa50f0a69b269b2c627af1e468e1a9cc3833393eeb7b82d2e5a7fd1e56
Instruction ID: 26cd3764ebd314ce47046a9d54eb6ea4a9f6059ac271195cab327930a723ef7d
Opcode Fuzzy Hash: 8a0628fa50f0a69b269b2c627af1e468e1a9cc3833393eeb7b82d2e5a7fd1e56
Instruction Fuzzy Hash: 4A3197317442097BE7209E59CC51FBB77B9DF89B24F20072ABA14EB2C0D5B4B8009B95

Function 040335F0 Relevance: 10.6, APIs: 2, Strings: 4, Instructions: 70
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegCloseKey.ADVAPI32(?), ref: 04033641

Strings

ytITivo, xrefs: 0403368E, 040336A4
app, xrefs: 040335FE
IUIManager, xrefs: 040335F9
SOFTWARE\TiVo\Desktop\Beacon, xrefs: 0403361E

Memory Dump Source

Source File: 00000014.00000002.2502041842.0000000004031000.00000020.00000001.01000000.00000017.sdmp, Offset: 04030000, based on PE: true

Associated: 00000014.00000002.2501986218.0000000004030000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000014.00000002.2504208079.0000000004079000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000014.00000002.2504943590.0000000004086000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000014.00000002.2505148754.000000000408E000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000014.00000002.2505282171.0000000004090000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000014.00000002.2505501725.0000000004097000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_4030000_Picasa3.jbxd

Similarity

API ID: Close
String ID: IUIManager$SOFTWARE\TiVo\Desktop\Beacon$app$ytITivo
API String ID: 3535843008-3500199463
Opcode ID: e05bab042a0e9c9e7caff7c4bc8f9601852fe321d7768923e3e220e5632c3d28
Instruction ID: 3f00a1e33a4791d15ceb2520cef46a3bc5c53ce85edf39a549d0bccb5b1a16ee
Opcode Fuzzy Hash: e05bab042a0e9c9e7caff7c4bc8f9601852fe321d7768923e3e220e5632c3d28
Instruction Fuzzy Hash: 1011AB71B401115FE650FA789C95F9B77D8AF84A49F444120FD04FB340E678F91447D6

Function 048340D0 Relevance: 7.7, APIs: 5, Instructions: 179
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,000000FF,00000000,00000000), ref: 048340FD
MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,000000FF,00000000,00000000), ref: 04834118
MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,000000FF,?,00000000), ref: 04834135
RegQueryValueExW.KERNELBASE(?,?,?,?,00000000,?), ref: 048341C4
WideCharToMultiByte.KERNEL32(0000FDE9,00000000,00000000,?,?,?,00000000,00000000), ref: 0483425C

Memory Dump Source

Source File: 00000014.00000002.2526268174.00000000047E1000.00000020.00000001.01000000.00000016.sdmp, Offset: 047E0000, based on PE: true

Associated: 00000014.00000002.2526187657.00000000047E0000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000014.00000002.2533437740.000000000488F000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000014.00000002.2535246598.00000000048AB000.00000004.00000001.01000000.00000016.sdmpDownload File
Associated: 00000014.00000002.2535569716.00000000048B3000.00000008.00000001.01000000.00000016.sdmpDownload File
Associated: 00000014.00000002.2535640427.00000000048B5000.00000004.00000001.01000000.00000016.sdmpDownload File
Associated: 00000014.00000002.2536317728.00000000048C0000.00000002.00000001.01000000.00000016.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_47e0000_Picasa3.jbxd

Similarity

API ID: ByteCharMultiWide$QueryValue
String ID:
API String ID: 4146047584-0
Opcode ID: 104310f01a954a835dc8ab7daeacf1b6b2f621226b040d634311df5a1055caeb
Instruction ID: 96faef45d36268956bccfce285bbaa6985eca42e267759b47f11bddc7442a9ab
Opcode Fuzzy Hash: 104310f01a954a835dc8ab7daeacf1b6b2f621226b040d634311df5a1055caeb
Instruction Fuzzy Hash: 37518371A00119ABDB21DFA9CC44AAFBBB9EF95B15F240B55E411E7280E770BD4087A1

Function 048266A0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 122
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetLastError.KERNEL32 ref: 04826796
SetFilePointer.KERNELBASE(?,00000000,00000000,00000002), ref: 048267D1
GetLastError.KERNEL32 ref: 048267DC

Strings

.\yt\ytIO.cpp, xrefs: 048267A9

Memory Dump Source

Source File: 00000014.00000002.2526268174.00000000047E1000.00000020.00000001.01000000.00000016.sdmp, Offset: 047E0000, based on PE: true

Associated: 00000014.00000002.2526187657.00000000047E0000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000014.00000002.2533437740.000000000488F000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000014.00000002.2535246598.00000000048AB000.00000004.00000001.01000000.00000016.sdmpDownload File
Associated: 00000014.00000002.2535569716.00000000048B3000.00000008.00000001.01000000.00000016.sdmpDownload File
Associated: 00000014.00000002.2535640427.00000000048B5000.00000004.00000001.01000000.00000016.sdmpDownload File
Associated: 00000014.00000002.2536317728.00000000048C0000.00000002.00000001.01000000.00000016.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_47e0000_Picasa3.jbxd

Similarity

API ID: ErrorLast$FilePointer
String ID: .\yt\ytIO.cpp
API String ID: 1156039329-3183256253
Opcode ID: 8e683de790124149b39060b3c0cdc11a0df93aba2724700e69e1fe212110abe5
Instruction ID: 384dcc19f5e71db3d4becc4b94a89a81c0f595cf52d7d26cc5fc79757cf35a88
Opcode Fuzzy Hash: 8e683de790124149b39060b3c0cdc11a0df93aba2724700e69e1fe212110abe5
Instruction Fuzzy Hash: 8E41AF716007549FE7209F34DA85B2AB7E5FB40314F548F2DE16AE7281EB34F9848B41

Function 0482E1E0 Relevance: 6.1, APIs: 4, Instructions: 93
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentThread.KERNEL32 ref: 0482E203
GetCurrentThreadId.KERNEL32 ref: 0482E20B
SetErrorMode.KERNELBASE(00008001), ref: 0482E2F5
InitCommonControlsEx.COMCTL32 ref: 0482E316

Memory Dump Source

Source File: 00000014.00000002.2526268174.00000000047E1000.00000020.00000001.01000000.00000016.sdmp, Offset: 047E0000, based on PE: true

Associated: 00000014.00000002.2526187657.00000000047E0000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000014.00000002.2533437740.000000000488F000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000014.00000002.2535246598.00000000048AB000.00000004.00000001.01000000.00000016.sdmpDownload File
Associated: 00000014.00000002.2535569716.00000000048B3000.00000008.00000001.01000000.00000016.sdmpDownload File
Associated: 00000014.00000002.2535640427.00000000048B5000.00000004.00000001.01000000.00000016.sdmpDownload File
Associated: 00000014.00000002.2536317728.00000000048C0000.00000002.00000001.01000000.00000016.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_47e0000_Picasa3.jbxd

Similarity

API ID: CurrentThread$CommonControlsErrorInitMode
String ID:
API String ID: 1145268306-0
Opcode ID: 81c40fd3ddf02c5947d8e38988bdc448a2bcd1493065965e51dc0d819b26d04f
Instruction ID: b3c0624be18cbb20dc3b35306c8bf2f5a587fd4c445537050b2ce10ebdaebc56
Opcode Fuzzy Hash: 81c40fd3ddf02c5947d8e38988bdc448a2bcd1493065965e51dc0d819b26d04f
Instruction Fuzzy Hash: 863191B04043508BE711EF68D6487667B94EF45309F044F5DEE49DA281DBB8B584CBA7

Function 048347B1 Relevance: 6.1, APIs: 4, Instructions: 69
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,000000FF,00000000,00000000), ref: 048347E2
MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,000000FF,00000000,00000000), ref: 04834800
MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,000000FF,?,00000000), ref: 0483481D
CreateFileW.KERNELBASE(00000000,?,?,?,?,?,?), ref: 0483483B

Memory Dump Source

Source File: 00000014.00000002.2526268174.00000000047E1000.00000020.00000001.01000000.00000016.sdmp, Offset: 047E0000, based on PE: true

Associated: 00000014.00000002.2526187657.00000000047E0000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000014.00000002.2533437740.000000000488F000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000014.00000002.2535246598.00000000048AB000.00000004.00000001.01000000.00000016.sdmpDownload File
Associated: 00000014.00000002.2535569716.00000000048B3000.00000008.00000001.01000000.00000016.sdmpDownload File
Associated: 00000014.00000002.2535640427.00000000048B5000.00000004.00000001.01000000.00000016.sdmpDownload File
Associated: 00000014.00000002.2536317728.00000000048C0000.00000002.00000001.01000000.00000016.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_47e0000_Picasa3.jbxd

Similarity

API ID: ByteCharMultiWide$CreateFile
String ID:
API String ID: 472006099-0
Opcode ID: 5717205d19e5ca080913f756777880ae9f8fce585b7e383bb1203a2f4fc020d4
Instruction ID: 3bd77eaaca3b2f0ac31cae49a0b9eb019d53a8a579963c70121cf8b756302ba5
Opcode Fuzzy Hash: 5717205d19e5ca080913f756777880ae9f8fce585b7e383bb1203a2f4fc020d4
Instruction Fuzzy Hash: FC119335700209BBEB20DE59DC41FAB77A9EF49B24F204729B615EB2C0D670BC0097A1

Function 04039050 Relevance: 6.1, APIs: 4, Instructions: 66
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,000000FF,00000000,00000000), ref: 04039082
MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,000000FF,00000000,00000000), ref: 040390A0
MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,000000FF,?,00000000), ref: 040390BD
RegOpenKeyExW.KERNELBASE(?,00000000,?,?,?), ref: 040390D3

Memory Dump Source

Source File: 00000014.00000002.2502041842.0000000004031000.00000020.00000001.01000000.00000017.sdmp, Offset: 04030000, based on PE: true

Associated: 00000014.00000002.2501986218.0000000004030000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000014.00000002.2504208079.0000000004079000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000014.00000002.2504943590.0000000004086000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000014.00000002.2505148754.000000000408E000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000014.00000002.2505282171.0000000004090000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000014.00000002.2505501725.0000000004097000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_4030000_Picasa3.jbxd

Similarity

API ID: ByteCharMultiWide$Open
String ID:
API String ID: 103789273-0
Opcode ID: e27d6a4a273419125f6ea5f3c840176e756fd04a325ef6837158fcb24b2616a3
Instruction ID: 97a38b7c20806beb4a491d6b9f3e1eae666458a68155e1542f83d756835913dd
Opcode Fuzzy Hash: e27d6a4a273419125f6ea5f3c840176e756fd04a325ef6837158fcb24b2616a3
Instruction Fuzzy Hash: 6A119475B00219BFEB20DF69DC41FAB7B68EF45724F204625B615BB2C0D970BC0096A5

Function 04835A91 Relevance: 6.1, APIs: 4, Instructions: 59
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,000000FF,00000000,00000000), ref: 04835ABE
MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,000000FF,00000000,00000000), ref: 04835ADC
MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,000000FF,?,00000000), ref: 04835AF9
CreateDirectoryW.KERNELBASE(00000000,?), ref: 04835B03

Memory Dump Source

Source File: 00000014.00000002.2526268174.00000000047E1000.00000020.00000001.01000000.00000016.sdmp, Offset: 047E0000, based on PE: true

Associated: 00000014.00000002.2526187657.00000000047E0000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000014.00000002.2533437740.000000000488F000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000014.00000002.2535246598.00000000048AB000.00000004.00000001.01000000.00000016.sdmpDownload File
Associated: 00000014.00000002.2535569716.00000000048B3000.00000008.00000001.01000000.00000016.sdmpDownload File
Associated: 00000014.00000002.2535640427.00000000048B5000.00000004.00000001.01000000.00000016.sdmpDownload File
Associated: 00000014.00000002.2536317728.00000000048C0000.00000002.00000001.01000000.00000016.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_47e0000_Picasa3.jbxd

Similarity

API ID: ByteCharMultiWide$CreateDirectory
String ID:
API String ID: 2198582921-0
Opcode ID: 268bae6f74787a25c2a2111ffd5c474b29a9d0519fa6f0e520a129e2a34c6768
Instruction ID: 41af9544c2a3de7bd323628b195388517b037eb37e9fceba9e67e1b8aaa7c08f
Opcode Fuzzy Hash: 268bae6f74787a25c2a2111ffd5c474b29a9d0519fa6f0e520a129e2a34c6768
Instruction Fuzzy Hash: 70110831B01219BBE720AA699C46FBB7B64EF05730F300B35B615EB1C0D970B90092A1

Function 0483DB20 Relevance: 4.6, APIs: 3, Instructions: 132
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetFileVersionInfoSizeW.VERSION(00000000,00000000), ref: 0483DB65
GetFileVersionInfoW.VERSION(00000000,00000000,00000000,00000000,?,?,?,?,?,00000000), ref: 0483DB93
VerQueryValueA.VERSION(00000000,048919A0,?,?,00000000,00000000,00000000,00000000,?,?,?,?,?,00000000), ref: 0483DBD1

Memory Dump Source

Source File: 00000014.00000002.2526268174.00000000047E1000.00000020.00000001.01000000.00000016.sdmp, Offset: 047E0000, based on PE: true

Associated: 00000014.00000002.2526187657.00000000047E0000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000014.00000002.2533437740.000000000488F000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000014.00000002.2535246598.00000000048AB000.00000004.00000001.01000000.00000016.sdmpDownload File
Associated: 00000014.00000002.2535569716.00000000048B3000.00000008.00000001.01000000.00000016.sdmpDownload File
Associated: 00000014.00000002.2535640427.00000000048B5000.00000004.00000001.01000000.00000016.sdmpDownload File
Associated: 00000014.00000002.2536317728.00000000048C0000.00000002.00000001.01000000.00000016.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_47e0000_Picasa3.jbxd

Similarity

API ID: FileInfoVersion$QuerySizeValue
String ID:
API String ID: 2179348866-0
Opcode ID: 5b0072d8952ef5b8787e0f43fa24f36198475e6bceca823763a38c4223caf4f9
Instruction ID: 6a95a4794889a61cedffb282fa17b99c711d3b5c28d257de4b00a81a77aad485
Opcode Fuzzy Hash: 5b0072d8952ef5b8787e0f43fa24f36198475e6bceca823763a38c4223caf4f9
Instruction Fuzzy Hash: 3D4116726153154BE311EF69D840A77B3D8AF80B5AF484FBCEC05D7251E765F80982E2

Function 0481BA00 Relevance: 3.2, APIs: 2, Instructions: 214
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

InterlockedIncrement.KERNEL32(?), ref: 0481BA9B
InterlockedIncrement.KERNEL32(00000000), ref: 0481BBE3

Part of subcall function 047E3430: InterlockedDecrement.KERNEL32(00000000), ref: 047E3442
Part of subcall function 047E3430: InterlockedIncrement.KERNEL32(00000000), ref: 047E345E

Memory Dump Source

Source File: 00000014.00000002.2526268174.00000000047E1000.00000020.00000001.01000000.00000016.sdmp, Offset: 047E0000, based on PE: true

Associated: 00000014.00000002.2526187657.00000000047E0000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000014.00000002.2533437740.000000000488F000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000014.00000002.2535246598.00000000048AB000.00000004.00000001.01000000.00000016.sdmpDownload File
Associated: 00000014.00000002.2535569716.00000000048B3000.00000008.00000001.01000000.00000016.sdmpDownload File
Associated: 00000014.00000002.2535640427.00000000048B5000.00000004.00000001.01000000.00000016.sdmpDownload File
Associated: 00000014.00000002.2536317728.00000000048C0000.00000002.00000001.01000000.00000016.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_47e0000_Picasa3.jbxd

Similarity

API ID: Interlocked$Increment$Decrement
String ID:
API String ID: 4289621856-0
Opcode ID: 39aa705ad610c2d798f028cf90257be7516e40e8e02016282605b18964863564
Instruction ID: 740565a1b482700f23ae1e14e42587b488cf331fa7953adca7496daaeb258c33
Opcode Fuzzy Hash: 39aa705ad610c2d798f028cf90257be7516e40e8e02016282605b18964863564
Instruction Fuzzy Hash: 8B81B1725083818FD711EF29D8909AEB7E5EF84304F844F6EE495E7220C774BA498BD2

Function 047E1FB0 Relevance: 3.1, APIs: 2, Instructions: 116registryCOMMON

Download Yara Rule

APIs

RegCloseKey.ADVAPI32(00000000,?,00000000,00000000,000F003F), ref: 047E2088
RegCloseKey.ADVAPI32(00000000,?,00000000,00000000,000F003F), ref: 047E20AB

Memory Dump Source

Source File: 00000014.00000002.2526268174.00000000047E1000.00000020.00000001.01000000.00000016.sdmp, Offset: 047E0000, based on PE: true

Associated: 00000014.00000002.2526187657.00000000047E0000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000014.00000002.2533437740.000000000488F000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000014.00000002.2535246598.00000000048AB000.00000004.00000001.01000000.00000016.sdmpDownload File
Associated: 00000014.00000002.2535569716.00000000048B3000.00000008.00000001.01000000.00000016.sdmpDownload File
Associated: 00000014.00000002.2535640427.00000000048B5000.00000004.00000001.01000000.00000016.sdmpDownload File
Associated: 00000014.00000002.2536317728.00000000048C0000.00000002.00000001.01000000.00000016.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_47e0000_Picasa3.jbxd

Similarity

API ID: Close
String ID:
API String ID: 3535843008-0
Opcode ID: 2f3f8b9777898bbc9223aacfedc94218d662535fdd16ccb70a69a1f470cbdd1b
Instruction ID: c0079592b53b510516f1d5b43d8c3dfc8160384a390139c59b8a1afaed80fe51
Opcode Fuzzy Hash: 2f3f8b9777898bbc9223aacfedc94218d662535fdd16ccb70a69a1f470cbdd1b
Instruction Fuzzy Hash: D4315FB26043028FD710DF6AC88093BB7E9AB98344B544E6DF589D3252E770F949CB92

Function 0481E380 Relevance: 3.0, APIs: 2, Instructions: 40networkCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 0481E39F
InternetGetConnectedStateEx.WININET ref: 0481E3BD

Memory Dump Source

Source File: 00000014.00000002.2526268174.00000000047E1000.00000020.00000001.01000000.00000016.sdmp, Offset: 047E0000, based on PE: true

Associated: 00000014.00000002.2526187657.00000000047E0000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000014.00000002.2533437740.000000000488F000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000014.00000002.2535246598.00000000048AB000.00000004.00000001.01000000.00000016.sdmpDownload File
Associated: 00000014.00000002.2535569716.00000000048B3000.00000008.00000001.01000000.00000016.sdmpDownload File
Associated: 00000014.00000002.2535640427.00000000048B5000.00000004.00000001.01000000.00000016.sdmpDownload File
Associated: 00000014.00000002.2536317728.00000000048C0000.00000002.00000001.01000000.00000016.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_47e0000_Picasa3.jbxd

Similarity

API ID: ConnectedInternetState_memset
String ID:
API String ID: 2089801137-0
Opcode ID: 062a74e3439c74e618cbee1dda583b653d0bf803eda0b77f01efec63b092954d
Instruction ID: 0d25451d884a3b2e857a7ef71b4db7436adaccf75304d0575a73e68e948af183
Opcode Fuzzy Hash: 062a74e3439c74e618cbee1dda583b653d0bf803eda0b77f01efec63b092954d
Instruction Fuzzy Hash: 52014F71108341AFE304DF18D855B6BBBE5ABC4704F444D1DF58587281E7B5E508C793

Function 033E1A38 Relevance: 3.0, APIs: 2, Instructions: 28memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

HeapCreate.KERNEL32(00000000,00001000,00000000,033DD1E7,00000001,?,?,00000001,?,?,033DD365,00000001,?,?,033FDA28,0000000C), ref: 033E1A49
HeapDestroy.KERNEL32(?,?,00000001,?,?,033DD365,00000001,?,?,033FDA28,0000000C,033DD41F,?), ref: 033E1A7F

Memory Dump Source

Source File: 00000014.00000002.2494020967.00000000033B1000.00000020.00000001.01000000.00000015.sdmp, Offset: 033B0000, based on PE: true

Associated: 00000014.00000002.2493917908.00000000033B0000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000014.00000002.2497615129.00000000033F3000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000014.00000002.2498110795.0000000003400000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000014.00000002.2498410969.0000000003406000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000014.00000002.2498556459.0000000003408000.00000008.00000001.01000000.00000015.sdmpDownload File
Associated: 00000014.00000002.2498718201.000000000340A000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000014.00000002.2499166516.0000000003411000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_33b0000_Picasa3.jbxd

Similarity

API ID: Heap$CreateDestroy
String ID:
API String ID: 3296620671-0
Opcode ID: 1d82d81bbb55e88b33257c04fe4af7b667247fe6a720b66c85dfaed95074b10a
Instruction ID: c80fd685d5d6dfee7ae734b1447b547c24d3b385e6513e96a39944699a173424
Opcode Fuzzy Hash: 1d82d81bbb55e88b33257c04fe4af7b667247fe6a720b66c85dfaed95074b10a
Instruction Fuzzy Hash: EEE03938B14325EADB54FB71EE8873576E8E740B4AF004925E801EE0C8EBB094849E01

Function 040669AA Relevance: 3.0, APIs: 2, Instructions: 28memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

HeapCreate.KERNELBASE(00000000,00001000,00000000,04061379,00000001,?,?,00000001,?,?,040614F7,00000001,?,?,040837A0,0000000C), ref: 040669BB
HeapDestroy.KERNEL32(?,?,00000001,?,?,040614F7,00000001,?,?,040837A0,0000000C,040615B1,?), ref: 040669F1

Memory Dump Source

Source File: 00000014.00000002.2502041842.0000000004031000.00000020.00000001.01000000.00000017.sdmp, Offset: 04030000, based on PE: true

Associated: 00000014.00000002.2501986218.0000000004030000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000014.00000002.2504208079.0000000004079000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000014.00000002.2504943590.0000000004086000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000014.00000002.2505148754.000000000408E000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000014.00000002.2505282171.0000000004090000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000014.00000002.2505501725.0000000004097000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_4030000_Picasa3.jbxd

Similarity

API ID: Heap$CreateDestroy
String ID:
API String ID: 3296620671-0
Opcode ID: 8c0773fc34d357279aeb96d5a33abf05e0f74e8e39978dfa4fd37d1a5660ee85
Instruction ID: 9ab5e95f2ac7801a945812520a3e2daf49ee6fde3a97c1f226e208577f85cd9e
Opcode Fuzzy Hash: 8c0773fc34d357279aeb96d5a33abf05e0f74e8e39978dfa4fd37d1a5660ee85
Instruction Fuzzy Hash: 06E06D71A513029EFB51AF309E1476536D8E74824EF104C35E413F9084EFBDAC50AA15

Function 04878C93 Relevance: 3.0, APIs: 2, Instructions: 28memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

HeapCreate.KERNELBASE(00000000,00001000,00000000,04874FF8,00000001,?,?,00000001,?,?,04875176,00000001,?,?,048A7B00,0000000C), ref: 04878CA4
HeapDestroy.KERNEL32(?,?,00000001,?,?,04875176,00000001,?,?,048A7B00,0000000C,04875230,?), ref: 04878CDA

Memory Dump Source

Source File: 00000014.00000002.2526268174.00000000047E1000.00000020.00000001.01000000.00000016.sdmp, Offset: 047E0000, based on PE: true

Associated: 00000014.00000002.2526187657.00000000047E0000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000014.00000002.2533437740.000000000488F000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000014.00000002.2535246598.00000000048AB000.00000004.00000001.01000000.00000016.sdmpDownload File
Associated: 00000014.00000002.2535569716.00000000048B3000.00000008.00000001.01000000.00000016.sdmpDownload File
Associated: 00000014.00000002.2535640427.00000000048B5000.00000004.00000001.01000000.00000016.sdmpDownload File
Associated: 00000014.00000002.2536317728.00000000048C0000.00000002.00000001.01000000.00000016.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_47e0000_Picasa3.jbxd

Similarity

API ID: Heap$CreateDestroy
String ID:
API String ID: 3296620671-0
Opcode ID: 2f2df7e412b541ab70df8ba109962464809c159db172bc0f0269c0598dfa3db9
Instruction ID: 2f426bd087e46b4c5c9bd712a395e9321eff2919955fb633254653ffa50bfdec
Opcode Fuzzy Hash: 2f2df7e412b541ab70df8ba109962464809c159db172bc0f0269c0598dfa3db9
Instruction Fuzzy Hash: 1DE06D78656301AFEF957F38AE2C7263AD5F78024AF000E29E611C4080EB78D9489A81

Function 04839E20 Relevance: 1.6, APIs: 1, Instructions: 71COMMON

Download Yara Rule

APIs

InterlockedIncrement.KERNEL32(00000000), ref: 04839E77

Memory Dump Source

Source File: 00000014.00000002.2526268174.00000000047E1000.00000020.00000001.01000000.00000016.sdmp, Offset: 047E0000, based on PE: true

Associated: 00000014.00000002.2526187657.00000000047E0000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000014.00000002.2533437740.000000000488F000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000014.00000002.2535246598.00000000048AB000.00000004.00000001.01000000.00000016.sdmpDownload File
Associated: 00000014.00000002.2535569716.00000000048B3000.00000008.00000001.01000000.00000016.sdmpDownload File
Associated: 00000014.00000002.2535640427.00000000048B5000.00000004.00000001.01000000.00000016.sdmpDownload File
Associated: 00000014.00000002.2536317728.00000000048C0000.00000002.00000001.01000000.00000016.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_47e0000_Picasa3.jbxd

Similarity

API ID: IncrementInterlocked
String ID:
API String ID: 3508698243-0
Opcode ID: 3e6cf05868bee532b8c2eaef6a23c4ed5f006a81ee18a061e391f74173c1fba0
Instruction ID: 4ca2ae1281eb8020b878687b8e9e28f3c7d9518a7d2dfc22065adad6b4f46f1f
Opcode Fuzzy Hash: 3e6cf05868bee532b8c2eaef6a23c4ed5f006a81ee18a061e391f74173c1fba0
Instruction Fuzzy Hash: 5A11E4B36043515BE3218E55DC44B6BB7A9EF84B16F544E2AFA81E7140C7F4B90087D1

Function 04077CB0 Relevance: 1.5, APIs: 1, Instructions: 8COMMON

Download Yara Rule

APIs

GetSystemInfo.KERNELBASE ref: 04077CB7

Memory Dump Source

Source File: 00000014.00000002.2502041842.0000000004031000.00000020.00000001.01000000.00000017.sdmp, Offset: 04030000, based on PE: true

Associated: 00000014.00000002.2501986218.0000000004030000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000014.00000002.2504208079.0000000004079000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000014.00000002.2504943590.0000000004086000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000014.00000002.2505148754.000000000408E000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000014.00000002.2505282171.0000000004090000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000014.00000002.2505501725.0000000004097000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_4030000_Picasa3.jbxd

Similarity

API ID: InfoSystem
String ID:
API String ID: 31276548-0
Opcode ID: d8e50b6b6d87d6d8aa9fe8bdf97420e03f3049880f2b4265af02e5b6021ed604
Instruction ID: 9e104bd78fba3798cacf6d43c5061ce5b24b7f539494e8be3aa600e793e39e10
Opcode Fuzzy Hash: d8e50b6b6d87d6d8aa9fe8bdf97420e03f3049880f2b4265af02e5b6021ed604
Instruction Fuzzy Hash: 72C04CF48091019BD71CEF51D68984677E4FB88200F800479D856A2341E73D9D9DCB53

Non-executed Functions

Function 04042FD0 Relevance: 44.0, APIs: 1, Strings: 24, Instructions: 283COMMON

Download Yara Rule

APIs

Part of subcall function 04037DD0: EnterCriticalSection.KERNEL32(040923C4,00000001,00000000,00000000,?,?,04042FE3,January,00000000,?,040360D0), ref: 04037E03
Part of subcall function 04037DD0: InterlockedIncrement.KERNEL32(00000000), ref: 04037E77
Part of subcall function 04037DD0: InterlockedIncrement.KERNEL32(00000000), ref: 04037E94

Part of subcall function 04037DD0: InterlockedIncrement.KERNEL32(?), ref: 04037F27
Part of subcall function 04037DD0: InterlockedIncrement.KERNEL32(?), ref: 04037F44
Part of subcall function 04037DD0: LeaveCriticalSection.KERNEL32(040923C4), ref: 04037F99

GetLocaleInfoA.KERNEL32(00000400,00000022,?,00000002), ref: 040433A4

Strings

March, xrefs: 04043026, 0404302B
Oct, xrefs: 0404331E, 04043323
Jan, xrefs: 040431B6, 040431BB
February, xrefs: 04042FFE, 04043003
Nov, xrefs: 04043346, 0404334B
June, xrefs: 0404309E, 040430A3
August, xrefs: 040430EE, 040430F3
December, xrefs: 0404318E, 04043193
October, xrefs: 0404313E, 04043143
November, xrefs: 04043166, 0404316B
Jun, xrefs: 0404327E, 04043283
Jul, xrefs: 040432A6, 040432AB
Aug, xrefs: 040432CE, 040432D3
Mar, xrefs: 04043206, 0404320B
January, xrefs: 04042FD4, 04042FD9
Dec, xrefs: 0404336E, 04043373
Apr, xrefs: 0404322E, 04043233
April, xrefs: 0404304E, 04043053
July, xrefs: 040430C6, 040430CB
Feb, xrefs: 040431DE, 040431E3
May, xrefs: 04043076, 0404307B, 0404325B
September, xrefs: 04043116, 0404311B
Abbreviation::May, xrefs: 04043256
Sep, xrefs: 040432F6, 040432FB

Memory Dump Source

Source File: 00000014.00000002.2502041842.0000000004031000.00000020.00000001.01000000.00000017.sdmp, Offset: 04030000, based on PE: true

Associated: 00000014.00000002.2501986218.0000000004030000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000014.00000002.2504208079.0000000004079000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000014.00000002.2504943590.0000000004086000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000014.00000002.2505148754.000000000408E000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000014.00000002.2505282171.0000000004090000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000014.00000002.2505501725.0000000004097000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_4030000_Picasa3.jbxd

Similarity

API ID: IncrementInterlocked$CriticalSection$EnterInfoLeaveLocale
String ID: Abbreviation::May$Apr$April$Aug$August$Dec$December$Feb$February$Jan$January$Jul$July$Jun$June$Mar$March$May$Nov$November$Oct$October$Sep$September
API String ID: 2682901361-164861888
Opcode ID: 2b25ae523046c02fb2d00890c1bc4bbefa7cbe162f91efe3868e6ce54410ac67
Instruction ID: 2ef2adf2549a5e9d4c08e9aeaa6b0907d3daae5cf84c90f56c6dedac7c0053d4
Opcode Fuzzy Hash: 2b25ae523046c02fb2d00890c1bc4bbefa7cbe162f91efe3868e6ce54410ac67
Instruction Fuzzy Hash: 67A1FBF1F042499FFB609F58E88196936B0FA9464CB04587AE802BF310E678FC14AF57

Function 04035CD0 Relevance: 18.1, APIs: 12, Instructions: 103windowthreadCOMMON

Download Yara Rule

APIs

IsWindow.USER32(00000000), ref: 04035CF2
IsWindowVisible.USER32(00000000), ref: 04035CFE
GetCurrentThreadId.KERNEL32 ref: 04035D2A
EnumThreadWindows.USER32(00000000,?,040364BF), ref: 04035D2D
IsWindowVisible.USER32(00000000), ref: 04035D41
IsIconic.USER32(040364BF), ref: 04035D52
IsWindow.USER32(00000000), ref: 04035D62
IsWindowVisible.USER32(00000000), ref: 04035D6E
IsWindowVisible.USER32(00000000), ref: 04035D90
IsIconic.USER32(040364BF), ref: 04035D9B
GetCurrentThreadId.KERNEL32 ref: 04035DBA
SetWindowsHookExA.USER32(00000005,04035C10,04030000,00000000), ref: 04035DCB

Memory Dump Source

Source File: 00000014.00000002.2502041842.0000000004031000.00000020.00000001.01000000.00000017.sdmp, Offset: 04030000, based on PE: true

Associated: 00000014.00000002.2501986218.0000000004030000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000014.00000002.2504208079.0000000004079000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000014.00000002.2504943590.0000000004086000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000014.00000002.2505148754.000000000408E000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000014.00000002.2505282171.0000000004090000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000014.00000002.2505501725.0000000004097000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_4030000_Picasa3.jbxd

Similarity

API ID: Window$Visible$Thread$CurrentIconicWindows$EnumHook
String ID:
API String ID: 3749286783-0
Opcode ID: d9b9549e237a70918266e25ad06700a70a85833a1de8b6d0eab400337c2b2481
Instruction ID: b743a5b9caa3570ca351d445f61f2643cca029d6b2917ace8369b95eeadbd7d5
Opcode Fuzzy Hash: d9b9549e237a70918266e25ad06700a70a85833a1de8b6d0eab400337c2b2481
Instruction Fuzzy Hash: 4C31BEB1605702BFE760DEB5DC48A2A7BECFB44756B14496DA911F72A0DB38FC008B21

Function 033B2780 Relevance: 12.2, APIs: 8, Instructions: 207librarystringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(?), ref: 033B27D2
_malloc.LIBCMT ref: 033B282E
WideCharToMultiByte.KERNEL32(?,00000000,?,000000FF,00000008,?,00000000,00000000), ref: 033B285D
LoadLibraryExA.KERNEL32(00000000,00000000,00000002,-00000001,?,00000002,00000000), ref: 033B28A5
FindResourceA.KERNEL32(00000000,?,?), ref: 033B28C6
LoadResource.KERNEL32(00000000,00000000,?,00000002,00000000), ref: 033B28DE
SizeofResource.KERNEL32(00000000,00000000,?,00000002,00000000), ref: 033B28F7
FreeLibrary.KERNEL32(00000000,?,00000000), ref: 033B298A

Memory Dump Source

Source File: 00000014.00000002.2494020967.00000000033B1000.00000020.00000001.01000000.00000015.sdmp, Offset: 033B0000, based on PE: true

Associated: 00000014.00000002.2493917908.00000000033B0000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000014.00000002.2497615129.00000000033F3000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000014.00000002.2498110795.0000000003400000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000014.00000002.2498410969.0000000003406000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000014.00000002.2498556459.0000000003408000.00000008.00000001.01000000.00000015.sdmpDownload File
Associated: 00000014.00000002.2498718201.000000000340A000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000014.00000002.2499166516.0000000003411000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_33b0000_Picasa3.jbxd

Similarity

API ID: Resource$LibraryLoad$ByteCharFindFreeMultiSizeofWide_malloclstrlen
String ID:
API String ID: 2471754344-0
Opcode ID: 6aa69baad9a0589303bfa7f310e6e0f6a447dc5d0a9c4ee3349eb1aa9af1131e
Instruction ID: de40cfc312e734016cad8dbe56162622cae34a5a4a0ead76e19430ee8e81ad0e
Opcode Fuzzy Hash: 6aa69baad9a0589303bfa7f310e6e0f6a447dc5d0a9c4ee3349eb1aa9af1131e
Instruction Fuzzy Hash: E261D075E003499BDB20EBA48CC4BDFB7BDAF44310F180A29EA19EF654E7349944CB91

Function 033BB850 Relevance: 10.6, APIs: 7, Instructions: 112COMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,000000FF,00000000,00000000), ref: 033BB8A2
MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,000000FF,00000000,00000000), ref: 033BB8C0
MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,000000FF,?,00000000), ref: 033BB8DD
_memset.LIBCMT ref: 033BB8F4
FindFirstFileExW.KERNEL32(00000000,?,?,?,?,?), ref: 033BB91A
WideCharToMultiByte.KERNEL32(0000FDE9,00000000,?,000000FF,?,00000104,00000000,00000000), ref: 033BB957
WideCharToMultiByte.KERNEL32(0000FDE9,00000000,?,000000FF,?,0000000E,00000000,00000000), ref: 033BB976

Memory Dump Source

Source File: 00000014.00000002.2494020967.00000000033B1000.00000020.00000001.01000000.00000015.sdmp, Offset: 033B0000, based on PE: true

Associated: 00000014.00000002.2493917908.00000000033B0000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000014.00000002.2497615129.00000000033F3000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000014.00000002.2498110795.0000000003400000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000014.00000002.2498410969.0000000003406000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000014.00000002.2498556459.0000000003408000.00000008.00000001.01000000.00000015.sdmpDownload File
Associated: 00000014.00000002.2498718201.000000000340A000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000014.00000002.2499166516.0000000003411000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_33b0000_Picasa3.jbxd

Similarity

API ID: ByteCharMultiWide$FileFindFirst_memset
String ID:
API String ID: 188699313-0
Opcode ID: 3bb1302be81c646d650e219c02ba747654c3a322a761a2bf2481b3cde0bf001e
Instruction ID: 2e39b004b65ad3af36f260de6d966cdaac9acc2cee4f5ca91d16b94fe06e4a25
Opcode Fuzzy Hash: 3bb1302be81c646d650e219c02ba747654c3a322a761a2bf2481b3cde0bf001e
Instruction Fuzzy Hash: 06316C71A402596BE730EEA5DC81FEEB778EF49720F240225FA15AF2C0D6B06904CB95

Function 04038810 Relevance: 10.6, APIs: 7, Instructions: 112COMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,000000FF,00000000,00000000), ref: 04038862
MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,000000FF,00000000,00000000), ref: 04038880
MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,000000FF,?,00000000), ref: 0403889D
_memset.LIBCMT ref: 040388B4
FindFirstFileExW.KERNEL32(00000000,?,?,?,?,?), ref: 040388DA
WideCharToMultiByte.KERNEL32(0000FDE9,00000000,?,000000FF,?,00000104,00000000,00000000), ref: 04038917
WideCharToMultiByte.KERNEL32(0000FDE9,00000000,?,000000FF,?,0000000E,00000000,00000000), ref: 04038936

Memory Dump Source

Source File: 00000014.00000002.2502041842.0000000004031000.00000020.00000001.01000000.00000017.sdmp, Offset: 04030000, based on PE: true

Associated: 00000014.00000002.2501986218.0000000004030000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000014.00000002.2504208079.0000000004079000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000014.00000002.2504943590.0000000004086000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000014.00000002.2505148754.000000000408E000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000014.00000002.2505282171.0000000004090000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000014.00000002.2505501725.0000000004097000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_4030000_Picasa3.jbxd

Similarity

API ID: ByteCharMultiWide$FileFindFirst_memset
String ID:
API String ID: 188699313-0
Opcode ID: e75675f6aa81b9f784cad9ca12352e7de5b0f3300fdf802acbf4d4b8b7a7c073
Instruction ID: 141410510290d8c559222578d636117ae5942efa457a58f2de24b8e500d855d6
Opcode Fuzzy Hash: e75675f6aa81b9f784cad9ca12352e7de5b0f3300fdf802acbf4d4b8b7a7c073
Instruction Fuzzy Hash: 02319972A402596BFB30EEA5CC41FEE7768EF49724F244229FA157F2C0D6B039048B91

Function 033BB710 Relevance: 10.6, APIs: 7, Instructions: 102fileCOMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,000000FF,00000000,00000000), ref: 033BB759
MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,000000FF,00000000,00000000), ref: 033BB777
MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,000000FF,?,00000000), ref: 033BB794
_memset.LIBCMT ref: 033BB7AB
FindFirstFileW.KERNEL32(00000000,?), ref: 033BB7B8
WideCharToMultiByte.KERNEL32(0000FDE9,00000000,?,000000FF,?,00000104,00000000,00000000), ref: 033BB7F5
WideCharToMultiByte.KERNEL32(0000FDE9,00000000,?,000000FF,?,0000000E,00000000,00000000), ref: 033BB814

Memory Dump Source

Source File: 00000014.00000002.2494020967.00000000033B1000.00000020.00000001.01000000.00000015.sdmp, Offset: 033B0000, based on PE: true

Associated: 00000014.00000002.2493917908.00000000033B0000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000014.00000002.2497615129.00000000033F3000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000014.00000002.2498110795.0000000003400000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000014.00000002.2498410969.0000000003406000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000014.00000002.2498556459.0000000003408000.00000008.00000001.01000000.00000015.sdmpDownload File
Associated: 00000014.00000002.2498718201.000000000340A000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000014.00000002.2499166516.0000000003411000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_33b0000_Picasa3.jbxd

Similarity

API ID: ByteCharMultiWide$FileFindFirst_memset
String ID:
API String ID: 188699313-0
Opcode ID: a9f0f69f57588aefad3575395fbfeecf5451e21ff9b1152150ee24f5721df3a6
Instruction ID: bda084b94b906d84b1a94d688a79d154ffcf8b9e97811e05d654cbfe2674769f
Opcode Fuzzy Hash: a9f0f69f57588aefad3575395fbfeecf5451e21ff9b1152150ee24f5721df3a6
Instruction Fuzzy Hash: 49316A75A402147BE730EAA5DC85FEEB764EF49720F740325BA29BF1C0DAB06904CB95

Function 040386D0 Relevance: 10.6, APIs: 7, Instructions: 102fileCOMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,000000FF,00000000,00000000), ref: 04038719
MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,000000FF,00000000,00000000), ref: 04038737
MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,000000FF,?,00000000), ref: 04038754
_memset.LIBCMT ref: 0403876B
FindFirstFileW.KERNEL32(00000000,?), ref: 04038778
WideCharToMultiByte.KERNEL32(0000FDE9,00000000,?,000000FF,?,00000104,00000000,00000000), ref: 040387B5
WideCharToMultiByte.KERNEL32(0000FDE9,00000000,?,000000FF,?,0000000E,00000000,00000000), ref: 040387D4

Memory Dump Source

Source File: 00000014.00000002.2502041842.0000000004031000.00000020.00000001.01000000.00000017.sdmp, Offset: 04030000, based on PE: true

Associated: 00000014.00000002.2501986218.0000000004030000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000014.00000002.2504208079.0000000004079000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000014.00000002.2504943590.0000000004086000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000014.00000002.2505148754.000000000408E000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000014.00000002.2505282171.0000000004090000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000014.00000002.2505501725.0000000004097000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_4030000_Picasa3.jbxd

Similarity

API ID: ByteCharMultiWide$FileFindFirst_memset
String ID:
API String ID: 188699313-0
Opcode ID: be7cc698e83c3ef72f80c07b2d8d2e7ec7b7502f240d75ab65ad7195a5ff9439
Instruction ID: 70755169e99e9f82114abee1b32af7ab1298f6c30845ddb4d9a1bf724f05a7b6
Opcode Fuzzy Hash: be7cc698e83c3ef72f80c07b2d8d2e7ec7b7502f240d75ab65ad7195a5ff9439
Instruction Fuzzy Hash: 3A31B972A402146BFB30AAA5DC45FEE7764EF45724F304725BA29BF1C0D6B07904CB95

Function 048336A0 Relevance: 10.6, APIs: 7, Instructions: 102fileCOMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,000000FF,00000000,00000000), ref: 048336E9
MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,000000FF,00000000,00000000), ref: 04833707
MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,000000FF,?,00000000), ref: 04833724
_memset.LIBCMT ref: 0483373B
FindFirstFileW.KERNEL32(00000000,?), ref: 04833748
WideCharToMultiByte.KERNEL32(0000FDE9,00000000,?,000000FF,?,00000104,00000000,00000000), ref: 04833785
WideCharToMultiByte.KERNEL32(0000FDE9,00000000,?,000000FF,?,0000000E,00000000,00000000), ref: 048337A4

Memory Dump Source

Source File: 00000014.00000002.2526268174.00000000047E1000.00000020.00000001.01000000.00000016.sdmp, Offset: 047E0000, based on PE: true

Associated: 00000014.00000002.2526187657.00000000047E0000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000014.00000002.2533437740.000000000488F000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000014.00000002.2535246598.00000000048AB000.00000004.00000001.01000000.00000016.sdmpDownload File
Associated: 00000014.00000002.2535569716.00000000048B3000.00000008.00000001.01000000.00000016.sdmpDownload File
Associated: 00000014.00000002.2535640427.00000000048B5000.00000004.00000001.01000000.00000016.sdmpDownload File
Associated: 00000014.00000002.2536317728.00000000048C0000.00000002.00000001.01000000.00000016.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_47e0000_Picasa3.jbxd

Similarity

API ID: ByteCharMultiWide$FileFindFirst_memset
String ID:
API String ID: 188699313-0
Opcode ID: c8e07b4d3c78772a7b4d6c519d92dfbcdec9696c8a222e4c1782c1694cdf87a3
Instruction ID: 521f808e1611cff156cfe9883234a7eacae632c4d9b20457668e00b4bf4bd7ad
Opcode Fuzzy Hash: c8e07b4d3c78772a7b4d6c519d92dfbcdec9696c8a222e4c1782c1694cdf87a3
Instruction Fuzzy Hash: 5E318871A442186BF7309AA9DC45FEE7764EB45720F340729BB24BB1C0DBB07904CB95

Function 04036450 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 45windowCOMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(00000000,?,0404064D), ref: 04036459
FormatMessageA.KERNEL32(00001300,00000000,00000000,00000400,00000000,00000000,00000000,?,0404064D), ref: 04036479

Part of subcall function 04037DD0: EnterCriticalSection.KERNEL32(040923C4,00000001,00000000,00000000,?,?,04042FE3,January,00000000,?,040360D0), ref: 04037E03
Part of subcall function 04037DD0: InterlockedIncrement.KERNEL32(00000000), ref: 04037E77
Part of subcall function 04037DD0: InterlockedIncrement.KERNEL32(00000000), ref: 04037E94

LocalFree.KERNEL32(?), ref: 040364CB

Strings

Error, xrefs: 0403648C
ytApp::ErrorTitle, xrefs: 04036487

Memory Dump Source

Source File: 00000014.00000002.2502041842.0000000004031000.00000020.00000001.01000000.00000017.sdmp, Offset: 04030000, based on PE: true

Associated: 00000014.00000002.2501986218.0000000004030000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000014.00000002.2504208079.0000000004079000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000014.00000002.2504943590.0000000004086000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000014.00000002.2505148754.000000000408E000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000014.00000002.2505282171.0000000004090000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000014.00000002.2505501725.0000000004097000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_4030000_Picasa3.jbxd

Similarity

API ID: IncrementInterlocked$CriticalEnterErrorFormatFreeLastLocalMessageSection
String ID: Error$ytApp::ErrorTitle
API String ID: 3250743246-2857558516
Opcode ID: 82e3fc8a73a4138f3c20f4d548c52246d2a1180218c3e35a2b081a29da4d53b5
Instruction ID: 41a72d9456e9d44659a65b0ac89210699a68c2505a7a987ff8b801114d8f6955
Opcode Fuzzy Hash: 82e3fc8a73a4138f3c20f4d548c52246d2a1180218c3e35a2b081a29da4d53b5
Instruction Fuzzy Hash: EB01D6B2A502007BF6146F64DC45F973BECDB4471AF008828BA41F6181DA3DFC008666

Function 033C0100 Relevance: 7.9, APIs: 5, Instructions: 361threadCOMMON

Download Yara Rule

APIs

WaitForMultipleObjects.KERNEL32(00000002,?,00000000,000000FF), ref: 033C013F
GetCurrentThreadId.KERNEL32 ref: 033C015D
EnterCriticalSection.KERNEL32(?), ref: 033C0180
GetCurrentThreadId.KERNEL32 ref: 033C0483
LeaveCriticalSection.KERNEL32(?), ref: 033C04A5

Memory Dump Source

Source File: 00000014.00000002.2494020967.00000000033B1000.00000020.00000001.01000000.00000015.sdmp, Offset: 033B0000, based on PE: true

Associated: 00000014.00000002.2493917908.00000000033B0000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000014.00000002.2497615129.00000000033F3000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000014.00000002.2498110795.0000000003400000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000014.00000002.2498410969.0000000003406000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000014.00000002.2498556459.0000000003408000.00000008.00000001.01000000.00000015.sdmpDownload File
Associated: 00000014.00000002.2498718201.000000000340A000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000014.00000002.2499166516.0000000003411000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_33b0000_Picasa3.jbxd

Similarity

API ID: CriticalCurrentSectionThread$EnterLeaveMultipleObjectsWait
String ID:
API String ID: 2097877875-0
Opcode ID: dcafafedb50a0be0d63798fae55e95965f83a4da017a919f62b60f21b6f81a0a
Instruction ID: f4bd13c2b1c13d1aac6018f06b821267a570e241bf21f36d8aac5fe5c0f827d5
Opcode Fuzzy Hash: dcafafedb50a0be0d63798fae55e95965f83a4da017a919f62b60f21b6f81a0a
Instruction Fuzzy Hash: FCD102B5A242C1DFDB1CCF18C8C47AAB7A9BF84314F18826CE9568B685E735DC44CB81

Function 04044810 Relevance: 7.9, APIs: 5, Instructions: 361threadCOMMON

Download Yara Rule

APIs

WaitForMultipleObjects.KERNEL32(00000002,?,00000000,000000FF), ref: 0404484F
GetCurrentThreadId.KERNEL32 ref: 0404486D
EnterCriticalSection.KERNEL32(?), ref: 04044890
GetCurrentThreadId.KERNEL32 ref: 04044B93
LeaveCriticalSection.KERNEL32(?), ref: 04044BB5

Memory Dump Source

Source File: 00000014.00000002.2502041842.0000000004031000.00000020.00000001.01000000.00000017.sdmp, Offset: 04030000, based on PE: true

Associated: 00000014.00000002.2501986218.0000000004030000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000014.00000002.2504208079.0000000004079000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000014.00000002.2504943590.0000000004086000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000014.00000002.2505148754.000000000408E000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000014.00000002.2505282171.0000000004090000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000014.00000002.2505501725.0000000004097000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_4030000_Picasa3.jbxd

Similarity

API ID: CriticalCurrentSectionThread$EnterLeaveMultipleObjectsWait
String ID:
API String ID: 2097877875-0
Opcode ID: 31f368229d4fc693adb0c3af9f348d75e2ab14683a5615b8b23a2555f843195a
Instruction ID: aaf44a8ad1c073c515033b2b2542deb4854368af60cbda7d8dc4db160e2783e1
Opcode Fuzzy Hash: 31f368229d4fc693adb0c3af9f348d75e2ab14683a5615b8b23a2555f843195a
Instruction Fuzzy Hash: D5D1E1F1A042019FEB54DF68D884769B7E5BFC4318F148678EC46AB285E739F854CB82

Function 1000102A Relevance: 7.6, APIs: 5, Instructions: 57COMMONLIBRARYCODE

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32 ref: 100013E2
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 100013F7
UnhandledExceptionFilter.KERNEL32(10008150), ref: 10001402
GetCurrentProcess.KERNEL32(C0000409), ref: 1000141E
TerminateProcess.KERNEL32(00000000), ref: 10001425

Memory Dump Source

Source File: 00000014.00000002.2599543268.0000000010001000.00000020.00000001.01000000.00000014.sdmp, Offset: 10000000, based on PE: true

Associated: 00000014.00000002.2599497758.0000000010000000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000014.00000002.2599698862.0000000010008000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000014.00000002.2599759208.000000001000A000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000014.00000002.2599824731.000000001000C000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000014.00000002.2599824731.0000000010A0C000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000014.00000002.2599824731.000000001140C000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_10000000_Picasa3.jbxd

Similarity

API ID: ExceptionFilterProcessUnhandled$CurrentDebuggerPresentTerminate
String ID:
API String ID: 2579439406-0
Opcode ID: efd9edc3cc7224faa584ec0678f99a151fd08ef970b0146f77a5f7907ff55cba
Instruction ID: aa823f07c3e4643ba665683593d98a0e33f6ef9f3c07eadce98db9b2fc41adcf
Opcode Fuzzy Hash: efd9edc3cc7224faa584ec0678f99a151fd08ef970b0146f77a5f7907ff55cba
Instruction Fuzzy Hash: 6F21AFB4811225DFF740DF24CDC8A483BB4FB4A396F50422BE50A86A68E7B456C4DF45

Function 033DC711 Relevance: 7.6, APIs: 5, Instructions: 57COMMONLIBRARYCODE

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32 ref: 033DFF6F
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 033DFF84
UnhandledExceptionFilter.KERNEL32(033F37A8), ref: 033DFF8F
GetCurrentProcess.KERNEL32(C0000409), ref: 033DFFAB
TerminateProcess.KERNEL32(00000000), ref: 033DFFB2

Memory Dump Source

Source File: 00000014.00000002.2494020967.00000000033B1000.00000020.00000001.01000000.00000015.sdmp, Offset: 033B0000, based on PE: true

Associated: 00000014.00000002.2493917908.00000000033B0000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000014.00000002.2497615129.00000000033F3000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000014.00000002.2498110795.0000000003400000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000014.00000002.2498410969.0000000003406000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000014.00000002.2498556459.0000000003408000.00000008.00000001.01000000.00000015.sdmpDownload File
Associated: 00000014.00000002.2498718201.000000000340A000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000014.00000002.2499166516.0000000003411000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_33b0000_Picasa3.jbxd

Similarity

API ID: ExceptionFilterProcessUnhandled$CurrentDebuggerPresentTerminate
String ID:
API String ID: 2579439406-0
Opcode ID: a267d7ac27ca4093ff658ab979202f10d9d7437681d685a937c177020f83bdb6
Instruction ID: f1fc5c85e30ef1556cf72d40fd09ed27726a67f8d182a452b6ff1aa10b93163c
Opcode Fuzzy Hash: a267d7ac27ca4093ff658ab979202f10d9d7437681d685a937c177020f83bdb6
Instruction Fuzzy Hash: 0A21E0B9A10308DFD709FF14F684A547BF8FB08319F50005AE609AA389E3F1D9818F88

Function 040610AC Relevance: 7.6, APIs: 5, Instructions: 57COMMONLIBRARYCODE

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32 ref: 040644AE
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 040644C3
UnhandledExceptionFilter.KERNEL32(04079768), ref: 040644CE
GetCurrentProcess.KERNEL32(C0000409), ref: 040644EA
TerminateProcess.KERNEL32(00000000), ref: 040644F1

Memory Dump Source

Source File: 00000014.00000002.2502041842.0000000004031000.00000020.00000001.01000000.00000017.sdmp, Offset: 04030000, based on PE: true

Associated: 00000014.00000002.2501986218.0000000004030000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000014.00000002.2504208079.0000000004079000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000014.00000002.2504943590.0000000004086000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000014.00000002.2505148754.000000000408E000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000014.00000002.2505282171.0000000004090000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000014.00000002.2505501725.0000000004097000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_4030000_Picasa3.jbxd

Similarity

API ID: ExceptionFilterProcessUnhandled$CurrentDebuggerPresentTerminate
String ID:
API String ID: 2579439406-0
Opcode ID: f50c55cce3a731fa41f6a8cfb07ba4dc8ec36834b4e4ca03ed0a80f55fba9082
Instruction ID: 804941484fd4f3762e5f903bbef993e3e14dab1e74f10fc446acf60693977dad
Opcode Fuzzy Hash: f50c55cce3a731fa41f6a8cfb07ba4dc8ec36834b4e4ca03ed0a80f55fba9082
Instruction Fuzzy Hash: 6821C0B8A0030ADBF741DF25E548A857BF4FB08344F504079E80ABA280EB7D6D81DF46

Function 0480B510 Relevance: 6.4, APIs: 4, Instructions: 357windowCOMMON

Download Yara Rule

APIs

SendMessageA.USER32 ref: 0480B559
SendMessageA.USER32(00000000,00001074,00000000,00000001), ref: 0480B5C7

Part of subcall function 0482D480: MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,000000FF,00000000,00000000,?,?,00000000,?,0483DB48,00000000,?,?,?,?), ref: 0482D4A1
Part of subcall function 0482D480: MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,000000FF,-00000004,00000000,?,00000000,00000000,?,0483DB48,00000000,?,?,?,?), ref: 0482D4CE

InterlockedIncrement.KERNEL32(00000000), ref: 0480B6E7

Memory Dump Source

Source File: 00000014.00000002.2526268174.00000000047E1000.00000020.00000001.01000000.00000016.sdmp, Offset: 047E0000, based on PE: true

Associated: 00000014.00000002.2526187657.00000000047E0000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000014.00000002.2533437740.000000000488F000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000014.00000002.2535246598.00000000048AB000.00000004.00000001.01000000.00000016.sdmpDownload File
Associated: 00000014.00000002.2535569716.00000000048B3000.00000008.00000001.01000000.00000016.sdmpDownload File
Associated: 00000014.00000002.2535640427.00000000048B5000.00000004.00000001.01000000.00000016.sdmpDownload File
Associated: 00000014.00000002.2536317728.00000000048C0000.00000002.00000001.01000000.00000016.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_47e0000_Picasa3.jbxd

Similarity

API ID: ByteCharMessageMultiSendWide$IncrementInterlocked
String ID:
API String ID: 3535660883-0
Opcode ID: 1e5c311b035dc89bd53aec21ae092037c2448e5453b443523089207f56c74aaf
Instruction ID: b5c4933756e4c5ac7e0373d650efad1d73e22fd26e8452b47b9dccdd751eed48
Opcode Fuzzy Hash: 1e5c311b035dc89bd53aec21ae092037c2448e5453b443523089207f56c74aaf
Instruction Fuzzy Hash: 6BC1AE72A243158BEB60DFA8CC4076A77E1AF84384F058F29E955DB390EB75F901CB81

Function 04041930 Relevance: 6.1, APIs: 4, Instructions: 74windowCOMMON

Download Yara Rule

APIs

IsIconic.USER32(?), ref: 04041944
ShowWindow.USER32(?,00000009,?,?,040334EB,00000000), ref: 04041954
DialogBoxIndirectParamW.USER32(00000000,?,?,04041A10,?), ref: 040419D0
GlobalFree.KERNEL32(?), ref: 040419DA

Memory Dump Source

Source File: 00000014.00000002.2502041842.0000000004031000.00000020.00000001.01000000.00000017.sdmp, Offset: 04030000, based on PE: true

Associated: 00000014.00000002.2501986218.0000000004030000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000014.00000002.2504208079.0000000004079000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000014.00000002.2504943590.0000000004086000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000014.00000002.2505148754.000000000408E000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000014.00000002.2505282171.0000000004090000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000014.00000002.2505501725.0000000004097000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_4030000_Picasa3.jbxd

Similarity

API ID: DialogFreeGlobalIconicIndirectParamShowWindow
String ID:
API String ID: 3029972572-0
Opcode ID: e6f2ae2d78598f5812b91369443f9b73a2deef2c7ca8653b6205ee4694096170
Instruction ID: 59070e13a16be98594cb055a21b9708bbafee078be28722385abecb9f6d6b2ba
Opcode Fuzzy Hash: e6f2ae2d78598f5812b91369443f9b73a2deef2c7ca8653b6205ee4694096170
Instruction Fuzzy Hash: BF213EB2604610BBD720DFA9D908A57B7E8EB847657004D2EE596FB244DA38FC80CB61

Function 0483F400 Relevance: 6.1, APIs: 4, Instructions: 74windowCOMMON

Download Yara Rule

APIs

IsIconic.USER32(?), ref: 0483F414
ShowWindow.USER32(?,00000009), ref: 0483F424
DialogBoxIndirectParamW.USER32(00000000,?,?,0483F4E0,?), ref: 0483F4A0
GlobalFree.KERNEL32(?), ref: 0483F4AA

Memory Dump Source

Source File: 00000014.00000002.2526268174.00000000047E1000.00000020.00000001.01000000.00000016.sdmp, Offset: 047E0000, based on PE: true

Associated: 00000014.00000002.2526187657.00000000047E0000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000014.00000002.2533437740.000000000488F000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000014.00000002.2535246598.00000000048AB000.00000004.00000001.01000000.00000016.sdmpDownload File
Associated: 00000014.00000002.2535569716.00000000048B3000.00000008.00000001.01000000.00000016.sdmpDownload File
Associated: 00000014.00000002.2535640427.00000000048B5000.00000004.00000001.01000000.00000016.sdmpDownload File
Associated: 00000014.00000002.2536317728.00000000048C0000.00000002.00000001.01000000.00000016.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_47e0000_Picasa3.jbxd

Similarity

API ID: DialogFreeGlobalIconicIndirectParamShowWindow
String ID:
API String ID: 3029972572-0
Opcode ID: 023a8a50bc07312b40bf195b5a3e5658f9dd5275145b53dc1b9762cd0fc9631f
Instruction ID: 65a1b2561f7492466e19554096fcddd7786db3d21e47f0964ee68d3c47285a47
Opcode Fuzzy Hash: 023a8a50bc07312b40bf195b5a3e5658f9dd5275145b53dc1b9762cd0fc9631f
Instruction Fuzzy Hash: B3213C75A04600AFD720EF69E808A1777A8EB94A25B008E1EEB55D7250D6B8FC458BE1

Function 04820580 Relevance: 3.1, APIs: 2, Instructions: 53timeCOMMON

Download Yara Rule

APIs

__time64.LIBCMT ref: 048205C6
GetTimeZoneInformation.KERNEL32 ref: 048205DC

Memory Dump Source

Source File: 00000014.00000002.2526268174.00000000047E1000.00000020.00000001.01000000.00000016.sdmp, Offset: 047E0000, based on PE: true

Associated: 00000014.00000002.2526187657.00000000047E0000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000014.00000002.2533437740.000000000488F000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000014.00000002.2535246598.00000000048AB000.00000004.00000001.01000000.00000016.sdmpDownload File
Associated: 00000014.00000002.2535569716.00000000048B3000.00000008.00000001.01000000.00000016.sdmpDownload File
Associated: 00000014.00000002.2535640427.00000000048B5000.00000004.00000001.01000000.00000016.sdmpDownload File
Associated: 00000014.00000002.2536317728.00000000048C0000.00000002.00000001.01000000.00000016.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_47e0000_Picasa3.jbxd

Similarity

API ID: InformationTimeZone__time64
String ID:
API String ID: 1623792584-0
Opcode ID: 1e2f3a63e0ed445253d15f67601872a481a540f548112ad4616a8b5c3c30cb47
Instruction ID: db6cbcc5a9de4528f3bafb09b1c0913b962baeae3e867ba4ff220b1dd4e3949c
Opcode Fuzzy Hash: 1e2f3a63e0ed445253d15f67601872a481a540f548112ad4616a8b5c3c30cb47
Instruction Fuzzy Hash: FE112171A092119BE728DB28D951F6FB3E1AF88314F448A2DE54DC7241E678E954CB83

Function 033B3B20 Relevance: 47.7, APIs: 23, Strings: 4, Instructions: 442registrystringCOMMON

Download Yara Rule

APIs

lstrcmpiA.KERNEL32(033B2987,Delete), ref: 033B3B94
lstrcmpiA.KERNEL32(033B2987,ForceRemove), ref: 033B3BA5
CharNextA.USER32(033B2987,033B2987), ref: 033B3BE1
lstrcmpiA.KERNEL32(033B2987,033B2987), ref: 033B3BFC
lstrcmpiA.KERNEL32(033B2987,NoRemove), ref: 033B3C4F
lstrcmpiA.KERNEL32(033B2987,Val), ref: 033B3C77
lstrlenA.KERNEL32(033B2987,033B2987,?), ref: 033B3CF1
RegOpenKeyExA.ADVAPI32(?,00000000,00000000,00020006,00000000,033B2987,?), ref: 033B3D65
RegDeleteValueA.ADVAPI32(?,?), ref: 033B3D80
RegCloseKey.ADVAPI32(?), ref: 033B3D98
CharNextA.USER32(033B2987), ref: 033B3DBA
RegOpenKeyExA.ADVAPI32(?,033B2987,00000000,0002001F,?), ref: 033B3DF0
RegCloseKey.ADVAPI32(033B2987), ref: 033B3E05
RegOpenKeyExA.ADVAPI32(?,033B2987,00000000,00020019,?), ref: 033B3E31
RegCloseKey.ADVAPI32(033B2987), ref: 033B3E44
RegOpenKeyExA.ADVAPI32(?,033B2987,00000000,00020019,?), ref: 033B3EB6
RegCloseKey.ADVAPI32(033B2987), ref: 033B3ECB
lstrlenA.KERNEL32(033B2987,033B2987), ref: 033B3F28
RegCloseKey.ADVAPI32(033B2987,033B2987), ref: 033B3F92
RegCloseKey.ADVAPI32(?,033B2987), ref: 033B4011
RegDeleteKeyA.ADVAPI32(?,?), ref: 033B4043
RegCloseKey.ADVAPI32(033B2987), ref: 033B405F
RegCloseKey.ADVAPI32(?), ref: 033B4091

Strings

Val, xrefs: 033B3C71
Delete, xrefs: 033B3B86
ForceRemove, xrefs: 033B3B9A
NoRemove, xrefs: 033B3C49

Memory Dump Source

Source File: 00000014.00000002.2494020967.00000000033B1000.00000020.00000001.01000000.00000015.sdmp, Offset: 033B0000, based on PE: true

Associated: 00000014.00000002.2493917908.00000000033B0000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000014.00000002.2497615129.00000000033F3000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000014.00000002.2498110795.0000000003400000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000014.00000002.2498410969.0000000003406000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000014.00000002.2498556459.0000000003408000.00000008.00000001.01000000.00000015.sdmpDownload File
Associated: 00000014.00000002.2498718201.000000000340A000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000014.00000002.2499166516.0000000003411000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_33b0000_Picasa3.jbxd

Similarity

API ID: Close$lstrcmpi$Open$CharDeleteNextlstrlen$Value
String ID: Delete$ForceRemove$NoRemove$Val
API String ID: 1659507741-1781481701
Opcode ID: 8cd9d86630cc0fa55561f76bf72f3874637b2639dc4d9c3e38932ba1a70d3434
Instruction ID: 3b5d39c684de727477428a202dd8b799028dd54e9c7accb397fc8366577eb9e7
Opcode Fuzzy Hash: 8cd9d86630cc0fa55561f76bf72f3874637b2639dc4d9c3e38932ba1a70d3434
Instruction Fuzzy Hash: 29E16079A043269FD724DE64DCD4AAFB7F8EF84760F080A1DFA859B640D734D9048B92

Function 0403E430 Relevance: 45.9, APIs: 23, Strings: 3, Instructions: 416COMMON

Download Yara Rule

APIs

Part of subcall function 0403DE60: QueryPerformanceCounter.KERNEL32(?,?,00000000,?,?,0403209B,?,tivo,?,tivo,?,tivo), ref: 0403DE98
Part of subcall function 0403DE60: QueryPerformanceFrequency.KERNEL32(?,?,00000000,?,?,0403209B,?,tivo,?,tivo,?,tivo), ref: 0403DEB2

InterlockedIncrement.KERNEL32(00000000), ref: 0403E4C8
InterlockedDecrement.KERNEL32(?), ref: 0403E56E
InterlockedIncrement.KERNEL32(?), ref: 0403E58B
InterlockedDecrement.KERNEL32(?), ref: 0403E5DF
InterlockedIncrement.KERNEL32(?), ref: 0403E5F6
InterlockedDecrement.KERNEL32(?), ref: 0403E63C
InterlockedIncrement.KERNEL32(?), ref: 0403E653
InterlockedDecrement.KERNEL32(?), ref: 0403E699
InterlockedIncrement.KERNEL32(?), ref: 0403E6B0
InterlockedDecrement.KERNEL32(?), ref: 0403E6F3
InterlockedDecrement.KERNEL32(?), ref: 0403E792
InterlockedIncrement.KERNEL32(?), ref: 0403E7B2
InterlockedDecrement.KERNEL32(?), ref: 0403E7D5
InterlockedIncrement.KERNEL32(?), ref: 0403E7ED
InterlockedDecrement.KERNEL32(00000000), ref: 0403E81C
InterlockedIncrement.KERNEL32(00000000), ref: 0403E833
InterlockedDecrement.KERNEL32(?), ref: 0403E862
InterlockedIncrement.KERNEL32(?), ref: 0403E87A
InterlockedIncrement.KERNEL32(?), ref: 0403E70A

Part of subcall function 04035550: GetCurrentThreadId.KERNEL32 ref: 04035571
Part of subcall function 04035550: GetCurrentThreadId.KERNEL32 ref: 04035659

InterlockedDecrement.KERNEL32(?), ref: 0403E8C8
InterlockedIncrement.KERNEL32(?), ref: 0403E8DF
InterlockedDecrement.KERNEL32(?), ref: 0403E90E
InterlockedIncrement.KERNEL32(?), ref: 0403E926

Strings

%s_%d, xrefs: 0403E757
`ruru, xrefs: 0403E511
tempdir, xrefs: 0403E456, 0403E47B

Memory Dump Source

Source File: 00000014.00000002.2502041842.0000000004031000.00000020.00000001.01000000.00000017.sdmp, Offset: 04030000, based on PE: true

Associated: 00000014.00000002.2501986218.0000000004030000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000014.00000002.2504208079.0000000004079000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000014.00000002.2504943590.0000000004086000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000014.00000002.2505148754.000000000408E000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000014.00000002.2505282171.0000000004090000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000014.00000002.2505501725.0000000004097000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_4030000_Picasa3.jbxd

Similarity

API ID: Interlocked$Increment$Decrement$CurrentPerformanceQueryThread$CounterFrequency
String ID: %s_%d$`ruru$tempdir
API String ID: 962852316-157827906
Opcode ID: 491ffec4778c6351107c6f4c304baa09d6036b9e6649d8e1dcc0dad4515ff45b
Instruction ID: f5e2e691a129d1badeba31b6a45cb81baa6e9c6e30561f0ad595f4becb12b14a
Opcode Fuzzy Hash: 491ffec4778c6351107c6f4c304baa09d6036b9e6649d8e1dcc0dad4515ff45b
Instruction Fuzzy Hash: 80D1CBB2A0425246F770AE20DC507BE7EDDAF42356F180A35E885F7181FA2CFA0597D6

Function 033BCD90 Relevance: 36.4, APIs: 24, Instructions: 448windowCOMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,000000FF,00000000,00000000), ref: 033BCDFF
MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,000000FF,?,00000000), ref: 033BCE3B
MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,000000FF,00000000,00000000), ref: 033BCE77
MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,000000FF,?,00000000), ref: 033BCEB7
SendMessageW.USER32(?,?,?,?), ref: 033BCEE7
MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,000000FF,00000000,00000000), ref: 033BCF2D
MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,000000FF,00000000,00000000), ref: 033BCF4E
MultiByteToWideChar.KERNEL32(0000FDE9,00000000,00000000,000000FF,00000000,00000000), ref: 033BCF85
MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,000000FF,00000000,00000000), ref: 033BD014
MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,000000FF,00000000,00000000), ref: 033BD035
MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,000000FF,00000000,00000000), ref: 033BD06C
SendMessageW.USER32(00000000,-000020A0,?,?), ref: 033BD0EE
WideCharToMultiByte.KERNEL32(0000FDE9,00000000,00000000,000000FF,00001061,?,00000000,00000000), ref: 033BD117
MultiByteToWideChar.KERNEL32(0000FDE9,00000000,00001061,000000FF,00000000,00000000), ref: 033BD161
MultiByteToWideChar.KERNEL32(0000FDE9,00000000,00001061,000000FF,00000000,00000000), ref: 033BD182
MultiByteToWideChar.KERNEL32(0000FDE9,00000000,00000000,000000FF,00000000,00000000), ref: 033BD1B9
MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,000000FF,00000000,00000000), ref: 033BD1F9
MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,000000FF,00000000,00000000), ref: 033BD21A
MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,000000FF,00000000,00000000), ref: 033BD251
MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,000000FF,00000000,00000000), ref: 033BD290
MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,000000FF,00000000,00000000), ref: 033BD2B1
MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,000000FF,00000000,00000000), ref: 033BD2E8

Memory Dump Source

Source File: 00000014.00000002.2494020967.00000000033B1000.00000020.00000001.01000000.00000015.sdmp, Offset: 033B0000, based on PE: true

Associated: 00000014.00000002.2493917908.00000000033B0000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000014.00000002.2497615129.00000000033F3000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000014.00000002.2498110795.0000000003400000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000014.00000002.2498410969.0000000003406000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000014.00000002.2498556459.0000000003408000.00000008.00000001.01000000.00000015.sdmpDownload File
Associated: 00000014.00000002.2498718201.000000000340A000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000014.00000002.2499166516.0000000003411000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_33b0000_Picasa3.jbxd

Similarity

API ID: ByteCharMultiWide$MessageSend
String ID:
API String ID: 2091379346-0
Opcode ID: d3c1c565f1708a6c62d786f1bb005565bb872e6e4fdce171dc583ef71db7dad6
Instruction ID: ffff399d199e61ae3ce6daba51510e4d8049b6a66ec14d67237a8ebcbdafdd95
Opcode Fuzzy Hash: d3c1c565f1708a6c62d786f1bb005565bb872e6e4fdce171dc583ef71db7dad6
Instruction Fuzzy Hash: D8F17E74644206FBE730DE65CCD5FA9B7B8AB04720F284225B625AFAD4C7B4F940CB91

Function 04039D50 Relevance: 36.4, APIs: 24, Instructions: 448windowCOMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,000000FF,00000000,00000000), ref: 04039DBF
MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,000000FF,?,00000000), ref: 04039DFB
MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,000000FF,00000000,00000000), ref: 04039E37
MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,000000FF,?,00000000), ref: 04039E77
SendMessageW.USER32(?,?,?,?), ref: 04039EA7
MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,000000FF,00000000,00000000), ref: 04039EED
MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,000000FF,00000000,00000000), ref: 04039F0E
MultiByteToWideChar.KERNEL32(0000FDE9,00000000,00000000,000000FF,00000000,00000000), ref: 04039F45
MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,000000FF,00000000,00000000), ref: 04039FD4
MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,000000FF,00000000,00000000), ref: 04039FF5
MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,000000FF,00000000,00000000), ref: 0403A02C
SendMessageW.USER32(00000000,-000020A0,?,?), ref: 0403A0AE
WideCharToMultiByte.KERNEL32(0000FDE9,00000000,00000000,000000FF,00001061,?,00000000,00000000), ref: 0403A0D7
MultiByteToWideChar.KERNEL32(0000FDE9,00000000,00001061,000000FF,00000000,00000000), ref: 0403A121
MultiByteToWideChar.KERNEL32(0000FDE9,00000000,00001061,000000FF,00000000,00000000), ref: 0403A142
MultiByteToWideChar.KERNEL32(0000FDE9,00000000,00000000,000000FF,00000000,00000000), ref: 0403A179
MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,000000FF,00000000,00000000), ref: 0403A1B9
MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,000000FF,00000000,00000000), ref: 0403A1DA
MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,000000FF,00000000,00000000), ref: 0403A211
MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,000000FF,00000000,00000000), ref: 0403A250
MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,000000FF,00000000,00000000), ref: 0403A271
MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,000000FF,00000000,00000000), ref: 0403A2A8

Memory Dump Source

Source File: 00000014.00000002.2502041842.0000000004031000.00000020.00000001.01000000.00000017.sdmp, Offset: 04030000, based on PE: true

Associated: 00000014.00000002.2501986218.0000000004030000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000014.00000002.2504208079.0000000004079000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000014.00000002.2504943590.0000000004086000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000014.00000002.2505148754.000000000408E000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000014.00000002.2505282171.0000000004090000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000014.00000002.2505501725.0000000004097000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_4030000_Picasa3.jbxd

Similarity

API ID: ByteCharMultiWide$MessageSend
String ID:
API String ID: 2091379346-0
Opcode ID: 6e263d297446844a7aba13d0d9559c6f2820c9b9a52dadaa00fad3de46972bbf
Instruction ID: 20a98bf435ff02fc130fde2ec1242e531610f8df49cbd16d5dad7293ca9a0af4
Opcode Fuzzy Hash: 6e263d297446844a7aba13d0d9559c6f2820c9b9a52dadaa00fad3de46972bbf
Instruction Fuzzy Hash: 4BF18FB0704206BBFB20DE55CC81FAA7BA8EF05725F244625B525BB2C0D7B4B940DB92

Function 0481B5D0 Relevance: 36.3, APIs: 24, Instructions: 309COMMON

Download Yara Rule

APIs

InterlockedDecrement.KERNEL32(?), ref: 0481B617
InterlockedIncrement.KERNEL32(?), ref: 0481B62F
InterlockedDecrement.KERNEL32(?), ref: 0481B679
InterlockedIncrement.KERNEL32(?), ref: 0481B691
InterlockedDecrement.KERNEL32(?), ref: 0481B6FB
InterlockedIncrement.KERNEL32(?), ref: 0481B713

Part of subcall function 0481BED0: InternetSetOptionA.WININET ref: 0481BF06
Part of subcall function 0481BED0: InternetQueryOptionA.WININET(00000000,00000032,00000032,00000008), ref: 0481BF1A

InterlockedDecrement.KERNEL32(?), ref: 0481B75D
InterlockedIncrement.KERNEL32(?), ref: 0481B775
InterlockedDecrement.KERNEL32(?), ref: 0481B7BF
InterlockedIncrement.KERNEL32(?), ref: 0481B7D7
InterlockedDecrement.KERNEL32(?), ref: 0481B821
InterlockedIncrement.KERNEL32(?), ref: 0481B839
InterlockedDecrement.KERNEL32(?), ref: 0481B883
InterlockedIncrement.KERNEL32(?), ref: 0481B89B
InterlockedDecrement.KERNEL32(?), ref: 0481B8E2
InterlockedIncrement.KERNEL32(?), ref: 0481B8FA
DeleteCriticalSection.KERNEL32(?,?,0526DCC8,?,00000000,0481BCA6,0526DCC8), ref: 0481B94D
CloseHandle.KERNEL32(?,?,0526DCC8,?,00000000,0481BCA6,0526DCC8), ref: 0481B957
InterlockedDecrement.KERNEL32(?), ref: 0481B976
InterlockedIncrement.KERNEL32(?), ref: 0481B98D
FreeLibrary.KERNEL32(?,?,0526DCC8,?,00000000,0481BCA6,0526DCC8), ref: 0481B9CB
FreeLibrary.KERNEL32(?,?,0526DCC8,?,00000000,0481BCA6,0526DCC8), ref: 0481B9D5
FreeLibrary.KERNEL32(?,?,0526DCC8,?,00000000,0481BCA6,0526DCC8), ref: 0481B9DF
FreeLibrary.KERNEL32(?,?,0526DCC8,?,00000000,0481BCA6,0526DCC8), ref: 0481B9E9

Memory Dump Source

Source File: 00000014.00000002.2526268174.00000000047E1000.00000020.00000001.01000000.00000016.sdmp, Offset: 047E0000, based on PE: true

Associated: 00000014.00000002.2526187657.00000000047E0000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000014.00000002.2533437740.000000000488F000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000014.00000002.2535246598.00000000048AB000.00000004.00000001.01000000.00000016.sdmpDownload File
Associated: 00000014.00000002.2535569716.00000000048B3000.00000008.00000001.01000000.00000016.sdmpDownload File
Associated: 00000014.00000002.2535640427.00000000048B5000.00000004.00000001.01000000.00000016.sdmpDownload File
Associated: 00000014.00000002.2536317728.00000000048C0000.00000002.00000001.01000000.00000016.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_47e0000_Picasa3.jbxd

Similarity

API ID: Interlocked$DecrementIncrement$FreeLibrary$InternetOption$CloseCriticalDeleteHandleQuerySection
String ID:
API String ID: 3793541432-0
Opcode ID: 2e54e704d54b444468e470eb14e8220c060c0465247454845d756c90dfa3b9ea
Instruction ID: 0379b2a909921a39c649280da4b13eae165390739e11de26d8d21c8e5654aaab
Opcode Fuzzy Hash: 2e54e704d54b444468e470eb14e8220c060c0465247454845d756c90dfa3b9ea
Instruction Fuzzy Hash: 2BB1B7B25001A54BFB319F20CC90BBE379DAF01754F144E3AE989DA292D73CF601A795

Function 033E01C9 Relevance: 33.4, APIs: 15, Strings: 4, Instructions: 156fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

_strcpy_s.LIBCMT ref: 033E0235
__invoke_watson.LIBCMT ref: 033E0246
GetModuleFileNameA.KERNEL32(00000000,0340C119,00000104,?,033DC7F4,?), ref: 033E0262
_strcpy_s.LIBCMT ref: 033E0277
__invoke_watson.LIBCMT ref: 033E028A
_strlen.LIBCMT ref: 033E0293
_strlen.LIBCMT ref: 033E02A0
__invoke_watson.LIBCMT ref: 033E02CD
_strcat_s.LIBCMT ref: 033E02E0
__invoke_watson.LIBCMT ref: 033E02F1
_strcat_s.LIBCMT ref: 033E0302
__invoke_watson.LIBCMT ref: 033E0313
GetStdHandle.KERNEL32(000000F4,?,00000001,?,00000000,00000003,033E0395,000000FC,033E0E0B,033FDC40,0000000C,033E0EC6,033DC7F4,?,?,033E7C2A), ref: 033E0332
_strlen.LIBCMT ref: 033E0353
WriteFile.KERNEL32(00000000,00000000,00000000,033DC7F4,00000000,?,00000001,?,00000000,00000003,033E0395,000000FC,033E0E0B,033FDC40,0000000C,033E0EC6), ref: 033E035D

Strings

<program name unknown>, xrefs: 033E026C
Runtime Error!Program: , xrefs: 033E0224
..., xrefs: 033E02B1
Microsoft Visual C++ Runtime Library, xrefs: 033E0320

Memory Dump Source

Source File: 00000014.00000002.2494020967.00000000033B1000.00000020.00000001.01000000.00000015.sdmp, Offset: 033B0000, based on PE: true

Associated: 00000014.00000002.2493917908.00000000033B0000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000014.00000002.2497615129.00000000033F3000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000014.00000002.2498110795.0000000003400000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000014.00000002.2498410969.0000000003406000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000014.00000002.2498556459.0000000003408000.00000008.00000001.01000000.00000015.sdmpDownload File
Associated: 00000014.00000002.2498718201.000000000340A000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000014.00000002.2499166516.0000000003411000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_33b0000_Picasa3.jbxd

Similarity

API ID: __invoke_watson$_strlen$File_strcat_s_strcpy_s$HandleModuleNameWrite
String ID: ...$<program name unknown>$Microsoft Visual C++ Runtime Library$Runtime Error!Program:
API String ID: 1879448924-4022980321
Opcode ID: 061fdc5baab17514e64dbeaf044113da098b7d790f9bd1f98bf6dab729c5db02
Instruction ID: cedb5553999626b249e7784c0b1ab0faada93a51f1e8541b2470aed89ddf5d66
Opcode Fuzzy Hash: 061fdc5baab17514e64dbeaf044113da098b7d790f9bd1f98bf6dab729c5db02
Instruction Fuzzy Hash: 6E316B6AE40338BEE519F2229CC5F2F724CAF11624F580534FD15ED1C6EA92D90082F2

Function 04066037 Relevance: 33.4, APIs: 15, Strings: 4, Instructions: 156fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

_strcpy_s.LIBCMT ref: 040660A3
__invoke_watson.LIBCMT ref: 040660B4
GetModuleFileNameA.KERNEL32(00000000,04091B11,00000104,00000000,?,00000000), ref: 040660D0
_strcpy_s.LIBCMT ref: 040660E5
__invoke_watson.LIBCMT ref: 040660F8
_strlen.LIBCMT ref: 04066101
_strlen.LIBCMT ref: 0406610E
__invoke_watson.LIBCMT ref: 0406613B
_strcat_s.LIBCMT ref: 0406614E
__invoke_watson.LIBCMT ref: 0406615F
_strcat_s.LIBCMT ref: 04066170
__invoke_watson.LIBCMT ref: 04066181
GetStdHandle.KERNEL32(000000F4,?,00000001,-0000000F,00000000,00000003,04066203,000000FC,0406756F,04083AE8,0000000C,0406762A,?,-0000000F,?,0406D4DF), ref: 040661A0
_strlen.LIBCMT ref: 040661C1
WriteFile.KERNEL32(00000000,00000000,00000000,?,00000000,?,00000001,-0000000F,00000000,00000003,04066203,000000FC,0406756F,04083AE8,0000000C,0406762A), ref: 040661CB

Strings

Microsoft Visual C++ Runtime Library, xrefs: 0406618E
Runtime Error!Program: , xrefs: 04066092
<program name unknown>, xrefs: 040660DA
..., xrefs: 0406611F

Memory Dump Source

Source File: 00000014.00000002.2502041842.0000000004031000.00000020.00000001.01000000.00000017.sdmp, Offset: 04030000, based on PE: true

Associated: 00000014.00000002.2501986218.0000000004030000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000014.00000002.2504208079.0000000004079000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000014.00000002.2504943590.0000000004086000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000014.00000002.2505148754.000000000408E000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000014.00000002.2505282171.0000000004090000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000014.00000002.2505501725.0000000004097000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_4030000_Picasa3.jbxd

Similarity

API ID: __invoke_watson$_strlen$File_strcat_s_strcpy_s$HandleModuleNameWrite
String ID: ...$<program name unknown>$Microsoft Visual C++ Runtime Library$Runtime Error!Program:
API String ID: 1879448924-4022980321
Opcode ID: ea2429964fdc26bb61137bb200ab1e34a2c652de4a4b83602612ba0d587d48ad
Instruction ID: 72bc8c35ac016b457fdc81de5f19c759719d591995bd271db7190ce444fbcb2b
Opcode Fuzzy Hash: ea2429964fdc26bb61137bb200ab1e34a2c652de4a4b83602612ba0d587d48ad
Instruction Fuzzy Hash: 8731E5F2A402157AFA603A219C46FAF368C9F41758F090925FD07B9083FE5BB95189F2

Function 0487A522 Relevance: 33.4, APIs: 15, Strings: 4, Instructions: 156fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

_strcpy_s.LIBCMT ref: 0487A58E
__invoke_watson.LIBCMT ref: 0487A59F
GetModuleFileNameA.KERNEL32(00000000,048BAD71,00000104,?,048729D8,?), ref: 0487A5BB
_strcpy_s.LIBCMT ref: 0487A5D0
__invoke_watson.LIBCMT ref: 0487A5E3
_strlen.LIBCMT ref: 0487A5EC
_strlen.LIBCMT ref: 0487A5F9
__invoke_watson.LIBCMT ref: 0487A626
_strcat_s.LIBCMT ref: 0487A639
__invoke_watson.LIBCMT ref: 0487A64A
_strcat_s.LIBCMT ref: 0487A65B
__invoke_watson.LIBCMT ref: 0487A66C
GetStdHandle.KERNEL32(000000F4,?,00000001,?,00000000,00000003,0487A6EE,000000FC,04878E35,048A7D50,0000000C,04878EF0,048729D8,?,?,0488232F), ref: 0487A68B
_strlen.LIBCMT ref: 0487A6AC
WriteFile.KERNEL32(00000000,00000000,00000000,048729D8,00000000,?,00000001,?,00000000,00000003,0487A6EE,000000FC,04878E35,048A7D50,0000000C,04878EF0), ref: 0487A6B6

Strings

<program name unknown>, xrefs: 0487A5C5
Runtime Error!Program: , xrefs: 0487A57D
..., xrefs: 0487A60A
Microsoft Visual C++ Runtime Library, xrefs: 0487A679

Memory Dump Source

Source File: 00000014.00000002.2526268174.00000000047E1000.00000020.00000001.01000000.00000016.sdmp, Offset: 047E0000, based on PE: true

Associated: 00000014.00000002.2526187657.00000000047E0000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000014.00000002.2533437740.000000000488F000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000014.00000002.2535246598.00000000048AB000.00000004.00000001.01000000.00000016.sdmpDownload File
Associated: 00000014.00000002.2535569716.00000000048B3000.00000008.00000001.01000000.00000016.sdmpDownload File
Associated: 00000014.00000002.2535640427.00000000048B5000.00000004.00000001.01000000.00000016.sdmpDownload File
Associated: 00000014.00000002.2536317728.00000000048C0000.00000002.00000001.01000000.00000016.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_47e0000_Picasa3.jbxd

Similarity

API ID: __invoke_watson$_strlen$File_strcat_s_strcpy_s$HandleModuleNameWrite
String ID: ...$<program name unknown>$Microsoft Visual C++ Runtime Library$Runtime Error!Program:
API String ID: 1879448924-4022980321
Opcode ID: 0549eec02ac08bd3112e197b03cafc8aaa22d22fbf034f4ac873bf5fd2a138f5
Instruction ID: 053f77900be12321dcea4066eccba9bf94d2e753e503eec2812b278b20e95bd8
Opcode Fuzzy Hash: 0549eec02ac08bd3112e197b03cafc8aaa22d22fbf034f4ac873bf5fd2a138f5
Instruction Fuzzy Hash: 2F315BB2A012103AF61931789CA5F7F3A4C9F55618F050F25FE05E1182FA89FE0181F3

Function 047F6530 Relevance: 31.8, APIs: 17, Strings: 1, Instructions: 348COMMON

Download Yara Rule

APIs

_com_util::ConvertStringToBSTR.COMSUPP ref: 047F654A

Part of subcall function 04888B40: lstrlenA.KERNEL32(?,CD67C23D,?,?,00000000,?,?,00000000,?,?,?), ref: 04888B7E
Part of subcall function 04888B40: MultiByteToWideChar.KERNEL32(00000000,00000000,?,-00000001,00000000,00000000,?,?,00000000,?,?,00000000,?,?,?), ref: 04888B96
Part of subcall function 04888B40: GetLastError.KERNEL32(?,?,00000000,?,?), ref: 04888BAB
Part of subcall function 04888B40: GetLastError.KERNEL32(?,?,00000000,?,?), ref: 04888BB1

VariantClear.OLEAUT32(?), ref: 047F65A2
VariantClear.OLEAUT32(?), ref: 047F65C8
SysStringLen.OLEAUT32(?), ref: 047F66D0
SysStringLen.OLEAUT32(?), ref: 047F66E1
VarBstrCat.OLEAUT32(?,?,?), ref: 047F66F6
SysFreeString.OLEAUT32(?), ref: 047F6700
WideCharToMultiByte.KERNEL32(0000FDE9,00000000,?,000000FF,00000000,00000000,00000000,00000000), ref: 047F672B
WideCharToMultiByte.KERNEL32(0000FDE9,00000000,?,000000FF,00000000,00000001,00000000,00000000,?,00000001,00000000), ref: 047F6774
VariantClear.OLEAUT32(?), ref: 047F67AF
SysStringLen.OLEAUT32(00000000), ref: 047F67D6
WideCharToMultiByte.KERNEL32(0000FDE9,00000000,00000000,000000FF,00000000,00000000,00000000,00000000), ref: 047F67F5
WideCharToMultiByte.KERNEL32(0000FDE9,00000000,?,000000FF,00000000,00000001,00000000,00000000,?,00000001,00000000), ref: 047F683E

Strings

<html, xrefs: 047F6788

Memory Dump Source

Source File: 00000014.00000002.2526268174.00000000047E1000.00000020.00000001.01000000.00000016.sdmp, Offset: 047E0000, based on PE: true

Associated: 00000014.00000002.2526187657.00000000047E0000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000014.00000002.2533437740.000000000488F000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000014.00000002.2535246598.00000000048AB000.00000004.00000001.01000000.00000016.sdmpDownload File
Associated: 00000014.00000002.2535569716.00000000048B3000.00000008.00000001.01000000.00000016.sdmpDownload File
Associated: 00000014.00000002.2535640427.00000000048B5000.00000004.00000001.01000000.00000016.sdmpDownload File
Associated: 00000014.00000002.2536317728.00000000048C0000.00000002.00000001.01000000.00000016.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_47e0000_Picasa3.jbxd

Similarity

API ID: ByteCharMultiStringWide$ClearVariant$ErrorLast$BstrConvertFree_com_util::lstrlen
String ID: <html
API String ID: 816744628-2614003043
Opcode ID: d1060c1da2a3136b3acfcb6b616350c70048144717828107bbfc47b8a957f6bf
Instruction ID: 103e32f9beb78c1f7e28b41b4aa9ee2538f157eb254a23b499ccf83a5d7f81ca
Opcode Fuzzy Hash: d1060c1da2a3136b3acfcb6b616350c70048144717828107bbfc47b8a957f6bf
Instruction Fuzzy Hash: 66C14372608301AFC310EFA9CC8492BB7E9EF88714F544A2DF68597350D774EC068BA2

Function 047EB640 Relevance: 31.8, APIs: 4, Strings: 14, Instructions: 319COMMON

Download Yara Rule

APIs

CoInitialize.OLE32(00000000), ref: 047EB6BF

Strings

My Pictures, xrefs: 047EB979
CExpWebsites::DefaultAlbum, xrefs: 047EB974
webexport, xrefs: 047EB681
AutomatedTest, xrefs: 047EB726
option_thumbsize, xrefs: 047EB6A8
Preparing upload, xrefs: 047EB7B9
option_jpegquality, xrefs: 047EB695
CExpWebsites::DefaultAlbumEnglish, xrefs: 047EB9BE
Uploading, xrefs: 047EB770
Pictures, xrefs: 047EB9C3
CExpWebsites::ProgUpload, xrefs: 047EB76B
CExpWebsites::PrepUpload, xrefs: 047EB7B4
_albumName_, xrefs: 047EB9F6
AutomatedTestResult, xrefs: 047EB747

Memory Dump Source

Source File: 00000014.00000002.2526268174.00000000047E1000.00000020.00000001.01000000.00000016.sdmp, Offset: 047E0000, based on PE: true

Associated: 00000014.00000002.2526187657.00000000047E0000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000014.00000002.2533437740.000000000488F000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000014.00000002.2535246598.00000000048AB000.00000004.00000001.01000000.00000016.sdmpDownload File
Associated: 00000014.00000002.2535569716.00000000048B3000.00000008.00000001.01000000.00000016.sdmpDownload File
Associated: 00000014.00000002.2535640427.00000000048B5000.00000004.00000001.01000000.00000016.sdmpDownload File
Associated: 00000014.00000002.2536317728.00000000048C0000.00000002.00000001.01000000.00000016.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_47e0000_Picasa3.jbxd

Similarity

API ID: Initialize
String ID: AutomatedTest$AutomatedTestResult$CExpWebsites::DefaultAlbum$CExpWebsites::DefaultAlbumEnglish$CExpWebsites::PrepUpload$CExpWebsites::ProgUpload$My Pictures$Pictures$Preparing upload$Uploading$_albumName_$option_jpegquality$option_thumbsize$webexport
API String ID: 2538663250-902767772
Opcode ID: a03be4212dab5da9eb35b0934fb2227f18a069df8dffac2d06bed52d1eb2e88c
Instruction ID: e4ff6a28cf77f40d92f241db4777df6a2ee55d23a4830cea9a5a537197f9ac95
Opcode Fuzzy Hash: a03be4212dab5da9eb35b0934fb2227f18a069df8dffac2d06bed52d1eb2e88c
Instruction Fuzzy Hash: 14C18D717002059FDB20EFA9CC85BBA77E4AF89704F040A59EA09DB391DA71FD05CB92

Function 04031E10 Relevance: 30.1, APIs: 10, Strings: 7, Instructions: 313COMMON

Download Yara Rule

APIs

InterlockedIncrement.KERNEL32(00000000), ref: 04031E7B
GetDlgItem.USER32(?,0000040D), ref: 04031EAC
InterlockedIncrement.KERNEL32(00000000), ref: 04031FDB
InterlockedIncrement.KERNEL32(00000000), ref: 04032002
InterlockedIncrement.KERNEL32(00000000), ref: 040320D3

Part of subcall function 04040B90: InterlockedIncrement.KERNEL32(00000000), ref: 04040BEC

InterlockedIncrement.KERNEL32(?), ref: 04032122
GetDlgItem.USER32(?,0000040E), ref: 0403214B
GetDlgItem.USER32(?,0000040D), ref: 04032176
CheckDlgButton.USER32(?,000003E8,00000000), ref: 040321BA
CheckDlgButton.USER32(?,000003E9,00000000), ref: 040321CE

Strings

expsizeindex, xrefs: 04031F6F
showfolder, xrefs: 04031F2A
TiVo Desktop\Photos\, xrefs: 040320F8
replace, xrefs: 04031EE9
ru, xrefs: 04031E7B, 04031FDB, 04032002, 040320D3, 04032122
tivo, xrefs: 04031EDB, 04031F1C, 04031F61, 04031FA1
exppath, xrefs: 04031FAF

Memory Dump Source

Source File: 00000014.00000002.2502041842.0000000004031000.00000020.00000001.01000000.00000017.sdmp, Offset: 04030000, based on PE: true

Associated: 00000014.00000002.2501986218.0000000004030000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000014.00000002.2504208079.0000000004079000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000014.00000002.2504943590.0000000004086000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000014.00000002.2505148754.000000000408E000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000014.00000002.2505282171.0000000004090000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000014.00000002.2505501725.0000000004097000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_4030000_Picasa3.jbxd

Similarity

API ID: IncrementInterlocked$Item$ButtonCheck
String ID: TiVo Desktop\Photos\$exppath$expsizeindex$replace$showfolder$tivo$ru
API String ID: 1458399062-1960239455
Opcode ID: ca409a8f339ee979217fd932ab2b4bcc136453401de70aaba55445201c0dafda
Instruction ID: 7c41da3783d4ba04c47ad603551881ebde796040a01893cee5bfbe8dba992f0d
Opcode Fuzzy Hash: ca409a8f339ee979217fd932ab2b4bcc136453401de70aaba55445201c0dafda
Instruction Fuzzy Hash: F0B1C7715043418FD710EF60C8806ABBBEAAFC831AF148D6DE546BB251DB74F849CB92

Function 033E0877 Relevance: 29.9, APIs: 12, Strings: 5, Instructions: 109libraryloadermemoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(KERNEL32.DLL,?,033DD1F5,?,?,00000001,?,?,033DD365,00000001,?,?,033FDA28,0000000C,033DD41F,?), ref: 033E087D
__mtterm.LIBCMT ref: 033E0889

Part of subcall function 033E0562: TlsFree.KERNEL32(00000030,033DD291,?,?,00000001,?,?,033DD365,00000001,?,?,033FDA28,0000000C,033DD41F,?), ref: 033E058D
Part of subcall function 033E0562: DeleteCriticalSection.KERNEL32(00000000,00000000,?,00000001,033DD291,?,?,00000001,?,?,033DD365,00000001,?,?,033FDA28,0000000C), ref: 033E0D9B
Part of subcall function 033E0562: DeleteCriticalSection.KERNEL32(00000030,?,00000001,033DD291,?,?,00000001,?,?,033DD365,00000001,?,?,033FDA28,0000000C,033DD41F), ref: 033E0DC5

GetProcAddress.KERNEL32(00000000,FlsAlloc), ref: 033E089F
GetProcAddress.KERNEL32(00000000,FlsGetValue), ref: 033E08AC
GetProcAddress.KERNEL32(00000000,FlsSetValue), ref: 033E08B9
GetProcAddress.KERNEL32(00000000,FlsFree), ref: 033E08C6
TlsAlloc.KERNEL32(?,?,00000001,?,?,033DD365,00000001,?,?,033FDA28,0000000C,033DD41F,?), ref: 033E0916
TlsSetValue.KERNEL32(00000000,?,?,00000001,?,?,033DD365,00000001,?,?,033FDA28,0000000C,033DD41F,?), ref: 033E0931
__init_pointers.LIBCMT ref: 033E093B
__calloc_crt.LIBCMT ref: 033E09B0
GetCurrentThreadId.KERNEL32 ref: 033E09E0

Strings

FlsFree, xrefs: 033E08BB
FlsSetValue, xrefs: 033E08AE
FlsAlloc, xrefs: 033E0899
KERNEL32.DLL, xrefs: 033E0878
FlsGetValue, xrefs: 033E08A1

Memory Dump Source

Source File: 00000014.00000002.2494020967.00000000033B1000.00000020.00000001.01000000.00000015.sdmp, Offset: 033B0000, based on PE: true

Associated: 00000014.00000002.2493917908.00000000033B0000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000014.00000002.2497615129.00000000033F3000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000014.00000002.2498110795.0000000003400000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000014.00000002.2498410969.0000000003406000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000014.00000002.2498556459.0000000003408000.00000008.00000001.01000000.00000015.sdmpDownload File
Associated: 00000014.00000002.2498718201.000000000340A000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000014.00000002.2499166516.0000000003411000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_33b0000_Picasa3.jbxd

Similarity

API ID: AddressProc$CriticalDeleteSection$AllocCurrentFreeHandleModuleThreadValue__calloc_crt__init_pointers__mtterm
String ID: FlsAlloc$FlsFree$FlsGetValue$FlsSetValue$KERNEL32.DLL
API String ID: 2125014093-3819984048
Opcode ID: 54c7c863a9b2e5b24075ab01ef231c281aa5f51844c1ce7bc62dacf94bf4fb88
Instruction ID: 447817573d9795283b434563eb35460f2fb6fb3f11654863c5a48b30ced56bff
Opcode Fuzzy Hash: 54c7c863a9b2e5b24075ab01ef231c281aa5f51844c1ce7bc62dacf94bf4fb88
Instruction Fuzzy Hash: 06317335A40331DEDB14FF76AEC4A257AE4FB843A8B444629F852BE1D9DBB084418F91

Function 040649CE Relevance: 29.9, APIs: 12, Strings: 5, Instructions: 109libraryloadermemoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(KERNEL32.DLL,?,04061387,?,?,00000001,?,?,040614F7,00000001,?,?,040837A0,0000000C,040615B1,?), ref: 040649D4
__mtterm.LIBCMT ref: 040649E0

Part of subcall function 040646B9: TlsFree.KERNEL32(00000037,04061423,?,?,00000001,?,?,040614F7,00000001,?,?,040837A0,0000000C,040615B1,?), ref: 040646E4
Part of subcall function 040646B9: DeleteCriticalSection.KERNEL32(00000000,00000000,?,00000001,04061423,?,?,00000001,?,?,040614F7,00000001,?,?,040837A0,0000000C), ref: 040674FF
Part of subcall function 040646B9: DeleteCriticalSection.KERNEL32(00000037,?,00000001,04061423,?,?,00000001,?,?,040614F7,00000001,?,?,040837A0,0000000C,040615B1), ref: 04067529

GetProcAddress.KERNEL32(00000000,FlsAlloc), ref: 040649F6
GetProcAddress.KERNEL32(00000000,FlsGetValue), ref: 04064A03
GetProcAddress.KERNEL32(00000000,FlsSetValue), ref: 04064A10
GetProcAddress.KERNEL32(00000000,FlsFree), ref: 04064A1D
TlsAlloc.KERNEL32(?,?,00000001,?,?,040614F7,00000001,?,?,040837A0,0000000C,040615B1,?), ref: 04064A6D
TlsSetValue.KERNEL32(00000000,?,?,00000001,?,?,040614F7,00000001,?,?,040837A0,0000000C,040615B1,?), ref: 04064A88
__init_pointers.LIBCMT ref: 04064A92
__calloc_crt.LIBCMT ref: 04064B07
GetCurrentThreadId.KERNEL32 ref: 04064B37

Strings

FlsSetValue, xrefs: 04064A05
FlsGetValue, xrefs: 040649F8
FlsAlloc, xrefs: 040649F0
KERNEL32.DLL, xrefs: 040649CF
FlsFree, xrefs: 04064A12

Memory Dump Source

Source File: 00000014.00000002.2502041842.0000000004031000.00000020.00000001.01000000.00000017.sdmp, Offset: 04030000, based on PE: true

Associated: 00000014.00000002.2501986218.0000000004030000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000014.00000002.2504208079.0000000004079000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000014.00000002.2504943590.0000000004086000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000014.00000002.2505148754.000000000408E000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000014.00000002.2505282171.0000000004090000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000014.00000002.2505501725.0000000004097000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_4030000_Picasa3.jbxd

Similarity

API ID: AddressProc$CriticalDeleteSection$AllocCurrentFreeHandleModuleThreadValue__calloc_crt__init_pointers__mtterm
String ID: FlsAlloc$FlsFree$FlsGetValue$FlsSetValue$KERNEL32.DLL
API String ID: 2125014093-3819984048
Opcode ID: d7eda617850be6b6e0b2781d5be5be33492303ca903f6180be19951105696012
Instruction ID: 8410144b1acbf15e5be8373af670409fb48ec32b05cf5067f93421687d04927d
Opcode Fuzzy Hash: d7eda617850be6b6e0b2781d5be5be33492303ca903f6180be19951105696012
Instruction Fuzzy Hash: 1B317071A402039AFB11AF74BD05A953BE9FB40368B004639E417BB591EF7DAC80CF59

Function 040381B0 Relevance: 28.2, APIs: 13, Strings: 3, Instructions: 234windowCOMMON

Download Yara Rule

APIs

GetWindow.USER32(?,00000005), ref: 04038204
GetWindow.USER32(?,00000005), ref: 04038252
GetWindowLongA.USER32(00000000,000000F4), ref: 0403828A
GetClassNameA.USER32(00000000,00000000,00000100), ref: 040382D9
SendMessageA.USER32(00000000,00000030,00000000,00000000), ref: 04038325
GetWindow.USER32(00000000,00000002), ref: 0403832E
InterlockedDecrement.KERNEL32(?), ref: 0403836E
InterlockedIncrement.KERNEL32(?), ref: 0403838A
GetClassNameA.USER32(00000000,00000000,00000100), ref: 040383C0
SendMessageA.USER32(00000000,00000030,00000000,00000000), ref: 0403840D
GetWindow.USER32(00000000,00000002), ref: 04038416
InterlockedDecrement.KERNEL32(?), ref: 0403843D
InterlockedIncrement.KERNEL32(?), ref: 04038459

Strings

`ruru, xrefs: 0403836E, 0403843D
Edit, xrefs: 040382EE, 0403830D, 040383D5, 040383F5
, xrefs: 04038337

Memory Dump Source

Source File: 00000014.00000002.2502041842.0000000004031000.00000020.00000001.01000000.00000017.sdmp, Offset: 04030000, based on PE: true

Associated: 00000014.00000002.2501986218.0000000004030000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000014.00000002.2504208079.0000000004079000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000014.00000002.2504943590.0000000004086000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000014.00000002.2505148754.000000000408E000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000014.00000002.2505282171.0000000004090000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000014.00000002.2505501725.0000000004097000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_4030000_Picasa3.jbxd

Similarity

API ID: Window$Interlocked$ClassDecrementIncrementMessageNameSend$Long
String ID: $Edit$`ruru
API String ID: 1448439664-3971228775
Opcode ID: b5f8107dd88d309c12732c40c0c91387281855e4be9f60f5377f3e73cf3178a4
Instruction ID: fce11ef629be2592323c2eccbbf025c5a47b76a8f6314c95e0d02201a7ae5635
Opcode Fuzzy Hash: b5f8107dd88d309c12732c40c0c91387281855e4be9f60f5377f3e73cf3178a4
Instruction Fuzzy Hash: F171E2726047029BE761FE24D88477A3FDDEB41306F04C9A8F956BA281E778F9058652

Function 04037710 Relevance: 28.1, APIs: 8, Strings: 8, Instructions: 80libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(USER32,?,?,?,0403796F,?,?,?), ref: 04037739
GetProcAddress.KERNEL32(00000000,GetSystemMetrics), ref: 04037755
GetProcAddress.KERNEL32(00000000,MonitorFromWindow), ref: 04037766
GetProcAddress.KERNEL32(00000000,MonitorFromRect), ref: 04037777
GetProcAddress.KERNEL32(00000000,MonitorFromPoint), ref: 04037788
GetProcAddress.KERNEL32(00000000,EnumDisplayMonitors), ref: 04037799
GetProcAddress.KERNEL32(00000000,GetMonitorInfoA), ref: 040377AA
GetProcAddress.KERNEL32(00000000,EnumDisplayDevicesA), ref: 040377BB

Strings

GetSystemMetrics, xrefs: 0403774F
USER32, xrefs: 0403772F
MonitorFromPoint, xrefs: 04037782
MonitorFromWindow, xrefs: 04037760
GetMonitorInfoA, xrefs: 040377A4
EnumDisplayDevicesA, xrefs: 040377B5
EnumDisplayMonitors, xrefs: 04037793
MonitorFromRect, xrefs: 04037771

Memory Dump Source

Source File: 00000014.00000002.2502041842.0000000004031000.00000020.00000001.01000000.00000017.sdmp, Offset: 04030000, based on PE: true

Associated: 00000014.00000002.2501986218.0000000004030000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000014.00000002.2504208079.0000000004079000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000014.00000002.2504943590.0000000004086000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000014.00000002.2505148754.000000000408E000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000014.00000002.2505282171.0000000004090000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000014.00000002.2505501725.0000000004097000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_4030000_Picasa3.jbxd

Similarity

API ID: AddressProc$HandleModule
String ID: EnumDisplayDevicesA$EnumDisplayMonitors$GetMonitorInfoA$GetSystemMetrics$MonitorFromPoint$MonitorFromRect$MonitorFromWindow$USER32
API String ID: 667068680-68207542
Opcode ID: 533ca645c2757b23bbb9b13bb1e848a481b021e86740a37a5b13edc4662af47f
Instruction ID: 95a6c3e15c4cbfeb5000e0a51749cd026828f84a9cdf835f09d0654f9e3fb4d3
Opcode Fuzzy Hash: 533ca645c2757b23bbb9b13bb1e848a481b021e86740a37a5b13edc4662af47f
Instruction Fuzzy Hash: D22149B1A05210BFC761AF2AECC095ABAE8FA4835975548FED004F6540DF7C6C81DF55

Function 04042970 Relevance: 26.5, APIs: 14, Strings: 1, Instructions: 244COMMON

Download Yara Rule

APIs

InterlockedIncrement.KERNEL32(?), ref: 040429AA
InterlockedDecrement.KERNEL32(?), ref: 040429F5
InterlockedIncrement.KERNEL32(?), ref: 04042A0D
GetLastError.KERNEL32(?,00000000), ref: 04042A34
InterlockedDecrement.KERNEL32(?), ref: 04042A9C
InterlockedIncrement.KERNEL32(?), ref: 04042AB4
InterlockedDecrement.KERNEL32(?), ref: 04042AFA
InterlockedIncrement.KERNEL32(?), ref: 04042B12
InterlockedDecrement.KERNEL32(?), ref: 04042B58
InterlockedIncrement.KERNEL32(?), ref: 04042B70
InterlockedDecrement.KERNEL32(?), ref: 04042BB6
InterlockedIncrement.KERNEL32(?), ref: 04042BCE
InterlockedDecrement.KERNEL32(?), ref: 04042C11
InterlockedIncrement.KERNEL32(?), ref: 04042C29

Strings

ru, xrefs: 040429AA, 04042A0D, 04042AB4, 04042B12, 04042B70, 04042BCE, 04042C29

Memory Dump Source

Source File: 00000014.00000002.2502041842.0000000004031000.00000020.00000001.01000000.00000017.sdmp, Offset: 04030000, based on PE: true

Associated: 00000014.00000002.2501986218.0000000004030000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000014.00000002.2504208079.0000000004079000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000014.00000002.2504943590.0000000004086000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000014.00000002.2505148754.000000000408E000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000014.00000002.2505282171.0000000004090000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000014.00000002.2505501725.0000000004097000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_4030000_Picasa3.jbxd

Similarity

API ID: Interlocked$Increment$Decrement$ErrorLast
String ID: ru
API String ID: 1785395282-1355688448
Opcode ID: a589bec57bd44ebe6b6ca7f55e66ec65cba6da4c55555579f4733dcf7bb2044a
Instruction ID: 0bd5b6a4f44a515c8bfabfd2ff9ec54b09a30c436e6d88faf2750ee9cb68a296
Opcode Fuzzy Hash: a589bec57bd44ebe6b6ca7f55e66ec65cba6da4c55555579f4733dcf7bb2044a
Instruction Fuzzy Hash: 7271F6F27042914BEB71AE24D89077E76D5EFC2290F184CBDF582F6141EA2CF940A796

Function 047F55F0 Relevance: 24.3, APIs: 16, Instructions: 348memoryCOMMON

Download Yara Rule

APIs

InterlockedIncrement.KERNEL32(?), ref: 047F56B4
InterlockedIncrement.KERNEL32(?), ref: 047F5735
_com_util::ConvertStringToBSTR.COMSUPP ref: 047F57B3
VariantCopy.OLEAUT32(?,?), ref: 047F57CB
SafeArrayCreate.OLEAUT32(00000011,00000001,?), ref: 047F5871
SafeArrayPutElement.OLEAUT32(00000000,?,?), ref: 047F589C
VariantInit.OLEAUT32(?), ref: 047F58B7
SysAllocString.OLEAUT32 ref: 047F5907
SysAllocString.OLEAUT32(?), ref: 047F592B

Part of subcall function 047E3490: InterlockedIncrement.KERNEL32(00000000), ref: 047E34B2

Part of subcall function 047E3430: InterlockedDecrement.KERNEL32(00000000), ref: 047E3442
Part of subcall function 047E3430: InterlockedIncrement.KERNEL32(00000000), ref: 047E345E

SafeArrayDestroy.OLEAUT32(00000000), ref: 047F596E
VariantClear.OLEAUT32(?), ref: 047F597F
VariantClear.OLEAUT32(?), ref: 047F5986
SysFreeString.OLEAUT32(00000000), ref: 047F5989
VariantClear.OLEAUT32(?), ref: 047F5998
VariantClear.OLEAUT32(?), ref: 047F599F
SysFreeString.OLEAUT32(?), ref: 047F59A2

Memory Dump Source

Source File: 00000014.00000002.2526268174.00000000047E1000.00000020.00000001.01000000.00000016.sdmp, Offset: 047E0000, based on PE: true

Associated: 00000014.00000002.2526187657.00000000047E0000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000014.00000002.2533437740.000000000488F000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000014.00000002.2535246598.00000000048AB000.00000004.00000001.01000000.00000016.sdmpDownload File
Associated: 00000014.00000002.2535569716.00000000048B3000.00000008.00000001.01000000.00000016.sdmpDownload File
Associated: 00000014.00000002.2535640427.00000000048B5000.00000004.00000001.01000000.00000016.sdmpDownload File
Associated: 00000014.00000002.2536317728.00000000048C0000.00000002.00000001.01000000.00000016.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_47e0000_Picasa3.jbxd

Similarity

API ID: Variant$InterlockedString$ClearIncrement$ArraySafe$AllocFree$ConvertCopyCreateDecrementDestroyElementInit_com_util::
String ID:
API String ID: 383798855-0
Opcode ID: d051bbc07fba7119e6797afd1e00f4c200fa6c440086eb1c72300d87ae5a82be
Instruction ID: 1bc16996ea8a0874179adc8f65dfbcc4caf77b4d6164832fc04681280d664a76
Opcode Fuzzy Hash: d051bbc07fba7119e6797afd1e00f4c200fa6c440086eb1c72300d87ae5a82be
Instruction Fuzzy Hash: E4C1CD71204345ABD711EF68C8849ABB3E8EF88714F144A2DFA9597311E735F909CBA2

Function 033BF3E0 Relevance: 24.3, APIs: 16, Instructions: 260COMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,000000FF,00000000,00000000), ref: 033BF41D
MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,000000FF,00000000,00000000), ref: 033BF43E
MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,000000FF,00000000,00000000), ref: 033BF477
MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,000000FF,00000000,00000000), ref: 033BF494
MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,000000FF,00000000,00000000), ref: 033BF4B5
MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,000000FF,00000000,00000000), ref: 033BF4EE
MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,000000FF,00000000,00000000), ref: 033BF50B
MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,000000FF,00000000,00000000), ref: 033BF52C
MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,000000FF,00000000,00000000), ref: 033BF565
MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,000000FF,00000000,00000000), ref: 033BF582
MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,000000FF,00000000,00000000), ref: 033BF5A3
MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,000000FF,00000000,00000000), ref: 033BF5DC
MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,000000FF,00000000,00000000), ref: 033BF5F9
MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,000000FF,00000000,00000000), ref: 033BF61A
MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,000000FF,00000000,00000000), ref: 033BF653
ShellExecuteExW.SHELL32(?), ref: 033BF665

Memory Dump Source

Source File: 00000014.00000002.2494020967.00000000033B1000.00000020.00000001.01000000.00000015.sdmp, Offset: 033B0000, based on PE: true

Associated: 00000014.00000002.2493917908.00000000033B0000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000014.00000002.2497615129.00000000033F3000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000014.00000002.2498110795.0000000003400000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000014.00000002.2498410969.0000000003406000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000014.00000002.2498556459.0000000003408000.00000008.00000001.01000000.00000015.sdmpDownload File
Associated: 00000014.00000002.2498718201.000000000340A000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000014.00000002.2499166516.0000000003411000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_33b0000_Picasa3.jbxd

Similarity

API ID: ByteCharMultiWide$ExecuteShell
String ID:
API String ID: 4114931494-0
Opcode ID: ac33c5f29029e138337f2f9dbab20a545665fa80b2094e0d053799093fa33e07
Instruction ID: 5061faf0c999468e42b0507e456e43cadcf403516731d22cf60a3c1a5915d5c1
Opcode Fuzzy Hash: ac33c5f29029e138337f2f9dbab20a545665fa80b2094e0d053799093fa33e07
Instruction Fuzzy Hash: 728166747442057BEB20DE69CCC1FBA77B9AF44720F345266BA11EFAD4C670E8408751

Function 0403C3A1 Relevance: 24.3, APIs: 16, Instructions: 259COMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,000000FF,00000000,00000000), ref: 0403C3DD
MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,000000FF,00000000,00000000), ref: 0403C3FE
MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,000000FF,00000000,00000000), ref: 0403C437
MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,000000FF,00000000,00000000), ref: 0403C454
MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,000000FF,00000000,00000000), ref: 0403C475
MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,000000FF,00000000,00000000), ref: 0403C4AE
MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,000000FF,00000000,00000000), ref: 0403C4CB
MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,000000FF,00000000,00000000), ref: 0403C4EC
MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,000000FF,00000000,00000000), ref: 0403C525
MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,000000FF,00000000,00000000), ref: 0403C542
MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,000000FF,00000000,00000000), ref: 0403C563
MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,000000FF,00000000,00000000), ref: 0403C59C
MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,000000FF,00000000,00000000), ref: 0403C5B9
MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,000000FF,00000000,00000000), ref: 0403C5DA
MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,000000FF,00000000,00000000), ref: 0403C613
ShellExecuteExW.SHELL32(?), ref: 0403C625

Memory Dump Source

Source File: 00000014.00000002.2502041842.0000000004031000.00000020.00000001.01000000.00000017.sdmp, Offset: 04030000, based on PE: true

Associated: 00000014.00000002.2501986218.0000000004030000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000014.00000002.2504208079.0000000004079000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000014.00000002.2504943590.0000000004086000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000014.00000002.2505148754.000000000408E000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000014.00000002.2505282171.0000000004090000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000014.00000002.2505501725.0000000004097000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_4030000_Picasa3.jbxd

Similarity

API ID: ByteCharMultiWide$ExecuteShell
String ID:
API String ID: 4114931494-0
Opcode ID: f194cf84ff0b161634780744a1eefc939daa3b6d81047562ae30500c16708c4a
Instruction ID: 5f2c544e12c4c84952825543442b041d2f4812984043bf1078d3d556f877daed
Opcode Fuzzy Hash: f194cf84ff0b161634780744a1eefc939daa3b6d81047562ae30500c16708c4a
Instruction Fuzzy Hash: 29816271748216BAFB20EE69CC81F7A7BA9AF44720F344665B911FF2C4DA70F8409751

Function 033B6C70 Relevance: 22.9, APIs: 15, Instructions: 445COMMON

Download Yara Rule

APIs

InterlockedIncrement.KERNEL32(00000000), ref: 033B6D7A

Part of subcall function 033B8E00: _malloc.LIBCMT ref: 033B8E18

InterlockedIncrement.KERNEL32(?), ref: 033B6DA8
InterlockedIncrement.KERNEL32(?), ref: 033B6F81
InterlockedDecrement.KERNEL32(?), ref: 033B6FBE
InterlockedIncrement.KERNEL32(?), ref: 033B6FDA
InterlockedDecrement.KERNEL32(?), ref: 033B704D
InterlockedIncrement.KERNEL32(?), ref: 033B7065
InterlockedDecrement.KERNEL32(?), ref: 033B70AB
InterlockedIncrement.KERNEL32(?), ref: 033B70C3
InterlockedDecrement.KERNEL32(?), ref: 033B7109
InterlockedIncrement.KERNEL32(?), ref: 033B7121
InterlockedDecrement.KERNEL32(?), ref: 033B7167
InterlockedIncrement.KERNEL32(?), ref: 033B717F
InterlockedDecrement.KERNEL32(?), ref: 033B71C2
InterlockedIncrement.KERNEL32(?), ref: 033B71DA

Memory Dump Source

Source File: 00000014.00000002.2494020967.00000000033B1000.00000020.00000001.01000000.00000015.sdmp, Offset: 033B0000, based on PE: true

Associated: 00000014.00000002.2493917908.00000000033B0000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000014.00000002.2497615129.00000000033F3000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000014.00000002.2498110795.0000000003400000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000014.00000002.2498410969.0000000003406000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000014.00000002.2498556459.0000000003408000.00000008.00000001.01000000.00000015.sdmpDownload File
Associated: 00000014.00000002.2498718201.000000000340A000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000014.00000002.2499166516.0000000003411000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_33b0000_Picasa3.jbxd

Similarity

API ID: Interlocked$Increment$Decrement$_malloc
String ID:
API String ID: 2671738418-0
Opcode ID: 8711e0e0b55de87fa5795155201254356d16ed40b7b5cb1555ba268bc0925ad7
Instruction ID: ac2daef35a5a8c7744b4daacc851a418df32ee5cc9f60f1e627a8f9c5f2a93e4
Opcode Fuzzy Hash: 8711e0e0b55de87fa5795155201254356d16ed40b7b5cb1555ba268bc0925ad7
Instruction Fuzzy Hash: 76F1E0759043519FDB20DF24C8C07AAB7F9FF81344F1888ADE6859BA42DB39E805CB91

Function 033E7169 Relevance: 21.2, APIs: 8, Strings: 4, Instructions: 164libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(USER32.DLL,00000000,00000000,00000314,?,?,?,0340C100,033E032B,0340C100,Microsoft Visual C++ Runtime Library,00012010), ref: 033E7196
GetProcAddress.KERNEL32(00000000,MessageBoxA), ref: 033E71B2

Part of subcall function 033E040E: TlsGetValue.KERNEL32(033E6E58,033E6ED8,033E6E58,00000014,033E0E67,00000000,00000FA0,033FDC40,0000000C,033E0EC6,033DC7F4,?,?,033E7C2A,00000004,033FDE40), ref: 033E041B
Part of subcall function 033E040E: TlsGetValue.KERNEL32(00000009,?,033E7C2A,00000004,033FDE40,0000000C,033E2E0E,033DC7F4,033DC7F4,00000000,00000000,00000000,033E0687,00000001,00000214), ref: 033E0432

GetProcAddress.KERNEL32(00000000,00000000), ref: 033E71CF

Part of subcall function 033E040E: GetModuleHandleA.KERNEL32(KERNEL32.DLL,?,033E7C2A,00000004,033FDE40,0000000C,033E2E0E,033DC7F4,033DC7F4,00000000,00000000,00000000,033E0687,00000001,00000214), ref: 033E0447
Part of subcall function 033E040E: GetProcAddress.KERNEL32(00000000,EncodePointer), ref: 033E0462

GetProcAddress.KERNEL32(00000000,00000000), ref: 033E71E4
__invoke_watson.LIBCMT ref: 033E7205

Part of subcall function 033E2C6A: _memset.LIBCMT ref: 033E2CF6
Part of subcall function 033E2C6A: IsDebuggerPresent.KERNEL32(?,?,00000000), ref: 033E2D14
Part of subcall function 033E2C6A: SetUnhandledExceptionFilter.KERNEL32(00000000,?,?,00000000), ref: 033E2D1E
Part of subcall function 033E2C6A: UnhandledExceptionFilter.KERNEL32(00000000,?,?,00000000), ref: 033E2D28
Part of subcall function 033E2C6A: GetCurrentProcess.KERNEL32(C000000D,?,?,00000000), ref: 033E2D43
Part of subcall function 033E2C6A: TerminateProcess.KERNEL32(00000000,?,?,00000000), ref: 033E2D4A

Part of subcall function 033E0485: TlsGetValue.KERNEL32(?,033E0AC9,033DC963,033DC7F4,?,033DC7F4,?), ref: 033E0492
Part of subcall function 033E0485: TlsGetValue.KERNEL32(00000009,?,033DC7F4,?), ref: 033E04A9

Part of subcall function 033E0485: GetModuleHandleA.KERNEL32(KERNEL32.DLL,?,033DC7F4,?), ref: 033E04BE
Part of subcall function 033E0485: GetProcAddress.KERNEL32(00000000,DecodePointer), ref: 033E04D9

GetProcAddress.KERNEL32(00000000,GetUserObjectInformationA), ref: 033E7219
GetProcAddress.KERNEL32(00000000,GetProcessWindowStation), ref: 033E7231
__invoke_watson.LIBCMT ref: 033E72A4

Strings

USER32.DLL, xrefs: 033E7191
MessageBoxA, xrefs: 033E71AC
GetUserObjectInformationA, xrefs: 033E7213
GetProcessWindowStation, xrefs: 033E722B

Memory Dump Source

Source File: 00000014.00000002.2494020967.00000000033B1000.00000020.00000001.01000000.00000015.sdmp, Offset: 033B0000, based on PE: true

Associated: 00000014.00000002.2493917908.00000000033B0000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000014.00000002.2497615129.00000000033F3000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000014.00000002.2498110795.0000000003400000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000014.00000002.2498410969.0000000003406000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000014.00000002.2498556459.0000000003408000.00000008.00000001.01000000.00000015.sdmpDownload File
Associated: 00000014.00000002.2498718201.000000000340A000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000014.00000002.2499166516.0000000003411000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_33b0000_Picasa3.jbxd

Similarity

API ID: AddressProc$Value$ExceptionFilterHandleModuleProcessUnhandled__invoke_watson$CurrentDebuggerLibraryLoadPresentTerminate_memset
String ID: GetProcessWindowStation$GetUserObjectInformationA$MessageBoxA$USER32.DLL
API String ID: 2940365033-1046234306
Opcode ID: b71e06c85da6922e5b74ec07367351cb9532316caf68b43cf3d3467222194928
Instruction ID: 0452b7233ea3a7a7e7481ef06546befd7ec5d62e50729cdfc077d88c4e132a34
Opcode Fuzzy Hash: b71e06c85da6922e5b74ec07367351cb9532316caf68b43cf3d3467222194928
Instruction Fuzzy Hash: 5741A176D00329AECF14FFB69EC496EBBE8AB44305F18092EF500FA1C4DB7595848E65

Function 0406DA55 Relevance: 21.2, APIs: 8, Strings: 4, Instructions: 164libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(USER32.DLL,00000000,00000000,00000314,?,?,?,04091AF8,04066199,04091AF8,Microsoft Visual C++ Runtime Library,00012010), ref: 0406DA82
GetProcAddress.KERNEL32(00000000,MessageBoxA), ref: 0406DA9E

Part of subcall function 04064565: TlsGetValue.KERNEL32(0406D233,0406D2B3,0406D233,00000014,040675CB,00000000,00000FA0,04083AE8,0000000C,0406762A,?,-0000000F,?,0406D4DF,00000004,04083C48), ref: 04064572
Part of subcall function 04064565: TlsGetValue.KERNEL32(0000000B,?,0406D4DF,00000004,04083C48,0000000C,04064BA5,?,?,00000000,00000000,00000000,040647DE,00000001,00000214), ref: 04064589

GetProcAddress.KERNEL32(00000000,00000000), ref: 0406DABB

Part of subcall function 04064565: GetModuleHandleA.KERNEL32(KERNEL32.DLL,?,0406D4DF,00000004,04083C48,0000000C,04064BA5,?,?,00000000,00000000,00000000,040647DE,00000001,00000214), ref: 0406459E
Part of subcall function 04064565: GetProcAddress.KERNEL32(00000000,EncodePointer), ref: 040645B9

GetProcAddress.KERNEL32(00000000,00000000), ref: 0406DAD0
__invoke_watson.LIBCMT ref: 0406DAF1

Part of subcall function 04065E06: _memset.LIBCMT ref: 04065E92
Part of subcall function 04065E06: IsDebuggerPresent.KERNEL32(?,?,00000000), ref: 04065EB0
Part of subcall function 04065E06: SetUnhandledExceptionFilter.KERNEL32(00000000,?,?,00000000), ref: 04065EBA
Part of subcall function 04065E06: UnhandledExceptionFilter.KERNEL32(?,?,?,00000000), ref: 04065EC4
Part of subcall function 04065E06: GetCurrentProcess.KERNEL32(C000000D,?,?,00000000), ref: 04065EDF
Part of subcall function 04065E06: TerminateProcess.KERNEL32(00000000,?,?,00000000), ref: 04065EE6

Part of subcall function 040645DC: TlsGetValue.KERNEL32(00000000,04066D4A,04061974,?,00000001,040351EC,00000001), ref: 040645E9
Part of subcall function 040645DC: TlsGetValue.KERNEL32(0000000B), ref: 04064600

Part of subcall function 040645DC: GetModuleHandleA.KERNEL32(KERNEL32.DLL), ref: 04064615
Part of subcall function 040645DC: GetProcAddress.KERNEL32(00000000,DecodePointer), ref: 04064630

GetProcAddress.KERNEL32(00000000,GetUserObjectInformationA), ref: 0406DB05
GetProcAddress.KERNEL32(00000000,GetProcessWindowStation), ref: 0406DB1D
__invoke_watson.LIBCMT ref: 0406DB90

Strings

GetUserObjectInformationA, xrefs: 0406DAFF
USER32.DLL, xrefs: 0406DA7D
GetProcessWindowStation, xrefs: 0406DB17
MessageBoxA, xrefs: 0406DA98

Memory Dump Source

Source File: 00000014.00000002.2502041842.0000000004031000.00000020.00000001.01000000.00000017.sdmp, Offset: 04030000, based on PE: true

Associated: 00000014.00000002.2501986218.0000000004030000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000014.00000002.2504208079.0000000004079000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000014.00000002.2504943590.0000000004086000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000014.00000002.2505148754.000000000408E000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000014.00000002.2505282171.0000000004090000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000014.00000002.2505501725.0000000004097000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_4030000_Picasa3.jbxd

Similarity

API ID: AddressProc$Value$ExceptionFilterHandleModuleProcessUnhandled__invoke_watson$CurrentDebuggerLibraryLoadPresentTerminate_memset
String ID: GetProcessWindowStation$GetUserObjectInformationA$MessageBoxA$USER32.DLL
API String ID: 2940365033-1046234306
Opcode ID: 0331377bdcb5a2e73f5dda97673af3f5c48291fc7511da173420d8eeb9f372a8
Instruction ID: 5e78ebba9f3adfe5f77568f7fdc4cfbb37e1a0de5049a46f301ed3cf66cc3124
Opcode Fuzzy Hash: 0331377bdcb5a2e73f5dda97673af3f5c48291fc7511da173420d8eeb9f372a8
Instruction Fuzzy Hash: 4B41A1B1E04205FEEF94AFE19D849AE7BE9EF45318B10087EE513F2140DF38B9408A59

Function 04882420 Relevance: 21.2, APIs: 8, Strings: 4, Instructions: 164libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(USER32.DLL,00000000,00000000,00000314,?,?,?,048BAD58,0487A684,048BAD58,Microsoft Visual C++ Runtime Library,00012010), ref: 0488244D
GetProcAddress.KERNEL32(00000000,MessageBoxA), ref: 04882469

Part of subcall function 04879A73: TlsGetValue.KERNEL32(04881AE1,04881B61,04881AE1,00000014,04878E91,00000000,00000FA0,048A7D50,0000000C,04878EF0,048729D8,?,?,0488232F,00000004,048A7FD8), ref: 04879A80
Part of subcall function 04879A73: TlsGetValue.KERNEL32(0000000A,?,0488232F,00000004,048A7FD8,0000000C,0487A0B3,048729D8,048729D8,00000000,00000000,00000000,04879CEC,00000001,00000214), ref: 04879A97

GetProcAddress.KERNEL32(00000000,00000000), ref: 04882486

Part of subcall function 04879A73: GetModuleHandleA.KERNEL32(KERNEL32.DLL,?,0488232F,00000004,048A7FD8,0000000C,0487A0B3,048729D8,048729D8,00000000,00000000,00000000,04879CEC,00000001,00000214), ref: 04879AAC
Part of subcall function 04879A73: GetProcAddress.KERNEL32(00000000,EncodePointer), ref: 04879AC7

GetProcAddress.KERNEL32(00000000,00000000), ref: 0488249B
__invoke_watson.LIBCMT ref: 048824BC

Part of subcall function 04877CA4: _memset.LIBCMT ref: 04877D30
Part of subcall function 04877CA4: IsDebuggerPresent.KERNEL32(?,?,00000000), ref: 04877D4E
Part of subcall function 04877CA4: SetUnhandledExceptionFilter.KERNEL32(00000000,?,?,00000000), ref: 04877D58
Part of subcall function 04877CA4: UnhandledExceptionFilter.KERNEL32(00000001,?,?,00000000), ref: 04877D62
Part of subcall function 04877CA4: GetCurrentProcess.KERNEL32(C000000D,?,?,00000000), ref: 04877D7D
Part of subcall function 04877CA4: TerminateProcess.KERNEL32(00000000,?,?,00000000), ref: 04877D84

Part of subcall function 04879AEA: TlsGetValue.KERNEL32(00000000,0487A710,04872914,048729D8,?,048729D8,?), ref: 04879AF7
Part of subcall function 04879AEA: TlsGetValue.KERNEL32(0000000A,?,048729D8,?), ref: 04879B0E

Part of subcall function 04879AEA: GetModuleHandleA.KERNEL32(KERNEL32.DLL,?,048729D8,?), ref: 04879B23
Part of subcall function 04879AEA: GetProcAddress.KERNEL32(00000000,DecodePointer), ref: 04879B3E

GetProcAddress.KERNEL32(00000000,GetUserObjectInformationA), ref: 048824D0
GetProcAddress.KERNEL32(00000000,GetProcessWindowStation), ref: 048824E8
__invoke_watson.LIBCMT ref: 0488255B

Strings

MessageBoxA, xrefs: 04882463
GetUserObjectInformationA, xrefs: 048824CA
GetProcessWindowStation, xrefs: 048824E2
USER32.DLL, xrefs: 04882448

Memory Dump Source

Source File: 00000014.00000002.2526268174.00000000047E1000.00000020.00000001.01000000.00000016.sdmp, Offset: 047E0000, based on PE: true

Associated: 00000014.00000002.2526187657.00000000047E0000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000014.00000002.2533437740.000000000488F000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000014.00000002.2535246598.00000000048AB000.00000004.00000001.01000000.00000016.sdmpDownload File
Associated: 00000014.00000002.2535569716.00000000048B3000.00000008.00000001.01000000.00000016.sdmpDownload File
Associated: 00000014.00000002.2535640427.00000000048B5000.00000004.00000001.01000000.00000016.sdmpDownload File
Associated: 00000014.00000002.2536317728.00000000048C0000.00000002.00000001.01000000.00000016.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_47e0000_Picasa3.jbxd

Similarity

API ID: AddressProc$Value$ExceptionFilterHandleModuleProcessUnhandled__invoke_watson$CurrentDebuggerLibraryLoadPresentTerminate_memset
String ID: GetProcessWindowStation$GetUserObjectInformationA$MessageBoxA$USER32.DLL
API String ID: 2940365033-1046234306
Opcode ID: 5ef2b2307ddb8c17d77238eff73cdf269919cb0e85c1a14eb09da76e0e4326fc
Instruction ID: a6c224bd2adea86c8586cfbc0beb15c9611c9236caf5fdc8044a67e7fa801e1a
Opcode Fuzzy Hash: 5ef2b2307ddb8c17d77238eff73cdf269919cb0e85c1a14eb09da76e0e4326fc
Instruction Fuzzy Hash: B54183B1D45205AEEF50BFA89C9596EBBA8FF05314B140F6EE501D2540DBB4F9808BA1

Function 033BF220 Relevance: 19.7, APIs: 13, Instructions: 173COMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,000000FF,00000000,00000000), ref: 033BF24E
MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,000000FF,00000000,00000000), ref: 033BF26C
MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,000000FF,?,00000000), ref: 033BF289
MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,000000FF,00000000,00000000), ref: 033BF2A0
MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,000000FF,00000000,00000000), ref: 033BF2C7
MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,000000FF,?,00000000), ref: 033BF2E4
MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,000000FF,00000000,00000000), ref: 033BF2FB
MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,000000FF,00000000,00000000), ref: 033BF322
MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,000000FF,?,00000000), ref: 033BF33F
MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,000000FF,00000000,00000000), ref: 033BF35A
MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,000000FF,00000000,00000000), ref: 033BF381
MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,000000FF,?,00000000), ref: 033BF39E
ShellExecuteW.SHELL32(00000000,00000000,00000000,00000000,00000000,?), ref: 033BF3B8

Memory Dump Source

Source File: 00000014.00000002.2494020967.00000000033B1000.00000020.00000001.01000000.00000015.sdmp, Offset: 033B0000, based on PE: true

Associated: 00000014.00000002.2493917908.00000000033B0000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000014.00000002.2497615129.00000000033F3000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000014.00000002.2498110795.0000000003400000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000014.00000002.2498410969.0000000003406000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000014.00000002.2498556459.0000000003408000.00000008.00000001.01000000.00000015.sdmpDownload File
Associated: 00000014.00000002.2498718201.000000000340A000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000014.00000002.2499166516.0000000003411000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_33b0000_Picasa3.jbxd

Similarity

API ID: ByteCharMultiWide$ExecuteShell
String ID:
API String ID: 4114931494-0
Opcode ID: ed5e2e83e32e49f75471c59783ed4be4f14d47f70127b7bdb8fe5e9b68cd1f6a
Instruction ID: ad8562533639737e804e84c76d602eb8ec1f4b80bb1b4023e503a55e10dc3162
Opcode Fuzzy Hash: ed5e2e83e32e49f75471c59783ed4be4f14d47f70127b7bdb8fe5e9b68cd1f6a
Instruction Fuzzy Hash: E4515634B4431677E730EA698CC2FBA7679AB45B24F3403367721BFAC4C9B0A8049665

Function 0403C1E0 Relevance: 19.7, APIs: 13, Instructions: 173COMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,000000FF,00000000,00000000), ref: 0403C20E
MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,000000FF,00000000,00000000), ref: 0403C22C
MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,000000FF,?,00000000), ref: 0403C249
MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,000000FF,00000000,00000000), ref: 0403C260
MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,000000FF,00000000,00000000), ref: 0403C287
MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,000000FF,?,00000000), ref: 0403C2A4
MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,000000FF,00000000,00000000), ref: 0403C2BB
MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,000000FF,00000000,00000000), ref: 0403C2E2
MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,000000FF,?,00000000), ref: 0403C2FF
MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,000000FF,00000000,00000000), ref: 0403C31A
MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,000000FF,00000000,00000000), ref: 0403C341
MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,000000FF,?,00000000), ref: 0403C35E
ShellExecuteW.SHELL32(00000000,00000000,00000000,00000000,00000000,?), ref: 0403C378

Memory Dump Source

Source File: 00000014.00000002.2502041842.0000000004031000.00000020.00000001.01000000.00000017.sdmp, Offset: 04030000, based on PE: true

Associated: 00000014.00000002.2501986218.0000000004030000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000014.00000002.2504208079.0000000004079000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000014.00000002.2504943590.0000000004086000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000014.00000002.2505148754.000000000408E000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000014.00000002.2505282171.0000000004090000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000014.00000002.2505501725.0000000004097000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_4030000_Picasa3.jbxd

Similarity

API ID: ByteCharMultiWide$ExecuteShell
String ID:
API String ID: 4114931494-0
Opcode ID: 362b7f62392e36e8e0fc7701a73a1f95414b524a58e038416c0ce73257255182
Instruction ID: fed90fc2b951aaaa021321df9e6cd6c354194dd906bc3e37ae3b65d20f703080
Opcode Fuzzy Hash: 362b7f62392e36e8e0fc7701a73a1f95414b524a58e038416c0ce73257255182
Instruction Fuzzy Hash: FB517671B4831A77FB30AAA98C42F7A7AACDB45B24F3007367621FF6C0D9B479009655

Function 033B32B0 Relevance: 18.3, APIs: 12, Instructions: 325stringCOMMON

Download Yara Rule

APIs

Part of subcall function 033B2FC0: lstrcmpiA.KERNEL32(?,00000000), ref: 033B3039

lstrlenA.KERNEL32(?,?,?,00000000), ref: 033B337A

Memory Dump Source

Source File: 00000014.00000002.2494020967.00000000033B1000.00000020.00000001.01000000.00000015.sdmp, Offset: 033B0000, based on PE: true

Associated: 00000014.00000002.2493917908.00000000033B0000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000014.00000002.2497615129.00000000033F3000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000014.00000002.2498110795.0000000003400000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000014.00000002.2498410969.0000000003406000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000014.00000002.2498556459.0000000003408000.00000008.00000001.01000000.00000015.sdmpDownload File
Associated: 00000014.00000002.2498718201.000000000340A000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000014.00000002.2499166516.0000000003411000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_33b0000_Picasa3.jbxd

Similarity

API ID: lstrcmpilstrlen
String ID:
API String ID: 3649823140-0
Opcode ID: 571261e676ced0d9cfc297972c3228b5b6b08f8530c256135382bcbc3575fa6e
Instruction ID: d76078dd8dfc6076ad0959181b1ab731aa68682b6145a94571ab6de2216b4c40
Opcode Fuzzy Hash: 571261e676ced0d9cfc297972c3228b5b6b08f8530c256135382bcbc3575fa6e
Instruction Fuzzy Hash: E6C1C679E00268ABDB25DB24CCC1BDEB3B9AB48360F4841D5E749D7640DB749EC48F90

Function 048325E0 Relevance: 18.3, APIs: 12, Instructions: 257COMMON

Download Yara Rule

APIs

_realloc.LIBCMT ref: 048325FB

Part of subcall function 04873BC2: _malloc.LIBCMT ref: 04873BD8

Memory Dump Source

Source File: 00000014.00000002.2526268174.00000000047E1000.00000020.00000001.01000000.00000016.sdmp, Offset: 047E0000, based on PE: true

Associated: 00000014.00000002.2526187657.00000000047E0000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000014.00000002.2533437740.000000000488F000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000014.00000002.2535246598.00000000048AB000.00000004.00000001.01000000.00000016.sdmpDownload File
Associated: 00000014.00000002.2535569716.00000000048B3000.00000008.00000001.01000000.00000016.sdmpDownload File
Associated: 00000014.00000002.2535640427.00000000048B5000.00000004.00000001.01000000.00000016.sdmpDownload File
Associated: 00000014.00000002.2536317728.00000000048C0000.00000002.00000001.01000000.00000016.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_47e0000_Picasa3.jbxd

Similarity

API ID: _malloc_realloc
String ID:
API String ID: 3664626178-0
Opcode ID: 2b6d3e01f6d9665b31b71899e5bc4e235b14c3a4144da9924923448499a65be2
Instruction ID: a479cb186b1b93b47233e30e5a148d9809be0cc61c35566b6fb179edf20a8b1b
Opcode Fuzzy Hash: 2b6d3e01f6d9665b31b71899e5bc4e235b14c3a4144da9924923448499a65be2
Instruction Fuzzy Hash: 1771AC7A7012054FEB12AE6DF8442A57798F7C4767F040FAAD908C2240EB39AC46C7D3

Function 033B9AE0 Relevance: 18.3, APIs: 12, Instructions: 255COMMON

Download Yara Rule

APIs

_realloc.LIBCMT ref: 033B9AFB

Part of subcall function 033DCE24: _malloc.LIBCMT ref: 033DCE3A

Memory Dump Source

Source File: 00000014.00000002.2494020967.00000000033B1000.00000020.00000001.01000000.00000015.sdmp, Offset: 033B0000, based on PE: true

Associated: 00000014.00000002.2493917908.00000000033B0000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000014.00000002.2497615129.00000000033F3000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000014.00000002.2498110795.0000000003400000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000014.00000002.2498410969.0000000003406000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000014.00000002.2498556459.0000000003408000.00000008.00000001.01000000.00000015.sdmpDownload File
Associated: 00000014.00000002.2498718201.000000000340A000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000014.00000002.2499166516.0000000003411000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_33b0000_Picasa3.jbxd

Similarity

API ID: _malloc_realloc
String ID:
API String ID: 3664626178-0
Opcode ID: 694f64966cb0f451e9d61bd244eef28f548924df6158e09ccb3abf6f7d5a22a1
Instruction ID: 369b321d391732d8b39c2365137f76fa3d935a19ea645a33caa81782f4c24911
Opcode Fuzzy Hash: 694f64966cb0f451e9d61bd244eef28f548924df6158e09ccb3abf6f7d5a22a1
Instruction Fuzzy Hash: 52712D77B003454BC710FA99BEC4795B3E8E78527AF1802B7DB18EAA84D77644848F91

Function 04035280 Relevance: 18.3, APIs: 12, Instructions: 255COMMON

Download Yara Rule

APIs

_realloc.LIBCMT ref: 0403529B

Part of subcall function 04061984: _malloc.LIBCMT ref: 0406199A

Memory Dump Source

Source File: 00000014.00000002.2502041842.0000000004031000.00000020.00000001.01000000.00000017.sdmp, Offset: 04030000, based on PE: true

Associated: 00000014.00000002.2501986218.0000000004030000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000014.00000002.2504208079.0000000004079000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000014.00000002.2504943590.0000000004086000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000014.00000002.2505148754.000000000408E000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000014.00000002.2505282171.0000000004090000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000014.00000002.2505501725.0000000004097000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_4030000_Picasa3.jbxd

Similarity

API ID: _malloc_realloc
String ID:
API String ID: 3664626178-0
Opcode ID: dad826213bf1fc660a39cdf456cc8f50606c0db8ef5071df20bf4f1693e3c200
Instruction ID: 831759a6ef39dec60cf5a39f5a20040d07298b91333875201681d9ac7dfb7276
Opcode Fuzzy Hash: dad826213bf1fc660a39cdf456cc8f50606c0db8ef5071df20bf4f1693e3c200
Instruction Fuzzy Hash: 4D71A577B042046BD7109E69BC44665BBD8F78532BF04427ADD09F2A90EB3EAC458BD2

Function 040322B0 Relevance: 17.6, APIs: 5, Strings: 5, Instructions: 131windowCOMMON

Download Yara Rule

APIs

IsDlgButtonChecked.USER32(?,000003E8), ref: 040322CE
IsDlgButtonChecked.USER32(?,000003E9), ref: 040322DF

Part of subcall function 04033B30: InterlockedIncrement.KERNEL32(00000000), ref: 04033BA9
Part of subcall function 04033B30: InterlockedIncrement.KERNEL32(00000007), ref: 04033C1C

Part of subcall function 04031710: RegCloseKey.ADVAPI32(?,?,?,tivo), ref: 0403179C
Part of subcall function 04031710: RegCloseKey.ADVAPI32(?,?,?,tivo), ref: 040317BC

Part of subcall function 04031000: InterlockedDecrement.KERNEL32(00000000), ref: 04031012
Part of subcall function 04031000: InterlockedIncrement.KERNEL32(00000000), ref: 0403102E

Part of subcall function 040336C0: InterlockedIncrement.KERNEL32(00000000), ref: 0403373A
Part of subcall function 040336C0: InterlockedIncrement.KERNEL32(?), ref: 040337AC

Part of subcall function 040337F0: InterlockedIncrement.KERNEL32(00000000), ref: 04033840

IsDlgButtonChecked.USER32(?,00000461), ref: 040323DD
GetDlgItem.USER32(?,0000043C), ref: 040323F0
SendMessageA.USER32(00000000,00000400,00000000,00000000), ref: 0403240F

Strings

expsizeindex, xrefs: 04032432
showfolder, xrefs: 04032338
replace, xrefs: 040322F7
exppath, xrefs: 0403237D
tivo, xrefs: 040322E7, 0403232A, 0403236F, 04032424

Memory Dump Source

Source File: 00000014.00000002.2502041842.0000000004031000.00000020.00000001.01000000.00000017.sdmp, Offset: 04030000, based on PE: true

Associated: 00000014.00000002.2501986218.0000000004030000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000014.00000002.2504208079.0000000004079000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000014.00000002.2504943590.0000000004086000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000014.00000002.2505148754.000000000408E000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000014.00000002.2505282171.0000000004090000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000014.00000002.2505501725.0000000004097000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_4030000_Picasa3.jbxd

Similarity

API ID: Interlocked$Increment$ButtonChecked$Close$DecrementItemMessageSend
String ID: exppath$expsizeindex$replace$showfolder$tivo
API String ID: 720157188-1886339066
Opcode ID: 24bc0f82e4a8610dd1bc4ae3fa0754fc3555a20362c86e8c093edfe9bbe9af5d
Instruction ID: 61498118340f8ef2bdea414ebc7dbe4e37f2037f1c628517055659d790e98f62
Opcode Fuzzy Hash: 24bc0f82e4a8610dd1bc4ae3fa0754fc3555a20362c86e8c093edfe9bbe9af5d
Instruction Fuzzy Hash: EC5140B15043059FD700EF10C880A8ABBA8EF8839DF11495DA945BB256CB74F94ACFE2

Function 040646F6 Relevance: 17.5, APIs: 6, Strings: 4, Instructions: 49libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(KERNEL32.DLL,04083A00,0000000C,04064807,00000000,00000000,?,?,?,04064626), ref: 04064707
GetProcAddress.KERNEL32(?,EncodePointer), ref: 0406473B
GetProcAddress.KERNEL32(?,DecodePointer), ref: 0406474B
InterlockedIncrement.KERNEL32(040867F0), ref: 0406476D
__lock.LIBCMT ref: 04064775
___addlocaleref.LIBCMT ref: 04064794

Strings

DecodePointer, xrefs: 04064743
KERNEL32.DLL, xrefs: 04064702
ru, xrefs: 0406476D
EncodePointer, xrefs: 0406472D

Memory Dump Source

Source File: 00000014.00000002.2502041842.0000000004031000.00000020.00000001.01000000.00000017.sdmp, Offset: 04030000, based on PE: true

Associated: 00000014.00000002.2501986218.0000000004030000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000014.00000002.2504208079.0000000004079000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000014.00000002.2504943590.0000000004086000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000014.00000002.2505148754.000000000408E000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000014.00000002.2505282171.0000000004090000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000014.00000002.2505501725.0000000004097000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_4030000_Picasa3.jbxd

Similarity

API ID: AddressProc$HandleIncrementInterlockedModule___addlocaleref__lock
String ID: DecodePointer$EncodePointer$KERNEL32.DLL$ru
API String ID: 1036688887-3108580440
Opcode ID: d0569b52cd45ec3899b486167f0821229bb97634b6ef4d825f90f0311f249015
Instruction ID: e70cca5d5cf14531991455be03186e6d8e724356fe02213ed769d24c4ed188ea
Opcode Fuzzy Hash: d0569b52cd45ec3899b486167f0821229bb97634b6ef4d825f90f0311f249015
Instruction Fuzzy Hash: AF118FB09407019FF720AF79D844F9ABBE0EF44318F108829D8A7BA250CA78F901CF55

Function 04037FB0 Relevance: 15.9, APIs: 7, Strings: 2, Instructions: 166COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(040923C4,?,00000000), ref: 04037FD7
LoadStringA.USER32(00000000,00000001,?,00000400), ref: 04038016
InterlockedIncrement.KERNEL32(?), ref: 04038076
InterlockedIncrement.KERNEL32(?), ref: 04038092
InterlockedIncrement.KERNEL32(?), ref: 04038120

Part of subcall function 04037C70: InitializeCriticalSection.KERNEL32(040923C4,January,04037DEF,00000001,00000000,00000000,?,?,04042FE3,January,00000000,?,040360D0), ref: 04037C76

InterlockedIncrement.KERNEL32(?), ref: 0403813F
LeaveCriticalSection.KERNEL32(040923C4), ref: 04038191

Strings

IDS_SELECT_EXPORT_FOLDER, xrefs: 04037FDD, 04038038, 0403804E
ru, xrefs: 04038076, 04038092, 04038120, 0403813F

Memory Dump Source

Source File: 00000014.00000002.2502041842.0000000004031000.00000020.00000001.01000000.00000017.sdmp, Offset: 04030000, based on PE: true

Associated: 00000014.00000002.2501986218.0000000004030000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000014.00000002.2504208079.0000000004079000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000014.00000002.2504943590.0000000004086000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000014.00000002.2505148754.000000000408E000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000014.00000002.2505282171.0000000004090000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000014.00000002.2505501725.0000000004097000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_4030000_Picasa3.jbxd

Similarity

API ID: IncrementInterlocked$CriticalSection$EnterInitializeLeaveLoadString
String ID: IDS_SELECT_EXPORT_FOLDER$ru
API String ID: 1717521058-743805197
Opcode ID: 1838060f25b2b6708a5054bcf7c340ca55a38da2eaec2000d13b31dfad3f120c
Instruction ID: 221440a0d07e883dd67b8175e5af73fa5344c7e29a33935c12fe7e5ee361ff46
Opcode Fuzzy Hash: 1838060f25b2b6708a5054bcf7c340ca55a38da2eaec2000d13b31dfad3f120c
Instruction Fuzzy Hash: 435180B29002159FDB50EF64C4806AEBBF9FF4531AF14C9A8E941BB200D779BD05CBA1

Function 0403F5C0 Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 144COMMON

Download Yara Rule

APIs

InterlockedDecrement.KERNEL32(000000FF), ref: 0403F5EB
InterlockedIncrement.KERNEL32(000000FF), ref: 0403F603
InterlockedDecrement.KERNEL32(34468BFF), ref: 0403F656
InterlockedIncrement.KERNEL32(34468BFF), ref: 0403F66E
InterlockedDecrement.KERNEL32(00FF3D00), ref: 0403F6C5
InterlockedIncrement.KERNEL32(00FF3D00), ref: 0403F6DD
InterlockedDecrement.KERNEL32(CCCCCCCC), ref: 0403F735
InterlockedIncrement.KERNEL32(CCCCCCCC), ref: 0403F74D

Strings

ru, xrefs: 0403F603, 0403F66E, 0403F6DD, 0403F74D

Memory Dump Source

Source File: 00000014.00000002.2502041842.0000000004031000.00000020.00000001.01000000.00000017.sdmp, Offset: 04030000, based on PE: true

Associated: 00000014.00000002.2501986218.0000000004030000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000014.00000002.2504208079.0000000004079000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000014.00000002.2504943590.0000000004086000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000014.00000002.2505148754.000000000408E000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000014.00000002.2505282171.0000000004090000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000014.00000002.2505501725.0000000004097000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_4030000_Picasa3.jbxd

Similarity

API ID: Interlocked$DecrementIncrement
String ID: ru
API String ID: 2172605799-1355688448
Opcode ID: 6b40b11f4d696e8d6ab86091d06a8f96cb9234e47ba8f5d83d145070472e3c46
Instruction ID: 854b3a448577377771e8964463790693e91806510b7d9163058190039e50df8f
Opcode Fuzzy Hash: 6b40b11f4d696e8d6ab86091d06a8f96cb9234e47ba8f5d83d145070472e3c46
Instruction Fuzzy Hash: 5A41A2B29002535BE7215E34D99073E7F9EEF06356F240834E881BB251EB3CFA11A75A

Function 04035F20 Relevance: 15.8, APIs: 5, Strings: 4, Instructions: 54libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(kernel32,wine_get_unix_file_name,00000001,00000000), ref: 04035F59
GetProcAddress.KERNEL32(00000000), ref: 04035F60
LoadLibraryExA.KERNEL32(Rasapi32.dll,00000000,00000008,00000001,00000000), ref: 04035F7D
GetProcAddress.KERNEL32(00000000,RasEnumEntriesA), ref: 04035F8F
FreeLibrary.KERNEL32(00000000), ref: 04035FC0

Strings

Rasapi32.dll, xrefs: 04035F78
kernel32, xrefs: 04035F54
wine_get_unix_file_name, xrefs: 04035F4F
RasEnumEntriesA, xrefs: 04035F89

Memory Dump Source

Source File: 00000014.00000002.2502041842.0000000004031000.00000020.00000001.01000000.00000017.sdmp, Offset: 04030000, based on PE: true

Associated: 00000014.00000002.2501986218.0000000004030000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000014.00000002.2504208079.0000000004079000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000014.00000002.2504943590.0000000004086000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000014.00000002.2505148754.000000000408E000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000014.00000002.2505282171.0000000004090000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000014.00000002.2505501725.0000000004097000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_4030000_Picasa3.jbxd

Similarity

API ID: AddressLibraryProc$FreeHandleLoadModule
String ID: RasEnumEntriesA$Rasapi32.dll$kernel32$wine_get_unix_file_name
API String ID: 3023338733-2676939310
Opcode ID: b10f1eb3ff81119264e9d9026e70a37e9d360759d33ebbd9e40edfe135c1c132
Instruction ID: 9b638ebab3bc67204ec5ab853926114e3aad7940cd2e7b97db1291100c71ae97
Opcode Fuzzy Hash: b10f1eb3ff81119264e9d9026e70a37e9d360759d33ebbd9e40edfe135c1c132
Instruction Fuzzy Hash: 1811E072945300BFE751AFA4AC05FAA7BE4EB84710F00452DF446B6282CB7CBC048B92

Function 033E059F Relevance: 15.8, APIs: 6, Strings: 3, Instructions: 49libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(KERNEL32.DLL,033FDBF8,0000000C,033E06B0,00000000,00000000,?,00000000,033DF4AB,033E1BF6,00000001,033E03BD,?,00000000), ref: 033E05B0
GetProcAddress.KERNEL32(?,EncodePointer), ref: 033E05E4
GetProcAddress.KERNEL32(?,DecodePointer), ref: 033E05F4
InterlockedIncrement.KERNEL32(034004A8), ref: 033E0616
__lock.LIBCMT ref: 033E061E
___addlocaleref.LIBCMT ref: 033E063D

Strings

EncodePointer, xrefs: 033E05D6
KERNEL32.DLL, xrefs: 033E05AB
DecodePointer, xrefs: 033E05EC

Memory Dump Source

Source File: 00000014.00000002.2494020967.00000000033B1000.00000020.00000001.01000000.00000015.sdmp, Offset: 033B0000, based on PE: true

Associated: 00000014.00000002.2493917908.00000000033B0000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000014.00000002.2497615129.00000000033F3000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000014.00000002.2498110795.0000000003400000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000014.00000002.2498410969.0000000003406000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000014.00000002.2498556459.0000000003408000.00000008.00000001.01000000.00000015.sdmpDownload File
Associated: 00000014.00000002.2498718201.000000000340A000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000014.00000002.2499166516.0000000003411000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_33b0000_Picasa3.jbxd

Similarity

API ID: AddressProc$HandleIncrementInterlockedModule___addlocaleref__lock
String ID: DecodePointer$EncodePointer$KERNEL32.DLL
API String ID: 1036688887-2843748187
Opcode ID: 7b911cc4d0c4657ebdb9c0e0c31a3c253c6f7d42876e9b1ec3f6250808b41c55
Instruction ID: 303aadc860a403312657b6a977e8a08ebf02c0ec05674e77446467697d712bb9
Opcode Fuzzy Hash: 7b911cc4d0c4657ebdb9c0e0c31a3c253c6f7d42876e9b1ec3f6250808b41c55
Instruction Fuzzy Hash: D6114F79940701AFDB10EF7AD984B5AFBF4EF44314F40481DE9A6AA291DBB89901CF10

Function 033BF820 Relevance: 15.1, APIs: 10, Instructions: 146processCOMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,000000FF,00000000,00000000), ref: 033BF84E
MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,000000FF,00000000,00000000), ref: 033BF86C
MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,000000FF,?,00000000), ref: 033BF889
MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,000000FF,00000000,00000000), ref: 033BF8A0
MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,000000FF,00000000,00000000), ref: 033BF8C7
MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,000000FF,?,00000000), ref: 033BF8E4
MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,000000FF,00000000,00000000), ref: 033BF8FF
MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,000000FF,00000000,00000000), ref: 033BF926
MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,000000FF,?,00000000), ref: 033BF943
CreateProcessW.KERNEL32(00000000,00000000,?,?,?,?,?,00000000,?,?), ref: 033BF96D

Memory Dump Source

Source File: 00000014.00000002.2494020967.00000000033B1000.00000020.00000001.01000000.00000015.sdmp, Offset: 033B0000, based on PE: true

Associated: 00000014.00000002.2493917908.00000000033B0000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000014.00000002.2497615129.00000000033F3000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000014.00000002.2498110795.0000000003400000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000014.00000002.2498410969.0000000003406000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000014.00000002.2498556459.0000000003408000.00000008.00000001.01000000.00000015.sdmpDownload File
Associated: 00000014.00000002.2498718201.000000000340A000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000014.00000002.2499166516.0000000003411000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_33b0000_Picasa3.jbxd

Similarity

API ID: ByteCharMultiWide$CreateProcess
String ID:
API String ID: 1137714917-0
Opcode ID: 6d7a3d800a3866471e2779fa08cfb5ffb556da249f9bbe67f9db1a3f6a579edb
Instruction ID: 345a4b5f2e03fcd4bf6c2f288c922eef4cdd33e1355b2323562de53a9ce4b263
Opcode Fuzzy Hash: 6d7a3d800a3866471e2779fa08cfb5ffb556da249f9bbe67f9db1a3f6a579edb
Instruction Fuzzy Hash: E7415675B442197BE730EA698C81FBA76BDDB89B24F304336B620EF6C4C5B0A8009755

Function 0403C7E0 Relevance: 15.1, APIs: 10, Instructions: 146processCOMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,000000FF,00000000,00000000), ref: 0403C80E
MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,000000FF,00000000,00000000), ref: 0403C82C
MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,000000FF,?,00000000), ref: 0403C849
MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,000000FF,00000000,00000000), ref: 0403C860
MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,000000FF,00000000,00000000), ref: 0403C887
MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,000000FF,?,00000000), ref: 0403C8A4
MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,000000FF,00000000,00000000), ref: 0403C8BF
MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,000000FF,00000000,00000000), ref: 0403C8E6
MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,000000FF,?,00000000), ref: 0403C903
CreateProcessW.KERNEL32(00000000,00000000,?,?,?,?,?,00000000,?,?), ref: 0403C92D

Memory Dump Source

Source File: 00000014.00000002.2502041842.0000000004031000.00000020.00000001.01000000.00000017.sdmp, Offset: 04030000, based on PE: true

Associated: 00000014.00000002.2501986218.0000000004030000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000014.00000002.2504208079.0000000004079000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000014.00000002.2504943590.0000000004086000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000014.00000002.2505148754.000000000408E000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000014.00000002.2505282171.0000000004090000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000014.00000002.2505501725.0000000004097000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_4030000_Picasa3.jbxd

Similarity

API ID: ByteCharMultiWide$CreateProcess
String ID:
API String ID: 1137714917-0
Opcode ID: 8ccb73d4366c50f8833ba7322f61f536c7b1eb124336fc9bb8ee43060f9d97da
Instruction ID: 4eb6d831eacdeb06e7f8cdf6cded6f177254869727834f54ee45826fb91f1878
Opcode Fuzzy Hash: 8ccb73d4366c50f8833ba7322f61f536c7b1eb124336fc9bb8ee43060f9d97da
Instruction Fuzzy Hash: D8418871B442197BF7209E598C41F7A7AACDB89B24F304736B621FF2C0D5B4B9009795

Function 04041560 Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 196COMMONLIBRARYCODE

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(00000000,00000000,00000000,000000FF,00000000,00000000,?,00000000,00000000,00000000,?,00000000), ref: 04041593
MultiByteToWideChar.KERNEL32(00000000,00000000,00000000,000000FF,00000000,00000000,?,00000000), ref: 04041618
WideCharToMultiByte.KERNEL32(0000FDE9,00000000,00000000,000000FF,00000000,00000000,00000000,00000000,?,00000000), ref: 04041648
WideCharToMultiByte.KERNEL32(0000FDE9,00000000,00000000,000000FF,00000000,00000001,00000000,00000000,?,00000001,00000000,?,00000000), ref: 0404168B
MultiByteToWideChar.KERNEL32(00000000,00000000,00000000,000000FF,?,00000000,?,00000000), ref: 040416B0
InterlockedIncrement.KERNEL32(?), ref: 0404171A
InterlockedIncrement.KERNEL32(00000000), ref: 04041754

Strings

ru, xrefs: 0404171A, 04041754

Memory Dump Source

Source File: 00000014.00000002.2502041842.0000000004031000.00000020.00000001.01000000.00000017.sdmp, Offset: 04030000, based on PE: true

Associated: 00000014.00000002.2501986218.0000000004030000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000014.00000002.2504208079.0000000004079000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000014.00000002.2504943590.0000000004086000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000014.00000002.2505148754.000000000408E000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000014.00000002.2505282171.0000000004090000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000014.00000002.2505501725.0000000004097000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_4030000_Picasa3.jbxd

Similarity

API ID: ByteCharMultiWide$IncrementInterlocked
String ID: ru
API String ID: 1786315571-1355688448
Opcode ID: 8c824d071b43246b1158c4b5ac2a342e62ea7479c63a7268290bc4dbd6741111
Instruction ID: 0c690c17a2d995b7f32c464c57f85fbfefe3000f0b1a8b8c6226e417bbb948c1
Opcode Fuzzy Hash: 8c824d071b43246b1158c4b5ac2a342e62ea7479c63a7268290bc4dbd6741111
Instruction Fuzzy Hash: 5D61C7B1A00228ABEB50AF60CC44BEEBBB8EF85765F150174E915BF180D774BE4487D1

Function 047EB420 Relevance: 14.2, APIs: 6, Strings: 2, Instructions: 174COMMON

Download Yara Rule

APIs

InterlockedIncrement.KERNEL32(?), ref: 047EB457
InterlockedIncrement.KERNEL32(0000000A), ref: 047EB498
InterlockedIncrement.KERNEL32(?), ref: 047EB4D9
InterlockedIncrement.KERNEL32(00000000), ref: 047EB531
InterlockedIncrement.KERNEL32(0000000A), ref: 047EB56B
InterlockedIncrement.KERNEL32(0000000A), ref: 047EB5AB

Strings

CExpWebsites::ShowDetails, xrefs: 047EB46D
One or more images failed to upload, xrefs: 047EB472

Memory Dump Source

Source File: 00000014.00000002.2526268174.00000000047E1000.00000020.00000001.01000000.00000016.sdmp, Offset: 047E0000, based on PE: true

Associated: 00000014.00000002.2526187657.00000000047E0000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000014.00000002.2533437740.000000000488F000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000014.00000002.2535246598.00000000048AB000.00000004.00000001.01000000.00000016.sdmpDownload File
Associated: 00000014.00000002.2535569716.00000000048B3000.00000008.00000001.01000000.00000016.sdmpDownload File
Associated: 00000014.00000002.2535640427.00000000048B5000.00000004.00000001.01000000.00000016.sdmpDownload File
Associated: 00000014.00000002.2536317728.00000000048C0000.00000002.00000001.01000000.00000016.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_47e0000_Picasa3.jbxd

Similarity

API ID: IncrementInterlocked
String ID: CExpWebsites::ShowDetails$One or more images failed to upload
API String ID: 3508698243-3037643549
Opcode ID: 62b91c84c992fc3e5c65a3ea171d2e6afd693ee361512d3a0edb7bffcc2d8878
Instruction ID: bea82d5fed5e3cbd9b23b614232d2fbd74841ec5aa1b65a93d09f36fe937c649
Opcode Fuzzy Hash: 62b91c84c992fc3e5c65a3ea171d2e6afd693ee361512d3a0edb7bffcc2d8878
Instruction Fuzzy Hash: ED51B2726043524BE710DF66C980A7BB7E5AF89704F440E29E991E7341DB74FA098BE2

Function 033C9900 Relevance: 14.2, APIs: 1, Strings: 7, Instructions: 154COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 033C9A23

Part of subcall function 033CDD30: __vsnprintf.LIBCMT ref: 033CDD5E

Strings

arap, xrefs: 033C99B9
arap, xrefs: 033C994D
Unknow curve type '%s', xrefs: 033C9AA0
vruc, xrefs: 033C99B1
arap, xrefs: 033C9A59
r, xrefs: 033C9A7E
vruc, xrefs: 033C9961

Memory Dump Source

Source File: 00000014.00000002.2494020967.00000000033B1000.00000020.00000001.01000000.00000015.sdmp, Offset: 033B0000, based on PE: true

Associated: 00000014.00000002.2493917908.00000000033B0000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000014.00000002.2497615129.00000000033F3000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000014.00000002.2498110795.0000000003400000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000014.00000002.2498410969.0000000003406000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000014.00000002.2498556459.0000000003408000.00000008.00000001.01000000.00000015.sdmpDownload File
Associated: 00000014.00000002.2498718201.000000000340A000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000014.00000002.2499166516.0000000003411000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_33b0000_Picasa3.jbxd

Similarity

API ID: __vsnprintf_memset
String ID: Unknow curve type '%s'$arap$arap$arap$r$vruc$vruc
API String ID: 2559201795-1656342419
Opcode ID: 2cf5e950d2481bb14d8d607e6725b049e03a9f60bf19af78efe07336fea4a930
Instruction ID: 7cf2ab1c7b0d16554df67be4f5d0e0c97cc4fa092cd2aaf9a5292f87802f6c63
Opcode Fuzzy Hash: 2cf5e950d2481bb14d8d607e6725b049e03a9f60bf19af78efe07336fea4a930
Instruction Fuzzy Hash: 045170755183819FC714CF58D881A5BBBE5AFC8310F088A5DF9988B341D730E949CB93

Function 0404E260 Relevance: 14.2, APIs: 1, Strings: 7, Instructions: 154COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 0404E383

Part of subcall function 0404A590: __vsnprintf.LIBCMT ref: 0404A5BE

Strings

vruc, xrefs: 0404E311
vruc, xrefs: 0404E2C1
r, xrefs: 0404E3DE
arap, xrefs: 0404E319
arap, xrefs: 0404E2AD
Unknow curve type '%s', xrefs: 0404E400
arap, xrefs: 0404E3B9

Memory Dump Source

Source File: 00000014.00000002.2502041842.0000000004031000.00000020.00000001.01000000.00000017.sdmp, Offset: 04030000, based on PE: true

Associated: 00000014.00000002.2501986218.0000000004030000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000014.00000002.2504208079.0000000004079000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000014.00000002.2504943590.0000000004086000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000014.00000002.2505148754.000000000408E000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000014.00000002.2505282171.0000000004090000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000014.00000002.2505501725.0000000004097000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_4030000_Picasa3.jbxd

Similarity

API ID: __vsnprintf_memset
String ID: Unknow curve type '%s'$arap$arap$arap$r$vruc$vruc
API String ID: 2559201795-1656342419
Opcode ID: ecbe9f3beafad9e646cb212f274ff1e58ca863edcc7743b88863979833ecb852
Instruction ID: 16a821e707c55b4d8dc49e459b58b9711cc97c6811aabd2296c3ed0cbbe6eef0
Opcode Fuzzy Hash: ecbe9f3beafad9e646cb212f274ff1e58ca863edcc7743b88863979833ecb852
Instruction Fuzzy Hash: 45517CB16083419FD714CF68D481A9BBBE4BBC8314F048A6DF9999B241D770E949CBA3

Function 04037DD0 Relevance: 14.2, APIs: 6, Strings: 2, Instructions: 154COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(040923C4,00000001,00000000,00000000,?,?,04042FE3,January,00000000,?,040360D0), ref: 04037E03
InterlockedIncrement.KERNEL32(00000000), ref: 04037E77
InterlockedIncrement.KERNEL32(00000000), ref: 04037E94
InterlockedIncrement.KERNEL32(?), ref: 04037F27

Part of subcall function 04037C70: InitializeCriticalSection.KERNEL32(040923C4,January,04037DEF,00000001,00000000,00000000,?,?,04042FE3,January,00000000,?,040360D0), ref: 04037C76

InterlockedIncrement.KERNEL32(?), ref: 04037F44
LeaveCriticalSection.KERNEL32(040923C4), ref: 04037F99

Strings

January, xrefs: 04037E23
ru, xrefs: 04037E77, 04037E94, 04037F27, 04037F44

Memory Dump Source

Source File: 00000014.00000002.2502041842.0000000004031000.00000020.00000001.01000000.00000017.sdmp, Offset: 04030000, based on PE: true

Associated: 00000014.00000002.2501986218.0000000004030000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000014.00000002.2504208079.0000000004079000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000014.00000002.2504943590.0000000004086000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000014.00000002.2505148754.000000000408E000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000014.00000002.2505282171.0000000004090000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000014.00000002.2505501725.0000000004097000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_4030000_Picasa3.jbxd

Similarity

API ID: IncrementInterlocked$CriticalSection$EnterInitializeLeave
String ID: January$ru
API String ID: 3455402115-3627732855
Opcode ID: 649524d58d2cceb22938fa16a67cca8b0d19fa6d4a647da72f6b37e574034303
Instruction ID: 8e24c310820c80d3a3b37c527b59531309bb1d3b156974f87d5116e73b947e7a
Opcode Fuzzy Hash: 649524d58d2cceb22938fa16a67cca8b0d19fa6d4a647da72f6b37e574034303
Instruction Fuzzy Hash: 99519AB16043129FD704DF25C48066ABBE9BF8935AF14C96CE855BB240EB35FC05CBA2

Function 048385C0 Relevance: 14.2, APIs: 4, Strings: 4, Instructions: 154timeCOMMON

Download Yara Rule

APIs

VariantTimeToSystemTime.OLEAUT32(?), ref: 048385E8
TzSpecificLocalTimeToSystemTime.KERNEL32(00000000,?,?), ref: 048385FA
InterlockedIncrement.KERNEL32(?), ref: 04838719
InterlockedIncrement.KERNEL32(?), ref: 0483874C

Part of subcall function 047E3430: InterlockedDecrement.KERNEL32(00000000), ref: 047E3442
Part of subcall function 047E3430: InterlockedIncrement.KERNEL32(00000000), ref: 047E345E

Strings

HH:mm:ss , xrefs: 04838682
%+.2d%.2d, xrefs: 048386EE
wwww, xrefs: 048386D9
d MMM yyyy , xrefs: 04838637

Memory Dump Source

Source File: 00000014.00000002.2526268174.00000000047E1000.00000020.00000001.01000000.00000016.sdmp, Offset: 047E0000, based on PE: true

Associated: 00000014.00000002.2526187657.00000000047E0000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000014.00000002.2533437740.000000000488F000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000014.00000002.2535246598.00000000048AB000.00000004.00000001.01000000.00000016.sdmpDownload File
Associated: 00000014.00000002.2535569716.00000000048B3000.00000008.00000001.01000000.00000016.sdmpDownload File
Associated: 00000014.00000002.2535640427.00000000048B5000.00000004.00000001.01000000.00000016.sdmpDownload File
Associated: 00000014.00000002.2536317728.00000000048C0000.00000002.00000001.01000000.00000016.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_47e0000_Picasa3.jbxd

Similarity

API ID: InterlockedTime$Increment$System$DecrementLocalSpecificVariant
String ID: %+.2d%.2d$HH:mm:ss $d MMM yyyy $wwww
API String ID: 292237772-418997072
Opcode ID: 14a656ac01e86b572e96f05a7535ec4e94ef3480e7b47bb61baceab25413b216
Instruction ID: a3e2ce5b52f91ec9aaf594efb458558c30e7c04e9b4fff7aec44d40e267b7980
Opcode Fuzzy Hash: 14a656ac01e86b572e96f05a7535ec4e94ef3480e7b47bb61baceab25413b216
Instruction Fuzzy Hash: FC5180712142059FE304EF65CD45B6BB7E9AF84705F048E2DF985D7280EBB4F9098BA2

Function 033B3B77 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 109stringregistryCOMMON

Download Yara Rule

APIs

lstrcmpiA.KERNEL32(033B2987,Delete), ref: 033B3B94
lstrcmpiA.KERNEL32(033B2987,ForceRemove), ref: 033B3BA5
CharNextA.USER32(033B2987,033B2987), ref: 033B3BE1
lstrcmpiA.KERNEL32(033B2987,033B2987), ref: 033B3BFC
lstrcmpiA.KERNEL32(033B2987,NoRemove), ref: 033B3C4F
lstrcmpiA.KERNEL32(033B2987,Val), ref: 033B3C77
lstrlenA.KERNEL32(033B2987,033B2987,?), ref: 033B3CF1
RegOpenKeyExA.ADVAPI32(?,00000000,00000000,00020006,00000000,033B2987,?), ref: 033B3D65
RegDeleteValueA.ADVAPI32(?,?), ref: 033B3D80
RegCloseKey.ADVAPI32(?), ref: 033B3D98
CharNextA.USER32(033B2987), ref: 033B3DBA
RegOpenKeyExA.ADVAPI32(?,033B2987,00000000,0002001F,?), ref: 033B3DF0
RegCloseKey.ADVAPI32(033B2987,033B2987), ref: 033B3F92

Strings

Delete, xrefs: 033B3B86
ForceRemove, xrefs: 033B3B9A

Memory Dump Source

Source File: 00000014.00000002.2494020967.00000000033B1000.00000020.00000001.01000000.00000015.sdmp, Offset: 033B0000, based on PE: true

Associated: 00000014.00000002.2493917908.00000000033B0000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000014.00000002.2497615129.00000000033F3000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000014.00000002.2498110795.0000000003400000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000014.00000002.2498410969.0000000003406000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000014.00000002.2498556459.0000000003408000.00000008.00000001.01000000.00000015.sdmpDownload File
Associated: 00000014.00000002.2498718201.000000000340A000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000014.00000002.2499166516.0000000003411000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_33b0000_Picasa3.jbxd

Similarity

API ID: lstrcmpi$CharCloseNextOpen$DeleteValuelstrlen
String ID: Delete$ForceRemove
API String ID: 3924739848-3704084903
Opcode ID: 06f0d62051abdfac58f66b6f95d0a340058eb1334b2c2d9a9f70f8427dbd7c28
Instruction ID: 671df53e1cea2963609d0cdb828b0d9a3455561ddf5fc4d7b83b6743d5aad8c0
Opcode Fuzzy Hash: 06f0d62051abdfac58f66b6f95d0a340058eb1334b2c2d9a9f70f8427dbd7c28
Instruction Fuzzy Hash: 3F31853EE043759FD725DA94DCD06ABB3F8EF45A60F080A1DFA459B640DB64DC048791

Function 033E32A5 Relevance: 13.7, APIs: 9, Instructions: 186COMMONLIBRARYCODE

Download Yara Rule

APIs

GetStartupInfoA.KERNEL32(?), ref: 033E32BA
__calloc_crt.LIBCMT ref: 033E32CD

Part of subcall function 033E2DFB: __calloc_impl.LIBCMT ref: 033E2E09
Part of subcall function 033E2DFB: Sleep.KERNEL32(00000000,?,033DC7F4,?), ref: 033E2E20

__calloc_crt.LIBCMT ref: 033E3350
GetFileType.KERNEL32(00000038,?,?,00000001,?,?,033DD365,00000001,?,?,033FDA28,0000000C,033DD41F,?), ref: 033E33D0
___crtInitCritSecAndSpinCount.LIBCMT ref: 033E3404
GetStdHandle.KERNEL32(-000000F6,?,?,00000001,?,?,033DD365,00000001,?,?,033FDA28,0000000C,033DD41F,?), ref: 033E345A
GetFileType.KERNEL32(00000000,?,?,00000001,?,?,033DD365,00000001,?,?,033FDA28,0000000C,033DD41F,?), ref: 033E346C
___crtInitCritSecAndSpinCount.LIBCMT ref: 033E349A
SetHandleCount.KERNEL32 ref: 033E34C4

Memory Dump Source

Source File: 00000014.00000002.2494020967.00000000033B1000.00000020.00000001.01000000.00000015.sdmp, Offset: 033B0000, based on PE: true

Associated: 00000014.00000002.2493917908.00000000033B0000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000014.00000002.2497615129.00000000033F3000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000014.00000002.2498110795.0000000003400000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000014.00000002.2498410969.0000000003406000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000014.00000002.2498556459.0000000003408000.00000008.00000001.01000000.00000015.sdmpDownload File
Associated: 00000014.00000002.2498718201.000000000340A000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000014.00000002.2499166516.0000000003411000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_33b0000_Picasa3.jbxd

Similarity

API ID: Count$CritFileHandleInitSpinType___crt__calloc_crt$InfoSleepStartup__calloc_impl
String ID:
API String ID: 1318386821-0
Opcode ID: c9efbc1e5f6f6de5f786ee96130e83d88649c8fd5b0bbaa29ba00668d392c430
Instruction ID: 90dff0b46bbc94a38db5f79cb7727d31271c605ec498f4f5cf90b0c0122e80c1
Opcode Fuzzy Hash: c9efbc1e5f6f6de5f786ee96130e83d88649c8fd5b0bbaa29ba00668d392c430
Instruction Fuzzy Hash: CD61053A9087618EC726CB68DCC4B29BBE4AF06330F2D4759D4669B2D5DB34D481CF11

Function 0406621A Relevance: 13.7, APIs: 9, Instructions: 186COMMONLIBRARYCODE

Download Yara Rule

APIs

GetStartupInfoA.KERNEL32(?), ref: 0406622F
__calloc_crt.LIBCMT ref: 04066242

Part of subcall function 04064B92: __calloc_impl.LIBCMT ref: 04064BA0
Part of subcall function 04064B92: Sleep.KERNEL32(00000000,00000000,?,00000000), ref: 04064BB7

__calloc_crt.LIBCMT ref: 040662C5
GetFileType.KERNEL32(00000038,?,?,00000001,?,?,040614F7,00000001,?,?,040837A0,0000000C,040615B1,?), ref: 04066345
___crtInitCritSecAndSpinCount.LIBCMT ref: 04066379
GetStdHandle.KERNEL32(-000000F6,?,?,00000001,?,?,040614F7,00000001,?,?,040837A0,0000000C,040615B1,?), ref: 040663CF
GetFileType.KERNEL32(00000000,?,?,00000001,?,?,040614F7,00000001,?,?,040837A0,0000000C,040615B1,?), ref: 040663E1
___crtInitCritSecAndSpinCount.LIBCMT ref: 0406640F
SetHandleCount.KERNEL32 ref: 04066439

Memory Dump Source

Source File: 00000014.00000002.2502041842.0000000004031000.00000020.00000001.01000000.00000017.sdmp, Offset: 04030000, based on PE: true

Associated: 00000014.00000002.2501986218.0000000004030000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000014.00000002.2504208079.0000000004079000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000014.00000002.2504943590.0000000004086000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000014.00000002.2505148754.000000000408E000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000014.00000002.2505282171.0000000004090000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000014.00000002.2505501725.0000000004097000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_4030000_Picasa3.jbxd

Similarity

API ID: Count$CritFileHandleInitSpinType___crt__calloc_crt$InfoSleepStartup__calloc_impl
String ID:
API String ID: 1318386821-0
Opcode ID: 09be09198227cf13329bce1497ea55a9d6b44e0f41558ef33436d8dfee3f62f7
Instruction ID: 9e7de6f8b5a3ddd9d06020a28c72af22ffd9f5f841cb588c0741970abd6986dd
Opcode Fuzzy Hash: 09be09198227cf13329bce1497ea55a9d6b44e0f41558ef33436d8dfee3f62f7
Instruction Fuzzy Hash: 916123719047118FD7608F28C8447597BE0AB52324F294F69D9A7BB2E1EB3AF842CB11

Function 04041C50 Relevance: 13.6, APIs: 9, Instructions: 88memoryCOMMON

Download Yara Rule

APIs

FindResourceA.KERNEL32(00000000,?,00000005), ref: 04041C73
LoadResource.KERNEL32(00000000,00000000,?,?,040334EB,00000000), ref: 04041C93
LockResource.KERNEL32(00000000,?,?,?,?,040334EB,00000000), ref: 04041CA4
SizeofResource.KERNEL32(00000000,00000000,?,?,?,?,040334EB,00000000), ref: 04041CCB
GlobalAlloc.KERNEL32(00000040,00000000,?,?,?,?,040334EB,00000000), ref: 04041CD6
GlobalLock.KERNEL32(00000000), ref: 04041CDF
SizeofResource.KERNEL32(00000000,00000000,?,?,?,?,040334EB,00000000), ref: 04041D12
GlobalAlloc.KERNEL32(00000040,00000000,?,?,?,?,040334EB,00000000), ref: 04041D1D
GlobalLock.KERNEL32(00000000), ref: 04041D26

Memory Dump Source

Source File: 00000014.00000002.2502041842.0000000004031000.00000020.00000001.01000000.00000017.sdmp, Offset: 04030000, based on PE: true

Associated: 00000014.00000002.2501986218.0000000004030000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000014.00000002.2504208079.0000000004079000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000014.00000002.2504943590.0000000004086000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000014.00000002.2505148754.000000000408E000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000014.00000002.2505282171.0000000004090000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000014.00000002.2505501725.0000000004097000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_4030000_Picasa3.jbxd

Similarity

API ID: Resource$Global$Lock$AllocSizeof$FindLoad
String ID:
API String ID: 915916825-0
Opcode ID: 559476bb65660ddd9a8499e14a01a4a4e37b2b81d8c7d09e39c9e341ba27bce2
Instruction ID: 689b3ae5e14279f494f89095eda7e660ed609e1ad2d2aff8efe658780cbfc3d8
Opcode Fuzzy Hash: 559476bb65660ddd9a8499e14a01a4a4e37b2b81d8c7d09e39c9e341ba27bce2
Instruction Fuzzy Hash: 42213EF2A01211BBEB249E65AC4CE567BECEB85795B004879F505FB200D77C9C548761

Function 04031D40 Relevance: 13.6, APIs: 9, Instructions: 81windowCOMMON

Download Yara Rule

APIs

CheckDlgButton.USER32(?,00000461,00000000), ref: 04031D5D
CheckDlgButton.USER32(?,00000460,00000000), ref: 04031D73
GetDlgItem.USER32(?,0000043C), ref: 04031D9E
SendMessageA.USER32(00000000,00000406,00000000,00020000), ref: 04031DBA
SendMessageA.USER32(00000000,00000405,00000001,?), ref: 04031DC9
GetDlgItem.USER32(?,0000043C), ref: 04031DE8
EnableWindow.USER32(00000000), ref: 04031DF1
GetDlgItem.USER32(?,0000044B), ref: 04031E02
EnableWindow.USER32(00000000), ref: 04031E05

Memory Dump Source

Source File: 00000014.00000002.2502041842.0000000004031000.00000020.00000001.01000000.00000017.sdmp, Offset: 04030000, based on PE: true

Associated: 00000014.00000002.2501986218.0000000004030000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000014.00000002.2504208079.0000000004079000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000014.00000002.2504943590.0000000004086000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000014.00000002.2505148754.000000000408E000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000014.00000002.2505282171.0000000004090000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000014.00000002.2505501725.0000000004097000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_4030000_Picasa3.jbxd

Similarity

API ID: Item$ButtonCheckEnableMessageSendWindow
String ID:
API String ID: 498519149-0
Opcode ID: 538f521b51b41e814ae5b896c14279206a7649874aac11d97db5ceb6531c43af
Instruction ID: 93c51a368c0cd6244cf6986b2076de9e1aba52e622c299b8bd4ed94af8af39c2
Opcode Fuzzy Hash: 538f521b51b41e814ae5b896c14279206a7649874aac11d97db5ceb6531c43af
Instruction Fuzzy Hash: 6A2110B5240705AFE214DB25CC81E27B3E9EF8DB20F11C61CF256A77A0DA74F8418A65

Function 04044F50 Relevance: 13.6, APIs: 9, Instructions: 52COMMON

Download Yara Rule

APIs

FreeLibrary.KERNEL32(?,00000000,00000000,04042E8E,?,00000000,00000000,?,040362CD), ref: 04044F62
FreeLibrary.KERNEL32(?,00000000,00000000,04042E8E,?,00000000,00000000,?,040362CD), ref: 04044F6C
FreeLibrary.KERNEL32(?,00000000,00000000,04042E8E,?,00000000,00000000,?,040362CD), ref: 04044F76
FreeLibrary.KERNEL32(?,00000000,00000000,04042E8E,?,00000000,00000000,?,040362CD), ref: 04044F80
FreeLibrary.KERNEL32(?,00000000,00000000,04042E8E,?,00000000,00000000,?,040362CD), ref: 04044F8A
FreeLibrary.KERNEL32(?,00000000,00000000,04042E8E,?,00000000,00000000,?,040362CD), ref: 04044F94
FreeLibrary.KERNEL32(?,00000000,00000000,04042E8E,?,00000000,00000000,?,040362CD), ref: 04044F9E
FreeLibrary.KERNEL32(?,00000000,00000000,04042E8E,?,00000000,00000000,?,040362CD), ref: 04044FA8
FreeLibrary.KERNEL32(?,00000000,00000000,04042E8E,?,00000000,00000000,?,040362CD), ref: 04044FB1

Memory Dump Source

Source File: 00000014.00000002.2502041842.0000000004031000.00000020.00000001.01000000.00000017.sdmp, Offset: 04030000, based on PE: true

Associated: 00000014.00000002.2501986218.0000000004030000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000014.00000002.2504208079.0000000004079000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000014.00000002.2504943590.0000000004086000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000014.00000002.2505148754.000000000408E000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000014.00000002.2505282171.0000000004090000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000014.00000002.2505501725.0000000004097000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_4030000_Picasa3.jbxd

Similarity

API ID: FreeLibrary
String ID:
API String ID: 3664257935-0
Opcode ID: d90d9d33f9aadc4c3f077d6680031c8a5b141e97efb806ed1371a3bde7f2aef5
Instruction ID: f3f371bd615f9ab818fd46bc3ce0458e503ff3a78f40bb9b56d40ceba69d2d90
Opcode Fuzzy Hash: d90d9d33f9aadc4c3f077d6680031c8a5b141e97efb806ed1371a3bde7f2aef5
Instruction Fuzzy Hash: 4501B6B1B047155B9AB0BE7FDD44F2BF3ECAED065030A0929E845F3560DB64F800A970

Function 033C0C30 Relevance: 12.6, APIs: 3, Strings: 4, Instructions: 338COMMON

Download Yara Rule

APIs

__floor_pentium4.LIBCMT ref: 033C0EC7
__floor_pentium4.LIBCMT ref: 033C0F10

Part of subcall function 033EC940: ___libm_error_support.LIBCMT ref: 033EC9F5

__floor_pentium4.LIBCMT ref: 033C0F59

Strings

psca, xrefs: 033C0D85
m, xrefs: 033C0FDF
c, xrefs: 033C0FDA
smcl, xrefs: 033C0C72

Memory Dump Source

Source File: 00000014.00000002.2494020967.00000000033B1000.00000020.00000001.01000000.00000015.sdmp, Offset: 033B0000, based on PE: true

Associated: 00000014.00000002.2493917908.00000000033B0000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000014.00000002.2497615129.00000000033F3000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000014.00000002.2498110795.0000000003400000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000014.00000002.2498410969.0000000003406000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000014.00000002.2498556459.0000000003408000.00000008.00000001.01000000.00000015.sdmpDownload File
Associated: 00000014.00000002.2498718201.000000000340A000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000014.00000002.2499166516.0000000003411000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_33b0000_Picasa3.jbxd

Similarity

API ID: __floor_pentium4$___libm_error_support
String ID: c$m$psca$smcl
API String ID: 190838090-3591798003
Opcode ID: eb7755ef91780a5b0dd18b0bdf70b2d67287f5bfc41669d00aaca8060ba6d0a5
Instruction ID: 0a7571347691d8eec3e5cc6eecbaa9f567b915a4c7e92d8dc4c3e4a9a62c8d8b
Opcode Fuzzy Hash: eb7755ef91780a5b0dd18b0bdf70b2d67287f5bfc41669d00aaca8060ba6d0a5
Instruction Fuzzy Hash: 8BF18DA550D3D28AC316DF29949059BFFE1AFEA200F484D9EF8D443346C668D64CDBA3

Function 040453F0 Relevance: 12.6, APIs: 3, Strings: 4, Instructions: 338COMMON

Download Yara Rule

APIs

__floor_pentium4.LIBCMT ref: 04045687
__floor_pentium4.LIBCMT ref: 040456D0

Part of subcall function 04072E50: ___libm_error_support.LIBCMT ref: 04072F05

__floor_pentium4.LIBCMT ref: 04045719

Strings

m, xrefs: 0404579F
smcl, xrefs: 04045432
psca, xrefs: 04045545
c, xrefs: 0404579A

Memory Dump Source

Source File: 00000014.00000002.2502041842.0000000004031000.00000020.00000001.01000000.00000017.sdmp, Offset: 04030000, based on PE: true

Associated: 00000014.00000002.2501986218.0000000004030000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000014.00000002.2504208079.0000000004079000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000014.00000002.2504943590.0000000004086000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000014.00000002.2505148754.000000000408E000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000014.00000002.2505282171.0000000004090000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000014.00000002.2505501725.0000000004097000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_4030000_Picasa3.jbxd

Similarity

API ID: __floor_pentium4$___libm_error_support
String ID: c$m$psca$smcl
API String ID: 190838090-3591798003
Opcode ID: edfece8676770f2d48d8f4a16d0878e1521619760be7721ea5b8633876d7c918
Instruction ID: 98938e1017b92d97b3ddc2f6405e9927f47ce01451cf7fdac9784c27ec5b42bd
Opcode Fuzzy Hash: edfece8676770f2d48d8f4a16d0878e1521619760be7721ea5b8633876d7c918
Instruction Fuzzy Hash: 4CF19FA550D3D28BC316CF29949059BFFE1AFEA200F484D9EE4D543342D668D64CDBA3

Function 033B40C0 Relevance: 12.5, APIs: 5, Strings: 2, Instructions: 274stringCOMMON

Download Yara Rule

APIs

Part of subcall function 033B1DC0: InitializeCriticalSection.KERNEL32(?,DD3E23C0), ref: 033B1DFB

lstrlenA.KERNEL32(?), ref: 033B41CD
GetModuleHandleA.KERNEL32(00000000,?), ref: 033B427F
lstrlenW.KERNEL32(?,?,?), ref: 033B42DB

Part of subcall function 033B1BD0: MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000000,?,033B3559,00000000,?,?,?,00000000), ref: 033B1BE9

Part of subcall function 033B2DB0: lstrlenW.KERNEL32(?), ref: 033B2DDD
Part of subcall function 033B2DB0: lstrlenW.KERNEL32(REGISTRY,-00000001,?,00000002,00000000), ref: 033B2E4B

GetModuleFileNameA.KERNEL32(033B0000,?,00000104), ref: 033B4191

Part of subcall function 033B2670: EnterCriticalSection.KERNEL32(?), ref: 033B269F
Part of subcall function 033B2670: lstrlenW.KERNEL32(?), ref: 033B26B6

lstrlenA.KERNEL32(?,?,?), ref: 033B4338

Part of subcall function 033B7A70: _malloc.LIBCMT ref: 033B7A7E

Strings

Module, xrefs: 033B428D, 033B42F8
Module_Raw, xrefs: 033B4314

Memory Dump Source

Source File: 00000014.00000002.2494020967.00000000033B1000.00000020.00000001.01000000.00000015.sdmp, Offset: 033B0000, based on PE: true

Associated: 00000014.00000002.2493917908.00000000033B0000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000014.00000002.2497615129.00000000033F3000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000014.00000002.2498110795.0000000003400000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000014.00000002.2498410969.0000000003406000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000014.00000002.2498556459.0000000003408000.00000008.00000001.01000000.00000015.sdmpDownload File
Associated: 00000014.00000002.2498718201.000000000340A000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000014.00000002.2499166516.0000000003411000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_33b0000_Picasa3.jbxd

Similarity

API ID: lstrlen$CriticalModuleSection$ByteCharEnterFileHandleInitializeMultiNameWide_malloc
String ID: Module$Module_Raw
API String ID: 3030691692-3885325121
Opcode ID: ffe218c389da38b3d2b372241de8167c0f567d1d3ce9546b88c3cb6652ce803e
Instruction ID: 170da933ceac8826c2029b987f608e4b28bb158b78f519c4902ce5848310cae7
Opcode Fuzzy Hash: ffe218c389da38b3d2b372241de8167c0f567d1d3ce9546b88c3cb6652ce803e
Instruction Fuzzy Hash: 5EA19076D002188BDF20EFA5DCD09EEB7B9FF44340F584529D61AEB651EB30A905CBA4

Function 033D0C00 Relevance: 12.5, APIs: 4, Strings: 3, Instructions: 222COMMON

Download Yara Rule

APIs

__floor_pentium4.LIBCMT ref: 033D0CDB
__floor_pentium4.LIBCMT ref: 033D0CF2
__floor_pentium4.LIBCMT ref: 033D0D09
__floor_pentium4.LIBCMT ref: 033D0D1E

Part of subcall function 033CDD30: __vsnprintf.LIBCMT ref: 033CDD5E

Strings

(internal) Attempt to PatchLUT on non-lut MPE, xrefs: 033D0C24
(internal) %d Channels are not supported on PatchLUT, xrefs: 033D0E6D
tulc, xrefs: 033D0C0C

Memory Dump Source

Source File: 00000014.00000002.2494020967.00000000033B1000.00000020.00000001.01000000.00000015.sdmp, Offset: 033B0000, based on PE: true

Associated: 00000014.00000002.2493917908.00000000033B0000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000014.00000002.2497615129.00000000033F3000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000014.00000002.2498110795.0000000003400000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000014.00000002.2498410969.0000000003406000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000014.00000002.2498556459.0000000003408000.00000008.00000001.01000000.00000015.sdmpDownload File
Associated: 00000014.00000002.2498718201.000000000340A000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000014.00000002.2499166516.0000000003411000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_33b0000_Picasa3.jbxd

Similarity

API ID: __floor_pentium4$__vsnprintf
String ID: (internal) %d Channels are not supported on PatchLUT$(internal) Attempt to PatchLUT on non-lut MPE$tulc
API String ID: 948451356-622667751
Opcode ID: dec81082706ee0ab0ccee6ee7082b3a387b770b4c194f7174dca92257ec7b80a
Instruction ID: 85d0f2123a39c6f31d089dfa72ead7775136bcda3bdcd7081b4a37dd27ecd8e8
Opcode Fuzzy Hash: dec81082706ee0ab0ccee6ee7082b3a387b770b4c194f7174dca92257ec7b80a
Instruction Fuzzy Hash: C2712372A087018BC708EF25E68565EF7E8FFC4B20F51895DE5C5966A4D731E824CB82

Function 04055FD0 Relevance: 12.5, APIs: 4, Strings: 3, Instructions: 222COMMON

Download Yara Rule

APIs

__floor_pentium4.LIBCMT ref: 040560AB
__floor_pentium4.LIBCMT ref: 040560C2
__floor_pentium4.LIBCMT ref: 040560D9
__floor_pentium4.LIBCMT ref: 040560EE

Part of subcall function 0404A590: __vsnprintf.LIBCMT ref: 0404A5BE

Strings

(internal) %d Channels are not supported on PatchLUT, xrefs: 0405623D
(internal) Attempt to PatchLUT on non-lut MPE, xrefs: 04055FF4
tulc, xrefs: 04055FDC

Memory Dump Source

Source File: 00000014.00000002.2502041842.0000000004031000.00000020.00000001.01000000.00000017.sdmp, Offset: 04030000, based on PE: true

Associated: 00000014.00000002.2501986218.0000000004030000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000014.00000002.2504208079.0000000004079000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000014.00000002.2504943590.0000000004086000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000014.00000002.2505148754.000000000408E000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000014.00000002.2505282171.0000000004090000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000014.00000002.2505501725.0000000004097000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_4030000_Picasa3.jbxd

Similarity

API ID: __floor_pentium4$__vsnprintf
String ID: (internal) %d Channels are not supported on PatchLUT$(internal) Attempt to PatchLUT on non-lut MPE$tulc
API String ID: 948451356-622667751
Opcode ID: 5e8120b8d926219d47183040b84f83865ac922127b4cd563e2c74f3ecc6761d6
Instruction ID: 6f16fb4a925c2b84da103434bd19690d74b84115d30bbea119ff49e399ecec0d
Opcode Fuzzy Hash: 5e8120b8d926219d47183040b84f83865ac922127b4cd563e2c74f3ecc6761d6
Instruction Fuzzy Hash: 94715431A087019BD708AF21D64465BB7F4FFC4319F518D6DE9C9A2260EB32E824CB87

Function 047F9570 Relevance: 12.4, APIs: 1, Strings: 6, Instructions: 197COMMON

Download Yara Rule

APIs

Part of subcall function 047E3430: InterlockedDecrement.KERNEL32(00000000), ref: 047E3442
Part of subcall function 047E3430: InterlockedIncrement.KERNEL32(00000000), ref: 047E345E

InterlockedIncrement.KERNEL32(?), ref: 047F95B3

Strings

.@-|_/:, xrefs: 047F957B
Failed to load configuration file, xrefs: 047F968B
CUploadProgram::ParseXmlVersErr, xrefs: 047F96E8
CUploadProgram::ParseXmlErr, xrefs: 047F9686
Picasa upgrade required, xrefs: 047F96ED
utf-8, xrefs: 047F95D7

Memory Dump Source

Source File: 00000014.00000002.2526268174.00000000047E1000.00000020.00000001.01000000.00000016.sdmp, Offset: 047E0000, based on PE: true

Associated: 00000014.00000002.2526187657.00000000047E0000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000014.00000002.2533437740.000000000488F000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000014.00000002.2535246598.00000000048AB000.00000004.00000001.01000000.00000016.sdmpDownload File
Associated: 00000014.00000002.2535569716.00000000048B3000.00000008.00000001.01000000.00000016.sdmpDownload File
Associated: 00000014.00000002.2535640427.00000000048B5000.00000004.00000001.01000000.00000016.sdmpDownload File
Associated: 00000014.00000002.2536317728.00000000048C0000.00000002.00000001.01000000.00000016.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_47e0000_Picasa3.jbxd

Similarity

API ID: Interlocked$Increment$Decrement
String ID: .@-|_/:$CUploadProgram::ParseXmlErr$CUploadProgram::ParseXmlVersErr$Failed to load configuration file$Picasa upgrade required$utf-8
API String ID: 4289621856-395172427
Opcode ID: 8e5c2379fc4379f05757d6def5fc3357a198b14805adf109b9e7040733e97734
Instruction ID: 97310ebd8586c12d7cd59571707cbceef352f276c51b1b6f1d392235b818d3f9
Opcode Fuzzy Hash: 8e5c2379fc4379f05757d6def5fc3357a198b14805adf109b9e7040733e97734
Instruction Fuzzy Hash: D45138F25003019FDB10EF64EC8066BB7A4AF85358F444E2DEA4697341E675F909CBA3

Function 0481E400 Relevance: 12.4, APIs: 1, Strings: 6, Instructions: 156COMMON

Download Yara Rule

APIs

InterlockedIncrement.KERNEL32(?), ref: 0481E460

Strings

Proxy config url: %s, xrefs: 0481E596
Proxy information for connection: %s, xrefs: 0481E498
Using direct connection, xrefs: 0481E4B0
Auto-detect proxy: Last detected proxy: %s, xrefs: 0481E4DF, 0481E4F1, 0481E506
Manual proxy: %sBypass urls: %s, xrefs: 0481E560
Proxy information for default connection:, xrefs: 0481E424

Memory Dump Source

Source File: 00000014.00000002.2526268174.00000000047E1000.00000020.00000001.01000000.00000016.sdmp, Offset: 047E0000, based on PE: true

Associated: 00000014.00000002.2526187657.00000000047E0000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000014.00000002.2533437740.000000000488F000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000014.00000002.2535246598.00000000048AB000.00000004.00000001.01000000.00000016.sdmpDownload File
Associated: 00000014.00000002.2535569716.00000000048B3000.00000008.00000001.01000000.00000016.sdmpDownload File
Associated: 00000014.00000002.2535640427.00000000048B5000.00000004.00000001.01000000.00000016.sdmpDownload File
Associated: 00000014.00000002.2536317728.00000000048C0000.00000002.00000001.01000000.00000016.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_47e0000_Picasa3.jbxd

Similarity

API ID: IncrementInterlocked
String ID: Auto-detect proxy: Last detected proxy: %s$Manual proxy: %sBypass urls: %s$Proxy config url: %s$Proxy information for connection: %s$Proxy information for default connection:$Using direct connection
API String ID: 3508698243-975716609
Opcode ID: 5d91fca1511a88b2faddc80535d090c219dc420acd0b3571cdb467d307d761a1
Instruction ID: f71f0f65701018e16b93a88d57fd3ac90f5bc6c41870e3b178576c0962cd5300
Opcode Fuzzy Hash: 5d91fca1511a88b2faddc80535d090c219dc420acd0b3571cdb467d307d761a1
Instruction Fuzzy Hash: F6516C716046069AEB24CE15D944BBA779CAF80748F488F2AFC17E7161F770F9089A62

Function 048405A0 Relevance: 12.4, APIs: 4, Strings: 3, Instructions: 156COMMON

Download Yara Rule

APIs

FindMimeFromData.URLMON(00000000,00000000,00000000,?,00000000,00000000,?,00000000), ref: 048405C0
WideCharToMultiByte.KERNEL32(0000FDE9,00000000,?,000000FF,00000000,00000000,00000000,00000000,?,00000000,?,?,?,?,048234E2,?), ref: 048405EE
WideCharToMultiByte.KERNEL32(0000FDE9,00000000,?,000000FF,00000000,00000001,00000000,00000000,?,00000001,00000000,?,?,048234E2,?,?), ref: 0484061E
InterlockedIncrement.KERNEL32(?), ref: 048406C9

Strings

image/pjpeg, xrefs: 04840633, 0484066A, 04840677
application/octet-stream, xrefs: 04840727
image/jpeg, xrefs: 04840683

Memory Dump Source

Source File: 00000014.00000002.2526268174.00000000047E1000.00000020.00000001.01000000.00000016.sdmp, Offset: 047E0000, based on PE: true

Associated: 00000014.00000002.2526187657.00000000047E0000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000014.00000002.2533437740.000000000488F000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000014.00000002.2535246598.00000000048AB000.00000004.00000001.01000000.00000016.sdmpDownload File
Associated: 00000014.00000002.2535569716.00000000048B3000.00000008.00000001.01000000.00000016.sdmpDownload File
Associated: 00000014.00000002.2535640427.00000000048B5000.00000004.00000001.01000000.00000016.sdmpDownload File
Associated: 00000014.00000002.2536317728.00000000048C0000.00000002.00000001.01000000.00000016.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_47e0000_Picasa3.jbxd

Similarity

API ID: ByteCharMultiWide$DataFindFromIncrementInterlockedMime
String ID: application/octet-stream$image/jpeg$image/pjpeg
API String ID: 3936750583-3763301617
Opcode ID: 5c5a11de5684475edf5d2f0802e67e9a1b3f47b2bab8ca7d442af0d1b2d89ffc
Instruction ID: ce4905d46420b7f847a2f8f8eac24767ab9c7171294d9facdabdfc9cb85797c7
Opcode Fuzzy Hash: 5c5a11de5684475edf5d2f0802e67e9a1b3f47b2bab8ca7d442af0d1b2d89ffc
Instruction Fuzzy Hash: 3C41023660430D6BD760AE69C840B2B7799EBC2354F940F1CFA46E7240D776BC088BA2

Function 04032480 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 114COMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,0000043C), ref: 040324B6
EnableWindow.USER32(00000000), ref: 040324BD
GetDlgItem.USER32(?,0000044B), ref: 040324CD
EnableWindow.USER32(00000000), ref: 040324D4
InterlockedIncrement.KERNEL32(?), ref: 04032500
InterlockedIncrement.KERNEL32(?), ref: 0403255B

Strings

ru, xrefs: 04032500, 0403255B

Memory Dump Source

Source File: 00000014.00000002.2502041842.0000000004031000.00000020.00000001.01000000.00000017.sdmp, Offset: 04030000, based on PE: true

Associated: 00000014.00000002.2501986218.0000000004030000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000014.00000002.2504208079.0000000004079000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000014.00000002.2504943590.0000000004086000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000014.00000002.2505148754.000000000408E000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000014.00000002.2505282171.0000000004090000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000014.00000002.2505501725.0000000004097000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_4030000_Picasa3.jbxd

Similarity

API ID: EnableIncrementInterlockedItemWindow
String ID: ru
API String ID: 2317100856-1355688448
Opcode ID: 64bef1816f25743ac3f0b79365aff1d9af664d5acb9c6ce50710f01f87030133
Instruction ID: 85281d59deff774be873bb940dd80d38bc123077b43fb73d87e132a83d83dd4d
Opcode Fuzzy Hash: 64bef1816f25743ac3f0b79365aff1d9af664d5acb9c6ce50710f01f87030133
Instruction Fuzzy Hash: 6C31C7B2A002105BEB10AF24D89496F7B9DEF85326F04857CF945BB241DB38FD41CBA6

Function 04032200 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 59windowCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,0000043C), ref: 04032222
SendMessageA.USER32(00000000,00000400,00000000,00000000), ref: 04032237
_sprintf.LIBCMT ref: 0403226C
GetDlgItem.USER32(?,0000044B), ref: 0403227D
SetWindowTextA.USER32(00000000), ref: 0403228B

Strings

%d pixels, xrefs: 04032244
ytITivo::sliderpixels, xrefs: 0403223F

Memory Dump Source

Source File: 00000014.00000002.2502041842.0000000004031000.00000020.00000001.01000000.00000017.sdmp, Offset: 04030000, based on PE: true

Associated: 00000014.00000002.2501986218.0000000004030000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000014.00000002.2504208079.0000000004079000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000014.00000002.2504943590.0000000004086000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000014.00000002.2505148754.000000000408E000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000014.00000002.2505282171.0000000004090000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000014.00000002.2505501725.0000000004097000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_4030000_Picasa3.jbxd

Similarity

API ID: Item$MessageSendTextWindow_sprintf
String ID: %d pixels$ytITivo::sliderpixels
API String ID: 4245410161-989874553
Opcode ID: 1e208d114a87339f155e644585bfca4c0ceff231b7eed897654d9b7d7a1ae15e
Instruction ID: a52ea2716636e7a933c13e55c4848ef5f507f8619e136622f74e2a0bdd80aea5
Opcode Fuzzy Hash: 1e208d114a87339f155e644585bfca4c0ceff231b7eed897654d9b7d7a1ae15e
Instruction Fuzzy Hash: 131165B1A003016BF610EBB9DC85F2777ECEB44719F044D29B606F7180EA74F8048657

Function 033B3810 Relevance: 12.2, APIs: 8, Instructions: 157memorystringCOMMON

Download Yara Rule

APIs

lstrlenA.KERNEL32(?,00000000,?,?,00000000,?,?,?,?,?,?,?,?,033B3A0E,?,00000000), ref: 033B3843
CoTaskMemAlloc.OLE32(00000000,?,00000000,?,?,00000000,?,?,?,?,?,?,?,?,033B3A0E), ref: 033B386D
CharNextA.USER32(?,?,00000000,?,?,00000000,?,?,?,?,?,?,?,?,033B3A0E), ref: 033B389B
CharNextA.USER32(?,?,00000000,?,?,00000000,?,?,?,?,?,?,?,?,033B3A0E), ref: 033B38A7
CharNextA.USER32(?,?,?,?,00000000,?,?,00000000), ref: 033B38C2
CoTaskMemFree.OLE32(?,?,00000000,?,?,00000000,?,?,?,?,?,?,?,?,033B3A0E), ref: 033B38E2
CoTaskMemFree.OLE32(00000000,?,00000000,?,?,00000000,?,?,?,?,?,?,?,?,033B3A0E), ref: 033B3902

Memory Dump Source

Source File: 00000014.00000002.2494020967.00000000033B1000.00000020.00000001.01000000.00000015.sdmp, Offset: 033B0000, based on PE: true

Associated: 00000014.00000002.2493917908.00000000033B0000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000014.00000002.2497615129.00000000033F3000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000014.00000002.2498110795.0000000003400000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000014.00000002.2498410969.0000000003406000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000014.00000002.2498556459.0000000003408000.00000008.00000001.01000000.00000015.sdmpDownload File
Associated: 00000014.00000002.2498718201.000000000340A000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000014.00000002.2499166516.0000000003411000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_33b0000_Picasa3.jbxd

Similarity

API ID: CharNextTask$Free$Alloclstrlen
String ID:
API String ID: 2576018442-0
Opcode ID: c718bcc30bed400c720f23bd4ec76c8211f70a2305cc3f6a6538cdc2ac172abf
Instruction ID: 581f3761f0f2ce55c58dd829e9e42598456adcec7d2740ecd90df58d83e8dbb1
Opcode Fuzzy Hash: c718bcc30bed400c720f23bd4ec76c8211f70a2305cc3f6a6538cdc2ac172abf
Instruction Fuzzy Hash: EE519F7AA043259FC720EF689CC469BB7F8EF84720F480A6DE655DB640EB34D448C796

Function 047F7490 Relevance: 12.1, APIs: 8, Instructions: 146COMMON

Download Yara Rule

APIs

InterlockedDecrement.KERNEL32(00000001), ref: 047F74D5
InterlockedIncrement.KERNEL32(00000001), ref: 047F74ED
InterlockedDecrement.KERNEL32(?), ref: 047F7527
InterlockedIncrement.KERNEL32(?), ref: 047F753F
InterlockedDecrement.KERNEL32(?), ref: 047F7579
InterlockedIncrement.KERNEL32(?), ref: 047F7591
InterlockedDecrement.KERNEL32(?), ref: 047F75E1
InterlockedIncrement.KERNEL32(?), ref: 047F75F9

Memory Dump Source

Source File: 00000014.00000002.2526268174.00000000047E1000.00000020.00000001.01000000.00000016.sdmp, Offset: 047E0000, based on PE: true

Associated: 00000014.00000002.2526187657.00000000047E0000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000014.00000002.2533437740.000000000488F000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000014.00000002.2535246598.00000000048AB000.00000004.00000001.01000000.00000016.sdmpDownload File
Associated: 00000014.00000002.2535569716.00000000048B3000.00000008.00000001.01000000.00000016.sdmpDownload File
Associated: 00000014.00000002.2535640427.00000000048B5000.00000004.00000001.01000000.00000016.sdmpDownload File
Associated: 00000014.00000002.2536317728.00000000048C0000.00000002.00000001.01000000.00000016.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_47e0000_Picasa3.jbxd

Similarity

API ID: Interlocked$DecrementIncrement
String ID:
API String ID: 2172605799-0
Opcode ID: abc09a582aedd80864c4271d2131009096ce16cc55057ac4f67d6e969d02adb8
Instruction ID: f1b3d91755facf6d6cc03defba56d7ec6fa829155d904a3ae1cb46b24bc7d020
Opcode Fuzzy Hash: abc09a582aedd80864c4271d2131009096ce16cc55057ac4f67d6e969d02adb8
Instruction Fuzzy Hash: 2541E4F25006A25BDB299F28DC80639F761FF00305F648D2DE295A7741CB38F650ABE6

Function 047EC5C0 Relevance: 12.1, APIs: 8, Instructions: 142COMMON

Download Yara Rule

APIs

InterlockedDecrement.KERNEL32(?), ref: 047EC607
InterlockedIncrement.KERNEL32(?), ref: 047EC61F
InterlockedDecrement.KERNEL32(?), ref: 047EC657
InterlockedIncrement.KERNEL32(?), ref: 047EC66F
InterlockedDecrement.KERNEL32(?), ref: 047EC6A7
InterlockedIncrement.KERNEL32(?), ref: 047EC6BF
InterlockedDecrement.KERNEL32(?), ref: 047EC6F6
InterlockedIncrement.KERNEL32(?), ref: 047EC70E

Memory Dump Source

Source File: 00000014.00000002.2526268174.00000000047E1000.00000020.00000001.01000000.00000016.sdmp, Offset: 047E0000, based on PE: true

Associated: 00000014.00000002.2526187657.00000000047E0000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000014.00000002.2533437740.000000000488F000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000014.00000002.2535246598.00000000048AB000.00000004.00000001.01000000.00000016.sdmpDownload File
Associated: 00000014.00000002.2535569716.00000000048B3000.00000008.00000001.01000000.00000016.sdmpDownload File
Associated: 00000014.00000002.2535640427.00000000048B5000.00000004.00000001.01000000.00000016.sdmpDownload File
Associated: 00000014.00000002.2536317728.00000000048C0000.00000002.00000001.01000000.00000016.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_47e0000_Picasa3.jbxd

Similarity

API ID: Interlocked$DecrementIncrement
String ID:
API String ID: 2172605799-0
Opcode ID: e29bff25cd0afdfbe789877ce8e3440d7586a7c2d7bacd4ed1d838ff372a2b6a
Instruction ID: e914c6346d38dd0a117808089fa52ef08e876cc1e42a2385d66bd06c08f95084
Opcode Fuzzy Hash: e29bff25cd0afdfbe789877ce8e3440d7586a7c2d7bacd4ed1d838ff372a2b6a
Instruction Fuzzy Hash: 274138FA4001628FE7229E36C884B7BB7D4FF09240F148E34E495D7241EB2CFA10A7A5

Function 033B2130 Relevance: 12.1, APIs: 8, Instructions: 110registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32 ref: 033B2175
RegCloseKey.ADVAPI32(?), ref: 033B218A
RegEnumKeyExA.ADVAPI32(00000000,00000000,?,00000000,00000000,00000000,00000000,DD3E23C0), ref: 033B21D2
RegEnumKeyExA.ADVAPI32(0002001F,00000000,?,00000000,00000000,00000000,00000000,DD3E23C0), ref: 033B2214
RegCloseKey.ADVAPI32(?), ref: 033B2227
RegDeleteKeyA.ADVAPI32(?,?), ref: 033B223A
RegCloseKey.ADVAPI32(?), ref: 033B224B
RegCloseKey.ADVAPI32(?), ref: 033B2276

Memory Dump Source

Source File: 00000014.00000002.2494020967.00000000033B1000.00000020.00000001.01000000.00000015.sdmp, Offset: 033B0000, based on PE: true

Associated: 00000014.00000002.2493917908.00000000033B0000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000014.00000002.2497615129.00000000033F3000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000014.00000002.2498110795.0000000003400000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000014.00000002.2498410969.0000000003406000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000014.00000002.2498556459.0000000003408000.00000008.00000001.01000000.00000015.sdmpDownload File
Associated: 00000014.00000002.2498718201.000000000340A000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000014.00000002.2499166516.0000000003411000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_33b0000_Picasa3.jbxd

Similarity

API ID: Close$Enum$DeleteOpen
String ID:
API String ID: 3743465055-0
Opcode ID: c9e110fae59701433ebd39fb287bc506602556a4b83a503d62317894fcc9c04d
Instruction ID: 682fcf33c7286f2dfb8bd5351a48369358ddfcee34b8e12b4e9a3ac980d82abe
Opcode Fuzzy Hash: c9e110fae59701433ebd39fb287bc506602556a4b83a503d62317894fcc9c04d
Instruction Fuzzy Hash: E53116B5608306AFD720DF25DC84FABB7FCAB88750F044A1DBA85D7640D774E9048BA2

Function 033BB270 Relevance: 12.1, APIs: 8, Instructions: 55synchronizationthreadCOMMON

Download Yara Rule

APIs

InterlockedExchange.KERNEL32(?,00000001), ref: 033BB28D

Part of subcall function 033BB0A0: GetCurrentThreadId.KERNEL32 ref: 033BB0B0
Part of subcall function 033BB0A0: GetCurrentThreadId.KERNEL32 ref: 033BB11E

InterlockedExchange.KERNEL32(?,00000000), ref: 033BB2A1
WaitForSingleObject.KERNEL32(00000000,000000FF,?,?,?,033BA494), ref: 033BB2AC
TerminateThread.KERNEL32(00000000,00000000,?,?,?,033BA494), ref: 033BB2BC
CloseHandle.KERNEL32(00000000,?,?,?,033BA494), ref: 033BB2C3
InterlockedExchange.KERNEL32(?,00000000), ref: 033BB2D3
CloseHandle.KERNEL32(00000000,?,?,?,033BA494), ref: 033BB2DF
InterlockedExchange.KERNEL32(?,00000000), ref: 033BB2E8

Memory Dump Source

Source File: 00000014.00000002.2494020967.00000000033B1000.00000020.00000001.01000000.00000015.sdmp, Offset: 033B0000, based on PE: true

Associated: 00000014.00000002.2493917908.00000000033B0000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000014.00000002.2497615129.00000000033F3000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000014.00000002.2498110795.0000000003400000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000014.00000002.2498410969.0000000003406000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000014.00000002.2498556459.0000000003408000.00000008.00000001.01000000.00000015.sdmpDownload File
Associated: 00000014.00000002.2498718201.000000000340A000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000014.00000002.2499166516.0000000003411000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_33b0000_Picasa3.jbxd

Similarity

API ID: ExchangeInterlocked$Thread$CloseCurrentHandle$ObjectSingleTerminateWait
String ID:
API String ID: 3753039515-0
Opcode ID: a1d5b7c4ddbf8ea9f2c0088d56d551a4a8a0232495fa36b9d2435b342972a524
Instruction ID: d7d0243020ef5d63303bf80caed4ce06d87ba5ed85a43acd3e989583155cdc37
Opcode Fuzzy Hash: a1d5b7c4ddbf8ea9f2c0088d56d551a4a8a0232495fa36b9d2435b342972a524
Instruction Fuzzy Hash: 9501F232505619BFE310AAA5ACC8FDAF36CFB05731F944112F24686880CB29E08087E9

Function 0403DB10 Relevance: 12.1, APIs: 8, Instructions: 55synchronizationthreadCOMMON

Download Yara Rule

APIs

InterlockedExchange.KERNEL32(?,00000001), ref: 0403DB2D

Part of subcall function 0403D940: GetCurrentThreadId.KERNEL32 ref: 0403D950
Part of subcall function 0403D940: GetCurrentThreadId.KERNEL32 ref: 0403D9BE

InterlockedExchange.KERNEL32(?,00000000), ref: 0403DB41
WaitForSingleObject.KERNEL32(00000000,000000FF,?,?,?,04031495), ref: 0403DB4C
TerminateThread.KERNEL32(00000000,00000000,?,?,?,04031495), ref: 0403DB5C
CloseHandle.KERNEL32(00000000,?,?,?,04031495), ref: 0403DB63
InterlockedExchange.KERNEL32(?,00000000), ref: 0403DB73
CloseHandle.KERNEL32(00000000,?,?,?,04031495), ref: 0403DB7F
InterlockedExchange.KERNEL32(?,00000000), ref: 0403DB88

Memory Dump Source

Source File: 00000014.00000002.2502041842.0000000004031000.00000020.00000001.01000000.00000017.sdmp, Offset: 04030000, based on PE: true

Associated: 00000014.00000002.2501986218.0000000004030000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000014.00000002.2504208079.0000000004079000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000014.00000002.2504943590.0000000004086000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000014.00000002.2505148754.000000000408E000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000014.00000002.2505282171.0000000004090000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000014.00000002.2505501725.0000000004097000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_4030000_Picasa3.jbxd

Similarity

API ID: ExchangeInterlocked$Thread$CloseCurrentHandle$ObjectSingleTerminateWait
String ID:
API String ID: 3753039515-0
Opcode ID: c945a30e8997887e83ce928149d7fe5965e8339ba27169a8003175e904f40d33
Instruction ID: 3a728a8d664ab4e34a7d85cc807789c9e2f9cca3fb5bb3dbe27bf0dfe5123250
Opcode Fuzzy Hash: c945a30e8997887e83ce928149d7fe5965e8339ba27169a8003175e904f40d33
Instruction Fuzzy Hash: 6E0126B2905619BBF3506EA5AC48FCABB9CFF00336F104220F204B14C1CB2DB45197E6

Function 033B5EB0 Relevance: 10.9, APIs: 3, Strings: 3, Instructions: 403comCOMMON

Download Yara Rule

APIs

CoCreateInstance.OLE32(033F563C,00000000,00000017,033F5AD8,?), ref: 033B5F3C
InterlockedIncrement.KERNEL32(?), ref: 033B6035
SysFreeString.OLEAUT32(?), ref: 033B60C9

Part of subcall function 033B1000: InterlockedDecrement.KERNEL32(?), ref: 033B1012
Part of subcall function 033B1000: InterlockedIncrement.KERNEL32(?), ref: 033B102E

Part of subcall function 033B1060: RaiseException.KERNEL32(?,00000001,00000000,00000000,033B1D15,80004005), ref: 033B107C

Strings

Picasa, xrefs: 033B606F
PBw, xrefs: 033B5F3C
`cu, xrefs: 033B60C9

Memory Dump Source

Source File: 00000014.00000002.2494020967.00000000033B1000.00000020.00000001.01000000.00000015.sdmp, Offset: 033B0000, based on PE: true

Associated: 00000014.00000002.2493917908.00000000033B0000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000014.00000002.2497615129.00000000033F3000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000014.00000002.2498110795.0000000003400000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000014.00000002.2498410969.0000000003406000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000014.00000002.2498556459.0000000003408000.00000008.00000001.01000000.00000015.sdmpDownload File
Associated: 00000014.00000002.2498718201.000000000340A000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000014.00000002.2499166516.0000000003411000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_33b0000_Picasa3.jbxd

Similarity

API ID: Interlocked$Increment$CreateDecrementExceptionFreeInstanceRaiseString
String ID: Picasa$PBw$`cu
API String ID: 250903436-3793890988
Opcode ID: e1b5967431f8f6bc843d211d968a8b2d33079b808471d2d2018a4dc801eda29a
Instruction ID: 5a51fe43d3f71f445a172f2242b91a6ac55429de16a95cef23f9c7d86249e96b
Opcode Fuzzy Hash: e1b5967431f8f6bc843d211d968a8b2d33079b808471d2d2018a4dc801eda29a
Instruction Fuzzy Hash: 40E19C76A083008FD310DF29D8C0A9EF7F5AF89710F188A59F698DB651C735E946CB92

Function 0480E510 Relevance: 10.8, APIs: 5, Strings: 1, Instructions: 275timewindowCOMMON

Download Yara Rule

APIs

SendMessageA.USER32(?,0000130B,00000000,00000000), ref: 0480E598
TzSpecificLocalTimeToSystemTime.KERNEL32(00000000,?,?), ref: 0480E63E
SystemTimeToFileTime.KERNEL32(?,?), ref: 0480E64E
EndDialog.USER32(?,00000000), ref: 0480E770

Strings

open, xrefs: 0480E752

Memory Dump Source

Source File: 00000014.00000002.2526268174.00000000047E1000.00000020.00000001.01000000.00000016.sdmp, Offset: 047E0000, based on PE: true

Associated: 00000014.00000002.2526187657.00000000047E0000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000014.00000002.2533437740.000000000488F000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000014.00000002.2535246598.00000000048AB000.00000004.00000001.01000000.00000016.sdmpDownload File
Associated: 00000014.00000002.2535569716.00000000048B3000.00000008.00000001.01000000.00000016.sdmpDownload File
Associated: 00000014.00000002.2535640427.00000000048B5000.00000004.00000001.01000000.00000016.sdmpDownload File
Associated: 00000014.00000002.2536317728.00000000048C0000.00000002.00000001.01000000.00000016.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_47e0000_Picasa3.jbxd

Similarity

API ID: Time$System$DialogFileLocalMessageSendSpecific
String ID: open
API String ID: 3960583937-2758837156
Opcode ID: e9fb5d3bec053720434b4b3fef5bd86fb35792e258327ae55db832a2ac9af77e
Instruction ID: c4ec966cb09daeddb47130f302fb81a7e484c4bad363639b99e9b790a3da305f
Opcode Fuzzy Hash: e9fb5d3bec053720434b4b3fef5bd86fb35792e258327ae55db832a2ac9af77e
Instruction Fuzzy Hash: D481C0727106019BD664DA6CDC81F7BB398EF98320F148F6AFA14C73D2EA61F91186D1

Function 033B4420 Relevance: 10.7, APIs: 4, Strings: 2, Instructions: 228stringCOMMON

Download Yara Rule

APIs

Part of subcall function 033B1DC0: InitializeCriticalSection.KERNEL32(?,DD3E23C0), ref: 033B1DFB

lstrlenA.KERNEL32(?), ref: 033B452A
GetModuleHandleA.KERNEL32(00000000,?), ref: 033B45DB

Part of subcall function 033B7A70: _malloc.LIBCMT ref: 033B7A7E

lstrlenW.KERNEL32(?,?,?), ref: 033B4634

Part of subcall function 033B2670: LeaveCriticalSection.KERNEL32(?,-00000004,00000000,00000000,?,-00000001,?,00000002,00000000), ref: 033B2745

Part of subcall function 033B2C80: lstrlenW.KERNEL32(REGISTRY), ref: 033B2CA3
Part of subcall function 033B2C80: WideCharToMultiByte.KERNEL32(?,00000000,REGISTRY,000000FF,00000008,00000000,00000000,00000000), ref: 033B2D25

GetModuleFileNameA.KERNEL32(033B0000,?,00000104), ref: 033B44EE

Part of subcall function 033B2670: EnterCriticalSection.KERNEL32(?), ref: 033B269F
Part of subcall function 033B2670: lstrlenW.KERNEL32(?), ref: 033B26B6

Strings

Module, xrefs: 033B45E9, 033B4653
Module_Raw, xrefs: 033B4681

Memory Dump Source

Source File: 00000014.00000002.2494020967.00000000033B1000.00000020.00000001.01000000.00000015.sdmp, Offset: 033B0000, based on PE: true

Associated: 00000014.00000002.2493917908.00000000033B0000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000014.00000002.2497615129.00000000033F3000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000014.00000002.2498110795.0000000003400000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000014.00000002.2498410969.0000000003406000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000014.00000002.2498556459.0000000003408000.00000008.00000001.01000000.00000015.sdmpDownload File
Associated: 00000014.00000002.2498718201.000000000340A000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000014.00000002.2499166516.0000000003411000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_33b0000_Picasa3.jbxd

Similarity

API ID: lstrlen$CriticalSection$Module$ByteCharEnterFileHandleInitializeLeaveMultiNameWide_malloc
String ID: Module$Module_Raw
API String ID: 2079919627-3885325121
Opcode ID: 08398ff8cc3826fc7eb8fe135b8f7cc2a9a75ef2a41941ee64979a6f338dfb5b
Instruction ID: 1803472bdd8af8e2f52cd30b4062b88c6b691d2f55e003e5df2fef3c17f7fc90
Opcode Fuzzy Hash: 08398ff8cc3826fc7eb8fe135b8f7cc2a9a75ef2a41941ee64979a6f338dfb5b
Instruction Fuzzy Hash: 9B815EB5D002489FDB20EFA9DCC0AEEB7B8FF44300F54462AD615EB611EB30AA45CB55

Function 04040170 Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 225windowCOMMON

Download Yara Rule

APIs

GetParent.USER32(?), ref: 040401A4

Part of subcall function 04037A30: GetWindowRect.USER32(?,?), ref: 04037A64
Part of subcall function 04037A30: GetWindowRect.USER32(?,?), ref: 04037A83
Part of subcall function 04037A30: MoveWindow.USER32(?,?,?,?,?,00000000), ref: 04037ADC

SendMessageA.USER32(?,00000465,00000000,00000000), ref: 040401E3
InterlockedIncrement.KERNEL32(?), ref: 040403AB
GetDlgItem.USER32(?,00003742), ref: 040403F4
SendMessageA.USER32(?,00000465,00000000), ref: 0404042C

Strings

ru, xrefs: 040403AB

Memory Dump Source

Source File: 00000014.00000002.2502041842.0000000004031000.00000020.00000001.01000000.00000017.sdmp, Offset: 04030000, based on PE: true

Associated: 00000014.00000002.2501986218.0000000004030000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000014.00000002.2504208079.0000000004079000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000014.00000002.2504943590.0000000004086000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000014.00000002.2505148754.000000000408E000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000014.00000002.2505282171.0000000004090000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000014.00000002.2505501725.0000000004097000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_4030000_Picasa3.jbxd

Similarity

API ID: Window$MessageRectSend$IncrementInterlockedItemMoveParent
String ID: ru
API String ID: 3524986924-1355688448
Opcode ID: b38e232df7dc4e9cbf838864ded45b5df3a60c5f3690fbfcfdf96713eec4aed5
Instruction ID: 20f3a62871f212b49c2a696775cb921d2813a1fbb93ba363d29e77d3d80838eb
Opcode Fuzzy Hash: b38e232df7dc4e9cbf838864ded45b5df3a60c5f3690fbfcfdf96713eec4aed5
Instruction Fuzzy Hash: EC81A6F16043419BE721DF24C944BAB7BDDABC5309F048878EA85BB182DB78F945C792

Function 04040460 Relevance: 10.7, APIs: 4, Strings: 2, Instructions: 164COMMON

Download Yara Rule

APIs

CoTaskMemFree.OLE32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,0403252F), ref: 04040565
SHGetMalloc.SHELL32(?), ref: 04040576
InterlockedIncrement.KERNEL32(00000000), ref: 040405F9
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,0403252F,?), ref: 0404063E

Strings

A, xrefs: 04040495
ru, xrefs: 040405F9

Memory Dump Source

Source File: 00000014.00000002.2502041842.0000000004031000.00000020.00000001.01000000.00000017.sdmp, Offset: 04030000, based on PE: true

Associated: 00000014.00000002.2501986218.0000000004030000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000014.00000002.2504208079.0000000004079000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000014.00000002.2504943590.0000000004086000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000014.00000002.2505148754.000000000408E000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000014.00000002.2505282171.0000000004090000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000014.00000002.2505501725.0000000004097000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_4030000_Picasa3.jbxd

Similarity

API ID: ErrorFreeIncrementInterlockedLastMallocTask
String ID: A$ru
API String ID: 2722844880-2013471278
Opcode ID: 025f102e65f65dde552abac143c7417f8ad9f21f3a2f5f84cf509466f47fd4be
Instruction ID: 6a5b921118c3e27643c21a44249677d470534b9bd9e83f1da3c97934452c0118
Opcode Fuzzy Hash: 025f102e65f65dde552abac143c7417f8ad9f21f3a2f5f84cf509466f47fd4be
Instruction Fuzzy Hash: 5B5157B15083419FD350EF29D840A9BBBE4EBC9748F44487DE685B7211DB39B948CBA2

Function 033E212E Relevance: 10.7, APIs: 7, Instructions: 158COMMONLIBRARYCODE

Download Yara Rule

APIs

getSystemCP.LIBCMT ref: 033E2147

Part of subcall function 033E20B4: _LocaleUpdate::_LocaleUpdate.LIBCMT ref: 033E20C1
Part of subcall function 033E20B4: GetOEMCP.KERNEL32(00000000,?,033E37BC,?,00000000,7572F380), ref: 033E20DB

setSBCS.LIBCMT ref: 033E2159

Part of subcall function 033E1E31: _memset.LIBCMT ref: 033E1E44

IsValidCodePage.KERNEL32(-00000030,00000000,?,00000000,033FDCA0), ref: 033E219F
GetCPInfo.KERNEL32(00000000,033E24B1), ref: 033E21B2
_memset.LIBCMT ref: 033E21CA
setSBUpLow.LIBCMT ref: 033E229D

Memory Dump Source

Source File: 00000014.00000002.2494020967.00000000033B1000.00000020.00000001.01000000.00000015.sdmp, Offset: 033B0000, based on PE: true

Associated: 00000014.00000002.2493917908.00000000033B0000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000014.00000002.2497615129.00000000033F3000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000014.00000002.2498110795.0000000003400000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000014.00000002.2498410969.0000000003406000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000014.00000002.2498556459.0000000003408000.00000008.00000001.01000000.00000015.sdmpDownload File
Associated: 00000014.00000002.2498718201.000000000340A000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000014.00000002.2499166516.0000000003411000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_33b0000_Picasa3.jbxd

Similarity

API ID: Locale_memset$CodeInfoPageSystemUpdateUpdate::_Valid
String ID:
API String ID: 2658552758-0
Opcode ID: 6b81d571c5bcd68c31af1d53a06540a96b429e072f43ea93d75ad350376384da
Instruction ID: f5130caca1b15d22ac0232897d18279c0f1c87cfab9272e409df98b53e52e42e
Opcode Fuzzy Hash: 6b81d571c5bcd68c31af1d53a06540a96b429e072f43ea93d75ad350376384da
Instruction Fuzzy Hash: B251B175D002699FDF65EF64C8C06BFBBA8EF45304F08886AD895EF282D634D546CB90

Function 040689E4 Relevance: 10.7, APIs: 7, Instructions: 158COMMONLIBRARYCODE

Download Yara Rule

APIs

getSystemCP.LIBCMT ref: 040689FD

Part of subcall function 0406896A: _LocaleUpdate::_LocaleUpdate.LIBCMT ref: 04068977
Part of subcall function 0406896A: GetOEMCP.KERNEL32(00000000,?,04066731,?,00000000,7572F380), ref: 04068991

setSBCS.LIBCMT ref: 04068A0F

Part of subcall function 040686E7: _memset.LIBCMT ref: 040686FA

IsValidCodePage.KERNEL32(-00000030,00000000,?,00000000,04083B28), ref: 04068A55
GetCPInfo.KERNEL32(00000000,04068D67), ref: 04068A68
_memset.LIBCMT ref: 04068A80
setSBUpLow.LIBCMT ref: 04068B53

Memory Dump Source

Source File: 00000014.00000002.2502041842.0000000004031000.00000020.00000001.01000000.00000017.sdmp, Offset: 04030000, based on PE: true

Associated: 00000014.00000002.2501986218.0000000004030000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000014.00000002.2504208079.0000000004079000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000014.00000002.2504943590.0000000004086000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000014.00000002.2505148754.000000000408E000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000014.00000002.2505282171.0000000004090000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000014.00000002.2505501725.0000000004097000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_4030000_Picasa3.jbxd

Similarity

API ID: Locale_memset$CodeInfoPageSystemUpdateUpdate::_Valid
String ID:
API String ID: 2658552758-0
Opcode ID: 669326e33739a9ce3aeff704111757e0572d9abf8dee941aa9a636a91bab43cf
Instruction ID: 45081ae1ab5edeb25f4955a54ff0e6c1564eb46c920464e33cf360480dffe538
Opcode Fuzzy Hash: 669326e33739a9ce3aeff704111757e0572d9abf8dee941aa9a636a91bab43cf
Instruction Fuzzy Hash: 6451E8729012559BEF55AF24C8846BEBBF8EF45304F04D46AD887BF242D638E542CB91

Function 033BED00 Relevance: 10.6, APIs: 7, Instructions: 133COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 033BED3A
MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,000000FF,00000000,00000000), ref: 033BED6B
MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,000000FF,00000000,00000000), ref: 033BED89
MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,000000FF,?,00000000), ref: 033BEDA9
SHGetFileInfoW.SHELL32(?,?,00000000,?,?), ref: 033BEDF3
WideCharToMultiByte.KERNEL32(0000FDE9,00000000,?,000000FF,?,00000104,00000000,00000000), ref: 033BEE3E
WideCharToMultiByte.KERNEL32(0000FDE9,00000000,?,000000FF,?,00000050,00000000,00000000), ref: 033BEE6C

Memory Dump Source

Source File: 00000014.00000002.2494020967.00000000033B1000.00000020.00000001.01000000.00000015.sdmp, Offset: 033B0000, based on PE: true

Associated: 00000014.00000002.2493917908.00000000033B0000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000014.00000002.2497615129.00000000033F3000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000014.00000002.2498110795.0000000003400000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000014.00000002.2498410969.0000000003406000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000014.00000002.2498556459.0000000003408000.00000008.00000001.01000000.00000015.sdmpDownload File
Associated: 00000014.00000002.2498718201.000000000340A000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000014.00000002.2499166516.0000000003411000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_33b0000_Picasa3.jbxd

Similarity

API ID: ByteCharMultiWide$FileInfo_memset
String ID:
API String ID: 3800430049-0
Opcode ID: ff5e31c77fa07d6274f598ba9fcdb60ac3214ebfb112517ce654d24bcfd09d34
Instruction ID: 08d648f4a3a65cdfc1a1366029e084130023bddc1ce617dc54cec701eff5cd85
Opcode Fuzzy Hash: ff5e31c77fa07d6274f598ba9fcdb60ac3214ebfb112517ce654d24bcfd09d34
Instruction Fuzzy Hash: 1C418371A01219BFEB20DE58DC86FEB777CEB44710F244255BA14AB2D0D7B0AD408BA0

Function 0403BCC0 Relevance: 10.6, APIs: 7, Instructions: 133COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 0403BCFA
MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,000000FF,00000000,00000000), ref: 0403BD2B
MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,000000FF,00000000,00000000), ref: 0403BD49
MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,000000FF,?,00000000), ref: 0403BD69
SHGetFileInfoW.SHELL32(?,?,00000000,?,?), ref: 0403BDB3
WideCharToMultiByte.KERNEL32(0000FDE9,00000000,?,000000FF,?,00000104,00000000,00000000), ref: 0403BDFE
WideCharToMultiByte.KERNEL32(0000FDE9,00000000,?,000000FF,?,00000050,00000000,00000000), ref: 0403BE2C

Memory Dump Source

Source File: 00000014.00000002.2502041842.0000000004031000.00000020.00000001.01000000.00000017.sdmp, Offset: 04030000, based on PE: true

Associated: 00000014.00000002.2501986218.0000000004030000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000014.00000002.2504208079.0000000004079000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000014.00000002.2504943590.0000000004086000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000014.00000002.2505148754.000000000408E000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000014.00000002.2505282171.0000000004090000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000014.00000002.2505501725.0000000004097000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_4030000_Picasa3.jbxd

Similarity

API ID: ByteCharMultiWide$FileInfo_memset
String ID:
API String ID: 3800430049-0
Opcode ID: fbdb3f96b76ceacc4b7717fe888ce62f8b4b9cf420a5e0af2cc99b63515319df
Instruction ID: 68a441655fd553433b0bc5d649c7cd2b3940a71dabf7f495bedf7831af6070bb
Opcode Fuzzy Hash: fbdb3f96b76ceacc4b7717fe888ce62f8b4b9cf420a5e0af2cc99b63515319df
Instruction Fuzzy Hash: 2E418471A01219BBEB20DE44CC86FEB77BCEB44714F204255BA15BB2C0D7B0BD408BA1

Function 0403CD60 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 133COMMON

Download Yara Rule

APIs

InterlockedDecrement.KERNEL32(?), ref: 0403CDA9
InterlockedIncrement.KERNEL32(?), ref: 0403CDC5
InterlockedDecrement.KERNEL32(?), ref: 0403CDFF
InterlockedIncrement.KERNEL32(?), ref: 0403CE1B

Strings

January, xrefs: 0403CD6E
`ruru, xrefs: 0403CDA9, 0403CDFF

Memory Dump Source

Source File: 00000014.00000002.2502041842.0000000004031000.00000020.00000001.01000000.00000017.sdmp, Offset: 04030000, based on PE: true

Associated: 00000014.00000002.2501986218.0000000004030000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000014.00000002.2504208079.0000000004079000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000014.00000002.2504943590.0000000004086000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000014.00000002.2505148754.000000000408E000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000014.00000002.2505282171.0000000004090000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000014.00000002.2505501725.0000000004097000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_4030000_Picasa3.jbxd

Similarity

API ID: Interlocked$DecrementIncrement
String ID: January$`ruru
API String ID: 2172605799-733983179
Opcode ID: 6b84484e020be1e69409b3657e69ccf6d0d25cb2f31663413351d43fb5b53ad2
Instruction ID: de8a7c8bbb9fa01917b64a2c6d0e60ac243aded3b5e02f9813faf00918a01351
Opcode Fuzzy Hash: 6b84484e020be1e69409b3657e69ccf6d0d25cb2f31663413351d43fb5b53ad2
Instruction Fuzzy Hash: 8F41ACB29083019FE320EF19D48092AFBE9BF01306B54892DE496FB601DB35F845DB96

Function 033DF16B Relevance: 10.6, APIs: 7, Instructions: 124COMMONLIBRARYCODE

Download Yara Rule

APIs

__mtinitlocknum.LIBCMT ref: 033DF182

Part of subcall function 033E0DEA: __FF_MSGBANNER.LIBCMT ref: 033E0E06

__lock.LIBCMT ref: 033DF196
__lock.LIBCMT ref: 033DF1DF
___crtInitCritSecAndSpinCount.LIBCMT ref: 033DF1FA
EnterCriticalSection.KERNEL32(00000115,033FDB30,00000018,033E84A0,00000109,00000000,00000000), ref: 033DF220
LeaveCriticalSection.KERNEL32(00000115), ref: 033DF22D

Memory Dump Source

Source File: 00000014.00000002.2494020967.00000000033B1000.00000020.00000001.01000000.00000015.sdmp, Offset: 033B0000, based on PE: true

Associated: 00000014.00000002.2493917908.00000000033B0000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000014.00000002.2497615129.00000000033F3000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000014.00000002.2498110795.0000000003400000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000014.00000002.2498410969.0000000003406000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000014.00000002.2498556459.0000000003408000.00000008.00000001.01000000.00000015.sdmpDownload File
Associated: 00000014.00000002.2498718201.000000000340A000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000014.00000002.2499166516.0000000003411000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_33b0000_Picasa3.jbxd

Similarity

API ID: CriticalSection__lock$CountCritEnterInitLeaveSpin___crt__mtinitlocknum
String ID:
API String ID: 2236623020-0
Opcode ID: 11d24d25875a5939e788e6260be633d519cce26b4470eafaa2f72a8f470b6686
Instruction ID: d5504438678496ffae7e83dbc64f5034f3000d86943bf6afdf10ea214e732b1f
Opcode Fuzzy Hash: 11d24d25875a5939e788e6260be633d519cce26b4470eafaa2f72a8f470b6686
Instruction Fuzzy Hash: 3841E47AD447068BDB28DFA8E8C476DBBF8AF05324F24825DD067AE5D4CB749581CB10

Function 04063A6B Relevance: 10.6, APIs: 7, Instructions: 124COMMONLIBRARYCODE

Download Yara Rule

APIs

__mtinitlocknum.LIBCMT ref: 04063A82

Part of subcall function 0406754E: __FF_MSGBANNER.LIBCMT ref: 0406756A

__lock.LIBCMT ref: 04063A96
__lock.LIBCMT ref: 04063ADF
___crtInitCritSecAndSpinCount.LIBCMT ref: 04063AFA
EnterCriticalSection.KERNEL32(00000115,04083978,00000018,0406DFD8,00000109,00000000,00000000), ref: 04063B20
LeaveCriticalSection.KERNEL32(00000115), ref: 04063B2D

Memory Dump Source

Source File: 00000014.00000002.2502041842.0000000004031000.00000020.00000001.01000000.00000017.sdmp, Offset: 04030000, based on PE: true

Associated: 00000014.00000002.2501986218.0000000004030000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000014.00000002.2504208079.0000000004079000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000014.00000002.2504943590.0000000004086000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000014.00000002.2505148754.000000000408E000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000014.00000002.2505282171.0000000004090000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000014.00000002.2505501725.0000000004097000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_4030000_Picasa3.jbxd

Similarity

API ID: CriticalSection__lock$CountCritEnterInitLeaveSpin___crt__mtinitlocknum
String ID:
API String ID: 2236623020-0
Opcode ID: dfb7a1c64c61bb44c8e21c5118f424ae6a397aeb381a2c725c44804c60fdf5d6
Instruction ID: 8a5010eefd18d818f88eb7f7f27e77425ee2defd8690964891df17cd29c7816c
Opcode Fuzzy Hash: dfb7a1c64c61bb44c8e21c5118f424ae6a397aeb381a2c725c44804c60fdf5d6
Instruction Fuzzy Hash: B3412631D043068BEB24EF68D8447ADBBE8AF01328F14965DD667BB1D0DB78B941CB91

Function 033BCA40 Relevance: 10.6, APIs: 7, Instructions: 118registryCOMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,000000FF,00000000,00000000), ref: 033BCA71
MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,000000FF,00000000,00000000), ref: 033BCA92
MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,000000FF,00000000,00000000), ref: 033BCAC8
MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,000000FF,00000000,00000000), ref: 033BCAE2
MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,000000FF,00000000,00000000), ref: 033BCB03
MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,000000FF,00000000,00000000), ref: 033BCB35
RegisterClassW.USER32(?), ref: 033BCB51

Memory Dump Source

Source File: 00000014.00000002.2494020967.00000000033B1000.00000020.00000001.01000000.00000015.sdmp, Offset: 033B0000, based on PE: true

Associated: 00000014.00000002.2493917908.00000000033B0000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000014.00000002.2497615129.00000000033F3000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000014.00000002.2498110795.0000000003400000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000014.00000002.2498410969.0000000003406000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000014.00000002.2498556459.0000000003408000.00000008.00000001.01000000.00000015.sdmpDownload File
Associated: 00000014.00000002.2498718201.000000000340A000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000014.00000002.2499166516.0000000003411000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_33b0000_Picasa3.jbxd

Similarity

API ID: ByteCharMultiWide$ClassRegister
String ID:
API String ID: 3731946009-0
Opcode ID: dbd77f40da7943ab33f3b4c9f4d5da34c92fa70f9eded92b1dc1e0db2ca882cf
Instruction ID: 05205ade1af84a347bdc51d48198ee1f4269e9cf6678a4f2d286ffd1de6a0bac
Opcode Fuzzy Hash: dbd77f40da7943ab33f3b4c9f4d5da34c92fa70f9eded92b1dc1e0db2ca882cf
Instruction Fuzzy Hash: 7E316175B44215BBEB30EE55CCC1FBAB7BCAF44760F250265BA15AF6D4C6B0AC008A91

Function 04039A00 Relevance: 10.6, APIs: 7, Instructions: 118registryCOMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,000000FF,00000000,00000000), ref: 04039A31
MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,000000FF,00000000,00000000), ref: 04039A52
MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,000000FF,00000000,00000000), ref: 04039A88
MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,000000FF,00000000,00000000), ref: 04039AA2
MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,000000FF,00000000,00000000), ref: 04039AC3
MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,000000FF,00000000,00000000), ref: 04039AF5
RegisterClassW.USER32(?), ref: 04039B11

Memory Dump Source

Source File: 00000014.00000002.2502041842.0000000004031000.00000020.00000001.01000000.00000017.sdmp, Offset: 04030000, based on PE: true

Associated: 00000014.00000002.2501986218.0000000004030000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000014.00000002.2504208079.0000000004079000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000014.00000002.2504943590.0000000004086000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000014.00000002.2505148754.000000000408E000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000014.00000002.2505282171.0000000004090000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000014.00000002.2505501725.0000000004097000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_4030000_Picasa3.jbxd

Similarity

API ID: ByteCharMultiWide$ClassRegister
String ID:
API String ID: 3731946009-0
Opcode ID: 932c1b0f4c5ee964fc1da3e6db3c8e41f49a12e7f7711de301db106199ba35da
Instruction ID: b9f8f74a0016712300d8f0a3740ea5543560e666eb30e36617e739211b612944
Opcode Fuzzy Hash: 932c1b0f4c5ee964fc1da3e6db3c8e41f49a12e7f7711de301db106199ba35da
Instruction Fuzzy Hash: 4F31B5B1744615BBFB20AE55CC81FBA7BA8EF44721F214335BA15BF2C0C6B4BC008A91

Function 033BB4D0 Relevance: 10.6, APIs: 7, Instructions: 115COMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,000000FF,00000000,00000000), ref: 033BB4FE
MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,000000FF,00000000,00000000), ref: 033BB51C
MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,000000FF,?,00000000), ref: 033BB539
MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,000000FF,00000000,00000000), ref: 033BB554
MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,000000FF,00000000,00000000), ref: 033BB57B
MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,000000FF,?,00000000), ref: 033BB598
CreateWindowExW.USER32(00000000,00000000,00000000,?,?,?,?,?,?,?,?,?), ref: 033BB5CA

Memory Dump Source

Source File: 00000014.00000002.2494020967.00000000033B1000.00000020.00000001.01000000.00000015.sdmp, Offset: 033B0000, based on PE: true

Associated: 00000014.00000002.2493917908.00000000033B0000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000014.00000002.2497615129.00000000033F3000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000014.00000002.2498110795.0000000003400000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000014.00000002.2498410969.0000000003406000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000014.00000002.2498556459.0000000003408000.00000008.00000001.01000000.00000015.sdmpDownload File
Associated: 00000014.00000002.2498718201.000000000340A000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000014.00000002.2499166516.0000000003411000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_33b0000_Picasa3.jbxd

Similarity

API ID: ByteCharMultiWide$CreateWindow
String ID:
API String ID: 4242617445-0
Opcode ID: 04a58be3c1ffa966e467bd0fba853f0b413777947bda53296f3ba112e8870416
Instruction ID: 79e77c49629837b6ef52f80d8ae4f6326223cffbb11fe02154891c9f610de53a
Opcode Fuzzy Hash: 04a58be3c1ffa966e467bd0fba853f0b413777947bda53296f3ba112e8870416
Instruction Fuzzy Hash: 2A316975B44209BBD720DE59DC81FAB77BDEF89B20F20432AB615AF6C4D970E8008765

Function 04038490 Relevance: 10.6, APIs: 7, Instructions: 115COMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,000000FF,00000000,00000000), ref: 040384BE
MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,000000FF,00000000,00000000), ref: 040384DC
MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,000000FF,?,00000000), ref: 040384F9
MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,000000FF,00000000,00000000), ref: 04038514
MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,000000FF,00000000,00000000), ref: 0403853B
MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,000000FF,?,00000000), ref: 04038558
CreateWindowExW.USER32(00000000,00000000,00000000,?,?,?,?,?,?,?,?,?), ref: 0403858A

Memory Dump Source

Source File: 00000014.00000002.2502041842.0000000004031000.00000020.00000001.01000000.00000017.sdmp, Offset: 04030000, based on PE: true

Associated: 00000014.00000002.2501986218.0000000004030000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000014.00000002.2504208079.0000000004079000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000014.00000002.2504943590.0000000004086000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000014.00000002.2505148754.000000000408E000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000014.00000002.2505282171.0000000004090000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000014.00000002.2505501725.0000000004097000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_4030000_Picasa3.jbxd

Similarity

API ID: ByteCharMultiWide$CreateWindow
String ID:
API String ID: 4242617445-0
Opcode ID: d5075c1309c8d691718fb194b59c1d6eecb79e22f1d246351539da51e1b9f766
Instruction ID: 28c11be1ceebe1827d2225de3a4bbd9b13a82d9b83664928aebb77068917b4ae
Opcode Fuzzy Hash: d5075c1309c8d691718fb194b59c1d6eecb79e22f1d246351539da51e1b9f766
Instruction Fuzzy Hash: BB31A9717042097BEB20EE59DC41FAB7BEDEF89B24F20436AB615BB2C0D970B8008755

Function 033BC310 Relevance: 10.6, APIs: 7, Instructions: 114registryCOMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,000000FF,00000000,00000000), ref: 033BC342
MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,000000FF,00000000,00000000), ref: 033BC360
MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,000000FF,?,00000000), ref: 033BC37D
MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,000000FF,00000000,00000000), ref: 033BC3A1
MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,000000FF,?,00000000), ref: 033BC3C8
MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,000000FF,00000000,00000000), ref: 033BC3EB
RegSetValueExW.ADVAPI32(00000000,00000000,?,?,00000000,00000000), ref: 033BC411

Memory Dump Source

Source File: 00000014.00000002.2494020967.00000000033B1000.00000020.00000001.01000000.00000015.sdmp, Offset: 033B0000, based on PE: true

Associated: 00000014.00000002.2493917908.00000000033B0000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000014.00000002.2497615129.00000000033F3000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000014.00000002.2498110795.0000000003400000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000014.00000002.2498410969.0000000003406000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000014.00000002.2498556459.0000000003408000.00000008.00000001.01000000.00000015.sdmpDownload File
Associated: 00000014.00000002.2498718201.000000000340A000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000014.00000002.2499166516.0000000003411000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_33b0000_Picasa3.jbxd

Similarity

API ID: ByteCharMultiWide$Value
String ID:
API String ID: 861997700-0
Opcode ID: d6059fda72cec77376b65cb9b5c5b03b0a7e448cddb0e1fc4c96a3ff32c8ecad
Instruction ID: 49d4e7aadd0cdc96b1692aefb82f5a659a96582becaf5c9b61fde1f972e3d4a8
Opcode Fuzzy Hash: d6059fda72cec77376b65cb9b5c5b03b0a7e448cddb0e1fc4c96a3ff32c8ecad
Instruction Fuzzy Hash: 2E319875B4420A7BE730DE699CC2FBA777DEB45720F740226B625AFAC0C5B4AC008765

Function 040392D0 Relevance: 10.6, APIs: 7, Instructions: 114registryCOMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,000000FF,00000000,00000000), ref: 04039302
MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,000000FF,00000000,00000000), ref: 04039320
MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,000000FF,?,00000000), ref: 0403933D
MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,000000FF,00000000,00000000), ref: 04039361
MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,000000FF,?,00000000), ref: 04039388
MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,000000FF,00000000,00000000), ref: 040393AB
RegSetValueExW.ADVAPI32(00000000,00000000,?,?,00000000,00000000), ref: 040393D1

Memory Dump Source

Source File: 00000014.00000002.2502041842.0000000004031000.00000020.00000001.01000000.00000017.sdmp, Offset: 04030000, based on PE: true

Associated: 00000014.00000002.2501986218.0000000004030000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000014.00000002.2504208079.0000000004079000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000014.00000002.2504943590.0000000004086000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000014.00000002.2505148754.000000000408E000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000014.00000002.2505282171.0000000004090000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000014.00000002.2505501725.0000000004097000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_4030000_Picasa3.jbxd

Similarity

API ID: ByteCharMultiWide$Value
String ID:
API String ID: 861997700-0
Opcode ID: 079c72375125bf702719212795f7364fe1af358e0b9aebf10212d6e9f7063ddc
Instruction ID: fdc23ff35784da1926c5bf44c2a6024f06d4eb979dd687a9f233cd746b1e7a71
Opcode Fuzzy Hash: 079c72375125bf702719212795f7364fe1af358e0b9aebf10212d6e9f7063ddc
Instruction Fuzzy Hash: F43167B1744219BBFB209E598C82F7E7BADEB85724F300626B621BB2D0D5B4BC009755

Function 04833461 Relevance: 10.6, APIs: 7, Instructions: 114COMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,000000FF,00000000,00000000), ref: 0483348E
MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,000000FF,00000000,00000000), ref: 048334AC
MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,000000FF,?,00000000), ref: 048334C9
MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,000000FF,00000000,00000000), ref: 048334E4
MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,000000FF,00000000,00000000), ref: 0483350B
MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,000000FF,?,00000000), ref: 04833528
CreateWindowExW.USER32(00000000,00000000,00000000,?,?,?,?,?,?,?,?,?), ref: 0483355A

Memory Dump Source

Source File: 00000014.00000002.2526268174.00000000047E1000.00000020.00000001.01000000.00000016.sdmp, Offset: 047E0000, based on PE: true

Associated: 00000014.00000002.2526187657.00000000047E0000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000014.00000002.2533437740.000000000488F000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000014.00000002.2535246598.00000000048AB000.00000004.00000001.01000000.00000016.sdmpDownload File
Associated: 00000014.00000002.2535569716.00000000048B3000.00000008.00000001.01000000.00000016.sdmpDownload File
Associated: 00000014.00000002.2535640427.00000000048B5000.00000004.00000001.01000000.00000016.sdmpDownload File
Associated: 00000014.00000002.2536317728.00000000048C0000.00000002.00000001.01000000.00000016.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_47e0000_Picasa3.jbxd

Similarity

API ID: ByteCharMultiWide$CreateWindow
String ID:
API String ID: 4242617445-0
Opcode ID: 34997e9850321e4bfc26f7487b8272f071484219120e5df3470cdc54bc801787
Instruction ID: d897f16462e901f9cf56925d1f9344f37ba7bd91c2217d701d90148d7bb57d62
Opcode Fuzzy Hash: 34997e9850321e4bfc26f7487b8272f071484219120e5df3470cdc54bc801787
Instruction Fuzzy Hash: 48317B7174410977E720DF99DC51FAB77A9DF89B24F20472ABA14EB2C0D5B0B8008795

Function 033BBF80 Relevance: 10.6, APIs: 7, Instructions: 109registryCOMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,000000FF,00000000,00000000), ref: 033BBFAE
MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,000000FF,00000000,00000000), ref: 033BBFCC
MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,000000FF,?,00000000), ref: 033BBFE9
MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,000000FF,00000000,00000000), ref: 033BC004
MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,000000FF,00000000,00000000), ref: 033BC02B
MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,000000FF,?,00000000), ref: 033BC048
RegCreateKeyExW.ADVAPI32(00000000,00000000,?,00000000,?,?,?,?,?), ref: 033BC06E

Memory Dump Source

Source File: 00000014.00000002.2494020967.00000000033B1000.00000020.00000001.01000000.00000015.sdmp, Offset: 033B0000, based on PE: true

Associated: 00000014.00000002.2493917908.00000000033B0000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000014.00000002.2497615129.00000000033F3000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000014.00000002.2498110795.0000000003400000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000014.00000002.2498410969.0000000003406000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000014.00000002.2498556459.0000000003408000.00000008.00000001.01000000.00000015.sdmpDownload File
Associated: 00000014.00000002.2498718201.000000000340A000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000014.00000002.2499166516.0000000003411000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_33b0000_Picasa3.jbxd

Similarity

API ID: ByteCharMultiWide$Create
String ID:
API String ID: 1150895397-0
Opcode ID: 625b3124b1f41a929846f6d1270c39549e102eb084d3807627fab97697f582ea
Instruction ID: c7ecd51486dde0876c858f5d741cd97ec566f49768dd52ec4cddabe6ed32baaa
Opcode Fuzzy Hash: 625b3124b1f41a929846f6d1270c39549e102eb084d3807627fab97697f582ea
Instruction Fuzzy Hash: B93188757442197BE730DEA9DC81FBB77BDEB89B20F2003267621AF6C0C974A8008B55

Function 04038F40 Relevance: 10.6, APIs: 7, Instructions: 109registryCOMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,000000FF,00000000,00000000), ref: 04038F6E
MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,000000FF,00000000,00000000), ref: 04038F8C
MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,000000FF,?,00000000), ref: 04038FA9
MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,000000FF,00000000,00000000), ref: 04038FC4
MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,000000FF,00000000,00000000), ref: 04038FEB
MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,000000FF,?,00000000), ref: 04039008
RegCreateKeyExW.ADVAPI32(00000000,00000000,?,00000000,?,?,?,?,?), ref: 0403902E

Memory Dump Source

Source File: 00000014.00000002.2502041842.0000000004031000.00000020.00000001.01000000.00000017.sdmp, Offset: 04030000, based on PE: true

Associated: 00000014.00000002.2501986218.0000000004030000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000014.00000002.2504208079.0000000004079000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000014.00000002.2504943590.0000000004086000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000014.00000002.2505148754.000000000408E000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000014.00000002.2505282171.0000000004090000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000014.00000002.2505501725.0000000004097000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_4030000_Picasa3.jbxd

Similarity

API ID: ByteCharMultiWide$Create
String ID:
API String ID: 1150895397-0
Opcode ID: 5b11dd73a0e0ec7bd4e7457c807782a313738a791497e62ae73fb7ee3440e610
Instruction ID: 55c29b28aa844139afbfdc3239d6dbeed12b3f1183abfe54f77abb490670ab1d
Opcode Fuzzy Hash: 5b11dd73a0e0ec7bd4e7457c807782a313738a791497e62ae73fb7ee3440e610
Instruction Fuzzy Hash: AD319C717442097BE720EE59CC41FBB7BADDF89B24F204366B615BB2C0D574B8009755

Function 033BBD70 Relevance: 10.6, APIs: 7, Instructions: 103COMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,000000FF,00000000,00000000), ref: 033BBD9E
MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,000000FF,00000000,00000000), ref: 033BBDBC
MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,000000FF,?,00000000), ref: 033BBDD9
MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,000000FF,00000000,00000000), ref: 033BBDF4
MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,000000FF,00000000,00000000), ref: 033BBE1B
MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,000000FF,?,00000000), ref: 033BBE38
CopyFileExW.KERNEL32(00000000,00000000,?,?,?,?), ref: 033BBE52

Memory Dump Source

Source File: 00000014.00000002.2494020967.00000000033B1000.00000020.00000001.01000000.00000015.sdmp, Offset: 033B0000, based on PE: true

Associated: 00000014.00000002.2493917908.00000000033B0000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000014.00000002.2497615129.00000000033F3000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000014.00000002.2498110795.0000000003400000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000014.00000002.2498410969.0000000003406000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000014.00000002.2498556459.0000000003408000.00000008.00000001.01000000.00000015.sdmpDownload File
Associated: 00000014.00000002.2498718201.000000000340A000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000014.00000002.2499166516.0000000003411000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_33b0000_Picasa3.jbxd

Similarity

API ID: ByteCharMultiWide$CopyFile
String ID:
API String ID: 230095305-0
Opcode ID: b2c99ca20f248a70f253ac14bcb94024fb50677d120286058e76bc5a08b425ab
Instruction ID: 188e63ea22092b8cc237f12c64a745a571552e9a00f2de2e9a39e781281f50b8
Opcode Fuzzy Hash: b2c99ca20f248a70f253ac14bcb94024fb50677d120286058e76bc5a08b425ab
Instruction Fuzzy Hash: 83317C357442197BE720EE559C82FAB777DDB45B20F3043267721AF6D4C97069008795

Function 04038D30 Relevance: 10.6, APIs: 7, Instructions: 103COMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,000000FF,00000000,00000000), ref: 04038D5E
MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,000000FF,00000000,00000000), ref: 04038D7C
MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,000000FF,?,00000000), ref: 04038D99
MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,000000FF,00000000,00000000), ref: 04038DB4
MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,000000FF,00000000,00000000), ref: 04038DDB
MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,000000FF,?,00000000), ref: 04038DF8
CopyFileExW.KERNEL32(00000000,00000000,?,?,?,?), ref: 04038E12

Memory Dump Source

Source File: 00000014.00000002.2502041842.0000000004031000.00000020.00000001.01000000.00000017.sdmp, Offset: 04030000, based on PE: true

Associated: 00000014.00000002.2501986218.0000000004030000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000014.00000002.2504208079.0000000004079000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000014.00000002.2504943590.0000000004086000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000014.00000002.2505148754.000000000408E000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000014.00000002.2505282171.0000000004090000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000014.00000002.2505501725.0000000004097000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_4030000_Picasa3.jbxd

Similarity

API ID: ByteCharMultiWide$CopyFile
String ID:
API String ID: 230095305-0
Opcode ID: e2918c20a9ca3ad734f7d1bd6ace91451f9e52c54a3f8c383e1e4a1364a97ffd
Instruction ID: 352a98f24da4c1026715b10973bc203f0cf958283c57fd6af08672cbaada4914
Opcode Fuzzy Hash: e2918c20a9ca3ad734f7d1bd6ace91451f9e52c54a3f8c383e1e4a1364a97ffd
Instruction Fuzzy Hash: 2131C831B442197BEB20AE598C42F6B7BACDB85B24F304376B621BF2C0D5B078009795

Function 033BFA30 Relevance: 10.6, APIs: 7, Instructions: 101COMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,000000FF,00000000,00000000), ref: 033BFA5E
MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,000000FF,00000000,00000000), ref: 033BFA7C
MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,000000FF,?,00000000), ref: 033BFA99
MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,000000FF,00000000,00000000), ref: 033BFAB4
MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,000000FF,00000000,00000000), ref: 033BFADB
MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,000000FF,?,00000000), ref: 033BFAF8
CompareStringW.KERNEL32(00000000,?,00000000,000000FF,00000000,000000FF), ref: 033BFB0E

Memory Dump Source

Source File: 00000014.00000002.2494020967.00000000033B1000.00000020.00000001.01000000.00000015.sdmp, Offset: 033B0000, based on PE: true

Associated: 00000014.00000002.2493917908.00000000033B0000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000014.00000002.2497615129.00000000033F3000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000014.00000002.2498110795.0000000003400000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000014.00000002.2498410969.0000000003406000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000014.00000002.2498556459.0000000003408000.00000008.00000001.01000000.00000015.sdmpDownload File
Associated: 00000014.00000002.2498718201.000000000340A000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000014.00000002.2499166516.0000000003411000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_33b0000_Picasa3.jbxd

Similarity

API ID: ByteCharMultiWide$CompareString
String ID:
API String ID: 376665442-0
Opcode ID: 72e1965d5dfe02ac49b458b869dc954faba139c79f420a5043d2be1dda684d43
Instruction ID: 112c7cb092247ff2aab02b690220a937d7dcd5b86b020291b45d6375794a2733
Opcode Fuzzy Hash: 72e1965d5dfe02ac49b458b869dc954faba139c79f420a5043d2be1dda684d43
Instruction Fuzzy Hash: 15319B34B44219BBE720EA698CC2FAA777CDB45F30F3003367631AF6C4D5B069049A55

Function 033BBE80 Relevance: 10.6, APIs: 7, Instructions: 101COMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,000000FF,00000000,00000000), ref: 033BBEAE
MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,000000FF,00000000,00000000), ref: 033BBECC
MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,000000FF,?,00000000), ref: 033BBEE9
MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,000000FF,00000000,00000000), ref: 033BBF04
MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,000000FF,00000000,00000000), ref: 033BBF2B
MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,000000FF,?,00000000), ref: 033BBF48
MoveFileWithProgressW.KERNEL32(00000000,00000000,?,?,?), ref: 033BBF5E

Memory Dump Source

Source File: 00000014.00000002.2494020967.00000000033B1000.00000020.00000001.01000000.00000015.sdmp, Offset: 033B0000, based on PE: true

Associated: 00000014.00000002.2493917908.00000000033B0000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000014.00000002.2497615129.00000000033F3000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000014.00000002.2498110795.0000000003400000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000014.00000002.2498410969.0000000003406000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000014.00000002.2498556459.0000000003408000.00000008.00000001.01000000.00000015.sdmpDownload File
Associated: 00000014.00000002.2498718201.000000000340A000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000014.00000002.2499166516.0000000003411000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_33b0000_Picasa3.jbxd

Similarity

API ID: ByteCharMultiWide$FileMoveProgressWith
String ID:
API String ID: 1662187513-0
Opcode ID: 29ccb4baf9ec02dc3dc723094e0df41161a14af5177448aeb87964f4981992a7
Instruction ID: f214c75e008c53b8561f7c0dc0d20e891bf6db97242db993d9797a1d1bcd496d
Opcode Fuzzy Hash: 29ccb4baf9ec02dc3dc723094e0df41161a14af5177448aeb87964f4981992a7
Instruction Fuzzy Hash: FB318974B442197BE730EAA59CC2FBB7779DB85B20F3003267721AF6D0C9B068009A95

Function 04038E40 Relevance: 10.6, APIs: 7, Instructions: 101COMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,000000FF,00000000,00000000), ref: 04038E6E
MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,000000FF,00000000,00000000), ref: 04038E8C
MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,000000FF,?,00000000), ref: 04038EA9
MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,000000FF,00000000,00000000), ref: 04038EC4
MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,000000FF,00000000,00000000), ref: 04038EEB
MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,000000FF,?,00000000), ref: 04038F08
MoveFileWithProgressW.KERNEL32(00000000,00000000,?,?,?), ref: 04038F1E

Memory Dump Source

Source File: 00000014.00000002.2502041842.0000000004031000.00000020.00000001.01000000.00000017.sdmp, Offset: 04030000, based on PE: true

Associated: 00000014.00000002.2501986218.0000000004030000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000014.00000002.2504208079.0000000004079000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000014.00000002.2504943590.0000000004086000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000014.00000002.2505148754.000000000408E000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000014.00000002.2505282171.0000000004090000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000014.00000002.2505501725.0000000004097000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_4030000_Picasa3.jbxd

Similarity

API ID: ByteCharMultiWide$FileMoveProgressWith
String ID:
API String ID: 1662187513-0
Opcode ID: 1cb8b684b6a5cc1763ce2a9dc8ef9962ebcde0c0335bdec7dc7591b561d0e02b
Instruction ID: 88be2dbd88d703e8a91c01c0b06989babcd0db4dd222b801cd65ddfa73e90249
Opcode Fuzzy Hash: 1cb8b684b6a5cc1763ce2a9dc8ef9962ebcde0c0335bdec7dc7591b561d0e02b
Instruction Fuzzy Hash: E031D931B442097BF720AA658C42F7B7BACDF85B24F3043767621BF2C0D5B478049695

Function 0403C9F0 Relevance: 10.6, APIs: 7, Instructions: 101COMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,000000FF,00000000,00000000), ref: 0403CA1E
MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,000000FF,00000000,00000000), ref: 0403CA3C
MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,000000FF,?,00000000), ref: 0403CA59
MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,000000FF,00000000,00000000), ref: 0403CA74
MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,000000FF,00000000,00000000), ref: 0403CA9B
MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,000000FF,?,00000000), ref: 0403CAB8
CompareStringW.KERNEL32(00000000,?,00000000,000000FF,00000000,000000FF), ref: 0403CACE

Memory Dump Source

Source File: 00000014.00000002.2502041842.0000000004031000.00000020.00000001.01000000.00000017.sdmp, Offset: 04030000, based on PE: true

Associated: 00000014.00000002.2501986218.0000000004030000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000014.00000002.2504208079.0000000004079000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000014.00000002.2504943590.0000000004086000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000014.00000002.2505148754.000000000408E000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000014.00000002.2505282171.0000000004090000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000014.00000002.2505501725.0000000004097000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_4030000_Picasa3.jbxd

Similarity

API ID: ByteCharMultiWide$CompareString
String ID:
API String ID: 376665442-0
Opcode ID: 4e77100b4b331e9ed7945519ca33219f67c8b48af0f04c7ee869c79da371ca8e
Instruction ID: 14e460968fc7f27faa4f747d38bffd2793ff3cecddbfbc48733f32f6a86398db
Opcode Fuzzy Hash: 4e77100b4b331e9ed7945519ca33219f67c8b48af0f04c7ee869c79da371ca8e
Instruction Fuzzy Hash: F7319931B482197BFB20EA698C42F6A7BACDB45B34F3007367621FF2C0D9B479009695

Function 033BDFB0 Relevance: 10.6, APIs: 7, Instructions: 99windowCOMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,000000FF,00000000,00000000), ref: 033BDFDE
MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,000000FF,00000000,00000000), ref: 033BDFFC
MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,000000FF,?,00000000), ref: 033BE019
MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,000000FF,00000000,00000000), ref: 033BE034
MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,000000FF,00000000,00000000), ref: 033BE05B
MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,000000FF,?,00000000), ref: 033BE078
MessageBoxW.USER32(00000000,00000000,00000000,?), ref: 033BE08A

Memory Dump Source

Source File: 00000014.00000002.2494020967.00000000033B1000.00000020.00000001.01000000.00000015.sdmp, Offset: 033B0000, based on PE: true

Associated: 00000014.00000002.2493917908.00000000033B0000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000014.00000002.2497615129.00000000033F3000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000014.00000002.2498110795.0000000003400000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000014.00000002.2498410969.0000000003406000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000014.00000002.2498556459.0000000003408000.00000008.00000001.01000000.00000015.sdmpDownload File
Associated: 00000014.00000002.2498718201.000000000340A000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000014.00000002.2499166516.0000000003411000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_33b0000_Picasa3.jbxd

Similarity

API ID: ByteCharMultiWide$Message
String ID:
API String ID: 3609034761-0
Opcode ID: 46dc4718c2687d1824796e380fe1e356e03753281a02e8f45f66b9e5c174f4ca
Instruction ID: a4d98747a5dab88cfbb1cabd15847cf8b6a3790ff24fb387b368d680a18da730
Opcode Fuzzy Hash: 46dc4718c2687d1824796e380fe1e356e03753281a02e8f45f66b9e5c174f4ca
Instruction Fuzzy Hash: AE218835B44219BBE730EA699CC2FAA77BDDB85B20F3007367721AF6C0C9B468049655

Function 0403AF71 Relevance: 10.6, APIs: 7, Instructions: 98windowCOMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,000000FF,00000000,00000000), ref: 0403AF9E
MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,000000FF,00000000,00000000), ref: 0403AFBC
MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,000000FF,?,00000000), ref: 0403AFD9
MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,000000FF,00000000,00000000), ref: 0403AFF4
MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,000000FF,00000000,00000000), ref: 0403B01B
MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,000000FF,?,00000000), ref: 0403B038
MessageBoxW.USER32(00000000,00000000,00000000,?), ref: 0403B04A

Memory Dump Source

Source File: 00000014.00000002.2502041842.0000000004031000.00000020.00000001.01000000.00000017.sdmp, Offset: 04030000, based on PE: true

Associated: 00000014.00000002.2501986218.0000000004030000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000014.00000002.2504208079.0000000004079000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000014.00000002.2504943590.0000000004086000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000014.00000002.2505148754.000000000408E000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000014.00000002.2505282171.0000000004090000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000014.00000002.2505501725.0000000004097000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_4030000_Picasa3.jbxd

Similarity

API ID: ByteCharMultiWide$Message
String ID:
API String ID: 3609034761-0
Opcode ID: 251a5cbc3f23df5a1c676d253cec92613ef0e7c1e75b608b606f83e8cbe4a73b
Instruction ID: 780db6f3a872f7b61213b2a40179bb8172364d4521698748ff7524b4fce00ea9
Opcode Fuzzy Hash: 251a5cbc3f23df5a1c676d253cec92613ef0e7c1e75b608b606f83e8cbe4a73b
Instruction Fuzzy Hash: 8721AB70B442197BF730AE658C42F6A7BBCDB85B24F3007367621BF2C0D5B478005655

Function 033BDBA0 Relevance: 10.6, APIs: 7, Instructions: 97COMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,000000FF,00000000,00000000), ref: 033BDBCE
MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,000000FF,00000000,00000000), ref: 033BDBEC
MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,000000FF,?,00000000), ref: 033BDC09
MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,000000FF,00000000,00000000), ref: 033BDC20
MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,000000FF,00000000,00000000), ref: 033BDC47
MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,000000FF,?,00000000), ref: 033BDC64
CreateDirectoryExW.KERNEL32(00000000,00000000,?), ref: 033BDC72

Memory Dump Source

Source File: 00000014.00000002.2494020967.00000000033B1000.00000020.00000001.01000000.00000015.sdmp, Offset: 033B0000, based on PE: true

Associated: 00000014.00000002.2493917908.00000000033B0000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000014.00000002.2497615129.00000000033F3000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000014.00000002.2498110795.0000000003400000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000014.00000002.2498410969.0000000003406000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000014.00000002.2498556459.0000000003408000.00000008.00000001.01000000.00000015.sdmpDownload File
Associated: 00000014.00000002.2498718201.000000000340A000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000014.00000002.2499166516.0000000003411000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_33b0000_Picasa3.jbxd

Similarity

API ID: ByteCharMultiWide$CreateDirectory
String ID:
API String ID: 2198582921-0
Opcode ID: 0ffcc4d7f3487c66b2ddbfe22bbd6786dde26616ccccc9e1142abf57eb6907ec
Instruction ID: 2799ab0623f3db729dc23faeab0fa818b2dc3874b0eb659c27c706496cb93f35
Opcode Fuzzy Hash: 0ffcc4d7f3487c66b2ddbfe22bbd6786dde26616ccccc9e1142abf57eb6907ec
Instruction Fuzzy Hash: A5217434B443197BE730AE659CC2FBA777DDB86B20F3003367621AFAC4D9B068049655

Function 033BBA80 Relevance: 10.6, APIs: 7, Instructions: 97fileCOMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,000000FF,00000000,00000000), ref: 033BBAAE
MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,000000FF,00000000,00000000), ref: 033BBACC
MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,000000FF,?,00000000), ref: 033BBAE9
MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,000000FF,00000000,00000000), ref: 033BBB00
MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,000000FF,00000000,00000000), ref: 033BBB27
MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,000000FF,?,00000000), ref: 033BBB44
CopyFileW.KERNEL32(00000000,00000000,?), ref: 033BBB52

Memory Dump Source

Source File: 00000014.00000002.2494020967.00000000033B1000.00000020.00000001.01000000.00000015.sdmp, Offset: 033B0000, based on PE: true

Associated: 00000014.00000002.2493917908.00000000033B0000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000014.00000002.2497615129.00000000033F3000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000014.00000002.2498110795.0000000003400000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000014.00000002.2498410969.0000000003406000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000014.00000002.2498556459.0000000003408000.00000008.00000001.01000000.00000015.sdmpDownload File
Associated: 00000014.00000002.2498718201.000000000340A000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000014.00000002.2499166516.0000000003411000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_33b0000_Picasa3.jbxd

Similarity

API ID: ByteCharMultiWide$CopyFile
String ID:
API String ID: 230095305-0
Opcode ID: 7ed51c768dbcfdd481d97404ad6a7ad695dd8b03dc5493b951d01ada74fd69e0
Instruction ID: df6356bea65e0c8d764f30d354a8b54f78197f7649c62c1f35c9d6ca07b39137
Opcode Fuzzy Hash: 7ed51c768dbcfdd481d97404ad6a7ad695dd8b03dc5493b951d01ada74fd69e0
Instruction Fuzzy Hash: 0A218834B44319BBE730EA659CC2FBABB7CDB45B20F3003367621AF6C4D9B068049655

Function 033BBC70 Relevance: 10.6, APIs: 7, Instructions: 97COMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,000000FF,00000000,00000000), ref: 033BBC9E
MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,000000FF,00000000,00000000), ref: 033BBCBC
MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,000000FF,?,00000000), ref: 033BBCD9
MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,000000FF,00000000,00000000), ref: 033BBCF0
MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,000000FF,00000000,00000000), ref: 033BBD17
MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,000000FF,?,00000000), ref: 033BBD34
MoveFileExW.KERNEL32(00000000,00000000,?), ref: 033BBD42

Memory Dump Source

Source File: 00000014.00000002.2494020967.00000000033B1000.00000020.00000001.01000000.00000015.sdmp, Offset: 033B0000, based on PE: true

Associated: 00000014.00000002.2493917908.00000000033B0000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000014.00000002.2497615129.00000000033F3000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000014.00000002.2498110795.0000000003400000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000014.00000002.2498410969.0000000003406000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000014.00000002.2498556459.0000000003408000.00000008.00000001.01000000.00000015.sdmpDownload File
Associated: 00000014.00000002.2498718201.000000000340A000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000014.00000002.2499166516.0000000003411000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_33b0000_Picasa3.jbxd

Similarity

API ID: ByteCharMultiWide$FileMove
String ID:
API String ID: 2485353372-0
Opcode ID: 6c5368694eab8da6bd3def863f5fa409200b4747fc25031ca4c9243ae0a6ca84
Instruction ID: 7a2b5b118e7c6c47e6d721a970239ca116e92c4a090005b0d9caf3a362b44263
Opcode Fuzzy Hash: 6c5368694eab8da6bd3def863f5fa409200b4747fc25031ca4c9243ae0a6ca84
Instruction Fuzzy Hash: 6F217634B443197BE730AA659CC2FAAB77CDB45B60F30033A7621AF6C4D9B468009755

Function 04038C30 Relevance: 10.6, APIs: 7, Instructions: 97COMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,000000FF,00000000,00000000), ref: 04038C5E
MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,000000FF,00000000,00000000), ref: 04038C7C
MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,000000FF,?,00000000), ref: 04038C99
MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,000000FF,00000000,00000000), ref: 04038CB0
MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,000000FF,00000000,00000000), ref: 04038CD7
MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,000000FF,?,00000000), ref: 04038CF4
MoveFileExW.KERNEL32(00000000,00000000,?), ref: 04038D02

Memory Dump Source

Source File: 00000014.00000002.2502041842.0000000004031000.00000020.00000001.01000000.00000017.sdmp, Offset: 04030000, based on PE: true

Associated: 00000014.00000002.2501986218.0000000004030000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000014.00000002.2504208079.0000000004079000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000014.00000002.2504943590.0000000004086000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000014.00000002.2505148754.000000000408E000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000014.00000002.2505282171.0000000004090000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000014.00000002.2505501725.0000000004097000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_4030000_Picasa3.jbxd

Similarity

API ID: ByteCharMultiWide$FileMove
String ID:
API String ID: 2485353372-0
Opcode ID: d0b1a3155748092ccd70fb5fb3acceae87acd16e639f318c7f5ac447713acbe9
Instruction ID: 9bf17c1c8986739db8c03eac5ea0a566b03e3601c355ad14a2763433bbf2a7f7
Opcode Fuzzy Hash: d0b1a3155748092ccd70fb5fb3acceae87acd16e639f318c7f5ac447713acbe9
Instruction Fuzzy Hash: EB21B431B54319BAFB306A658C42F6A7BACDB85F20F304376B621BF2C0D9B478049695

Function 04038A40 Relevance: 10.6, APIs: 7, Instructions: 97fileCOMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,000000FF,00000000,00000000), ref: 04038A6E
MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,000000FF,00000000,00000000), ref: 04038A8C
MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,000000FF,?,00000000), ref: 04038AA9
MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,000000FF,00000000,00000000), ref: 04038AC0
MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,000000FF,00000000,00000000), ref: 04038AE7
MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,000000FF,?,00000000), ref: 04038B04
CopyFileW.KERNEL32(00000000,00000000,?), ref: 04038B12

Memory Dump Source

Source File: 00000014.00000002.2502041842.0000000004031000.00000020.00000001.01000000.00000017.sdmp, Offset: 04030000, based on PE: true

Associated: 00000014.00000002.2501986218.0000000004030000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000014.00000002.2504208079.0000000004079000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000014.00000002.2504943590.0000000004086000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000014.00000002.2505148754.000000000408E000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000014.00000002.2505282171.0000000004090000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000014.00000002.2505501725.0000000004097000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_4030000_Picasa3.jbxd

Similarity

API ID: ByteCharMultiWide$CopyFile
String ID:
API String ID: 230095305-0
Opcode ID: fc3df0912a26784b6a085df0f76849c601e100f823dd2eea4e47ac786e40e2f9
Instruction ID: 9cd50561610199da44275f6eeb1f30ea2d2de26b0c3a9fe1e137528310b8dd54
Opcode Fuzzy Hash: fc3df0912a26784b6a085df0f76849c601e100f823dd2eea4e47ac786e40e2f9
Instruction Fuzzy Hash: B821B631B4431976FB30AA658C42F6A7BACDF85B20F304776B621BF6C0D5B478009655

Function 0403AB60 Relevance: 10.6, APIs: 7, Instructions: 97COMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,000000FF,00000000,00000000), ref: 0403AB8E
MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,000000FF,00000000,00000000), ref: 0403ABAC
MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,000000FF,?,00000000), ref: 0403ABC9
MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,000000FF,00000000,00000000), ref: 0403ABE0
MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,000000FF,00000000,00000000), ref: 0403AC07
MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,000000FF,?,00000000), ref: 0403AC24
CreateDirectoryExW.KERNEL32(00000000,00000000,?), ref: 0403AC32

Memory Dump Source

Source File: 00000014.00000002.2502041842.0000000004031000.00000020.00000001.01000000.00000017.sdmp, Offset: 04030000, based on PE: true

Associated: 00000014.00000002.2501986218.0000000004030000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000014.00000002.2504208079.0000000004079000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000014.00000002.2504943590.0000000004086000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000014.00000002.2505148754.000000000408E000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000014.00000002.2505282171.0000000004090000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000014.00000002.2505501725.0000000004097000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_4030000_Picasa3.jbxd

Similarity

API ID: ByteCharMultiWide$CreateDirectory
String ID:
API String ID: 2198582921-0
Opcode ID: 203759ad6858700fd077034b3538222462b99ee70beeebd2dfa008da46898043
Instruction ID: a3f1f797b5655bb9541a08a3080783118d6227ad4a939262c98afa2beb5bf713
Opcode Fuzzy Hash: 203759ad6858700fd077034b3538222462b99ee70beeebd2dfa008da46898043
Instruction Fuzzy Hash: 8921A830B54319BBFB305A658C52F7A7BADDB85B24F300776B621BF2C0D9B478005A55

Function 033BBB80 Relevance: 10.6, APIs: 7, Instructions: 95fileCOMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,000000FF,00000000,00000000), ref: 033BBBAE
MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,000000FF,00000000,00000000), ref: 033BBBCC
MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,000000FF,?,00000000), ref: 033BBBE9
MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,000000FF,00000000,00000000), ref: 033BBC00
MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,000000FF,00000000,00000000), ref: 033BBC27
MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,000000FF,?,00000000), ref: 033BBC44
MoveFileW.KERNEL32(00000000,00000000), ref: 033BBC4E

Memory Dump Source

Source File: 00000014.00000002.2494020967.00000000033B1000.00000020.00000001.01000000.00000015.sdmp, Offset: 033B0000, based on PE: true

Associated: 00000014.00000002.2493917908.00000000033B0000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000014.00000002.2497615129.00000000033F3000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000014.00000002.2498110795.0000000003400000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000014.00000002.2498410969.0000000003406000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000014.00000002.2498556459.0000000003408000.00000008.00000001.01000000.00000015.sdmpDownload File
Associated: 00000014.00000002.2498718201.000000000340A000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000014.00000002.2499166516.0000000003411000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_33b0000_Picasa3.jbxd

Similarity

API ID: ByteCharMultiWide$FileMove
String ID:
API String ID: 2485353372-0
Opcode ID: 968d20fd56e6094b1668c2484c7d23093b25742f7959edaf8fc4cf5c2e114d98
Instruction ID: a68ea89bb1194ec18dd5225bc4dd193f592ed2a62b242e70d84b45ba3d3dfc77
Opcode Fuzzy Hash: 968d20fd56e6094b1668c2484c7d23093b25742f7959edaf8fc4cf5c2e114d98
Instruction Fuzzy Hash: 69216735B442197BE730EA699CC2FAAB6BCDB45B20F3007367721AF6C4CDB069049755

Function 04038B40 Relevance: 10.6, APIs: 7, Instructions: 95fileCOMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,000000FF,00000000,00000000), ref: 04038B6E
MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,000000FF,00000000,00000000), ref: 04038B8C
MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,000000FF,?,00000000), ref: 04038BA9
MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,000000FF,00000000,00000000), ref: 04038BC0
MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,000000FF,00000000,00000000), ref: 04038BE7
MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,000000FF,?,00000000), ref: 04038C04
MoveFileW.KERNEL32(00000000,00000000), ref: 04038C0E

Memory Dump Source

Source File: 00000014.00000002.2502041842.0000000004031000.00000020.00000001.01000000.00000017.sdmp, Offset: 04030000, based on PE: true

Associated: 00000014.00000002.2501986218.0000000004030000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000014.00000002.2504208079.0000000004079000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000014.00000002.2504943590.0000000004086000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000014.00000002.2505148754.000000000408E000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000014.00000002.2505282171.0000000004090000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000014.00000002.2505501725.0000000004097000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_4030000_Picasa3.jbxd

Similarity

API ID: ByteCharMultiWide$FileMove
String ID:
API String ID: 2485353372-0
Opcode ID: 67ef874e04ce9b62add40c3186e323e0398dc65faa23b992390ecd4715de4528
Instruction ID: b265f087c6590d69309ee40a726eee17d3da7c54330b5e67f92f583b898e7af1
Opcode Fuzzy Hash: 67ef874e04ce9b62add40c3186e323e0398dc65faa23b992390ecd4715de4528
Instruction Fuzzy Hash: 1121E771B4431ABAFB306AA98C42F6A7AECDB45B20F304776B621BF2C0D5B478049655

Function 0480D5D0 Relevance: 10.6, APIs: 7, Instructions: 93windowCOMMON

Download Yara Rule

APIs

ShowWindow.USER32(00000000), ref: 0480D62A
GetParent.USER32(?), ref: 0480D659
GetParent.USER32(?), ref: 0480D66F
GetWindowLongA.USER32(00000000,000000EB), ref: 0480D678
EnumChildWindows.USER32(?,0480E390,00000000), ref: 0480D68D
ShowWindow.USER32(00000000), ref: 0480D6BC
SendMessageA.USER32(?,0000130C,?,00000000), ref: 0480D6D3

Memory Dump Source

Source File: 00000014.00000002.2526268174.00000000047E1000.00000020.00000001.01000000.00000016.sdmp, Offset: 047E0000, based on PE: true

Associated: 00000014.00000002.2526187657.00000000047E0000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000014.00000002.2533437740.000000000488F000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000014.00000002.2535246598.00000000048AB000.00000004.00000001.01000000.00000016.sdmpDownload File
Associated: 00000014.00000002.2535569716.00000000048B3000.00000008.00000001.01000000.00000016.sdmpDownload File
Associated: 00000014.00000002.2535640427.00000000048B5000.00000004.00000001.01000000.00000016.sdmpDownload File
Associated: 00000014.00000002.2536317728.00000000048C0000.00000002.00000001.01000000.00000016.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_47e0000_Picasa3.jbxd

Similarity

API ID: Window$ParentShow$ChildEnumLongMessageSendWindows
String ID:
API String ID: 3500080459-0
Opcode ID: 9e2615eb0e7474d6535839e3538c56020e2e1696d23d1854bc425ffec1c164d2
Instruction ID: ef7af8088cfcf1ffae17a3f29da398b7bb5a2f01e301f0498b009e92e73c1b64
Opcode Fuzzy Hash: 9e2615eb0e7474d6535839e3538c56020e2e1696d23d1854bc425ffec1c164d2
Instruction Fuzzy Hash: 2F313675700602AFD744DFA8DC94E66B3A9FB89310F148A58E62DC73A1CB35F851CB90

Function 033B54E0 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 92comCOMMON

Download Yara Rule

APIs

CoCreateInstance.OLE32 ref: 033B5514

Strings

PBw, xrefs: 033B5514
`cu, xrefs: 033B5568, 033B55B3, 033B55D3

Memory Dump Source

Source File: 00000014.00000002.2494020967.00000000033B1000.00000020.00000001.01000000.00000015.sdmp, Offset: 033B0000, based on PE: true

Associated: 00000014.00000002.2493917908.00000000033B0000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000014.00000002.2497615129.00000000033F3000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000014.00000002.2498110795.0000000003400000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000014.00000002.2498410969.0000000003406000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000014.00000002.2498556459.0000000003408000.00000008.00000001.01000000.00000015.sdmpDownload File
Associated: 00000014.00000002.2498718201.000000000340A000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000014.00000002.2499166516.0000000003411000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_33b0000_Picasa3.jbxd

Similarity

API ID: CreateInstance
String ID: PBw$`cu
API String ID: 542301482-2732529709
Opcode ID: f7cd89b4777f1a5dab480500d43f2cf97b7e05d07f7ceb333b72953f4b060e96
Instruction ID: 2294e12685f4a7d24a6e7d3e0ceac2f9d362134af22ac9a8a454f5968d9679ae
Opcode Fuzzy Hash: f7cd89b4777f1a5dab480500d43f2cf97b7e05d07f7ceb333b72953f4b060e96
Instruction Fuzzy Hash: D9316FB5604202AFE310DB28DCC0B9BB7F9AFC9715F088529FA89CB250D731D945CB92

Function 033E040E Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 36libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

TlsGetValue.KERNEL32(033E6E58,033E6ED8,033E6E58,00000014,033E0E67,00000000,00000FA0,033FDC40,0000000C,033E0EC6,033DC7F4,?,?,033E7C2A,00000004,033FDE40), ref: 033E041B
TlsGetValue.KERNEL32(00000009,?,033E7C2A,00000004,033FDE40,0000000C,033E2E0E,033DC7F4,033DC7F4,00000000,00000000,00000000,033E0687,00000001,00000214), ref: 033E0432
GetModuleHandleA.KERNEL32(KERNEL32.DLL,?,033E7C2A,00000004,033FDE40,0000000C,033E2E0E,033DC7F4,033DC7F4,00000000,00000000,00000000,033E0687,00000001,00000214), ref: 033E0447
GetProcAddress.KERNEL32(00000000,EncodePointer), ref: 033E0462

Strings

EncodePointer, xrefs: 033E045C
KERNEL32.DLL, xrefs: 033E0442

Memory Dump Source

Source File: 00000014.00000002.2494020967.00000000033B1000.00000020.00000001.01000000.00000015.sdmp, Offset: 033B0000, based on PE: true

Associated: 00000014.00000002.2493917908.00000000033B0000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000014.00000002.2497615129.00000000033F3000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000014.00000002.2498110795.0000000003400000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000014.00000002.2498410969.0000000003406000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000014.00000002.2498556459.0000000003408000.00000008.00000001.01000000.00000015.sdmpDownload File
Associated: 00000014.00000002.2498718201.000000000340A000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000014.00000002.2499166516.0000000003411000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_33b0000_Picasa3.jbxd

Similarity

API ID: Value$AddressHandleModuleProc
String ID: EncodePointer$KERNEL32.DLL
API String ID: 1929421221-3682587211
Opcode ID: 30319b91ef624fd6c47469247b96c8406a18242a9421182606d47fb189a8d56b
Instruction ID: 9367dd6f59c213a917a3052ffa06689f4fba0e87c44078715cd1bebe059821f4
Opcode Fuzzy Hash: 30319b91ef624fd6c47469247b96c8406a18242a9421182606d47fb189a8d56b
Instruction Fuzzy Hash: 9BF06235600223AF8626EB36EFC095EBAE4AF00360B4C8115F858E61A5DB70D8818E51

Function 033E0485 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 36libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?,033E0AC9,033DC963,033DC7F4,?,033DC7F4,?), ref: 033E0492
TlsGetValue.KERNEL32(00000009,?,033DC7F4,?), ref: 033E04A9
GetModuleHandleA.KERNEL32(KERNEL32.DLL,?,033DC7F4,?), ref: 033E04BE
GetProcAddress.KERNEL32(00000000,DecodePointer), ref: 033E04D9

Strings

KERNEL32.DLL, xrefs: 033E04B9
DecodePointer, xrefs: 033E04D3

Memory Dump Source

Source File: 00000014.00000002.2494020967.00000000033B1000.00000020.00000001.01000000.00000015.sdmp, Offset: 033B0000, based on PE: true

Associated: 00000014.00000002.2493917908.00000000033B0000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000014.00000002.2497615129.00000000033F3000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000014.00000002.2498110795.0000000003400000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000014.00000002.2498410969.0000000003406000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000014.00000002.2498556459.0000000003408000.00000008.00000001.01000000.00000015.sdmpDownload File
Associated: 00000014.00000002.2498718201.000000000340A000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000014.00000002.2499166516.0000000003411000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_33b0000_Picasa3.jbxd

Similarity

API ID: Value$AddressHandleModuleProc
String ID: DecodePointer$KERNEL32.DLL
API String ID: 1929421221-629428536
Opcode ID: 7c7f30719689193f3f4581641ee832abdc095660dab0aa892ddfa27daaf24326
Instruction ID: 8fa050ae66070cdf9e3355683106bb28899a672c2a920873bc6326bd33fc8d65
Opcode Fuzzy Hash: 7c7f30719689193f3f4581641ee832abdc095660dab0aa892ddfa27daaf24326
Instruction Fuzzy Hash: 0DF06236600222AFC625E73AEEC4E5DBAE4AF00260B084115F858E61A4DB74DC818E90

Function 04064565 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 36libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

TlsGetValue.KERNEL32(0406D233,0406D2B3,0406D233,00000014,040675CB,00000000,00000FA0,04083AE8,0000000C,0406762A,?,-0000000F,?,0406D4DF,00000004,04083C48), ref: 04064572
TlsGetValue.KERNEL32(0000000B,?,0406D4DF,00000004,04083C48,0000000C,04064BA5,?,?,00000000,00000000,00000000,040647DE,00000001,00000214), ref: 04064589
GetModuleHandleA.KERNEL32(KERNEL32.DLL,?,0406D4DF,00000004,04083C48,0000000C,04064BA5,?,?,00000000,00000000,00000000,040647DE,00000001,00000214), ref: 0406459E
GetProcAddress.KERNEL32(00000000,EncodePointer), ref: 040645B9

Strings

KERNEL32.DLL, xrefs: 04064599
EncodePointer, xrefs: 040645B3

Memory Dump Source

Source File: 00000014.00000002.2502041842.0000000004031000.00000020.00000001.01000000.00000017.sdmp, Offset: 04030000, based on PE: true

Associated: 00000014.00000002.2501986218.0000000004030000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000014.00000002.2504208079.0000000004079000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000014.00000002.2504943590.0000000004086000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000014.00000002.2505148754.000000000408E000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000014.00000002.2505282171.0000000004090000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000014.00000002.2505501725.0000000004097000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_4030000_Picasa3.jbxd

Similarity

API ID: Value$AddressHandleModuleProc
String ID: EncodePointer$KERNEL32.DLL
API String ID: 1929421221-3682587211
Opcode ID: 4b6ce2d3d34526939f958c8a996e880771330abc1ba8e60be4bd38b134423512
Instruction ID: 98fb732afdf4aacb10b107c1dadb0261833d7084027ac2550c5ec01f8f40c604
Opcode Fuzzy Hash: 4b6ce2d3d34526939f958c8a996e880771330abc1ba8e60be4bd38b134423512
Instruction Fuzzy Hash: C8F0C270600612DB96507F64EC44EA93BD2EF843547050524F817F6260DB29FC41CA56

Function 040645DC Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 36libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

TlsGetValue.KERNEL32(00000000,04066D4A,04061974,?,00000001,040351EC,00000001), ref: 040645E9
TlsGetValue.KERNEL32(0000000B), ref: 04064600
GetModuleHandleA.KERNEL32(KERNEL32.DLL), ref: 04064615
GetProcAddress.KERNEL32(00000000,DecodePointer), ref: 04064630

Strings

DecodePointer, xrefs: 0406462A
KERNEL32.DLL, xrefs: 04064610

Memory Dump Source

Source File: 00000014.00000002.2502041842.0000000004031000.00000020.00000001.01000000.00000017.sdmp, Offset: 04030000, based on PE: true

Associated: 00000014.00000002.2501986218.0000000004030000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000014.00000002.2504208079.0000000004079000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000014.00000002.2504943590.0000000004086000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000014.00000002.2505148754.000000000408E000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000014.00000002.2505282171.0000000004090000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000014.00000002.2505501725.0000000004097000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_4030000_Picasa3.jbxd

Similarity

API ID: Value$AddressHandleModuleProc
String ID: DecodePointer$KERNEL32.DLL
API String ID: 1929421221-629428536
Opcode ID: 52d1b126252ef2afaedc390a318ee459eae22c294b5f44444ee2e9f60d461133
Instruction ID: 0785b8ffb9374564c7054f398871397997e92d0f51786794a166709a6fbe6886
Opcode Fuzzy Hash: 52d1b126252ef2afaedc390a318ee459eae22c294b5f44444ee2e9f60d461133
Instruction Fuzzy Hash: F0F06270A016129B9A515F38EC04E9A3BD4EF813547054964F817F7160DB29FC11CE9B

Function 033BA920 Relevance: 9.2, APIs: 6, Instructions: 250COMMON

Download Yara Rule

APIs

_strtok.LIBCMT ref: 033BA999
InterlockedIncrement.KERNEL32(00000000), ref: 033BAAB9
InterlockedIncrement.KERNEL32(00000000), ref: 033BAB26
InterlockedDecrement.KERNEL32(00000000), ref: 033BAB6F
InterlockedIncrement.KERNEL32(00000000), ref: 033BAB8C
_strtok.LIBCMT ref: 033BABB6

Memory Dump Source

Source File: 00000014.00000002.2494020967.00000000033B1000.00000020.00000001.01000000.00000015.sdmp, Offset: 033B0000, based on PE: true

Associated: 00000014.00000002.2493917908.00000000033B0000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000014.00000002.2497615129.00000000033F3000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000014.00000002.2498110795.0000000003400000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000014.00000002.2498410969.0000000003406000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000014.00000002.2498556459.0000000003408000.00000008.00000001.01000000.00000015.sdmpDownload File
Associated: 00000014.00000002.2498718201.000000000340A000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000014.00000002.2499166516.0000000003411000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_33b0000_Picasa3.jbxd

Similarity

API ID: Interlocked$Increment$_strtok$Decrement
String ID:
API String ID: 2266323632-0
Opcode ID: a30195c5f3bf90c57216779db456b55d696c3f80a5b5848b2806b8929281d5f8
Instruction ID: faabfb1d03b74583a815c3345bbca662155b17da563a9a0294030b28eb0a61eb
Opcode Fuzzy Hash: a30195c5f3bf90c57216779db456b55d696c3f80a5b5848b2806b8929281d5f8
Instruction Fuzzy Hash: F5810236A04A558FE720DE28CDD07EAB7B9EF40240F0D4468EB56DFA81EB35D805C6A1

Function 033B4D50 Relevance: 9.2, APIs: 6, Instructions: 232stringCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(0340D2B8,?), ref: 033B4D93
GetModuleFileNameA.KERNEL32(033B0000,?,00000104), ref: 033B4E17
lstrlenA.KERNEL32(?), ref: 033B4E40
LoadTypeLib.OLEAUT32(00000000,?), ref: 033B4ED7
LeaveCriticalSection.KERNEL32(?), ref: 033B4FDE

Memory Dump Source

Source File: 00000014.00000002.2494020967.00000000033B1000.00000020.00000001.01000000.00000015.sdmp, Offset: 033B0000, based on PE: true

Associated: 00000014.00000002.2493917908.00000000033B0000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000014.00000002.2497615129.00000000033F3000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000014.00000002.2498110795.0000000003400000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000014.00000002.2498410969.0000000003406000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000014.00000002.2498556459.0000000003408000.00000008.00000001.01000000.00000015.sdmpDownload File
Associated: 00000014.00000002.2498718201.000000000340A000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000014.00000002.2499166516.0000000003411000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_33b0000_Picasa3.jbxd

Similarity

API ID: CriticalSection$EnterFileLeaveLoadModuleNameTypelstrlen
String ID:
API String ID: 3799466066-0
Opcode ID: dc71b73b46ddf9ccccdc5bd6b7df17de1d119f26cfb0d8beaa39be31f0ac225e
Instruction ID: 9d86aef809543101dec619e242042f418f456a0a001c4c343de34db5807f477b
Opcode Fuzzy Hash: dc71b73b46ddf9ccccdc5bd6b7df17de1d119f26cfb0d8beaa39be31f0ac225e
Instruction Fuzzy Hash: EC810875E002189FCB20EFA5C8C49AEB7B9EF88700F548659E609AF656D730A941CF94

Function 033B98B0 Relevance: 9.2, APIs: 6, Instructions: 166threadCOMMON

Download Yara Rule

APIs

_malloc.LIBCMT ref: 033B98C4

Part of subcall function 033DC8B0: __FF_MSGBANNER.LIBCMT ref: 033DC8D3
Part of subcall function 033DC8B0: HeapAlloc.KERNEL32(00000000,033DC7E5,?,?,?,?,033DC7F4,?), ref: 033DC928

GetCurrentThreadId.KERNEL32 ref: 033B98D2
_malloc.LIBCMT ref: 033B9A47
GetCurrentThreadId.KERNEL32 ref: 033B9A75

Memory Dump Source

Source File: 00000014.00000002.2494020967.00000000033B1000.00000020.00000001.01000000.00000015.sdmp, Offset: 033B0000, based on PE: true

Associated: 00000014.00000002.2493917908.00000000033B0000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000014.00000002.2497615129.00000000033F3000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000014.00000002.2498110795.0000000003400000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000014.00000002.2498410969.0000000003406000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000014.00000002.2498556459.0000000003408000.00000008.00000001.01000000.00000015.sdmpDownload File
Associated: 00000014.00000002.2498718201.000000000340A000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000014.00000002.2499166516.0000000003411000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_33b0000_Picasa3.jbxd

Similarity

API ID: CurrentThread_malloc$AllocHeap
String ID:
API String ID: 1243655417-0
Opcode ID: 9d0f5ca24f346bf1d51b4e38240f9275faaa95abe813dd3b8a369509cbc3b091
Instruction ID: e35fe1c428e5110b5c3df4894baca55298a54fe8ed597631fc7e9834ddb88e16
Opcode Fuzzy Hash: 9d0f5ca24f346bf1d51b4e38240f9275faaa95abe813dd3b8a369509cbc3b091
Instruction Fuzzy Hash: B5518B71B04341CFC318EF59E6C0B95B7F5FB89329B1841AED601AFA86DB759849CB40

Function 04035050 Relevance: 9.2, APIs: 6, Instructions: 166threadCOMMONLIBRARYCODE

Download Yara Rule

APIs

_malloc.LIBCMT ref: 04035064

Part of subcall function 040618C1: __FF_MSGBANNER.LIBCMT ref: 040618E4
Part of subcall function 040618C1: HeapAlloc.KERNEL32(00000000,?,00000000,00000000,00000000,00000001,040351EC,00000001), ref: 04061939

GetCurrentThreadId.KERNEL32 ref: 04035072
_malloc.LIBCMT ref: 040351E7
GetCurrentThreadId.KERNEL32 ref: 04035215

Memory Dump Source

Source File: 00000014.00000002.2502041842.0000000004031000.00000020.00000001.01000000.00000017.sdmp, Offset: 04030000, based on PE: true

Associated: 00000014.00000002.2501986218.0000000004030000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000014.00000002.2504208079.0000000004079000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000014.00000002.2504943590.0000000004086000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000014.00000002.2505148754.000000000408E000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000014.00000002.2505282171.0000000004090000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000014.00000002.2505501725.0000000004097000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_4030000_Picasa3.jbxd

Similarity

API ID: CurrentThread_malloc$AllocHeap
String ID:
API String ID: 1243655417-0
Opcode ID: 03f4853e50d1d3e35a17ef6427bd50e9d07af2995ae47e6a4163adeeb6feeb06
Instruction ID: 36320e3d2c6f30cf65d893d54cfb62ac7dd153b109e447026e1b9161816e1200
Opcode Fuzzy Hash: 03f4853e50d1d3e35a17ef6427bd50e9d07af2995ae47e6a4163adeeb6feeb06
Instruction Fuzzy Hash: 60518CB1605300EFC754DF18E890A157BE5FB8532AB1489BED402B76A1EB7EAC45CBC1

Function 033BAF70 Relevance: 9.1, APIs: 6, Instructions: 119threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 033BAF91
EnterCriticalSection.KERNEL32(0340DE08,?,00000000,00000000,033BAEDC,00000000), ref: 033BAFB0
GetCurrentThreadId.KERNEL32 ref: 033BB014
LeaveCriticalSection.KERNEL32(0340DDB8,?,00000000), ref: 033BB037

Memory Dump Source

Source File: 00000014.00000002.2494020967.00000000033B1000.00000020.00000001.01000000.00000015.sdmp, Offset: 033B0000, based on PE: true

Associated: 00000014.00000002.2493917908.00000000033B0000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000014.00000002.2497615129.00000000033F3000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000014.00000002.2498110795.0000000003400000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000014.00000002.2498410969.0000000003406000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000014.00000002.2498556459.0000000003408000.00000008.00000001.01000000.00000015.sdmpDownload File
Associated: 00000014.00000002.2498718201.000000000340A000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000014.00000002.2499166516.0000000003411000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_33b0000_Picasa3.jbxd

Similarity

API ID: CriticalCurrentSectionThread$EnterLeave
String ID:
API String ID: 637047042-0
Opcode ID: 3907a47565d19a99b149f9e033d629127e6fd3986683e80e8febe1d1a0449aab
Instruction ID: e7a96d03d59b33e5e966569465263caf52aac9024ed9982ad4978f2b11b7a786
Opcode Fuzzy Hash: 3907a47565d19a99b149f9e033d629127e6fd3986683e80e8febe1d1a0449aab
Instruction Fuzzy Hash: 9741E1B6601B009FC720DB69E8C47E6F7F0EB89325F08465ED69686A80D73AE485CB54

Function 0403D810 Relevance: 9.1, APIs: 6, Instructions: 119threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 0403D831
EnterCriticalSection.KERNEL32(04093868,?,00000000,00000000,0403D77C,00000000), ref: 0403D850
GetCurrentThreadId.KERNEL32 ref: 0403D8B4
LeaveCriticalSection.KERNEL32(04093818,?,00000000), ref: 0403D8D7

Memory Dump Source

Source File: 00000014.00000002.2502041842.0000000004031000.00000020.00000001.01000000.00000017.sdmp, Offset: 04030000, based on PE: true

Associated: 00000014.00000002.2501986218.0000000004030000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000014.00000002.2504208079.0000000004079000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000014.00000002.2504943590.0000000004086000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000014.00000002.2505148754.000000000408E000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000014.00000002.2505282171.0000000004090000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000014.00000002.2505501725.0000000004097000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_4030000_Picasa3.jbxd

Similarity

API ID: CriticalCurrentSectionThread$EnterLeave
String ID:
API String ID: 637047042-0
Opcode ID: 25546748cfa936e170eacc586fb908b8ea89b61f8aa738a4369758b4def00eb9
Instruction ID: 057838d3b498af6dde1787b6ffe07cdbf7a9a547cf5968529e9e161213576d6c
Opcode Fuzzy Hash: 25546748cfa936e170eacc586fb908b8ea89b61f8aa738a4369758b4def00eb9
Instruction Fuzzy Hash: 934145B66017009FD720DF29E44439ABBE8FF49326F004A7EC985A3640D73AF885CB55

Function 033BB0A0 Relevance: 9.1, APIs: 6, Instructions: 117threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 033BB0B0
EnterCriticalSection.KERNEL32(0340DE08,?,?,?,?,033BB27C,?,033BA494), ref: 033BB0D0
GetCurrentThreadId.KERNEL32 ref: 033BB11E
GetCurrentThreadId.KERNEL32 ref: 033BB144
LeaveCriticalSection.KERNEL32(0340DDB8,?,?,?,?,033BB27C,?,033BA494), ref: 033BB162

Memory Dump Source

Source File: 00000014.00000002.2494020967.00000000033B1000.00000020.00000001.01000000.00000015.sdmp, Offset: 033B0000, based on PE: true

Associated: 00000014.00000002.2493917908.00000000033B0000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000014.00000002.2497615129.00000000033F3000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000014.00000002.2498110795.0000000003400000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000014.00000002.2498410969.0000000003406000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000014.00000002.2498556459.0000000003408000.00000008.00000001.01000000.00000015.sdmpDownload File
Associated: 00000014.00000002.2498718201.000000000340A000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000014.00000002.2499166516.0000000003411000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_33b0000_Picasa3.jbxd

Similarity

API ID: CurrentThread$CriticalSection$EnterLeave
String ID:
API String ID: 2999955336-0
Opcode ID: f61f2dd864f42440b937fb3b7e648aa6eb1c69d9592e79bc689e26112d2486e3
Instruction ID: c04945b20939347b6285145d71b88c625e5c39c9568d82cd5ca329bcb12c6a3c
Opcode Fuzzy Hash: f61f2dd864f42440b937fb3b7e648aa6eb1c69d9592e79bc689e26112d2486e3
Instruction Fuzzy Hash: D931B276605741DFCB20DFA9A8C04AAF3F4FB99221318466FD29787E01DB32E486CB55

Function 0403D940 Relevance: 9.1, APIs: 6, Instructions: 117threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 0403D950
EnterCriticalSection.KERNEL32(04093868,?,?,?,0403DB1C,?,04031495), ref: 0403D970
GetCurrentThreadId.KERNEL32 ref: 0403D9BE
GetCurrentThreadId.KERNEL32 ref: 0403D9E4
LeaveCriticalSection.KERNEL32(04093818,?,?,?,0403DB1C,?,04031495), ref: 0403DA02

Memory Dump Source

Source File: 00000014.00000002.2502041842.0000000004031000.00000020.00000001.01000000.00000017.sdmp, Offset: 04030000, based on PE: true

Associated: 00000014.00000002.2501986218.0000000004030000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000014.00000002.2504208079.0000000004079000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000014.00000002.2504943590.0000000004086000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000014.00000002.2505148754.000000000408E000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000014.00000002.2505282171.0000000004090000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000014.00000002.2505501725.0000000004097000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_4030000_Picasa3.jbxd

Similarity

API ID: CurrentThread$CriticalSection$EnterLeave
String ID:
API String ID: 2999955336-0
Opcode ID: 6cc61f7d78fe0443ca6fa270bbb49bda3ad060cc2697d83713070bf87bc95bac
Instruction ID: bb3d381a879e8c7109a12cc5194775adbb8310cb7f356cf4847978ec00e55eac
Opcode Fuzzy Hash: 6cc61f7d78fe0443ca6fa270bbb49bda3ad060cc2697d83713070bf87bc95bac
Instruction Fuzzy Hash: A2310AB3A057409FCB20CF68A48045ABBE4FF993277144A7FC285A3601D735F886DB55

Function 0480D460 Relevance: 9.1, APIs: 6, Instructions: 116COMMON

Download Yara Rule

APIs

DestroyWindow.USER32(?), ref: 0480D4A1
DeleteObject.GDI32(?), ref: 0480D4F4
InterlockedDecrement.KERNEL32(?), ref: 0480D52D
InterlockedIncrement.KERNEL32(?), ref: 0480D545
InterlockedDecrement.KERNEL32(?), ref: 0480D57E
InterlockedIncrement.KERNEL32(?), ref: 0480D596

Memory Dump Source

Source File: 00000014.00000002.2526268174.00000000047E1000.00000020.00000001.01000000.00000016.sdmp, Offset: 047E0000, based on PE: true

Associated: 00000014.00000002.2526187657.00000000047E0000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000014.00000002.2533437740.000000000488F000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000014.00000002.2535246598.00000000048AB000.00000004.00000001.01000000.00000016.sdmpDownload File
Associated: 00000014.00000002.2535569716.00000000048B3000.00000008.00000001.01000000.00000016.sdmpDownload File
Associated: 00000014.00000002.2535640427.00000000048B5000.00000004.00000001.01000000.00000016.sdmpDownload File
Associated: 00000014.00000002.2536317728.00000000048C0000.00000002.00000001.01000000.00000016.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_47e0000_Picasa3.jbxd

Similarity

API ID: Interlocked$DecrementIncrement$DeleteDestroyObjectWindow
String ID:
API String ID: 2197972620-0
Opcode ID: 745747b6077ef3ec800f2fa3ec3d6650f4a76a423b9c04cd8f2655e285713cae
Instruction ID: 0b8737e0df4d3ce0afd0df5c225590c22bc646cc6d0cf7d9e2732ce19986176e
Opcode Fuzzy Hash: 745747b6077ef3ec800f2fa3ec3d6650f4a76a423b9c04cd8f2655e285713cae
Instruction Fuzzy Hash: 744180B1920A018BE760DFB8DCC0726B7E5BF49218F148E3DE65AC7681DB38F8449B51

Function 033BAE30 Relevance: 9.1, APIs: 6, Instructions: 107synchronizationthreadCOMMON

Download Yara Rule

APIs

WaitForSingleObject.KERNEL32(00000D88,00000000), ref: 033BAE58
GetCurrentThreadId.KERNEL32 ref: 033BAE71
EnterCriticalSection.KERNEL32(?), ref: 033BAE93
GetCurrentThreadId.KERNEL32 ref: 033BAEFC
LeaveCriticalSection.KERNEL32(?), ref: 033BAF19
WaitForSingleObject.KERNEL32(00000D88,00000064), ref: 033BAF3A

Memory Dump Source

Source File: 00000014.00000002.2494020967.00000000033B1000.00000020.00000001.01000000.00000015.sdmp, Offset: 033B0000, based on PE: true

Associated: 00000014.00000002.2493917908.00000000033B0000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000014.00000002.2497615129.00000000033F3000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000014.00000002.2498110795.0000000003400000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000014.00000002.2498410969.0000000003406000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000014.00000002.2498556459.0000000003408000.00000008.00000001.01000000.00000015.sdmpDownload File
Associated: 00000014.00000002.2498718201.000000000340A000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000014.00000002.2499166516.0000000003411000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_33b0000_Picasa3.jbxd

Similarity

API ID: CriticalCurrentObjectSectionSingleThreadWait$EnterLeave
String ID:
API String ID: 950976412-0
Opcode ID: 734c0d4e4b8e0de9cb881a6d1b8e55c113798a7e6c92c4031b6d9002e3228949
Instruction ID: 593b0ae916bafaa09cdee5ce76837eff66e1b1976b6cee153374c2210898edc5
Opcode Fuzzy Hash: 734c0d4e4b8e0de9cb881a6d1b8e55c113798a7e6c92c4031b6d9002e3228949
Instruction Fuzzy Hash: CE41A0B1A00685DFCB20EF58DCC45D9B7B9FB49218B09436AFA5ADBA40C734DC44CB92

Function 0403D6D0 Relevance: 9.1, APIs: 6, Instructions: 107synchronizationthreadCOMMON

Download Yara Rule

APIs

WaitForSingleObject.KERNEL32(00000E74,00000000), ref: 0403D6F8
GetCurrentThreadId.KERNEL32 ref: 0403D711
EnterCriticalSection.KERNEL32(?), ref: 0403D733
GetCurrentThreadId.KERNEL32 ref: 0403D79C
LeaveCriticalSection.KERNEL32(?), ref: 0403D7B9
WaitForSingleObject.KERNEL32(00000E74,00000064), ref: 0403D7DA

Memory Dump Source

Source File: 00000014.00000002.2502041842.0000000004031000.00000020.00000001.01000000.00000017.sdmp, Offset: 04030000, based on PE: true

Associated: 00000014.00000002.2501986218.0000000004030000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000014.00000002.2504208079.0000000004079000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000014.00000002.2504943590.0000000004086000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000014.00000002.2505148754.000000000408E000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000014.00000002.2505282171.0000000004090000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000014.00000002.2505501725.0000000004097000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_4030000_Picasa3.jbxd

Similarity

API ID: CriticalCurrentObjectSectionSingleThreadWait$EnterLeave
String ID:
API String ID: 950976412-0
Opcode ID: f4d4bda861bf430a55259b37e9dbb4a72c5b8e1b2c1f91a29280238b17891704
Instruction ID: dd4ed75440c18223eb24ea84a113b3f6958e79d01d17222d299cdee79972109f
Opcode Fuzzy Hash: f4d4bda861bf430a55259b37e9dbb4a72c5b8e1b2c1f91a29280238b17891704
Instruction Fuzzy Hash: 9841BFB16042859BDB60DF68D884C997FE9FF49316F048679E949B3240EB38EC44CB92

Function 033B6800 Relevance: 9.1, APIs: 3, Strings: 2, Instructions: 356COMMON

Download Yara Rule

APIs

InterlockedIncrement.KERNEL32(?), ref: 033B68F8
SysFreeString.OLEAUT32(?), ref: 033B698C
SafeArrayDestroyData.OLEAUT32(?), ref: 033B6A12

Strings

Picasa, xrefs: 033B6932
`cu, xrefs: 033B698C

Memory Dump Source

Source File: 00000014.00000002.2494020967.00000000033B1000.00000020.00000001.01000000.00000015.sdmp, Offset: 033B0000, based on PE: true

Associated: 00000014.00000002.2493917908.00000000033B0000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000014.00000002.2497615129.00000000033F3000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000014.00000002.2498110795.0000000003400000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000014.00000002.2498410969.0000000003406000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000014.00000002.2498556459.0000000003408000.00000008.00000001.01000000.00000015.sdmpDownload File
Associated: 00000014.00000002.2498718201.000000000340A000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000014.00000002.2499166516.0000000003411000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_33b0000_Picasa3.jbxd

Similarity

API ID: ArrayDataDestroyFreeIncrementInterlockedSafeString
String ID: Picasa$`cu
API String ID: 3609439297-4006816683
Opcode ID: 9ec1feeb312cca23c49b746c16681fcaf3cac1c229a632ac88630c5bfa664655
Instruction ID: ed125c07e87a7a871f82a010111a8897eca7c1ef2e2cc303f53c0c35affd340e
Opcode Fuzzy Hash: 9ec1feeb312cca23c49b746c16681fcaf3cac1c229a632ac88630c5bfa664655
Instruction Fuzzy Hash: CFD18A76A043459FC700EF69C8D0A9AB3F8AFC9350F444A6DFA949B651C731ED06CB92

Function 04828420 Relevance: 9.1, APIs: 6, Instructions: 85networkCOMMON

Download Yara Rule

APIs

Part of subcall function 048295F0: InternetSetStatusCallback.WININET ref: 04829613
Part of subcall function 048295F0: InternetCloseHandle.WININET(?), ref: 04829616
Part of subcall function 048295F0: InternetSetStatusCallback.WININET(?,00000000), ref: 04829629
Part of subcall function 048295F0: InternetCloseHandle.WININET(?), ref: 0482962C
Part of subcall function 048295F0: InternetSetStatusCallback.WININET(?,00000000), ref: 0482963F
Part of subcall function 048295F0: InternetCloseHandle.WININET(?), ref: 04829642

InternetSetStatusCallback.WININET(?,00000000), ref: 04828444
InternetCloseHandle.WININET(?), ref: 04828447
InternetSetStatusCallback.WININET(?,00000000), ref: 04828459
InternetCloseHandle.WININET(?), ref: 0482845C
InternetSetStatusCallback.WININET(?,00000000), ref: 0482846E
InternetCloseHandle.WININET(?), ref: 04828471

Memory Dump Source

Source File: 00000014.00000002.2526268174.00000000047E1000.00000020.00000001.01000000.00000016.sdmp, Offset: 047E0000, based on PE: true

Associated: 00000014.00000002.2526187657.00000000047E0000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000014.00000002.2533437740.000000000488F000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000014.00000002.2535246598.00000000048AB000.00000004.00000001.01000000.00000016.sdmpDownload File
Associated: 00000014.00000002.2535569716.00000000048B3000.00000008.00000001.01000000.00000016.sdmpDownload File
Associated: 00000014.00000002.2535640427.00000000048B5000.00000004.00000001.01000000.00000016.sdmpDownload File
Associated: 00000014.00000002.2536317728.00000000048C0000.00000002.00000001.01000000.00000016.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_47e0000_Picasa3.jbxd

Similarity

API ID: Internet$CallbackCloseHandleStatus
String ID:
API String ID: 1454515200-0
Opcode ID: 961c2b0bb1bc9ffa06a53c23e8b5bcc1e6d594f8b36db7b2fa33f96bddcb4a27
Instruction ID: 5142693013e8d4c87100f075cc3fc35cbb4f1d8c78cdabe540f635aed2f6c195
Opcode Fuzzy Hash: 961c2b0bb1bc9ffa06a53c23e8b5bcc1e6d594f8b36db7b2fa33f96bddcb4a27
Instruction Fuzzy Hash: E33169B2500B158FD722AFAAC98442BF7F9FF557093910E2DD28293A11C775F8458B90

Function 04035C10 Relevance: 9.1, APIs: 6, Instructions: 66COMMON

Download Yara Rule

APIs

GetParent.USER32(?), ref: 04035C28
GetWindowRect.USER32(?,?), ref: 04035C3C
GetWindowRect.USER32(00000000,?), ref: 04035C44
SetWindowPos.USER32(?,00000000,?,?,00000000,00000000,00000015), ref: 04035C85
UnhookWindowsHookEx.USER32(00000000), ref: 04035C92
CallNextHookEx.USER32(00000000,?,?,?), ref: 04035CBE

Memory Dump Source

Source File: 00000014.00000002.2502041842.0000000004031000.00000020.00000001.01000000.00000017.sdmp, Offset: 04030000, based on PE: true

Associated: 00000014.00000002.2501986218.0000000004030000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000014.00000002.2504208079.0000000004079000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000014.00000002.2504943590.0000000004086000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000014.00000002.2505148754.000000000408E000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000014.00000002.2505282171.0000000004090000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000014.00000002.2505501725.0000000004097000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_4030000_Picasa3.jbxd

Similarity

API ID: Window$HookRect$CallNextParentUnhookWindows
String ID:
API String ID: 1823628457-0
Opcode ID: cc99535453503c5c9ea550d7ee0d874df19117ba0dd098f927e033ad9a715cd4
Instruction ID: d4d4a4e6061d8c94103d84bb18f88a25a7c2243103f950121ef090f20412ff73
Opcode Fuzzy Hash: cc99535453503c5c9ea550d7ee0d874df19117ba0dd098f927e033ad9a715cd4
Instruction Fuzzy Hash: 2F112E72614600AFD708DF78DD99E6F77E9FBC8700F044A1DF545A2284D778AD058B62

Function 048295F0 Relevance: 9.0, APIs: 6, Instructions: 41networkCOMMON

Download Yara Rule

APIs

InternetSetStatusCallback.WININET ref: 04829613
InternetCloseHandle.WININET(?), ref: 04829616
InternetSetStatusCallback.WININET(?,00000000), ref: 04829629
InternetCloseHandle.WININET(?), ref: 0482962C
InternetSetStatusCallback.WININET(?,00000000), ref: 0482963F
InternetCloseHandle.WININET(?), ref: 04829642

Memory Dump Source

Source File: 00000014.00000002.2526268174.00000000047E1000.00000020.00000001.01000000.00000016.sdmp, Offset: 047E0000, based on PE: true

Associated: 00000014.00000002.2526187657.00000000047E0000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000014.00000002.2533437740.000000000488F000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000014.00000002.2535246598.00000000048AB000.00000004.00000001.01000000.00000016.sdmpDownload File
Associated: 00000014.00000002.2535569716.00000000048B3000.00000008.00000001.01000000.00000016.sdmpDownload File
Associated: 00000014.00000002.2535640427.00000000048B5000.00000004.00000001.01000000.00000016.sdmpDownload File
Associated: 00000014.00000002.2536317728.00000000048C0000.00000002.00000001.01000000.00000016.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_47e0000_Picasa3.jbxd

Similarity

API ID: Internet$CallbackCloseHandleStatus
String ID:
API String ID: 1454515200-0
Opcode ID: 71def845b67e33af0d4ba254170f18d076fdf1b4b044eaa3e124a7685fceea64
Instruction ID: 05bdc4b8096d1b52c40d89a60f1dc23a123cd3bb738b6c44441c8a4f51e0c029
Opcode Fuzzy Hash: 71def845b67e33af0d4ba254170f18d076fdf1b4b044eaa3e124a7685fceea64
Instruction Fuzzy Hash: F5F06272241B006BE3225B6A8D41B17F7F8BF86F14F15090DE258936609BB5F4014628

Function 033E4C47 Relevance: 9.0, APIs: 1, Strings: 4, Instructions: 220COMMONLIBRARYCODE

Download Yara Rule

APIs

__sopen_s.LIBCMT ref: 033E4EB2

Strings

UTF-16LE, xrefs: 033E4E42
UTF-8, xrefs: 033E4E25
ccs=, xrefs: 033E4E11
UNICODE, xrefs: 033E4E5F

Memory Dump Source

Source File: 00000014.00000002.2494020967.00000000033B1000.00000020.00000001.01000000.00000015.sdmp, Offset: 033B0000, based on PE: true

Associated: 00000014.00000002.2493917908.00000000033B0000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000014.00000002.2497615129.00000000033F3000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000014.00000002.2498110795.0000000003400000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000014.00000002.2498410969.0000000003406000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000014.00000002.2498556459.0000000003408000.00000008.00000001.01000000.00000015.sdmpDownload File
Associated: 00000014.00000002.2498718201.000000000340A000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000014.00000002.2499166516.0000000003411000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_33b0000_Picasa3.jbxd

Similarity

API ID: __sopen_s
String ID: UNICODE$UTF-16LE$UTF-8$ccs=
API String ID: 2693426323-2506416105
Opcode ID: e759f451f398fbe4699c2efc3b42d58393e3921a7409e8404965e8db74ff57f8
Instruction ID: 6d3723f1765b8f499cb44ed6c5c384a0ee010eb4751f5d019640f7460f14c4f8
Opcode Fuzzy Hash: e759f451f398fbe4699c2efc3b42d58393e3921a7409e8404965e8db74ff57f8
Instruction Fuzzy Hash: 0371C571C04339EEDB25CF9789C47AEBBE8AB4D314F09C15AD856AA5E2D3748241CF41

Function 04066F4C Relevance: 9.0, APIs: 1, Strings: 4, Instructions: 220COMMONLIBRARYCODE

Download Yara Rule

APIs

__sopen_s.LIBCMT ref: 040671B7

Strings

UNICODE, xrefs: 04067164
ccs=, xrefs: 04067116
UTF-16LE, xrefs: 04067147
UTF-8, xrefs: 0406712A

Memory Dump Source

Source File: 00000014.00000002.2502041842.0000000004031000.00000020.00000001.01000000.00000017.sdmp, Offset: 04030000, based on PE: true

Associated: 00000014.00000002.2501986218.0000000004030000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000014.00000002.2504208079.0000000004079000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000014.00000002.2504943590.0000000004086000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000014.00000002.2505148754.000000000408E000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000014.00000002.2505282171.0000000004090000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000014.00000002.2505501725.0000000004097000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_4030000_Picasa3.jbxd

Similarity

API ID: __sopen_s
String ID: UNICODE$UTF-16LE$UTF-8$ccs=
API String ID: 2693426323-2506416105
Opcode ID: 19425330e36b285220db54d8eb57ea40670ae97fc93e80d16ed007343ce78156
Instruction ID: be161d14a388a86eef7fdb59ec79aac8b2157d8c6eb3285cb9ad70196a46a756
Opcode Fuzzy Hash: 19425330e36b285220db54d8eb57ea40670ae97fc93e80d16ed007343ce78156
Instruction Fuzzy Hash: DC71AE71908209EEFB659FA9C5447AE7FE0AB0031CF14C06AEC57BB150E379A3419F62

Function 033B1450 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 145fileCOMMON

Download Yara Rule

APIs

SHCreateStreamOnFileW.SHLWAPI(00000000,00000040,?), ref: 033B14AA

Strings

`cu, xrefs: 033B151C, 033B1578

Memory Dump Source

Source File: 00000014.00000002.2494020967.00000000033B1000.00000020.00000001.01000000.00000015.sdmp, Offset: 033B0000, based on PE: true

Associated: 00000014.00000002.2493917908.00000000033B0000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000014.00000002.2497615129.00000000033F3000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000014.00000002.2498110795.0000000003400000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000014.00000002.2498410969.0000000003406000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000014.00000002.2498556459.0000000003408000.00000008.00000001.01000000.00000015.sdmpDownload File
Associated: 00000014.00000002.2498718201.000000000340A000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000014.00000002.2499166516.0000000003411000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_33b0000_Picasa3.jbxd

Similarity

API ID: CreateFileStream
String ID: `cu
API String ID: 3811216425-4120539311
Opcode ID: 9042fa6c25a5fd599a856fde7169f9cb8947f3c007fcc7f12546554e641c3480
Instruction ID: e6e074b574a3ec8a538b56371645c9b37aadd067e420eb68c38263bea7393a50
Opcode Fuzzy Hash: 9042fa6c25a5fd599a856fde7169f9cb8947f3c007fcc7f12546554e641c3480
Instruction Fuzzy Hash: 67416F71A042009FD311DE68DCD4AAAF7F9EBC5320F288A5AE659CB250D771DC85CB92

Function 04033C60 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 132COMMON

Download Yara Rule

APIs

InterlockedIncrement.KERNEL32(00000000), ref: 04033CB8
InterlockedIncrement.KERNEL32(00000000), ref: 04033D28
InterlockedIncrement.KERNEL32(00000000), ref: 04033D73
InterlockedIncrement.KERNEL32(?), ref: 04033DAE

Strings

ru, xrefs: 04033CB8, 04033D28, 04033D73, 04033DAE

Memory Dump Source

Source File: 00000014.00000002.2502041842.0000000004031000.00000020.00000001.01000000.00000017.sdmp, Offset: 04030000, based on PE: true

Associated: 00000014.00000002.2501986218.0000000004030000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000014.00000002.2504208079.0000000004079000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000014.00000002.2504943590.0000000004086000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000014.00000002.2505148754.000000000408E000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000014.00000002.2505282171.0000000004090000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000014.00000002.2505501725.0000000004097000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_4030000_Picasa3.jbxd

Similarity

API ID: IncrementInterlocked
String ID: ru
API String ID: 3508698243-1355688448
Opcode ID: d3f70b906282bb66488bce3a608d39ff561326050fb7c4c7eefa23072e41a4d4
Instruction ID: db0ed238076e0dfccf949b262ff27bfa62a08b5c921b0c33d1a6904728827588
Opcode Fuzzy Hash: d3f70b906282bb66488bce3a608d39ff561326050fb7c4c7eefa23072e41a4d4
Instruction Fuzzy Hash: 3941A1725102628BE7619F15D4807AEBFE9AF8474AF148829EC80FF105CB38B945C7D2

Function 0403FE90 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 73COMMON

Download Yara Rule

APIs

InterlockedIncrement.KERNEL32(?), ref: 0403FED4
InterlockedIncrement.KERNEL32(0000001C), ref: 0403FF11

Strings

Local AppData, xrefs: 0403FF19
AppData, xrefs: 0403FF36
ru, xrefs: 0403FED4, 0403FF11

Memory Dump Source

Source File: 00000014.00000002.2502041842.0000000004031000.00000020.00000001.01000000.00000017.sdmp, Offset: 04030000, based on PE: true

Associated: 00000014.00000002.2501986218.0000000004030000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000014.00000002.2504208079.0000000004079000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000014.00000002.2504943590.0000000004086000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000014.00000002.2505148754.000000000408E000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000014.00000002.2505282171.0000000004090000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000014.00000002.2505501725.0000000004097000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_4030000_Picasa3.jbxd

Similarity

API ID: IncrementInterlocked
String ID: AppData$Local AppData$ru
API String ID: 3508698243-258448553
Opcode ID: ce3066c30518eb8ccdc8ed8eaf16ec9cf512e32edf7f0191a016d7428b5bda5b
Instruction ID: 8140e7b93e27c45de3ac3fd0f5b12f4e82473671d1d3ab4cd91cd2d13167d0e6
Opcode Fuzzy Hash: ce3066c30518eb8ccdc8ed8eaf16ec9cf512e32edf7f0191a016d7428b5bda5b
Instruction Fuzzy Hash: 7121C9709043469FE714EF24D8557EA7FE8AF46309F044868F846A7151D778F808D793

Function 033DE21A Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 70threadCOMMON

Download Yara Rule

APIs

__calloc_crt.LIBCMT ref: 033DE255
CreateThread.KERNEL32(00000000,00000000,Vw#,00000000,00000000,033BB20D), ref: 033DE299
GetLastError.KERNEL32(?,75722E40,033BB20D,00000000,00000000,Function_0000ACC0,00000000,00000000,0000001C), ref: 033DE2A3
__dosmaperr.LIBCMT ref: 033DE2BB

Strings

Vw#, xrefs: 033DE28E

Memory Dump Source

Source File: 00000014.00000002.2494020967.00000000033B1000.00000020.00000001.01000000.00000015.sdmp, Offset: 033B0000, based on PE: true

Associated: 00000014.00000002.2493917908.00000000033B0000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000014.00000002.2497615129.00000000033F3000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000014.00000002.2498110795.0000000003400000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000014.00000002.2498410969.0000000003406000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000014.00000002.2498556459.0000000003408000.00000008.00000001.01000000.00000015.sdmpDownload File
Associated: 00000014.00000002.2498718201.000000000340A000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000014.00000002.2499166516.0000000003411000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_33b0000_Picasa3.jbxd

Similarity

API ID: CreateErrorLastThread__calloc_crt__dosmaperr
String ID: Vw#
API String ID: 84609068-2334111627
Opcode ID: 9e8640a3ead96d1709c0a94d69841a7968c02add6ecc06d661d43f0b15cdab53
Instruction ID: 192ba1badbd4cd8931b3b28cea7628fa217ce2823a72b2a3c0f95ab75638f45d
Opcode Fuzzy Hash: 9e8640a3ead96d1709c0a94d69841a7968c02add6ecc06d661d43f0b15cdab53
Instruction Fuzzy Hash: D611C177905319AFDB11FFA4ECC189FBBA8FF04364B104529F516EA090DB7189008B61

Function 040443B0 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 68COMMON

Download Yara Rule

APIs

DeleteCriticalSection.KERNEL32(?,?,00000000,00000001,00000000,0403626A,00000000), ref: 040443DF
CloseHandle.KERNEL32(?,?,00000000,00000001,00000000,0403626A,00000000), ref: 040443E9
InterlockedDecrement.KERNEL32(?), ref: 04044412
InterlockedDecrement.KERNEL32(00000000), ref: 04044442

Part of subcall function 0403D940: GetCurrentThreadId.KERNEL32 ref: 0403D950
Part of subcall function 0403D940: GetCurrentThreadId.KERNEL32 ref: 0403D9BE

Strings

`ruru, xrefs: 04044402

Memory Dump Source

Source File: 00000014.00000002.2502041842.0000000004031000.00000020.00000001.01000000.00000017.sdmp, Offset: 04030000, based on PE: true

Associated: 00000014.00000002.2501986218.0000000004030000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000014.00000002.2504208079.0000000004079000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000014.00000002.2504943590.0000000004086000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000014.00000002.2505148754.000000000408E000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000014.00000002.2505282171.0000000004090000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000014.00000002.2505501725.0000000004097000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_4030000_Picasa3.jbxd

Similarity

API ID: CurrentDecrementInterlockedThread$CloseCriticalDeleteHandleSection
String ID: `ruru
API String ID: 4273916725-999165909
Opcode ID: 0c6a07113d5f06a1e803f4a29af5bbcbdf2cf4888806e3c41e6c8c188252eeec
Instruction ID: 993e5429332b345451fd2fbe709d70899ff2f8a52b13e690d98bdf0ead80ae3a
Opcode Fuzzy Hash: 0c6a07113d5f06a1e803f4a29af5bbcbdf2cf4888806e3c41e6c8c188252eeec
Instruction Fuzzy Hash: 92214AF6900249BBDB00EF65DC904AE7BA9BE84359B45C439FA09BB200D734FA55CB91

Function 04036A00 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 59COMMON

Download Yara Rule

APIs

GetSystemDirectoryA.KERNEL32(?,00000800), ref: 04036A1F
_memset.LIBCMT ref: 04036A4C

Strings

/select,"%s", xrefs: 04036A5D
open, xrefs: 04036A6F
<, xrefs: 04036A67

Memory Dump Source

Source File: 00000014.00000002.2502041842.0000000004031000.00000020.00000001.01000000.00000017.sdmp, Offset: 04030000, based on PE: true

Associated: 00000014.00000002.2501986218.0000000004030000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000014.00000002.2504208079.0000000004079000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000014.00000002.2504943590.0000000004086000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000014.00000002.2505148754.000000000408E000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000014.00000002.2505282171.0000000004090000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000014.00000002.2505501725.0000000004097000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_4030000_Picasa3.jbxd

Similarity

API ID: DirectorySystem_memset
String ID: /select,"%s"$<$open
API String ID: 3633563235-2673884991
Opcode ID: afc2828f3435408831aa96d1cc4e1ddf8280342839947c87d32a9864b18c2bae
Instruction ID: dada9a37180d7687bf900f313e905ab948eebc446dad20b7f14ab15aa6878914
Opcode Fuzzy Hash: afc2828f3435408831aa96d1cc4e1ddf8280342839947c87d32a9864b18c2bae
Instruction Fuzzy Hash: CA1163B1914341ABE710DF24D845A5FBBE8BFC431DF408D1DE49AA6240EB79E508CB83

Function 033B1C60 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 53memoryCOMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000,?,?,033B1E7A,?,033B60B7,Picasa), ref: 033B1C86
SysAllocStringLen.OLEAUT32(00000000,-00000001), ref: 033B1C94
MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000,?,?,033B1E7A,?,033B60B7,Picasa), ref: 033B1CA8
SysFreeString.OLEAUT32(00000000), ref: 033B1CB3

Strings

`cu, xrefs: 033B1CB3

Memory Dump Source

Source File: 00000014.00000002.2494020967.00000000033B1000.00000020.00000001.01000000.00000015.sdmp, Offset: 033B0000, based on PE: true

Associated: 00000014.00000002.2493917908.00000000033B0000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000014.00000002.2497615129.00000000033F3000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000014.00000002.2498110795.0000000003400000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000014.00000002.2498410969.0000000003406000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000014.00000002.2498556459.0000000003408000.00000008.00000001.01000000.00000015.sdmpDownload File
Associated: 00000014.00000002.2498718201.000000000340A000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000014.00000002.2499166516.0000000003411000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_33b0000_Picasa3.jbxd

Similarity

API ID: ByteCharMultiStringWide$AllocFree
String ID: `cu
API String ID: 447844807-4120539311
Opcode ID: 2ccaa138366ea587c53a560c1cb69cdeeadafe636db6c4de5113e98655f7efb9
Instruction ID: 3bd9c39922600da2d6278280a471d8fa61a02bdf9a2f49394c4e688c942f38eb
Opcode Fuzzy Hash: 2ccaa138366ea587c53a560c1cb69cdeeadafe636db6c4de5113e98655f7efb9
Instruction Fuzzy Hash: 5F01A93A308216BFD310AA65BC85F6BF7ACDBC4B75F540226F61DE15C4DA71A8004674

Function 040688C6 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 47COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 0406482C: __amsg_exit.LIBCMT ref: 0406483A

__amsg_exit.LIBCMT ref: 040688F2
__lock.LIBCMT ref: 04068902
InterlockedDecrement.KERNEL32(?), ref: 0406891F
InterlockedIncrement.KERNEL32(03741548), ref: 0406894A

Strings

`ruru, xrefs: 0406891F

Memory Dump Source

Source File: 00000014.00000002.2502041842.0000000004031000.00000020.00000001.01000000.00000017.sdmp, Offset: 04030000, based on PE: true

Associated: 00000014.00000002.2501986218.0000000004030000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000014.00000002.2504208079.0000000004079000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000014.00000002.2504943590.0000000004086000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000014.00000002.2505148754.000000000408E000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000014.00000002.2505282171.0000000004090000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000014.00000002.2505501725.0000000004097000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_4030000_Picasa3.jbxd

Similarity

API ID: Interlocked__amsg_exit$DecrementIncrement__lock
String ID: `ruru
API String ID: 4129207761-999165909
Opcode ID: 0f6e2beb72a6e8b727e1313aac4fa6c46e2dfc1a59c89552292b8e59be23ffa5
Instruction ID: 2727175c664da444b1024f8817d331743d239a556ed973aa1256ddf4b19d811d
Opcode Fuzzy Hash: 0f6e2beb72a6e8b727e1313aac4fa6c46e2dfc1a59c89552292b8e59be23ffa5
Instruction Fuzzy Hash: 6A01D632D42711ABE720BF69950479D77A0EF01728F054418E847BB280CB38B981CBE7

Function 033DE44F Relevance: 7.7, APIs: 5, Instructions: 188COMMONLIBRARYCODE

Download Yara Rule

APIs

_memset.LIBCMT ref: 033DE4AF
_memcpy_s.LIBCMT ref: 033DE522
__filbuf.LIBCMT ref: 033DE5AD
_memset.LIBCMT ref: 033DE5F3
_memset.LIBCMT ref: 033DE61E

Memory Dump Source

Source File: 00000014.00000002.2494020967.00000000033B1000.00000020.00000001.01000000.00000015.sdmp, Offset: 033B0000, based on PE: true

Associated: 00000014.00000002.2493917908.00000000033B0000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000014.00000002.2497615129.00000000033F3000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000014.00000002.2498110795.0000000003400000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000014.00000002.2498410969.0000000003406000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000014.00000002.2498556459.0000000003408000.00000008.00000001.01000000.00000015.sdmpDownload File
Associated: 00000014.00000002.2498718201.000000000340A000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000014.00000002.2499166516.0000000003411000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_33b0000_Picasa3.jbxd

Similarity

API ID: _memset$__filbuf_memcpy_s
String ID:
API String ID: 2885843685-0
Opcode ID: 0a8534b5256209ad539516015d2216ad8fd293ee1363c256cd308430414ab1ab
Instruction ID: 96871ca7ecac74c4ad37d4ae9ee2b423714a9eb26e662b720f8272c385c1688f
Opcode Fuzzy Hash: 0a8534b5256209ad539516015d2216ad8fd293ee1363c256cd308430414ab1ab
Instruction Fuzzy Hash: 3951C537D00605EBCB21DFA9ACC459EBFB9AF41360F188669E8259A190E730DA90CB51

Function 040628FF Relevance: 7.7, APIs: 5, Instructions: 188COMMONLIBRARYCODE

Download Yara Rule

APIs

_memset.LIBCMT ref: 0406295F
_memcpy_s.LIBCMT ref: 040629D2
__filbuf.LIBCMT ref: 04062A5D
_memset.LIBCMT ref: 04062AA3
_memset.LIBCMT ref: 04062ACE

Memory Dump Source

Source File: 00000014.00000002.2502041842.0000000004031000.00000020.00000001.01000000.00000017.sdmp, Offset: 04030000, based on PE: true

Associated: 00000014.00000002.2501986218.0000000004030000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000014.00000002.2504208079.0000000004079000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000014.00000002.2504943590.0000000004086000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000014.00000002.2505148754.000000000408E000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000014.00000002.2505282171.0000000004090000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000014.00000002.2505501725.0000000004097000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_4030000_Picasa3.jbxd

Similarity

API ID: _memset$__filbuf_memcpy_s
String ID:
API String ID: 2885843685-0
Opcode ID: 19f577008db45b7b8cf46c9c086ed0775eb497b9e0b822fac2cfa27d026a6073
Instruction ID: db3f1bb6bd129862875f351b54af0bd5ac0c67bfe5b62dd7c9ccc75837ddaa8a
Opcode Fuzzy Hash: 19f577008db45b7b8cf46c9c086ed0775eb497b9e0b822fac2cfa27d026a6073
Instruction Fuzzy Hash: 4C510671A01205EBCB34EF699C445AEBBF5EF80324F14869DE867B6190E374BA50CF61

Function 033BC140 Relevance: 7.7, APIs: 5, Instructions: 179registryCOMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,000000FF,00000000,00000000), ref: 033BC16D
MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,000000FF,00000000,00000000), ref: 033BC188
MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,000000FF,?,00000000), ref: 033BC1A5
RegQueryValueExW.ADVAPI32(?,?,?,?,00000000,?), ref: 033BC234
WideCharToMultiByte.KERNEL32(0000FDE9,00000000,00000000,?,?,?,00000000,00000000), ref: 033BC2CC

Memory Dump Source

Source File: 00000014.00000002.2494020967.00000000033B1000.00000020.00000001.01000000.00000015.sdmp, Offset: 033B0000, based on PE: true

Associated: 00000014.00000002.2493917908.00000000033B0000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000014.00000002.2497615129.00000000033F3000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000014.00000002.2498110795.0000000003400000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000014.00000002.2498410969.0000000003406000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000014.00000002.2498556459.0000000003408000.00000008.00000001.01000000.00000015.sdmpDownload File
Associated: 00000014.00000002.2498718201.000000000340A000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000014.00000002.2499166516.0000000003411000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_33b0000_Picasa3.jbxd

Similarity

API ID: ByteCharMultiWide$QueryValue
String ID:
API String ID: 4146047584-0
Opcode ID: a2c2d18fc6c91e41a8cec7260e3c1626afea6b9deda21dd9626efdfb7588c182
Instruction ID: da935609fc0df94605321aa8dd611f1caa2904cc31a90455a8a991bf5bf316e7
Opcode Fuzzy Hash: a2c2d18fc6c91e41a8cec7260e3c1626afea6b9deda21dd9626efdfb7588c182
Instruction Fuzzy Hash: 6E515E75E00209ABDB30DEA5CCC0AEEB7BDEF85750F241566E651EFA90D730A940CB61

Function 04039100 Relevance: 7.7, APIs: 5, Instructions: 179registryCOMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,000000FF,00000000,00000000), ref: 0403912D
MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,000000FF,00000000,00000000), ref: 04039148
MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,000000FF,?,00000000), ref: 04039165
RegQueryValueExW.ADVAPI32(?,?,?,?,00000000,?), ref: 040391F4
WideCharToMultiByte.KERNEL32(0000FDE9,00000000,00000000,?,?,?,00000000,00000000), ref: 0403928C

Memory Dump Source

Source File: 00000014.00000002.2502041842.0000000004031000.00000020.00000001.01000000.00000017.sdmp, Offset: 04030000, based on PE: true

Associated: 00000014.00000002.2501986218.0000000004030000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000014.00000002.2504208079.0000000004079000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000014.00000002.2504943590.0000000004086000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000014.00000002.2505148754.000000000408E000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000014.00000002.2505282171.0000000004090000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000014.00000002.2505501725.0000000004097000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_4030000_Picasa3.jbxd

Similarity

API ID: ByteCharMultiWide$QueryValue
String ID:
API String ID: 4146047584-0
Opcode ID: ea396bb5790ac1de1835638a6f023047dc11614bcb8d02fb00ccfb4c1589088e
Instruction ID: 4932b9323004a760a23860aa1a918e4752bf801ceeb8c99d60ad00782194b457
Opcode Fuzzy Hash: ea396bb5790ac1de1835638a6f023047dc11614bcb8d02fb00ccfb4c1589088e
Instruction Fuzzy Hash: AC5170B1A00105AAEB20DF99CC84EAFBFBDEF85715F140525E411FB280E7B1BD408BA1

Function 033BA5C0 Relevance: 7.7, APIs: 5, Instructions: 177COMMON

Download Yara Rule

APIs

_strncpy.LIBCMT ref: 033BA5F3
_strncpy.LIBCMT ref: 033BA6D2
_strncpy.LIBCMT ref: 033BA71A
_strncpy.LIBCMT ref: 033BA747
_strncpy.LIBCMT ref: 033BA775

Memory Dump Source

Source File: 00000014.00000002.2494020967.00000000033B1000.00000020.00000001.01000000.00000015.sdmp, Offset: 033B0000, based on PE: true

Associated: 00000014.00000002.2493917908.00000000033B0000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000014.00000002.2497615129.00000000033F3000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000014.00000002.2498110795.0000000003400000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000014.00000002.2498410969.0000000003406000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000014.00000002.2498556459.0000000003408000.00000008.00000001.01000000.00000015.sdmpDownload File
Associated: 00000014.00000002.2498718201.000000000340A000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000014.00000002.2499166516.0000000003411000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_33b0000_Picasa3.jbxd

Similarity

API ID: _strncpy
String ID:
API String ID: 2961919466-0
Opcode ID: d364ebbdf8346997aeb57b5f11014a77df29e42233bcfb8cdaa6459547ac5de3
Instruction ID: 55dde424a8d2aa0d83b246b834224dd5f37f16c50dac118fabb0cefc591b4d42
Opcode Fuzzy Hash: d364ebbdf8346997aeb57b5f11014a77df29e42233bcfb8cdaa6459547ac5de3
Instruction Fuzzy Hash: A55108A9A08B465BD730CD2C9CC07F7BBBE9F51254F0C067DE7928BEC1D62688848356

Function 04041D50 Relevance: 7.7, APIs: 5, Instructions: 177COMMONLIBRARYCODE

Download Yara Rule

APIs

_strncpy.LIBCMT ref: 04041D83
_strncpy.LIBCMT ref: 04041E62
_strncpy.LIBCMT ref: 04041EAA
_strncpy.LIBCMT ref: 04041ED7
_strncpy.LIBCMT ref: 04041F05

Memory Dump Source

Source File: 00000014.00000002.2502041842.0000000004031000.00000020.00000001.01000000.00000017.sdmp, Offset: 04030000, based on PE: true

Associated: 00000014.00000002.2501986218.0000000004030000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000014.00000002.2504208079.0000000004079000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000014.00000002.2504943590.0000000004086000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000014.00000002.2505148754.000000000408E000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000014.00000002.2505282171.0000000004090000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000014.00000002.2505501725.0000000004097000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_4030000_Picasa3.jbxd

Similarity

API ID: _strncpy
String ID:
API String ID: 2961919466-0
Opcode ID: 4c6f229bbedb89c5d09308858675c10b3ae94105cf44327c53da756e39a8219c
Instruction ID: 6c1cb0363bc7aeee0dc86a4f06a695dc48c020bcba2d58f8bcc45e03c185802f
Opcode Fuzzy Hash: 4c6f229bbedb89c5d09308858675c10b3ae94105cf44327c53da756e39a8219c
Instruction Fuzzy Hash: 175108F56083464BE7305D29988877677CB9FC2354F080A7DD4566F2C2EB26B9C48352

Function 047EA510 Relevance: 7.7, APIs: 5, Instructions: 166COMMON

Download Yara Rule

APIs

GetModuleFileNameA.KERNEL32(00000000,?,00000104), ref: 047EA549
InterlockedIncrement.KERNEL32(?), ref: 047EA5B3
InterlockedIncrement.KERNEL32(00000000), ref: 047EA644
GetModuleFileNameA.KERNEL32(00000000,?,00000104,?,?), ref: 047EA680
InterlockedIncrement.KERNEL32(00000000), ref: 047EA6E4

Memory Dump Source

Source File: 00000014.00000002.2526268174.00000000047E1000.00000020.00000001.01000000.00000016.sdmp, Offset: 047E0000, based on PE: true

Associated: 00000014.00000002.2526187657.00000000047E0000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000014.00000002.2533437740.000000000488F000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000014.00000002.2535246598.00000000048AB000.00000004.00000001.01000000.00000016.sdmpDownload File
Associated: 00000014.00000002.2535569716.00000000048B3000.00000008.00000001.01000000.00000016.sdmpDownload File
Associated: 00000014.00000002.2535640427.00000000048B5000.00000004.00000001.01000000.00000016.sdmpDownload File
Associated: 00000014.00000002.2536317728.00000000048C0000.00000002.00000001.01000000.00000016.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_47e0000_Picasa3.jbxd

Similarity

API ID: IncrementInterlocked$FileModuleName
String ID:
API String ID: 2435430943-0
Opcode ID: 77e42759de0f90e4b144ef5d9f4e204949ac961adb00430d3e3e22d0dfd259cb
Instruction ID: 32c7b84079db3673b630a2f22235bf7ccb035b6fa1ef857759eb0950f10d4cf6
Opcode Fuzzy Hash: 77e42759de0f90e4b144ef5d9f4e204949ac961adb00430d3e3e22d0dfd259cb
Instruction Fuzzy Hash: 9D51F5725043428FD721DF28C844ABA77E5EF89344F540E69EC85AB344D778B949CBE2

Function 033B9DB0 Relevance: 7.7, APIs: 5, Instructions: 158threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 033B9DD1
GetCurrentThreadId.KERNEL32 ref: 033B9EB9

Part of subcall function 033DCD96: __lock.LIBCMT ref: 033DCDB4
Part of subcall function 033DCD96: ___sbh_find_block.LIBCMT ref: 033DCDBF
Part of subcall function 033DCD96: ___sbh_free_block.LIBCMT ref: 033DCDCE
Part of subcall function 033DCD96: HeapFree.KERNEL32(00000000,033DC7F4,033FD9E8,0000000C,033E0E8E,00000000,033FDC40,0000000C,033E0EC6,033DC7F4,?,?,033E7C2A,00000004,033FDE40,0000000C), ref: 033DCDFE
Part of subcall function 033DCD96: GetLastError.KERNEL32(?,033E7C2A,00000004,033FDE40,0000000C,033E2E0E,033DC7F4,033DC7F4,00000000,00000000,00000000,033E0687,00000001,00000214,?,00000000), ref: 033DCE0F

Memory Dump Source

Source File: 00000014.00000002.2494020967.00000000033B1000.00000020.00000001.01000000.00000015.sdmp, Offset: 033B0000, based on PE: true

Associated: 00000014.00000002.2493917908.00000000033B0000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000014.00000002.2497615129.00000000033F3000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000014.00000002.2498110795.0000000003400000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000014.00000002.2498410969.0000000003406000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000014.00000002.2498556459.0000000003408000.00000008.00000001.01000000.00000015.sdmpDownload File
Associated: 00000014.00000002.2498718201.000000000340A000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000014.00000002.2499166516.0000000003411000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_33b0000_Picasa3.jbxd

Similarity

API ID: CurrentThread$ErrorFreeHeapLast___sbh_find_block___sbh_free_block__lock
String ID:
API String ID: 2661013563-0
Opcode ID: 19e3f0e80035026462a4408d310e54311334298ea98258e839df954b4638aaab
Instruction ID: 5881c8b8b2ee0dd0139dc71f63e96084a70572b0ec75a77dbd22725f7e482e11
Opcode Fuzzy Hash: 19e3f0e80035026462a4408d310e54311334298ea98258e839df954b4638aaab
Instruction Fuzzy Hash: 2A51D376B003458FC304EF59EAC4B90B3E4F744339F1802AAD612ABAD5D7799889CF41

Function 04035550 Relevance: 7.7, APIs: 5, Instructions: 158threadCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 04035571
GetCurrentThreadId.KERNEL32 ref: 04035659

Part of subcall function 04061C18: __lock.LIBCMT ref: 04061C36
Part of subcall function 04061C18: ___sbh_find_block.LIBCMT ref: 04061C41
Part of subcall function 04061C18: ___sbh_free_block.LIBCMT ref: 04061C50
Part of subcall function 04061C18: HeapFree.KERNEL32(00000000,?,04083890,0000000C,040675F2,00000000,04083AE8,0000000C,0406762A,?,-0000000F,?,0406D4DF,00000004,04083C48,0000000C), ref: 04061C80
Part of subcall function 04061C18: GetLastError.KERNEL32(?,0406D4DF,00000004,04083C48,0000000C,04064BA5,?,?,00000000,00000000,00000000,040647DE,00000001,00000214), ref: 04061C91

Memory Dump Source

Source File: 00000014.00000002.2502041842.0000000004031000.00000020.00000001.01000000.00000017.sdmp, Offset: 04030000, based on PE: true

Associated: 00000014.00000002.2501986218.0000000004030000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000014.00000002.2504208079.0000000004079000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000014.00000002.2504943590.0000000004086000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000014.00000002.2505148754.000000000408E000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000014.00000002.2505282171.0000000004090000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000014.00000002.2505501725.0000000004097000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_4030000_Picasa3.jbxd

Similarity

API ID: CurrentThread$ErrorFreeHeapLast___sbh_find_block___sbh_free_block__lock
String ID:
API String ID: 2661013563-0
Opcode ID: cf83cb999f9c7f28177d85277abadf659e27cd9ed80f7d3f8f86cd3cb4e53692
Instruction ID: 1e6ce261fbe41f90402a1a116abea2ed953d6a11f6359da333d5a80bf59afd1f
Opcode Fuzzy Hash: cf83cb999f9c7f28177d85277abadf659e27cd9ed80f7d3f8f86cd3cb4e53692
Instruction Fuzzy Hash: B351A0B6A00200EFD754DF28E844B557BE4FB44326F14427AD502B7AA1DB3DBC45CB85

Function 033BF060 Relevance: 7.6, APIs: 5, Instructions: 120timeCOMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,000000FF,00000000,00000000), ref: 033BF092
MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,000000FF,00000000,00000000), ref: 033BF0B0
MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,000000FF,?,00000000), ref: 033BF0CD
GetTimeFormatW.KERNEL32(?,?,?,00000000,00000000,?), ref: 033BF13D
WideCharToMultiByte.KERNEL32(0000FDE9,00000000,00000000,000000FF,?,?,00000000,00000000), ref: 033BF167

Memory Dump Source

Source File: 00000014.00000002.2494020967.00000000033B1000.00000020.00000001.01000000.00000015.sdmp, Offset: 033B0000, based on PE: true

Associated: 00000014.00000002.2493917908.00000000033B0000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000014.00000002.2497615129.00000000033F3000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000014.00000002.2498110795.0000000003400000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000014.00000002.2498410969.0000000003406000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000014.00000002.2498556459.0000000003408000.00000008.00000001.01000000.00000015.sdmpDownload File
Associated: 00000014.00000002.2498718201.000000000340A000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000014.00000002.2499166516.0000000003411000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_33b0000_Picasa3.jbxd

Similarity

API ID: ByteCharMultiWide$FormatTime
String ID:
API String ID: 4224352952-0
Opcode ID: b51d94529072b72c3756d601d1d5b13ef3d6d9db4b1b5e02f7d2b3173402366b
Instruction ID: d3d7ad7e20c03984111854061ea4bc24aa509a24bd669fba92948a508c80de5f
Opcode Fuzzy Hash: b51d94529072b72c3756d601d1d5b13ef3d6d9db4b1b5e02f7d2b3173402366b
Instruction Fuzzy Hash: 0A31B335A00209BBD720DA65DCC1FEBB7BCEF45720F240625BA15EBAC4D670ED008790

Function 033BEF30 Relevance: 7.6, APIs: 5, Instructions: 120COMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,000000FF,00000000,00000000), ref: 033BEF62
MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,000000FF,00000000,00000000), ref: 033BEF80
MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,000000FF,?,00000000), ref: 033BEF9D
GetDateFormatW.KERNEL32(?,?,?,00000000,00000000,?), ref: 033BF00D
WideCharToMultiByte.KERNEL32(0000FDE9,00000000,00000000,000000FF,?,?,00000000,00000000), ref: 033BF037

Memory Dump Source

Source File: 00000014.00000002.2494020967.00000000033B1000.00000020.00000001.01000000.00000015.sdmp, Offset: 033B0000, based on PE: true

Associated: 00000014.00000002.2493917908.00000000033B0000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000014.00000002.2497615129.00000000033F3000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000014.00000002.2498110795.0000000003400000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000014.00000002.2498410969.0000000003406000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000014.00000002.2498556459.0000000003408000.00000008.00000001.01000000.00000015.sdmpDownload File
Associated: 00000014.00000002.2498718201.000000000340A000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000014.00000002.2499166516.0000000003411000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_33b0000_Picasa3.jbxd

Similarity

API ID: ByteCharMultiWide$DateFormat
String ID:
API String ID: 2343660074-0
Opcode ID: 75e4025e9f8a661342efbe47f908582426feb9c2d67a74b41bda2b01518e7c27
Instruction ID: b686dfdfaec6272e668718d03857327ed926f7b4ffb3b1fb115d96907e3a24c6
Opcode Fuzzy Hash: 75e4025e9f8a661342efbe47f908582426feb9c2d67a74b41bda2b01518e7c27
Instruction Fuzzy Hash: A6319175A00219BBD720DA69DCC1FEFB7B9EF44760F650325B615EB6C0D670E90086A0

Function 0403C020 Relevance: 7.6, APIs: 5, Instructions: 120timeCOMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,000000FF,00000000,00000000), ref: 0403C052
MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,000000FF,00000000,00000000), ref: 0403C070
MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,000000FF,?,00000000), ref: 0403C08D
GetTimeFormatW.KERNEL32(?,?,?,00000000,00000000,?), ref: 0403C0FD
WideCharToMultiByte.KERNEL32(0000FDE9,00000000,00000000,000000FF,?,?,00000000,00000000), ref: 0403C127

Memory Dump Source

Source File: 00000014.00000002.2502041842.0000000004031000.00000020.00000001.01000000.00000017.sdmp, Offset: 04030000, based on PE: true

Associated: 00000014.00000002.2501986218.0000000004030000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000014.00000002.2504208079.0000000004079000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000014.00000002.2504943590.0000000004086000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000014.00000002.2505148754.000000000408E000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000014.00000002.2505282171.0000000004090000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000014.00000002.2505501725.0000000004097000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_4030000_Picasa3.jbxd

Similarity

API ID: ByteCharMultiWide$FormatTime
String ID:
API String ID: 4224352952-0
Opcode ID: 2fb26fc90d06e82e9dcae6747e00a7107865ccf508585666ec9140c0051c9970
Instruction ID: 65b27e423ff25f041563bfc66b64772e229eb2e113cbd55ecdbc18bba1cfa92b
Opcode Fuzzy Hash: 2fb26fc90d06e82e9dcae6747e00a7107865ccf508585666ec9140c0051c9970
Instruction Fuzzy Hash: DC319372A04219BBE720DB64CC41FAFBBACEB84724F210225A915FB2C0D671FD009791

Function 0403BEF0 Relevance: 7.6, APIs: 5, Instructions: 120COMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,000000FF,00000000,00000000), ref: 0403BF22
MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,000000FF,00000000,00000000), ref: 0403BF40
MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,000000FF,?,00000000), ref: 0403BF5D
GetDateFormatW.KERNEL32(?,?,?,00000000,00000000,?), ref: 0403BFCD
WideCharToMultiByte.KERNEL32(0000FDE9,00000000,00000000,000000FF,?,?,00000000,00000000), ref: 0403BFF7

Memory Dump Source

Source File: 00000014.00000002.2502041842.0000000004031000.00000020.00000001.01000000.00000017.sdmp, Offset: 04030000, based on PE: true

Associated: 00000014.00000002.2501986218.0000000004030000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000014.00000002.2504208079.0000000004079000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000014.00000002.2504943590.0000000004086000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000014.00000002.2505148754.000000000408E000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000014.00000002.2505282171.0000000004090000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000014.00000002.2505501725.0000000004097000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_4030000_Picasa3.jbxd

Similarity

API ID: ByteCharMultiWide$DateFormat
String ID:
API String ID: 2343660074-0
Opcode ID: b860b5be8ef47f428e28ad7b75bfde76a7cdae8a092b1a1f3ee296f7656cc8a3
Instruction ID: a6e56ef365139d4f3e23991d78cf1953351e243d5b184068479e14625de1bbe7
Opcode Fuzzy Hash: b860b5be8ef47f428e28ad7b75bfde76a7cdae8a092b1a1f3ee296f7656cc8a3
Instruction Fuzzy Hash: D2315075A00219BEE7209A558C41FAFBBBCEF84729F610265B915FB2C1D670FD009BA1

Function 033B3170 Relevance: 7.6, APIs: 6, Instructions: 114COMMON

Download Yara Rule

APIs

CharNextA.USER32(?,00000000,?,?,00000000,033B3A3C,?,?,00000000,?,00000000), ref: 033B31A4
CharNextA.USER32(00000000,?,00000000,?,?,00000000,033B3A3C,?,?,00000000,?,00000000), ref: 033B31B8
CharNextA.USER32(00000000,?,00000000,?,?,00000000,033B3A3C,?,?,00000000,?,00000000), ref: 033B31C7
CharNextA.USER32(00000000,?,00000000,?,?,00000000,033B3A3C,?,?,00000000,?,00000000), ref: 033B31CE
CharNextA.USER32(?,?,00000000,?,?,00000000,033B3A3C,?,?,00000000,?,00000000), ref: 033B3213

Memory Dump Source

Source File: 00000014.00000002.2494020967.00000000033B1000.00000020.00000001.01000000.00000015.sdmp, Offset: 033B0000, based on PE: true

Associated: 00000014.00000002.2493917908.00000000033B0000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000014.00000002.2497615129.00000000033F3000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000014.00000002.2498110795.0000000003400000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000014.00000002.2498410969.0000000003406000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000014.00000002.2498556459.0000000003408000.00000008.00000001.01000000.00000015.sdmpDownload File
Associated: 00000014.00000002.2498718201.000000000340A000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000014.00000002.2499166516.0000000003411000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_33b0000_Picasa3.jbxd

Similarity

API ID: CharNext
String ID:
API String ID: 3213498283-0
Opcode ID: 3b178c223d50e5d2b8d811ffb0d59bf6480e2098c7cb87452177bee92e0c8028
Instruction ID: 7b0ac6ecf4a8b07953e2328e7a08862ca993d307295be13d414a333470aa6c29
Opcode Fuzzy Hash: 3b178c223d50e5d2b8d811ffb0d59bf6480e2098c7cb87452177bee92e0c8028
Instruction Fuzzy Hash: 9C3105795082A19FE722CF3CDCC0BA5BBF9AF96230F2C4599D2C48B646D7319840C760

Function 033BD670 Relevance: 7.6, APIs: 5, Instructions: 114COMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,000000FF,00000000,00000000), ref: 033BD6A1
MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,000000FF,00000000,00000000), ref: 033BD6C2
MultiByteToWideChar.KERNEL32(0000FDE9,00000000,00000000,000000FF,00000000,00000000), ref: 033BD6F1
SHBrowseForFolderW.SHELL32(?), ref: 033BD745
WideCharToMultiByte.KERNEL32(0000FDE9,00000000,00000000,000000FF,?,00000104,00000000,00000000), ref: 033BD778

Memory Dump Source

Source File: 00000014.00000002.2494020967.00000000033B1000.00000020.00000001.01000000.00000015.sdmp, Offset: 033B0000, based on PE: true

Associated: 00000014.00000002.2493917908.00000000033B0000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000014.00000002.2497615129.00000000033F3000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000014.00000002.2498110795.0000000003400000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000014.00000002.2498410969.0000000003406000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000014.00000002.2498556459.0000000003408000.00000008.00000001.01000000.00000015.sdmpDownload File
Associated: 00000014.00000002.2498718201.000000000340A000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000014.00000002.2499166516.0000000003411000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_33b0000_Picasa3.jbxd

Similarity

API ID: ByteCharMultiWide$BrowseFolder
String ID:
API String ID: 3258919473-0
Opcode ID: 30e1bf9d1d5bff0cd25d40f19102bfa1981bb6ae3ba741334729ed8d236bb0ca
Instruction ID: 79388761ad2003ad2e06ad745ed7fc6ba8fdfae3b69fc21c8a825befd870c411
Opcode Fuzzy Hash: 30e1bf9d1d5bff0cd25d40f19102bfa1981bb6ae3ba741334729ed8d236bb0ca
Instruction Fuzzy Hash: D5319935A00205BBD720EE55DCC5FEAF7B89F44B20F694165BA18AF5C4D770E900C790

Function 033BC6F0 Relevance: 7.6, APIs: 5, Instructions: 114COMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,000000FF,00000000,00000000), ref: 033BC722
MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,000000FF,00000000,00000000), ref: 033BC740
MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,000000FF,?,00000000), ref: 033BC75D
GetShortPathNameW.KERNEL32(00000000,00000000,?), ref: 033BC7C1
WideCharToMultiByte.KERNEL32(0000FDE9,00000000,00000000,000000FF,?,?,00000000,00000000), ref: 033BC7EB

Memory Dump Source

Source File: 00000014.00000002.2494020967.00000000033B1000.00000020.00000001.01000000.00000015.sdmp, Offset: 033B0000, based on PE: true

Associated: 00000014.00000002.2493917908.00000000033B0000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000014.00000002.2497615129.00000000033F3000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000014.00000002.2498110795.0000000003400000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000014.00000002.2498410969.0000000003406000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000014.00000002.2498556459.0000000003408000.00000008.00000001.01000000.00000015.sdmpDownload File
Associated: 00000014.00000002.2498718201.000000000340A000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000014.00000002.2499166516.0000000003411000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_33b0000_Picasa3.jbxd

Similarity

API ID: ByteCharMultiWide$NamePathShort
String ID:
API String ID: 931277373-0
Opcode ID: b7cbb28c848e51835aa236d2797b18567e70c3341d186d0980365fa021b9a773
Instruction ID: e59f42696facc30b5cc144950535a18658e086f251ee4e0d5d23e43db6388be9
Opcode Fuzzy Hash: b7cbb28c848e51835aa236d2797b18567e70c3341d186d0980365fa021b9a773
Instruction Fuzzy Hash: BA31A4B5A00219BFD730DA658CD6FEEB7BDEB45720F650225BA14EFAC0D770AD008690

Function 040396B0 Relevance: 7.6, APIs: 5, Instructions: 114COMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,000000FF,00000000,00000000), ref: 040396E2
MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,000000FF,00000000,00000000), ref: 04039700
MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,000000FF,?,00000000), ref: 0403971D
GetShortPathNameW.KERNEL32(00000000,00000000,?), ref: 04039781
WideCharToMultiByte.KERNEL32(0000FDE9,00000000,00000000,000000FF,?,?,00000000,00000000), ref: 040397AB

Memory Dump Source

Source File: 00000014.00000002.2502041842.0000000004031000.00000020.00000001.01000000.00000017.sdmp, Offset: 04030000, based on PE: true

Associated: 00000014.00000002.2501986218.0000000004030000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000014.00000002.2504208079.0000000004079000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000014.00000002.2504943590.0000000004086000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000014.00000002.2505148754.000000000408E000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000014.00000002.2505282171.0000000004090000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000014.00000002.2505501725.0000000004097000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_4030000_Picasa3.jbxd

Similarity

API ID: ByteCharMultiWide$NamePathShort
String ID:
API String ID: 931277373-0
Opcode ID: 14c084c017b759bfd23d8859339e279d65ee8c48b7b5269b060732042e6eafe7
Instruction ID: 20aa85068ebb5d3086b918afc871a03734b6c94d82f72d1cad9874fb5b29a9f0
Opcode Fuzzy Hash: 14c084c017b759bfd23d8859339e279d65ee8c48b7b5269b060732042e6eafe7
Instruction Fuzzy Hash: C531A7B1A00215BBE7209F558C81FAFBBECEF44725F650225E915FB2C0D6B0BD008691

Function 04834680 Relevance: 7.6, APIs: 5, Instructions: 114COMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,000000FF,00000000,00000000), ref: 048346B2
MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,000000FF,00000000,00000000), ref: 048346D0
MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,000000FF,?,00000000), ref: 048346ED
GetShortPathNameW.KERNEL32(00000000,00000000,?), ref: 04834751
WideCharToMultiByte.KERNEL32(0000FDE9,00000000,00000000,000000FF,?,?,00000000,00000000), ref: 0483477B

Memory Dump Source

Source File: 00000014.00000002.2526268174.00000000047E1000.00000020.00000001.01000000.00000016.sdmp, Offset: 047E0000, based on PE: true

Associated: 00000014.00000002.2526187657.00000000047E0000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000014.00000002.2533437740.000000000488F000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000014.00000002.2535246598.00000000048AB000.00000004.00000001.01000000.00000016.sdmpDownload File
Associated: 00000014.00000002.2535569716.00000000048B3000.00000008.00000001.01000000.00000016.sdmpDownload File
Associated: 00000014.00000002.2535640427.00000000048B5000.00000004.00000001.01000000.00000016.sdmpDownload File
Associated: 00000014.00000002.2536317728.00000000048C0000.00000002.00000001.01000000.00000016.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_47e0000_Picasa3.jbxd

Similarity

API ID: ByteCharMultiWide$NamePathShort
String ID:
API String ID: 931277373-0
Opcode ID: 8ce83f05fe79cf94abeb3e9865a344ad905a551a88833eaf9de821688513b229
Instruction ID: f5b5cb91edb0f1e51719b118369a96f83325b097b83eb2bf0ebb09c66cfdeddb
Opcode Fuzzy Hash: 8ce83f05fe79cf94abeb3e9865a344ad905a551a88833eaf9de821688513b229
Instruction Fuzzy Hash: E031C435A0021DBBE7219A598C41FBFB7A9EF45F24F650B25E915EB2C0EB70BD0086D1

Function 0403A631 Relevance: 7.6, APIs: 5, Instructions: 113COMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,000000FF,00000000,00000000), ref: 0403A661
MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,000000FF,00000000,00000000), ref: 0403A682
MultiByteToWideChar.KERNEL32(0000FDE9,00000000,00000000,000000FF,00000000,00000000), ref: 0403A6B1
SHBrowseForFolderW.SHELL32(?), ref: 0403A705
WideCharToMultiByte.KERNEL32(0000FDE9,00000000,00000000,000000FF,?,00000104,00000000,00000000), ref: 0403A738

Memory Dump Source

Source File: 00000014.00000002.2502041842.0000000004031000.00000020.00000001.01000000.00000017.sdmp, Offset: 04030000, based on PE: true

Associated: 00000014.00000002.2501986218.0000000004030000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000014.00000002.2504208079.0000000004079000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000014.00000002.2504943590.0000000004086000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000014.00000002.2505148754.000000000408E000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000014.00000002.2505282171.0000000004090000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000014.00000002.2505501725.0000000004097000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_4030000_Picasa3.jbxd

Similarity

API ID: ByteCharMultiWide$BrowseFolder
String ID:
API String ID: 3258919473-0
Opcode ID: ddcf5bd2e14afe830065041d7000fc177144a6e20ac68d30d44b6f3a2b8f8487
Instruction ID: 61f86d2cc8eb580ac431455c33d0031782033537fa1927eab444d273e2623cd2
Opcode Fuzzy Hash: ddcf5bd2e14afe830065041d7000fc177144a6e20ac68d30d44b6f3a2b8f8487
Instruction Fuzzy Hash: D431C371B00215ABEB60DE65CC81FAABBBCEF44B25F254165A915BF2C0D774B900CFA1

Function 033E4EE7 Relevance: 7.6, APIs: 5, Instructions: 98COMMONLIBRARYCODE

Download Yara Rule

APIs

__lock.LIBCMT ref: 033E4EFC

Part of subcall function 033E0EAD: __mtinitlocknum.LIBCMT ref: 033E0EC1
Part of subcall function 033E0EAD: __amsg_exit.LIBCMT ref: 033E0ECD
Part of subcall function 033E0EAD: EnterCriticalSection.KERNEL32(?,?,?,033E7C2A,00000004,033FDE40,0000000C,033E2E0E,033DC7F4,033DC7F4,00000000,00000000,00000000,033E0687,00000001,00000214), ref: 033E0ED5

__mtinitlocknum.LIBCMT ref: 033E4F3C
__malloc_crt.LIBCMT ref: 033E4F7D
___crtInitCritSecAndSpinCount.LIBCMT ref: 033E4FA2
EnterCriticalSection.KERNEL32(04992068,033FDD20,00000010,033DDC66,033FDA48,0000000C,033DDCE0,033C0AA9,033C0AA9,00000040,033C0AA9,?,033F5E70,?,033C2C6C), ref: 033E4FCC

Memory Dump Source

Source File: 00000014.00000002.2494020967.00000000033B1000.00000020.00000001.01000000.00000015.sdmp, Offset: 033B0000, based on PE: true

Associated: 00000014.00000002.2493917908.00000000033B0000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000014.00000002.2497615129.00000000033F3000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000014.00000002.2498110795.0000000003400000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000014.00000002.2498410969.0000000003406000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000014.00000002.2498556459.0000000003408000.00000008.00000001.01000000.00000015.sdmpDownload File
Associated: 00000014.00000002.2498718201.000000000340A000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000014.00000002.2499166516.0000000003411000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_33b0000_Picasa3.jbxd

Similarity

API ID: CriticalEnterSection__mtinitlocknum$CountCritInitSpin___crt__amsg_exit__lock__malloc_crt
String ID:
API String ID: 1486408876-0
Opcode ID: 8cc60f526a2348afd16f16cb033f2c6ace49022eabf93b856f0b1d5edaa44245
Instruction ID: a5e20836e0a92e661a824af5594a09c40efdb66acd9e6a9cf4cdde5ff0ec6982
Opcode Fuzzy Hash: 8cc60f526a2348afd16f16cb033f2c6ace49022eabf93b856f0b1d5edaa44245
Instruction Fuzzy Hash: 4531A036A04725DFC721EFAAD8C1A29F7E4BF0D7287444669E891AB6D4CB30E442CF40

Function 040671EC Relevance: 7.6, APIs: 5, Instructions: 98COMMONLIBRARYCODE

Download Yara Rule

APIs

__lock.LIBCMT ref: 04067201

Part of subcall function 04067611: __mtinitlocknum.LIBCMT ref: 04067625
Part of subcall function 04067611: __amsg_exit.LIBCMT ref: 04067631
Part of subcall function 04067611: EnterCriticalSection.KERNEL32(-0000000F,-0000000F,?,0406D4DF,00000004,04083C48,0000000C,04064BA5,?,?,00000000,00000000,00000000,040647DE,00000001,00000214), ref: 04067639

__mtinitlocknum.LIBCMT ref: 04067241
__malloc_crt.LIBCMT ref: 04067282
___crtInitCritSecAndSpinCount.LIBCMT ref: 040672A7
EnterCriticalSection.KERNEL32(03742068,04083AC8,00000010,04061706,04083810,0000000C,04061780,04045269,04045269,00000040,04045269,?,0407BDB8,?,040465AC), ref: 040672D1

Memory Dump Source

Source File: 00000014.00000002.2502041842.0000000004031000.00000020.00000001.01000000.00000017.sdmp, Offset: 04030000, based on PE: true

Associated: 00000014.00000002.2501986218.0000000004030000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000014.00000002.2504208079.0000000004079000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000014.00000002.2504943590.0000000004086000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000014.00000002.2505148754.000000000408E000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000014.00000002.2505282171.0000000004090000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000014.00000002.2505501725.0000000004097000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_4030000_Picasa3.jbxd

Similarity

API ID: CriticalEnterSection__mtinitlocknum$CountCritInitSpin___crt__amsg_exit__lock__malloc_crt
String ID:
API String ID: 1486408876-0
Opcode ID: 81d70948635f4db53f7d5ca6b45fa68580ba0e9f4f9d8c8fa8408961c90331e9
Instruction ID: 35b72b5ec37ce6c5175a3ac59887f34b6c443ab9780b6b17e321e04e715c8727
Opcode Fuzzy Hash: 81d70948635f4db53f7d5ca6b45fa68580ba0e9f4f9d8c8fa8408961c90331e9
Instruction Fuzzy Hash: 3E31C372600602EFEB65EFA9E980959B3E5FF093687504529E457BB294CB38FC41CF44

Function 04881487 Relevance: 7.6, APIs: 5, Instructions: 98COMMONLIBRARYCODE

Download Yara Rule

APIs

__lock.LIBCMT ref: 0488149C

Part of subcall function 04878ED7: __mtinitlocknum.LIBCMT ref: 04878EEB
Part of subcall function 04878ED7: __amsg_exit.LIBCMT ref: 04878EF7
Part of subcall function 04878ED7: EnterCriticalSection.KERNEL32(?,?,?,0488232F,00000004,048A7FD8,0000000C,0487A0B3,048729D8,048729D8,00000000,00000000,00000000,04879CEC,00000001,00000214), ref: 04878EFF

__mtinitlocknum.LIBCMT ref: 048814DC
__malloc_crt.LIBCMT ref: 0488151D
___crtInitCritSecAndSpinCount.LIBCMT ref: 04881542
EnterCriticalSection.KERNEL32(05262068,048A7F38,00000010,048767CC,048A7C68,0000000C,04876847,00000000,00000000,00000040,0483E161,00000000,00000000,0489A7B4,0489A7B4,?), ref: 0488156C

Memory Dump Source

Source File: 00000014.00000002.2526268174.00000000047E1000.00000020.00000001.01000000.00000016.sdmp, Offset: 047E0000, based on PE: true

Associated: 00000014.00000002.2526187657.00000000047E0000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000014.00000002.2533437740.000000000488F000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000014.00000002.2535246598.00000000048AB000.00000004.00000001.01000000.00000016.sdmpDownload File
Associated: 00000014.00000002.2535569716.00000000048B3000.00000008.00000001.01000000.00000016.sdmpDownload File
Associated: 00000014.00000002.2535640427.00000000048B5000.00000004.00000001.01000000.00000016.sdmpDownload File
Associated: 00000014.00000002.2536317728.00000000048C0000.00000002.00000001.01000000.00000016.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_47e0000_Picasa3.jbxd

Similarity

API ID: CriticalEnterSection__mtinitlocknum$CountCritInitSpin___crt__amsg_exit__lock__malloc_crt
String ID:
API String ID: 1486408876-0
Opcode ID: d3fdb7e55745b5832ed5b2743bb498249eac440067b71a1bcc2f1cb327a11a2d
Instruction ID: 40def635197723e022070b1c86d10a00edbce5581e7800ae2d86f9d6068ab08d
Opcode Fuzzy Hash: d3fdb7e55745b5832ed5b2743bb498249eac440067b71a1bcc2f1cb327a11a2d
Instruction Fuzzy Hash: D4314532A007019FE721AFACD888969B7A4FB493247804E1DE456D7690CF74F982CF95

Function 033BB1B0 Relevance: 7.6, APIs: 5, Instructions: 53COMMON

Download Yara Rule

APIs

InterlockedExchange.KERNEL32(00000008,00000000), ref: 033BB1C7

Part of subcall function 033BAF70: GetCurrentThreadId.KERNEL32 ref: 033BAF91
Part of subcall function 033BAF70: GetCurrentThreadId.KERNEL32 ref: 033BB014

EnterCriticalSection.KERNEL32(00000028), ref: 033BB1DB

Part of subcall function 033BB3E0: WaitForSingleObject.KERNEL32(?,00000000,033BB1EB), ref: 033BB3E5

ResetEvent.KERNEL32 ref: 033BB1F2
InterlockedExchange.KERNEL32(00000018,00000000), ref: 033BB215
LeaveCriticalSection.KERNEL32(00000028), ref: 033BB221

Memory Dump Source

Source File: 00000014.00000002.2494020967.00000000033B1000.00000020.00000001.01000000.00000015.sdmp, Offset: 033B0000, based on PE: true

Associated: 00000014.00000002.2493917908.00000000033B0000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000014.00000002.2497615129.00000000033F3000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000014.00000002.2498110795.0000000003400000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000014.00000002.2498410969.0000000003406000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000014.00000002.2498556459.0000000003408000.00000008.00000001.01000000.00000015.sdmpDownload File
Associated: 00000014.00000002.2498718201.000000000340A000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000014.00000002.2499166516.0000000003411000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_33b0000_Picasa3.jbxd

Similarity

API ID: CriticalCurrentExchangeInterlockedSectionThread$EnterEventLeaveObjectResetSingleWait
String ID:
API String ID: 2617359326-0
Opcode ID: 1a02ad8e8fdaf420aaca37828d298f29d9eb9a5e939619210ddb3c7d56f86cb2
Instruction ID: a4375f197367a4eb30c54993dd554201167ae394cd438f7636f02279cf38b92a
Opcode Fuzzy Hash: 1a02ad8e8fdaf420aaca37828d298f29d9eb9a5e939619210ddb3c7d56f86cb2
Instruction Fuzzy Hash: 1401DE76200704BFC620EB24DCC5FABB3BCEF89700F004919F2868BA41DA25F50987B1

Function 0403DA50 Relevance: 7.6, APIs: 5, Instructions: 53COMMON

Download Yara Rule

APIs

InterlockedExchange.KERNEL32(00000008,00000000), ref: 0403DA67

Part of subcall function 0403D810: GetCurrentThreadId.KERNEL32 ref: 0403D831
Part of subcall function 0403D810: GetCurrentThreadId.KERNEL32 ref: 0403D8B4

EnterCriticalSection.KERNEL32(00000028), ref: 0403DA7B

Part of subcall function 0403DC80: WaitForSingleObject.KERNEL32(?,00000000,0403DA8B), ref: 0403DC85

ResetEvent.KERNEL32 ref: 0403DA92
InterlockedExchange.KERNEL32(00000018,00000000), ref: 0403DAB5
LeaveCriticalSection.KERNEL32(00000028), ref: 0403DAC1

Memory Dump Source

Source File: 00000014.00000002.2502041842.0000000004031000.00000020.00000001.01000000.00000017.sdmp, Offset: 04030000, based on PE: true

Associated: 00000014.00000002.2501986218.0000000004030000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000014.00000002.2504208079.0000000004079000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000014.00000002.2504943590.0000000004086000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000014.00000002.2505148754.000000000408E000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000014.00000002.2505282171.0000000004090000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000014.00000002.2505501725.0000000004097000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_4030000_Picasa3.jbxd

Similarity

API ID: CriticalCurrentExchangeInterlockedSectionThread$EnterEventLeaveObjectResetSingleWait
String ID:
API String ID: 2617359326-0
Opcode ID: 90832dfaecdf19a76e94861180e310b1da5ab98e444dfd073f83f67986c12b3f
Instruction ID: 3b48767c803b8e3efc5622761f51d4df17c5ca8f73b6a314f1a62efb3406ca2d
Opcode Fuzzy Hash: 90832dfaecdf19a76e94861180e310b1da5ab98e444dfd073f83f67986c12b3f
Instruction Fuzzy Hash: D101B5B12007046BE620EF65DC84F9B77ACEF85605F004818F646A7541DB29F5198771

Function 033DCD96 Relevance: 7.5, APIs: 5, Instructions: 44memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

__lock.LIBCMT ref: 033DCDB4

Part of subcall function 033E0EAD: __mtinitlocknum.LIBCMT ref: 033E0EC1
Part of subcall function 033E0EAD: __amsg_exit.LIBCMT ref: 033E0ECD
Part of subcall function 033E0EAD: EnterCriticalSection.KERNEL32(?,?,?,033E7C2A,00000004,033FDE40,0000000C,033E2E0E,033DC7F4,033DC7F4,00000000,00000000,00000000,033E0687,00000001,00000214), ref: 033E0ED5

___sbh_find_block.LIBCMT ref: 033DCDBF
___sbh_free_block.LIBCMT ref: 033DCDCE
HeapFree.KERNEL32(00000000,033DC7F4,033FD9E8,0000000C,033E0E8E,00000000,033FDC40,0000000C,033E0EC6,033DC7F4,?,?,033E7C2A,00000004,033FDE40,0000000C), ref: 033DCDFE
GetLastError.KERNEL32(?,033E7C2A,00000004,033FDE40,0000000C,033E2E0E,033DC7F4,033DC7F4,00000000,00000000,00000000,033E0687,00000001,00000214,?,00000000), ref: 033DCE0F

Memory Dump Source

Source File: 00000014.00000002.2494020967.00000000033B1000.00000020.00000001.01000000.00000015.sdmp, Offset: 033B0000, based on PE: true

Associated: 00000014.00000002.2493917908.00000000033B0000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000014.00000002.2497615129.00000000033F3000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000014.00000002.2498110795.0000000003400000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000014.00000002.2498410969.0000000003406000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000014.00000002.2498556459.0000000003408000.00000008.00000001.01000000.00000015.sdmpDownload File
Associated: 00000014.00000002.2498718201.000000000340A000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000014.00000002.2499166516.0000000003411000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_33b0000_Picasa3.jbxd

Similarity

API ID: CriticalEnterErrorFreeHeapLastSection___sbh_find_block___sbh_free_block__amsg_exit__lock__mtinitlocknum
String ID:
API String ID: 2714421763-0
Opcode ID: d54e7d0ad33b2206e71eaea20cb19fb1877956f93af13d6b3d1a4300b207a979
Instruction ID: 6069e4bbff95e4285b16b8bd6fb19c00bd419a098c929872f04d378acd5e918f
Opcode Fuzzy Hash: d54e7d0ad33b2206e71eaea20cb19fb1877956f93af13d6b3d1a4300b207a979
Instruction Fuzzy Hash: 8701AD7BD04312ABDF24FBB1BCC9B5E7AA8AF00765F141118E405AF098DF788465CB54

Function 04061C18 Relevance: 7.5, APIs: 5, Instructions: 44memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

__lock.LIBCMT ref: 04061C36

Part of subcall function 04067611: __mtinitlocknum.LIBCMT ref: 04067625
Part of subcall function 04067611: __amsg_exit.LIBCMT ref: 04067631
Part of subcall function 04067611: EnterCriticalSection.KERNEL32(-0000000F,-0000000F,?,0406D4DF,00000004,04083C48,0000000C,04064BA5,?,?,00000000,00000000,00000000,040647DE,00000001,00000214), ref: 04067639

___sbh_find_block.LIBCMT ref: 04061C41
___sbh_free_block.LIBCMT ref: 04061C50
HeapFree.KERNEL32(00000000,?,04083890,0000000C,040675F2,00000000,04083AE8,0000000C,0406762A,?,-0000000F,?,0406D4DF,00000004,04083C48,0000000C), ref: 04061C80
GetLastError.KERNEL32(?,0406D4DF,00000004,04083C48,0000000C,04064BA5,?,?,00000000,00000000,00000000,040647DE,00000001,00000214), ref: 04061C91

Memory Dump Source

Source File: 00000014.00000002.2502041842.0000000004031000.00000020.00000001.01000000.00000017.sdmp, Offset: 04030000, based on PE: true

Associated: 00000014.00000002.2501986218.0000000004030000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000014.00000002.2504208079.0000000004079000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000014.00000002.2504943590.0000000004086000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000014.00000002.2505148754.000000000408E000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000014.00000002.2505282171.0000000004090000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000014.00000002.2505501725.0000000004097000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_4030000_Picasa3.jbxd

Similarity

API ID: CriticalEnterErrorFreeHeapLastSection___sbh_find_block___sbh_free_block__amsg_exit__lock__mtinitlocknum
String ID:
API String ID: 2714421763-0
Opcode ID: 876d904308f60469df205f41dc44533bd1052653fabd63d04ec7f48952a60db4
Instruction ID: 153e77f1d39b2fa759cec9959ea84e1a9cceb6d2c2be92f34daf050f8be6d13c
Opcode Fuzzy Hash: 876d904308f60469df205f41dc44533bd1052653fabd63d04ec7f48952a60db4
Instruction Fuzzy Hash: 32018B71911305AAFB207FB09D08BDD3AA4EF017ACF504118E903BA1C0DA39B8909AA5

Function 033BB230 Relevance: 7.5, APIs: 5, Instructions: 20COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(00000000,00000000,033BAD65), ref: 033BB235
InterlockedExchange.KERNEL32(?,00000000), ref: 033BB248
CloseHandle.KERNEL32(00000000), ref: 033BB253
SetEvent.KERNEL32(?), ref: 033BB25D
LeaveCriticalSection.KERNEL32(00000000), ref: 033BB264

Memory Dump Source

Source File: 00000014.00000002.2494020967.00000000033B1000.00000020.00000001.01000000.00000015.sdmp, Offset: 033B0000, based on PE: true

Associated: 00000014.00000002.2493917908.00000000033B0000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000014.00000002.2497615129.00000000033F3000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000014.00000002.2498110795.0000000003400000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000014.00000002.2498410969.0000000003406000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000014.00000002.2498556459.0000000003408000.00000008.00000001.01000000.00000015.sdmpDownload File
Associated: 00000014.00000002.2498718201.000000000340A000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000014.00000002.2499166516.0000000003411000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_33b0000_Picasa3.jbxd

Similarity

API ID: CriticalSection$CloseEnterEventExchangeHandleInterlockedLeave
String ID:
API String ID: 1078860413-0
Opcode ID: 49f93351a2e790e1213419513e8ef51813cfc36388f272d38520172883fe1b34
Instruction ID: 370cebd4b1de6ffed9d308f8b8fb2f83c10655d3eb6bf07b7926b89bb7b174e7
Opcode Fuzzy Hash: 49f93351a2e790e1213419513e8ef51813cfc36388f272d38520172883fe1b34
Instruction Fuzzy Hash: 33E0BF7A101601EFC720AF65E88CB9AB7BCEB88711F44450DF287C2448CB39E145DB61

Function 0403DAD0 Relevance: 7.5, APIs: 5, Instructions: 20COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(00000000,00000000,0403D605), ref: 0403DAD5
InterlockedExchange.KERNEL32(?,00000000), ref: 0403DAE8
CloseHandle.KERNEL32(00000000), ref: 0403DAF3
SetEvent.KERNEL32(?), ref: 0403DAFD
LeaveCriticalSection.KERNEL32(00000000), ref: 0403DB04

Memory Dump Source

Source File: 00000014.00000002.2502041842.0000000004031000.00000020.00000001.01000000.00000017.sdmp, Offset: 04030000, based on PE: true

Associated: 00000014.00000002.2501986218.0000000004030000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000014.00000002.2504208079.0000000004079000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000014.00000002.2504943590.0000000004086000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000014.00000002.2505148754.000000000408E000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000014.00000002.2505282171.0000000004090000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000014.00000002.2505501725.0000000004097000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_4030000_Picasa3.jbxd

Similarity

API ID: CriticalSection$CloseEnterEventExchangeHandleInterlockedLeave
String ID:
API String ID: 1078860413-0
Opcode ID: 19806df506e244e197ae8ea470dd2a6beba4c8a8f5c75a612d16888d18018d96
Instruction ID: b5da50243cc0b81cc3779c9187c49438a6cbb19784c747330b1569e51f1af0b4
Opcode Fuzzy Hash: 19806df506e244e197ae8ea470dd2a6beba4c8a8f5c75a612d16888d18018d96
Instruction Fuzzy Hash: 06E09AF25046019BE760AFA5E84CB6B77FCFB89701F04052CE246F1544DB7CA406CB62

Function 0403F790 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 195COMMON

Download Yara Rule

APIs

InterlockedIncrement.KERNEL32(00000000), ref: 0403F8B4
InterlockedIncrement.KERNEL32 ref: 0403F92B
InterlockedIncrement.KERNEL32(?), ref: 0403F995

Strings

ru, xrefs: 0403F8B4, 0403F913

Memory Dump Source

Source File: 00000014.00000002.2502041842.0000000004031000.00000020.00000001.01000000.00000017.sdmp, Offset: 04030000, based on PE: true

Associated: 00000014.00000002.2501986218.0000000004030000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000014.00000002.2504208079.0000000004079000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000014.00000002.2504943590.0000000004086000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000014.00000002.2505148754.000000000408E000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000014.00000002.2505282171.0000000004090000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000014.00000002.2505501725.0000000004097000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_4030000_Picasa3.jbxd

Similarity

API ID: IncrementInterlocked
String ID: ru
API String ID: 3508698243-1355688448
Opcode ID: 589accf40a9615c8c92b0bb0f9aa2bfe6e3f738efe13ac4fdb179c893940056d
Instruction ID: 956edc0f73bba8f916d40859fa82f4bcc41179360f4c99729b173cb95cea55b4
Opcode Fuzzy Hash: 589accf40a9615c8c92b0bb0f9aa2bfe6e3f738efe13ac4fdb179c893940056d
Instruction Fuzzy Hash: 6E51B0B2E042436FEB649F24D88077A7BD8EB4632EF18447AD841B7251DB29B845C691

Function 033ECD8D Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 185COMMON

Download Yara Rule

APIs

__startOneArgErrorHandling.LIBCMT ref: 033ECE1D

Strings

pow, xrefs: 033ECDF5, 033ECE12

Memory Dump Source

Source File: 00000014.00000002.2494020967.00000000033B1000.00000020.00000001.01000000.00000015.sdmp, Offset: 033B0000, based on PE: true

Associated: 00000014.00000002.2493917908.00000000033B0000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000014.00000002.2497615129.00000000033F3000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000014.00000002.2498110795.0000000003400000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000014.00000002.2498410969.0000000003406000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000014.00000002.2498556459.0000000003408000.00000008.00000001.01000000.00000015.sdmpDownload File
Associated: 00000014.00000002.2498718201.000000000340A000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000014.00000002.2499166516.0000000003411000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_33b0000_Picasa3.jbxd

Similarity

API ID: ErrorHandling__start
String ID: pow
API String ID: 3213639722-2276729525
Opcode ID: 7e7e97d848e7c0e1c60daeb7218d7825d6f27e72a083ccaf59198a9168b95961
Instruction ID: 321282870ba0a25760fcf644c96aa5ed5042a42fda99c755c75ad2d0cf69d2f0
Opcode Fuzzy Hash: 7e7e97d848e7c0e1c60daeb7218d7825d6f27e72a083ccaf59198a9168b95961
Instruction Fuzzy Hash: 0E516F25E082119ECB15FB18CDC03BE7BD8DB80752F189DA8F4D5492F8EB35C4949B86

Function 0407329D Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 185COMMON

Download Yara Rule

APIs

__startOneArgErrorHandling.LIBCMT ref: 0407332D

Strings

pow, xrefs: 04073305, 04073322

Memory Dump Source

Source File: 00000014.00000002.2502041842.0000000004031000.00000020.00000001.01000000.00000017.sdmp, Offset: 04030000, based on PE: true

Associated: 00000014.00000002.2501986218.0000000004030000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000014.00000002.2504208079.0000000004079000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000014.00000002.2504943590.0000000004086000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000014.00000002.2505148754.000000000408E000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000014.00000002.2505282171.0000000004090000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000014.00000002.2505501725.0000000004097000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_4030000_Picasa3.jbxd

Similarity

API ID: ErrorHandling__start
String ID: pow
API String ID: 3213639722-2276729525
Opcode ID: 235669b24c75b7a65cc5ffdeff55876d98ec97ea5f264ea23bee3009f7343a18
Instruction ID: c1ecc07388da0da2ba261bbc385b2ed4239b436dc4bc20626a43616a96730036
Opcode Fuzzy Hash: 235669b24c75b7a65cc5ffdeff55876d98ec97ea5f264ea23bee3009f7343a18
Instruction Fuzzy Hash: 9D511770E0810A96FB656B18D5013AE7BD4EB40714F10C969ECD5B6298EF38BC94F68F

Function 0488946D Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 185COMMON

Download Yara Rule

APIs

__startOneArgErrorHandling.LIBCMT ref: 048894FD

Part of subcall function 04889BB0: __87except.LIBCMT ref: 04889BEB

Strings

pow, xrefs: 048894D5, 048894F2

Memory Dump Source

Source File: 00000014.00000002.2526268174.00000000047E1000.00000020.00000001.01000000.00000016.sdmp, Offset: 047E0000, based on PE: true

Associated: 00000014.00000002.2526187657.00000000047E0000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000014.00000002.2533437740.000000000488F000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000014.00000002.2535246598.00000000048AB000.00000004.00000001.01000000.00000016.sdmpDownload File
Associated: 00000014.00000002.2535569716.00000000048B3000.00000008.00000001.01000000.00000016.sdmpDownload File
Associated: 00000014.00000002.2535640427.00000000048B5000.00000004.00000001.01000000.00000016.sdmpDownload File
Associated: 00000014.00000002.2536317728.00000000048C0000.00000002.00000001.01000000.00000016.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_47e0000_Picasa3.jbxd

Similarity

API ID: ErrorHandling__87except__start
String ID: pow
API String ID: 2905807303-2276729525
Opcode ID: fd1b76207bb3799aa3e2a78958780ffc998f92ab13364d829dc39f63bb360236
Instruction ID: 00a706d665863fd455f2c77670945f370101c4ea87d54951463bf28356245be5
Opcode Fuzzy Hash: fd1b76207bb3799aa3e2a78958780ffc998f92ab13364d829dc39f63bb360236
Instruction Fuzzy Hash: 9C512AE1A085069ADB15BE18C54037E7FD4EB40724F148F5CE4DAC22D8FB3AB8C4D68A

Function 0480A4D0 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 157COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 0480A516
MultiByteToWideChar.KERNEL32(00000000,00000000,00000000,000000FF,?,00000032), ref: 0480A66B
MultiByteToWideChar.KERNEL32(00000000,00000000,ButtonX,000000FF,?,00000032), ref: 0480A6A5

Strings

ButtonX, xrefs: 0480A69C

Memory Dump Source

Source File: 00000014.00000002.2526268174.00000000047E1000.00000020.00000001.01000000.00000016.sdmp, Offset: 047E0000, based on PE: true

Associated: 00000014.00000002.2526187657.00000000047E0000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000014.00000002.2533437740.000000000488F000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000014.00000002.2535246598.00000000048AB000.00000004.00000001.01000000.00000016.sdmpDownload File
Associated: 00000014.00000002.2535569716.00000000048B3000.00000008.00000001.01000000.00000016.sdmpDownload File
Associated: 00000014.00000002.2535640427.00000000048B5000.00000004.00000001.01000000.00000016.sdmpDownload File
Associated: 00000014.00000002.2536317728.00000000048C0000.00000002.00000001.01000000.00000016.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_47e0000_Picasa3.jbxd

Similarity

API ID: ByteCharMultiWide$_memset
String ID: ButtonX
API String ID: 3545102435-542983530
Opcode ID: 5e5e78eaf410016de77ff3f7d0d0d307950a9da1f581975fb1336e1d15b538fa
Instruction ID: 09c9ab9489ecce2c6009c1132ffff047b3e2d82c622c6f994ed9d7b9944f0973
Opcode Fuzzy Hash: 5e5e78eaf410016de77ff3f7d0d0d307950a9da1f581975fb1336e1d15b538fa
Instruction Fuzzy Hash: 92514670224702DFE364DF28D944B26BBB4FFA4704F158E58E4A4976E1E770E824CB96

Function 040337F0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 146registryCOMMON

Download Yara Rule

APIs

InterlockedIncrement.KERNEL32(00000000), ref: 04033840
RegCloseKey.ADVAPI32(?,?,0403239B,?), ref: 04033938
RegCloseKey.ADVAPI32(?,?,0403239B,?), ref: 04033958

Part of subcall function 04031000: InterlockedDecrement.KERNEL32(00000000), ref: 04031012
Part of subcall function 04031000: InterlockedIncrement.KERNEL32(00000000), ref: 0403102E

Strings

ru, xrefs: 04033840

Memory Dump Source

Source File: 00000014.00000002.2502041842.0000000004031000.00000020.00000001.01000000.00000017.sdmp, Offset: 04030000, based on PE: true

Associated: 00000014.00000002.2501986218.0000000004030000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000014.00000002.2504208079.0000000004079000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000014.00000002.2504943590.0000000004086000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000014.00000002.2505148754.000000000408E000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000014.00000002.2505282171.0000000004090000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000014.00000002.2505501725.0000000004097000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_4030000_Picasa3.jbxd

Similarity

API ID: Interlocked$CloseIncrement$Decrement
String ID: ru
API String ID: 1728259722-1355688448
Opcode ID: 139fb782f5549330a73f2e98ecc43c04176cdbe16499cf64d4b1307a8b9ee117
Instruction ID: b695c536a2924f98c7460965b79fd916ab6451fa7c311a99cc294af9fde421d4
Opcode Fuzzy Hash: 139fb782f5549330a73f2e98ecc43c04176cdbe16499cf64d4b1307a8b9ee117
Instruction Fuzzy Hash: 74518FB2604341DBE710DF29D9C0AAABBE9AFC4709F04492DF985FB210D735F9048B52

Function 033B5930 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 139COMMON

Download Yara Rule

APIs

SysFreeString.OLEAUT32(?), ref: 033B5A97
SysFreeString.OLEAUT32(?), ref: 033B5A9E
SysFreeString.OLEAUT32(?), ref: 033B5AA5

Part of subcall function 033B9360: WideCharToMultiByte.KERNEL32(0000FDE9,00000000,033F58EC,000000FF,00000000,00000000,00000000,00000000,00000000,?,?,00000000,033B5A39,?,?,033F58EC), ref: 033B9380
Part of subcall function 033B9360: WideCharToMultiByte.KERNEL32(0000FDE9,00000000,033F58EC,000000FF,00000000,00000001,00000000,00000000,?,00000001,00000000), ref: 033B93C0

Strings

`cu, xrefs: 033B5A90

Memory Dump Source

Source File: 00000014.00000002.2494020967.00000000033B1000.00000020.00000001.01000000.00000015.sdmp, Offset: 033B0000, based on PE: true

Associated: 00000014.00000002.2493917908.00000000033B0000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000014.00000002.2497615129.00000000033F3000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000014.00000002.2498110795.0000000003400000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000014.00000002.2498410969.0000000003406000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000014.00000002.2498556459.0000000003408000.00000008.00000001.01000000.00000015.sdmpDownload File
Associated: 00000014.00000002.2498718201.000000000340A000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000014.00000002.2499166516.0000000003411000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_33b0000_Picasa3.jbxd

Similarity

API ID: FreeString$ByteCharMultiWide
String ID: `cu
API String ID: 283159491-4120539311
Opcode ID: 9fe71db533408c1c47fe6dfd86cb940e7961e5bf47b72222a7a2764d44ca3ae0
Instruction ID: abc896640ac5f6a909288b63e82712d5555ba825cfb0178101af3f719ee7452e
Opcode Fuzzy Hash: 9fe71db533408c1c47fe6dfd86cb940e7961e5bf47b72222a7a2764d44ca3ae0
Instruction Fuzzy Hash: 96413976A083069FD300EF64CCC09ABB7F8EB89250F484D2EE655D7650D730E9098BA2

Function 033B4B90 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 138COMMON

Download Yara Rule

APIs

SysFreeString.OLEAUT32(00000000), ref: 033B4C9D
SysStringLen.OLEAUT32(00000000), ref: 033B4CA8
SysFreeString.OLEAUT32(?), ref: 033B4CD1

Part of subcall function 033DC7D7: _malloc.LIBCMT ref: 033DC7EF

Strings

`cu, xrefs: 033B4C9D, 033B4CD1

Memory Dump Source

Source File: 00000014.00000002.2494020967.00000000033B1000.00000020.00000001.01000000.00000015.sdmp, Offset: 033B0000, based on PE: true

Associated: 00000014.00000002.2493917908.00000000033B0000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000014.00000002.2497615129.00000000033F3000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000014.00000002.2498110795.0000000003400000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000014.00000002.2498410969.0000000003406000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000014.00000002.2498556459.0000000003408000.00000008.00000001.01000000.00000015.sdmpDownload File
Associated: 00000014.00000002.2498718201.000000000340A000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000014.00000002.2499166516.0000000003411000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_33b0000_Picasa3.jbxd

Similarity

API ID: String$Free$_malloc
String ID: `cu
API String ID: 1655449432-4120539311
Opcode ID: 37661f664ae3f89343f3c6248d16543fb14409d0f5d1a135d0a3397dbc4739db
Instruction ID: 7bbc53c66390b99ff02837d8c428f593a4254b5267086983d143387502c8a026
Opcode Fuzzy Hash: 37661f664ae3f89343f3c6248d16543fb14409d0f5d1a135d0a3397dbc4739db
Instruction Fuzzy Hash: 57415776604346AFD304DF5AD880A6BB7F9FF88610F14891DFA898B301D734E945CBA5

Function 0481D4F0 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 120COMMON

Download Yara Rule

APIs

Part of subcall function 047E3430: InterlockedDecrement.KERNEL32(00000000), ref: 047E3442
Part of subcall function 047E3430: InterlockedIncrement.KERNEL32(00000000), ref: 047E345E

Part of subcall function 04830460: _memset.LIBCMT ref: 0483048C
Part of subcall function 04830460: GetVersionExA.KERNEL32 ref: 048304A0

Part of subcall function 047E2A80: InterlockedIncrement.KERNEL32(00000000), ref: 047E2AD8
Part of subcall function 047E2A80: InterlockedIncrement.KERNEL32(00000000), ref: 047E2B48
Part of subcall function 047E2A80: InterlockedIncrement.KERNEL32(00000000), ref: 047E2B93

InterlockedIncrement.KERNEL32(00000000), ref: 0481D58D

Strings

Progid, xrefs: 0481D52B
Software\Microsoft\Windows\Shell\Associations\UrlAssociations\http\UserChoice, xrefs: 0481D535
\shell\open\command, xrefs: 0481D5A0

Memory Dump Source

Source File: 00000014.00000002.2526268174.00000000047E1000.00000020.00000001.01000000.00000016.sdmp, Offset: 047E0000, based on PE: true

Associated: 00000014.00000002.2526187657.00000000047E0000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000014.00000002.2533437740.000000000488F000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000014.00000002.2535246598.00000000048AB000.00000004.00000001.01000000.00000016.sdmpDownload File
Associated: 00000014.00000002.2535569716.00000000048B3000.00000008.00000001.01000000.00000016.sdmpDownload File
Associated: 00000014.00000002.2535640427.00000000048B5000.00000004.00000001.01000000.00000016.sdmpDownload File
Associated: 00000014.00000002.2536317728.00000000048C0000.00000002.00000001.01000000.00000016.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_47e0000_Picasa3.jbxd

Similarity

API ID: Interlocked$Increment$DecrementVersion_memset
String ID: Progid$Software\Microsoft\Windows\Shell\Associations\UrlAssociations\http\UserChoice$\shell\open\command
API String ID: 399028839-2324932162
Opcode ID: f97b3c32db3800690670765b840dff6deb38a55430e3e5c397bceca7ad27e4fd
Instruction ID: 30cca4b00f64d71f6ab17734f63bb9cae6f91da81a373c5397efa1e3f83ef817
Opcode Fuzzy Hash: f97b3c32db3800690670765b840dff6deb38a55430e3e5c397bceca7ad27e4fd
Instruction Fuzzy Hash: 5241E5315043408BD710EF69C8445AFB7E8AF84348F844F6EF985D7261C7B8F9098A92

Function 033B29E0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 115stringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(REGISTRY), ref: 033B2A03
_malloc.LIBCMT ref: 033B2A58
WideCharToMultiByte.KERNEL32(?,00000000,REGISTRY,000000FF,00000008,00000000,00000000,00000000), ref: 033B2A85

Strings

REGISTRY, xrefs: 033B29F9, 033B2A7A

Memory Dump Source

Source File: 00000014.00000002.2494020967.00000000033B1000.00000020.00000001.01000000.00000015.sdmp, Offset: 033B0000, based on PE: true

Associated: 00000014.00000002.2493917908.00000000033B0000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000014.00000002.2497615129.00000000033F3000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000014.00000002.2498110795.0000000003400000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000014.00000002.2498410969.0000000003406000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000014.00000002.2498556459.0000000003408000.00000008.00000001.01000000.00000015.sdmpDownload File
Associated: 00000014.00000002.2498718201.000000000340A000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000014.00000002.2499166516.0000000003411000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_33b0000_Picasa3.jbxd

Similarity

API ID: ByteCharMultiWide_malloclstrlen
String ID: REGISTRY
API String ID: 2576735857-194740550
Opcode ID: 5d007ccc4554ff04a99daa10487e625d938f746fdb7a5e2bd1a270706b7f1467
Instruction ID: 389a854420eab32d1e915d89f755f9f4df077154506c21d3eadb295a03bf5bc4
Opcode Fuzzy Hash: 5d007ccc4554ff04a99daa10487e625d938f746fdb7a5e2bd1a270706b7f1467
Instruction Fuzzy Hash: 4F312476E10215ABDB30EAA99CC5BEF73B89F45710F184B25FE14EF680EA74D8008791

Function 033B2C80 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 115stringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(REGISTRY), ref: 033B2CA3
_malloc.LIBCMT ref: 033B2CF8
WideCharToMultiByte.KERNEL32(?,00000000,REGISTRY,000000FF,00000008,00000000,00000000,00000000), ref: 033B2D25

Strings

REGISTRY, xrefs: 033B2C99, 033B2D1A

Memory Dump Source

Source File: 00000014.00000002.2494020967.00000000033B1000.00000020.00000001.01000000.00000015.sdmp, Offset: 033B0000, based on PE: true

Associated: 00000014.00000002.2493917908.00000000033B0000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000014.00000002.2497615129.00000000033F3000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000014.00000002.2498110795.0000000003400000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000014.00000002.2498410969.0000000003406000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000014.00000002.2498556459.0000000003408000.00000008.00000001.01000000.00000015.sdmpDownload File
Associated: 00000014.00000002.2498718201.000000000340A000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000014.00000002.2499166516.0000000003411000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_33b0000_Picasa3.jbxd

Similarity

API ID: ByteCharMultiWide_malloclstrlen
String ID: REGISTRY
API String ID: 2576735857-194740550
Opcode ID: b3439fa62eab0235ff2041877e991c7bf8eba4bdb74b83bf06c6ca524d9173c2
Instruction ID: 68590e90e68744ed7d97210b24f5b341a60c4e6a89f36a5625a560942fada699
Opcode Fuzzy Hash: b3439fa62eab0235ff2041877e991c7bf8eba4bdb74b83bf06c6ca524d9173c2
Instruction Fuzzy Hash: 8231F6B6E002156BDB10EA64DCC5FEB73B89F45790F180B29FE24EF680E634D9008791

Function 047ED630 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 115stringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(REGISTRY), ref: 047ED653
_malloc.LIBCMT ref: 047ED6A8
WideCharToMultiByte.KERNEL32(?,00000000,REGISTRY,000000FF,00000008,00000000,00000000,00000000), ref: 047ED6D5

Strings

REGISTRY, xrefs: 047ED649, 047ED6CA

Memory Dump Source

Source File: 00000014.00000002.2526268174.00000000047E1000.00000020.00000001.01000000.00000016.sdmp, Offset: 047E0000, based on PE: true

Associated: 00000014.00000002.2526187657.00000000047E0000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000014.00000002.2533437740.000000000488F000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000014.00000002.2535246598.00000000048AB000.00000004.00000001.01000000.00000016.sdmpDownload File
Associated: 00000014.00000002.2535569716.00000000048B3000.00000008.00000001.01000000.00000016.sdmpDownload File
Associated: 00000014.00000002.2535640427.00000000048B5000.00000004.00000001.01000000.00000016.sdmpDownload File
Associated: 00000014.00000002.2536317728.00000000048C0000.00000002.00000001.01000000.00000016.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_47e0000_Picasa3.jbxd

Similarity

API ID: ByteCharMultiWide_malloclstrlen
String ID: REGISTRY
API String ID: 2576735857-194740550
Opcode ID: f05188bf15966b85d61a155f58c422f819256cc6682efc5a3e74471aa0e98548
Instruction ID: 1177a353a9dc4bf489c03bf2754b681c354c1c888f08e7781cacc233e4efec12
Opcode Fuzzy Hash: f05188bf15966b85d61a155f58c422f819256cc6682efc5a3e74471aa0e98548
Instruction Fuzzy Hash: 28313672E00216A7EB319FAA8C44B7A33D8AF4C754F144725FD19EB380E678F9008791

Function 04033B30 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 100COMMON

Download Yara Rule

APIs

Part of subcall function 04033E10: InterlockedIncrement.KERNEL32(00000000), ref: 04033E68
Part of subcall function 04033E10: InterlockedIncrement.KERNEL32(00000000), ref: 04033ED8

InterlockedIncrement.KERNEL32(00000000), ref: 04033BA9
InterlockedIncrement.KERNEL32(00000007), ref: 04033C1C

Strings

ytHLocal::lang, xrefs: 04033B30, 04033B40
ru, xrefs: 04033BA9, 04033C1C

Memory Dump Source

Source File: 00000014.00000002.2502041842.0000000004031000.00000020.00000001.01000000.00000017.sdmp, Offset: 04030000, based on PE: true

Associated: 00000014.00000002.2501986218.0000000004030000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000014.00000002.2504208079.0000000004079000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000014.00000002.2504943590.0000000004086000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000014.00000002.2505148754.000000000408E000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000014.00000002.2505282171.0000000004090000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000014.00000002.2505501725.0000000004097000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_4030000_Picasa3.jbxd

Similarity

API ID: IncrementInterlocked
String ID: ytHLocal::lang$ru
API String ID: 3508698243-244117876
Opcode ID: 16d0ef782e7aba793a93be7dd01633a3fcf1148fdc8170c5ab68ea82e58ad833
Instruction ID: baae54b0f31d617f8b2f51cfac48d8538a170cd70ac290350375f155f3c6be0e
Opcode Fuzzy Hash: 16d0ef782e7aba793a93be7dd01633a3fcf1148fdc8170c5ab68ea82e58ad833
Instruction Fuzzy Hash: 7631D2712043458FD720AF14C8807ABBFADEF8435AF10886CEA81BB251CB78F945C795

Function 04041450 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 93COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 0404147F
InterlockedDecrement.KERNEL32(?), ref: 040414F1
InterlockedIncrement.KERNEL32(?), ref: 0404150D

Strings

`ruru, xrefs: 040414F1

Memory Dump Source

Source File: 00000014.00000002.2502041842.0000000004031000.00000020.00000001.01000000.00000017.sdmp, Offset: 04030000, based on PE: true

Associated: 00000014.00000002.2501986218.0000000004030000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000014.00000002.2504208079.0000000004079000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000014.00000002.2504943590.0000000004086000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000014.00000002.2505148754.000000000408E000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000014.00000002.2505282171.0000000004090000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000014.00000002.2505501725.0000000004097000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_4030000_Picasa3.jbxd

Similarity

API ID: Interlocked$DecrementIncrement_memset
String ID: `ruru
API String ID: 1097153766-999165909
Opcode ID: e641f006520e61e24a6a886f2bc7d38086ff9a7e7444ac3734262f34e47cfd4d
Instruction ID: 00b042aebff04be8d7e2d27070020b3b9a4e2e2087216b6b66ff54d386f4152b
Opcode Fuzzy Hash: e641f006520e61e24a6a886f2bc7d38086ff9a7e7444ac3734262f34e47cfd4d
Instruction Fuzzy Hash: 5921E6F2A052019BE720AE24DC48B7B73D9AFC1318F054938E893FB641E724F88086A1

Function 033B1370 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 81COMMON

Download Yara Rule

Strings

`cu, xrefs: 033B13E5, 033B1425

Memory Dump Source

Source File: 00000014.00000002.2494020967.00000000033B1000.00000020.00000001.01000000.00000015.sdmp, Offset: 033B0000, based on PE: true

Associated: 00000014.00000002.2493917908.00000000033B0000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000014.00000002.2497615129.00000000033F3000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000014.00000002.2498110795.0000000003400000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000014.00000002.2498410969.0000000003406000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000014.00000002.2498556459.0000000003408000.00000008.00000001.01000000.00000015.sdmpDownload File
Associated: 00000014.00000002.2498718201.000000000340A000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000014.00000002.2499166516.0000000003411000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_33b0000_Picasa3.jbxd

Similarity

API ID:
String ID: `cu
API String ID: 0-4120539311
Opcode ID: e064e9938b077564c1a45d28d7a73ec3829c134c079e2bb3d4604321e170b2f2
Instruction ID: 7277c8c9461c91129f67ac7b9196481f00b201e6aa8081a96e15bd7bae773721
Opcode Fuzzy Hash: e064e9938b077564c1a45d28d7a73ec3829c134c079e2bb3d4604321e170b2f2
Instruction Fuzzy Hash: 2D2192B5A00201AFD710EB69DC94B9BB7F9AF84710F0C8558EA88CB690E735DC81C761

Function 0403FC90 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 74COMMON

Download Yara Rule

APIs

InterlockedIncrement.KERNEL32(?), ref: 0403FCD4
InterlockedIncrement.KERNEL32(0000000D), ref: 0403FD11

Strings

My Music, xrefs: 0403FD19
ru, xrefs: 0403FCD4, 0403FD11

Memory Dump Source

Source File: 00000014.00000002.2502041842.0000000004031000.00000020.00000001.01000000.00000017.sdmp, Offset: 04030000, based on PE: true

Associated: 00000014.00000002.2501986218.0000000004030000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000014.00000002.2504208079.0000000004079000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000014.00000002.2504943590.0000000004086000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000014.00000002.2505148754.000000000408E000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000014.00000002.2505282171.0000000004090000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000014.00000002.2505501725.0000000004097000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_4030000_Picasa3.jbxd

Similarity

API ID: IncrementInterlocked
String ID: My Music$ru
API String ID: 3508698243-4114325043
Opcode ID: 8e3e56f249690b4a37e735fc8e36568fee03d96823e384530eb97b028ea886a9
Instruction ID: 5345ddafe101687d35a6cda8d91d7cbbea87990aa860261daaa98b3f13224b36
Opcode Fuzzy Hash: 8e3e56f249690b4a37e735fc8e36568fee03d96823e384530eb97b028ea886a9
Instruction Fuzzy Hash: 3221D8709043424FE754DF24E8597EA7FDABF45309F444869E446AB2A0DB38F808C753

Function 0403FD90 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 74COMMON

Download Yara Rule

APIs

InterlockedIncrement.KERNEL32(?), ref: 0403FDD4
InterlockedIncrement.KERNEL32(0000000E), ref: 0403FE11

Strings

ru, xrefs: 0403FDD4, 0403FE11
My Videos, xrefs: 0403FE19

Memory Dump Source

Source File: 00000014.00000002.2502041842.0000000004031000.00000020.00000001.01000000.00000017.sdmp, Offset: 04030000, based on PE: true

Associated: 00000014.00000002.2501986218.0000000004030000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000014.00000002.2504208079.0000000004079000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000014.00000002.2504943590.0000000004086000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000014.00000002.2505148754.000000000408E000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000014.00000002.2505282171.0000000004090000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000014.00000002.2505501725.0000000004097000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_4030000_Picasa3.jbxd

Similarity

API ID: IncrementInterlocked
String ID: My Videos$ru
API String ID: 3508698243-4176531663
Opcode ID: 8fc4f14b6873dc91532be22b0b857288abbac45075f7c81ca16aa14c3bc085e8
Instruction ID: 1d05cc4ff31c7f0ae62532570e57cb98ee2d49ffd2e6f4cec63f9fb64ca973d4
Opcode Fuzzy Hash: 8fc4f14b6873dc91532be22b0b857288abbac45075f7c81ca16aa14c3bc085e8
Instruction Fuzzy Hash: 3A21C4B0A043428FE714DF24D8417AB7FE9AF8530AF044868E546A7262DB38F808C753

Function 0403FB90 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 74COMMON

Download Yara Rule

APIs

InterlockedIncrement.KERNEL32(?), ref: 0403FBD4
InterlockedIncrement.KERNEL32(00000027), ref: 0403FC11

Strings

My Pictures, xrefs: 0403FC19
ru, xrefs: 0403FBD4, 0403FC11

Memory Dump Source

Source File: 00000014.00000002.2502041842.0000000004031000.00000020.00000001.01000000.00000017.sdmp, Offset: 04030000, based on PE: true

Associated: 00000014.00000002.2501986218.0000000004030000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000014.00000002.2504208079.0000000004079000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000014.00000002.2504943590.0000000004086000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000014.00000002.2505148754.000000000408E000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000014.00000002.2505282171.0000000004090000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000014.00000002.2505501725.0000000004097000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_4030000_Picasa3.jbxd

Similarity

API ID: IncrementInterlocked
String ID: My Pictures$ru
API String ID: 3508698243-3233556258
Opcode ID: bc9657323c271a7cf20cd8c180b5827585214e1e137b69eb6798e02ccf7f0e61
Instruction ID: 39d8696b74b09af1d9ee7ef656d00d0fb50139a5ee7effb73f79d8745ea82eaf
Opcode Fuzzy Hash: bc9657323c271a7cf20cd8c180b5827585214e1e137b69eb6798e02ccf7f0e61
Instruction Fuzzy Hash: E321D8B0A683428FE714DF24DA557EA7FD8AF45709F044868E886A7161DB39F808C753

Function 033B4C49 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 69COMMON

Download Yara Rule

APIs

SysFreeString.OLEAUT32(00000000), ref: 033B4C9D
SysStringLen.OLEAUT32(00000000), ref: 033B4CA8
SysFreeString.OLEAUT32(?), ref: 033B4CD1

Strings

`cu, xrefs: 033B4C9D, 033B4CD1

Memory Dump Source

Source File: 00000014.00000002.2494020967.00000000033B1000.00000020.00000001.01000000.00000015.sdmp, Offset: 033B0000, based on PE: true

Associated: 00000014.00000002.2493917908.00000000033B0000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000014.00000002.2497615129.00000000033F3000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000014.00000002.2498110795.0000000003400000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000014.00000002.2498410969.0000000003406000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000014.00000002.2498556459.0000000003408000.00000008.00000001.01000000.00000015.sdmpDownload File
Associated: 00000014.00000002.2498718201.000000000340A000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000014.00000002.2499166516.0000000003411000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_33b0000_Picasa3.jbxd

Similarity

API ID: String$Free
String ID: `cu
API String ID: 1391021980-4120539311
Opcode ID: 38bf7515e0969e085c56c2f72cc7ee406a79fc1880468c3effd36cdf4d59be4d
Instruction ID: 3e4877560a1f2940b1616f8da36a17082541982f26108deae674e720dcb43d12
Opcode Fuzzy Hash: 38bf7515e0969e085c56c2f72cc7ee406a79fc1880468c3effd36cdf4d59be4d
Instruction Fuzzy Hash: 0521EFB9604346AFD314DF59D884A6AB3E9FF88700F10880DFA8987351D735E944CBA2

Function 0403FF90 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 69COMMON

Download Yara Rule

APIs

InterlockedIncrement.KERNEL32(?), ref: 0403FFD4
InterlockedIncrement.KERNEL32(00000023), ref: 04040011

Strings

Common AppData, xrefs: 04040019
ru, xrefs: 0403FFD4, 04040011

Memory Dump Source

Source File: 00000014.00000002.2502041842.0000000004031000.00000020.00000001.01000000.00000017.sdmp, Offset: 04030000, based on PE: true

Associated: 00000014.00000002.2501986218.0000000004030000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000014.00000002.2504208079.0000000004079000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000014.00000002.2504943590.0000000004086000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000014.00000002.2505148754.000000000408E000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000014.00000002.2505282171.0000000004090000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000014.00000002.2505501725.0000000004097000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_4030000_Picasa3.jbxd

Similarity

API ID: IncrementInterlocked
String ID: Common AppData$ru
API String ID: 3508698243-234284087
Opcode ID: f137de8e234ae259d53518523e8e78b126077ed9e7097c485911bf6c1e5caca2
Instruction ID: b99cf9eaaab1fc59009b052204a241fab9e6d5503a52145701c49884c4dfc367
Opcode Fuzzy Hash: f137de8e234ae259d53518523e8e78b126077ed9e7097c485911bf6c1e5caca2
Instruction Fuzzy Hash: BD21C2B06043408FE764DF28D8557EA7BE5AFC6308F044C78EA45BB295D77AB808C752

Function 04040080 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 67COMMON

Download Yara Rule

APIs

InterlockedIncrement.KERNEL32(?), ref: 040400C4
InterlockedIncrement.KERNEL32(00000000), ref: 040400FE

Strings

Desktop, xrefs: 04040106
ru, xrefs: 040400C4, 040400FE

Memory Dump Source

Source File: 00000014.00000002.2502041842.0000000004031000.00000020.00000001.01000000.00000017.sdmp, Offset: 04030000, based on PE: true

Associated: 00000014.00000002.2501986218.0000000004030000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000014.00000002.2504208079.0000000004079000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000014.00000002.2504943590.0000000004086000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000014.00000002.2505148754.000000000408E000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000014.00000002.2505282171.0000000004090000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000014.00000002.2505501725.0000000004097000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_4030000_Picasa3.jbxd

Similarity

API ID: IncrementInterlocked
String ID: Desktop$ru
API String ID: 3508698243-3768680968
Opcode ID: 90fc4d11755a69fd5185c7c19839ed814a90e6050969d99e83b6973b2fd65fab
Instruction ID: d60ab9b79d69fc770475311a2248a4240ff96c3b9cbcbd1f9d3f54362a85ec93
Opcode Fuzzy Hash: 90fc4d11755a69fd5185c7c19839ed814a90e6050969d99e83b6973b2fd65fab
Instruction Fuzzy Hash: 0F2193B06043408FE714DF28D895BEB7BE5AFC5304F444978E685BB2A0DB79B844C792

Function 04037810 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 67COMMON

Download Yara Rule

APIs

SystemParametersInfoA.USER32(00000030,00000000,00000000,00000000), ref: 0403784C
GetSystemMetrics.USER32(00000000), ref: 04037863
GetSystemMetrics.USER32(00000001), ref: 0403786A

Strings

DISPLAY, xrefs: 04037899

Memory Dump Source

Source File: 00000014.00000002.2502041842.0000000004031000.00000020.00000001.01000000.00000017.sdmp, Offset: 04030000, based on PE: true

Associated: 00000014.00000002.2501986218.0000000004030000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000014.00000002.2504208079.0000000004079000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000014.00000002.2504943590.0000000004086000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000014.00000002.2505148754.000000000408E000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000014.00000002.2505282171.0000000004090000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000014.00000002.2505501725.0000000004097000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_4030000_Picasa3.jbxd

Similarity

API ID: System$Metrics$InfoParameters
String ID: DISPLAY
API String ID: 3136151823-865373369
Opcode ID: 82e2ff4fe856b6da35e793ebe786b36ab324ddd53e2346e1a5176dcc9cff132b
Instruction ID: 741f207f4fae1962c44c1709480c0a12ca0e8515e45ec6b2ec13bcfe20a96dc1
Opcode Fuzzy Hash: 82e2ff4fe856b6da35e793ebe786b36ab324ddd53e2346e1a5176dcc9cff132b
Instruction Fuzzy Hash: 4D117FB5A40700AFD324AF1ED844A97BBE8EFC4715F40893EE889A3351E774E444CBA5

Function 0403FAA0 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 67COMMON

Download Yara Rule

APIs

InterlockedIncrement.KERNEL32(?), ref: 0403FAE4
InterlockedIncrement.KERNEL32(00000005), ref: 0403FB1E

Strings

Personal, xrefs: 0403FB26
ru, xrefs: 0403FAE4, 0403FB1E

Memory Dump Source

Source File: 00000014.00000002.2502041842.0000000004031000.00000020.00000001.01000000.00000017.sdmp, Offset: 04030000, based on PE: true

Associated: 00000014.00000002.2501986218.0000000004030000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000014.00000002.2504208079.0000000004079000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000014.00000002.2504943590.0000000004086000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000014.00000002.2505148754.000000000408E000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000014.00000002.2505282171.0000000004090000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000014.00000002.2505501725.0000000004097000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_4030000_Picasa3.jbxd

Similarity

API ID: IncrementInterlocked
String ID: Personal$ru
API String ID: 3508698243-2695142331
Opcode ID: 4b88afeb528a73f1863cf5589bd94210f3c4290c7510bd19c34c89ac29d1ac60
Instruction ID: c29e58fa2dea9168dff148eb91d4120c6a1a3f8cdd7a3dd86dcc490ae34ddea3
Opcode Fuzzy Hash: 4b88afeb528a73f1863cf5589bd94210f3c4290c7510bd19c34c89ac29d1ac60
Instruction Fuzzy Hash: 7B21D5B0A043418FE714DF28D965BEA7FE9FF46305F0448A8E585EB290DB39B804CB52

Function 033EA82D Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 37libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(KERNEL32,033E9215), ref: 033EA832
GetProcAddress.KERNEL32(00000000,IsProcessorFeaturePresent), ref: 033EA842

Strings

IsProcessorFeaturePresent, xrefs: 033EA83C
KERNEL32, xrefs: 033EA82D

Memory Dump Source

Source File: 00000014.00000002.2494020967.00000000033B1000.00000020.00000001.01000000.00000015.sdmp, Offset: 033B0000, based on PE: true

Associated: 00000014.00000002.2493917908.00000000033B0000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000014.00000002.2497615129.00000000033F3000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000014.00000002.2498110795.0000000003400000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000014.00000002.2498410969.0000000003406000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000014.00000002.2498556459.0000000003408000.00000008.00000001.01000000.00000015.sdmpDownload File
Associated: 00000014.00000002.2498718201.000000000340A000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000014.00000002.2499166516.0000000003411000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_33b0000_Picasa3.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: IsProcessorFeaturePresent$KERNEL32
API String ID: 1646373207-3105848591
Opcode ID: 05a306655403f5ca5a2ce6e9da6e1f2f0c7c558a13b103ce23bc46004d1c99fa
Instruction ID: 0a69eee8fa942aceb4daa13c9f857dcfeba8b056f16ec6b1bce52342004afe5d
Opcode Fuzzy Hash: 05a306655403f5ca5a2ce6e9da6e1f2f0c7c558a13b103ce23bc46004d1c99fa
Instruction Fuzzy Hash: 4FF03020A00A1AEAEF00BBA1BD8E66EBF7CFB41742FC20594D6D2B01C8DF7090758251

Function 04070D40 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 37libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(KERNEL32,0406F728), ref: 04070D45
GetProcAddress.KERNEL32(00000000,IsProcessorFeaturePresent), ref: 04070D55

Strings

IsProcessorFeaturePresent, xrefs: 04070D4F
KERNEL32, xrefs: 04070D40

Memory Dump Source

Source File: 00000014.00000002.2502041842.0000000004031000.00000020.00000001.01000000.00000017.sdmp, Offset: 04030000, based on PE: true

Associated: 00000014.00000002.2501986218.0000000004030000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000014.00000002.2504208079.0000000004079000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000014.00000002.2504943590.0000000004086000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000014.00000002.2505148754.000000000408E000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000014.00000002.2505282171.0000000004090000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000014.00000002.2505501725.0000000004097000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_4030000_Picasa3.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: IsProcessorFeaturePresent$KERNEL32
API String ID: 1646373207-3105848591
Opcode ID: b1a0c78073323a51c5763cb4c59cbf430d62a2565a75d1f3b3a7d24368db59e9
Instruction ID: 3827c537e7aabb9fa1b2496b3e71ab08bd923849011693da6abd4d27a28e246d
Opcode Fuzzy Hash: b1a0c78073323a51c5763cb4c59cbf430d62a2565a75d1f3b3a7d24368db59e9
Instruction Fuzzy Hash: FFF0D060E40B0DD2DF102FA5A80E6AE7AB4FB8478AF8146A0D192B4188DF79B474D657

Function 04036170 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 30COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 04036190
_strncpy.LIBCMT ref: 040361AE
CreateFontIndirectA.GDI32 ref: 040361BF

Strings

Tahoma, xrefs: 0403619B

Memory Dump Source

Source File: 00000014.00000002.2502041842.0000000004031000.00000020.00000001.01000000.00000017.sdmp, Offset: 04030000, based on PE: true

Associated: 00000014.00000002.2501986218.0000000004030000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000014.00000002.2504208079.0000000004079000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000014.00000002.2504943590.0000000004086000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000014.00000002.2505148754.000000000408E000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000014.00000002.2505282171.0000000004090000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000014.00000002.2505501725.0000000004097000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_4030000_Picasa3.jbxd

Similarity

API ID: CreateFontIndirect_memset_strncpy
String ID: Tahoma
API String ID: 3960651802-3580928618
Opcode ID: 74a9e7e740f101b6643c00acc06f0a1382c55de6fd3782cbcf84be52acd06897
Instruction ID: e265704ee118eb668d9d5f287994dc9be5200d2e7e6f18e74bba777f64909cff
Opcode Fuzzy Hash: 74a9e7e740f101b6643c00acc06f0a1382c55de6fd3782cbcf84be52acd06897
Instruction Fuzzy Hash: 1EF03670919340AEE744EF64C986B5ABBF4AB98708F805C5CF096A6181E7BCA50CCB53

Function 047E6510 Relevance: 6.1, APIs: 4, Instructions: 133COMMON

Download Yara Rule

APIs

InterlockedDecrement.KERNEL32(?), ref: 047E6559
InterlockedIncrement.KERNEL32(?), ref: 047E6575
InterlockedDecrement.KERNEL32(?), ref: 047E65AF
InterlockedIncrement.KERNEL32(?), ref: 047E65CB

Memory Dump Source

Source File: 00000014.00000002.2526268174.00000000047E1000.00000020.00000001.01000000.00000016.sdmp, Offset: 047E0000, based on PE: true

Associated: 00000014.00000002.2526187657.00000000047E0000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000014.00000002.2533437740.000000000488F000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000014.00000002.2535246598.00000000048AB000.00000004.00000001.01000000.00000016.sdmpDownload File
Associated: 00000014.00000002.2535569716.00000000048B3000.00000008.00000001.01000000.00000016.sdmpDownload File
Associated: 00000014.00000002.2535640427.00000000048B5000.00000004.00000001.01000000.00000016.sdmpDownload File
Associated: 00000014.00000002.2536317728.00000000048C0000.00000002.00000001.01000000.00000016.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_47e0000_Picasa3.jbxd

Similarity

API ID: Interlocked$DecrementIncrement
String ID:
API String ID: 2172605799-0
Opcode ID: 882a0b0938eaf3496e806aec57203f9187a08e3346a1c4015d335b248b98a138
Instruction ID: cab4e556292e305e7d6fa214ff5d01c21530bf2e02ad3d6d1891d71ffaf86bbb
Opcode Fuzzy Hash: 882a0b0938eaf3496e806aec57203f9187a08e3346a1c4015d335b248b98a138
Instruction Fuzzy Hash: E241ADB5A007558FC720CF1AD48093AF7A1FB68304F948E6DE4959B701CB35F845CB96

Function 04035FE0 Relevance: 6.1, APIs: 4, Instructions: 112threadCOMMON

Download Yara Rule

APIs

GetCurrentThread.KERNEL32 ref: 04036000
GetCurrentThreadId.KERNEL32 ref: 04036008
SetErrorMode.KERNEL32(00008001), ref: 040360ED
InitCommonControlsEx.COMCTL32(?,?,?,?,?,?,?,?,?,?,?,04033657), ref: 0403610E

Memory Dump Source

Source File: 00000014.00000002.2502041842.0000000004031000.00000020.00000001.01000000.00000017.sdmp, Offset: 04030000, based on PE: true

Associated: 00000014.00000002.2501986218.0000000004030000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000014.00000002.2504208079.0000000004079000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000014.00000002.2504943590.0000000004086000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000014.00000002.2505148754.000000000408E000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000014.00000002.2505282171.0000000004090000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000014.00000002.2505501725.0000000004097000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_4030000_Picasa3.jbxd

Similarity

API ID: CurrentThread$CommonControlsErrorInitMode
String ID:
API String ID: 1145268306-0
Opcode ID: c7eff33fbaaf50c0f6abab509a6b1015d9e316c38fa932c3782790f918f7a89a
Instruction ID: a0667ec6198e6221b1134e3e55d4284fdd29995d2188b185c50484ffb3a0b10e
Opcode Fuzzy Hash: c7eff33fbaaf50c0f6abab509a6b1015d9e316c38fa932c3782790f918f7a89a
Instruction Fuzzy Hash: B941CFB1901344ABE720EF6498842DABFE8FF8430EF04493DE94972240DB7DB908CB52

Function 033E907D Relevance: 6.1, APIs: 4, Instructions: 101COMMONLIBRARYCODE

Download Yara Rule

APIs

_LocaleUpdate::_LocaleUpdate.LIBCMT ref: 033E90AD
__isleadbyte_l.LIBCMT ref: 033E90E1
MultiByteToWideChar.KERNEL32(840FFFF8,00000009,?,A045FF98,?,00000000,?,?,?,033E53EC,?,?,00000002), ref: 033E9112
MultiByteToWideChar.KERNEL32(840FFFF8,00000009,?,00000001,?,00000000,?,?,?,033E53EC,?,?,00000002), ref: 033E9180

Memory Dump Source

Source File: 00000014.00000002.2494020967.00000000033B1000.00000020.00000001.01000000.00000015.sdmp, Offset: 033B0000, based on PE: true

Associated: 00000014.00000002.2493917908.00000000033B0000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000014.00000002.2497615129.00000000033F3000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000014.00000002.2498110795.0000000003400000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000014.00000002.2498410969.0000000003406000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000014.00000002.2498556459.0000000003408000.00000008.00000001.01000000.00000015.sdmpDownload File
Associated: 00000014.00000002.2498718201.000000000340A000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000014.00000002.2499166516.0000000003411000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_33b0000_Picasa3.jbxd

Similarity

API ID: ByteCharLocaleMultiWide$UpdateUpdate::___isleadbyte_l
String ID:
API String ID: 3058430110-0
Opcode ID: 826d1bf4aa7680024acd929438306b710da388f03410eb9bed75bfda77c7a050
Instruction ID: 0967336f08be96a52c788b1dce25d593865a7f54bd202e745b1beb1b3f0991a1
Opcode Fuzzy Hash: 826d1bf4aa7680024acd929438306b710da388f03410eb9bed75bfda77c7a050
Instruction Fuzzy Hash: 2131B235A00266EFDB10DF64CCC4BAEBBA9FF01212F4985A9E4618B1D1D379D980CB51

Function 0406F242 Relevance: 6.1, APIs: 4, Instructions: 101COMMONLIBRARYCODE

Download Yara Rule

APIs

_LocaleUpdate::_LocaleUpdate.LIBCMT ref: 0406F272
__isleadbyte_l.LIBCMT ref: 0406F2A6
MultiByteToWideChar.KERNEL32(840FFFF8,00000009,?,A045FF98,?,00000000,?,?,?,0406938C,?,?,00000002), ref: 0406F2D7
MultiByteToWideChar.KERNEL32(840FFFF8,00000009,?,00000001,?,00000000,?,?,?,0406938C,?,?,00000002), ref: 0406F345

Memory Dump Source

Source File: 00000014.00000002.2502041842.0000000004031000.00000020.00000001.01000000.00000017.sdmp, Offset: 04030000, based on PE: true

Associated: 00000014.00000002.2501986218.0000000004030000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000014.00000002.2504208079.0000000004079000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000014.00000002.2504943590.0000000004086000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000014.00000002.2505148754.000000000408E000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000014.00000002.2505282171.0000000004090000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000014.00000002.2505501725.0000000004097000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_4030000_Picasa3.jbxd

Similarity

API ID: ByteCharLocaleMultiWide$UpdateUpdate::___isleadbyte_l
String ID:
API String ID: 3058430110-0
Opcode ID: 66c4d0d92ff03b01cf75a8d6f815c0e3df44341f0cde3626040f00249a7108d6
Instruction ID: a4ddc67235946e1bc28c70a11de06b21128653cc01c7b87cfbb9bea0b0928348
Opcode Fuzzy Hash: 66c4d0d92ff03b01cf75a8d6f815c0e3df44341f0cde3626040f00249a7108d6
Instruction Fuzzy Hash: AE31B035A04257EFDB20DFA4E8809AD3BE5FF02311F1585A9E463AB194E730A940DF51

Function 047F5400 Relevance: 6.1, APIs: 4, Instructions: 91COMMON

Download Yara Rule

APIs

InterlockedIncrement.KERNEL32(?), ref: 047F5439
InterlockedIncrement.KERNEL32(?), ref: 047F5473
InterlockedIncrement.KERNEL32(?), ref: 047F54AD
InterlockedIncrement.KERNEL32(?), ref: 047F54E6

Part of subcall function 047E3430: InterlockedDecrement.KERNEL32(00000000), ref: 047E3442
Part of subcall function 047E3430: InterlockedIncrement.KERNEL32(00000000), ref: 047E345E

Memory Dump Source

Source File: 00000014.00000002.2526268174.00000000047E1000.00000020.00000001.01000000.00000016.sdmp, Offset: 047E0000, based on PE: true

Associated: 00000014.00000002.2526187657.00000000047E0000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000014.00000002.2533437740.000000000488F000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000014.00000002.2535246598.00000000048AB000.00000004.00000001.01000000.00000016.sdmpDownload File
Associated: 00000014.00000002.2535569716.00000000048B3000.00000008.00000001.01000000.00000016.sdmpDownload File
Associated: 00000014.00000002.2535640427.00000000048B5000.00000004.00000001.01000000.00000016.sdmpDownload File
Associated: 00000014.00000002.2536317728.00000000048C0000.00000002.00000001.01000000.00000016.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_47e0000_Picasa3.jbxd

Similarity

API ID: Interlocked$Increment$Decrement
String ID:
API String ID: 4289621856-0
Opcode ID: 1703106292886d16a5be6d5cd43d2295c285ff5f9944615a6e6213d677316061
Instruction ID: 164570cdefd53bbd6f65edb858b95b95de0cb1919a289614c6bad899eec1f8a8
Opcode Fuzzy Hash: 1703106292886d16a5be6d5cd43d2295c285ff5f9944615a6e6213d677316061
Instruction Fuzzy Hash: 133191712006625FDB219F68C8C0A3A73A5BF41305F548D64DA95CBB47C738F8419BE1

Function 033B2280 Relevance: 6.1, APIs: 4, Instructions: 87stringCOMMON

Download Yara Rule

APIs

lstrlenA.KERNEL32 ref: 033B22A8

Part of subcall function 033DC7D7: _malloc.LIBCMT ref: 033DC7EF

lstrlenW.KERNEL32(?,?), ref: 033B22C3
_memcpy_s.LIBCMT ref: 033B22FE
_memcpy_s.LIBCMT ref: 033B2311

Memory Dump Source

Source File: 00000014.00000002.2494020967.00000000033B1000.00000020.00000001.01000000.00000015.sdmp, Offset: 033B0000, based on PE: true

Associated: 00000014.00000002.2493917908.00000000033B0000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000014.00000002.2497615129.00000000033F3000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000014.00000002.2498110795.0000000003400000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000014.00000002.2498410969.0000000003406000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000014.00000002.2498556459.0000000003408000.00000008.00000001.01000000.00000015.sdmpDownload File
Associated: 00000014.00000002.2498718201.000000000340A000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000014.00000002.2499166516.0000000003411000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_33b0000_Picasa3.jbxd

Similarity

API ID: _memcpy_slstrlen$_malloc
String ID:
API String ID: 2422982918-0
Opcode ID: 9859cd1a4291de1c46cc0e4122f329bf29f097ea6d3aebb8772ed8608d5ec65a
Instruction ID: 4dd3de75521ee18b8eff2da2194a53d8889b61e387421abb109cf7a3cf8bab33
Opcode Fuzzy Hash: 9859cd1a4291de1c46cc0e4122f329bf29f097ea6d3aebb8772ed8608d5ec65a
Instruction Fuzzy Hash: FE215376A043056FD350EBB5ACC5E6BB6ECEF84254F05492DFA09D6100E739D60986B2

Function 047ED410 Relevance: 6.1, APIs: 4, Instructions: 87stringCOMMON

Download Yara Rule

APIs

lstrlenA.KERNEL32 ref: 047ED438
lstrlenW.KERNEL32(?,?), ref: 047ED453
_memcpy_s.LIBCMT ref: 047ED48E
_memcpy_s.LIBCMT ref: 047ED4A1

Memory Dump Source

Source File: 00000014.00000002.2526268174.00000000047E1000.00000020.00000001.01000000.00000016.sdmp, Offset: 047E0000, based on PE: true

Associated: 00000014.00000002.2526187657.00000000047E0000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000014.00000002.2533437740.000000000488F000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000014.00000002.2535246598.00000000048AB000.00000004.00000001.01000000.00000016.sdmpDownload File
Associated: 00000014.00000002.2535569716.00000000048B3000.00000008.00000001.01000000.00000016.sdmpDownload File
Associated: 00000014.00000002.2535640427.00000000048B5000.00000004.00000001.01000000.00000016.sdmpDownload File
Associated: 00000014.00000002.2536317728.00000000048C0000.00000002.00000001.01000000.00000016.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_47e0000_Picasa3.jbxd

Similarity

API ID: _memcpy_slstrlen
String ID:
API String ID: 2392212498-0
Opcode ID: ec9508213496ee1bbd6eeed783d4a52540b4810929d98190b311601f2a2c68a1
Instruction ID: 22d9b7f8ff90b6d432f3db03c840cbe6ed53b3036afa64a66bf6fd971105d538
Opcode Fuzzy Hash: ec9508213496ee1bbd6eeed783d4a52540b4810929d98190b311601f2a2c68a1
Instruction Fuzzy Hash: 332198B29043026FE710DF7A9C4997B77DCDF99254F04492DFD09D2200E679F50986A3

Function 0403D230 Relevance: 6.1, APIs: 4, Instructions: 85COMMON

Download Yara Rule

APIs

InterlockedDecrement.KERNEL32(?), ref: 0403D279
InterlockedIncrement.KERNEL32(?), ref: 0403D291
InterlockedDecrement.KERNEL32(?), ref: 0403D2CE
InterlockedIncrement.KERNEL32(?), ref: 0403D2E6

Memory Dump Source

Source File: 00000014.00000002.2502041842.0000000004031000.00000020.00000001.01000000.00000017.sdmp, Offset: 04030000, based on PE: true

Associated: 00000014.00000002.2501986218.0000000004030000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000014.00000002.2504208079.0000000004079000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000014.00000002.2504943590.0000000004086000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000014.00000002.2505148754.000000000408E000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000014.00000002.2505282171.0000000004090000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000014.00000002.2505501725.0000000004097000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_4030000_Picasa3.jbxd

Similarity

API ID: Interlocked$DecrementIncrement
String ID:
API String ID: 2172605799-0
Opcode ID: a0217b0de54a8b38f38da0ed43702747e69653cc420c85b7aa513d3ff922ac4f
Instruction ID: 6ebe6958526b66e4503cab96aeac66964880c0a9ee3fead69e70a84c00882f27
Opcode Fuzzy Hash: a0217b0de54a8b38f38da0ed43702747e69653cc420c85b7aa513d3ff922ac4f
Instruction Fuzzy Hash: A721D1B29002525BF720DE14DC9077ABFA9EF51306F244834E881B7240E72CFA05A7A2

Function 033BA210 Relevance: 6.1, APIs: 4, Instructions: 79threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 033BA22C
EnterCriticalSection.KERNEL32(?), ref: 033BA24B
GetCurrentThreadId.KERNEL32 ref: 033BA296
LeaveCriticalSection.KERNEL32(?), ref: 033BA2BE

Memory Dump Source

Source File: 00000014.00000002.2494020967.00000000033B1000.00000020.00000001.01000000.00000015.sdmp, Offset: 033B0000, based on PE: true

Associated: 00000014.00000002.2493917908.00000000033B0000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000014.00000002.2497615129.00000000033F3000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000014.00000002.2498110795.0000000003400000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000014.00000002.2498410969.0000000003406000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000014.00000002.2498556459.0000000003408000.00000008.00000001.01000000.00000015.sdmpDownload File
Associated: 00000014.00000002.2498718201.000000000340A000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000014.00000002.2499166516.0000000003411000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_33b0000_Picasa3.jbxd

Similarity

API ID: CriticalCurrentSectionThread$EnterLeave
String ID:
API String ID: 637047042-0
Opcode ID: ea6e954996899edb0ed5190e1c8f92d18043f98b88e8370d6eb06ebfc2680301
Instruction ID: 0b01c9c086e24599ba9d85b63cd160cbab1a65f8f5d1352dae537a74871dcfc3
Opcode Fuzzy Hash: ea6e954996899edb0ed5190e1c8f92d18043f98b88e8370d6eb06ebfc2680301
Instruction Fuzzy Hash: 3E219C36A00B008BD724DB5DD884B9AF3F8FB89321F14431AD2DA8BA80C736E951CB50

Function 04035AC0 Relevance: 6.1, APIs: 4, Instructions: 79threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 04035ADC
EnterCriticalSection.KERNEL32(?), ref: 04035AFB
GetCurrentThreadId.KERNEL32 ref: 04035B46
LeaveCriticalSection.KERNEL32(?), ref: 04035B6E

Memory Dump Source

Source File: 00000014.00000002.2502041842.0000000004031000.00000020.00000001.01000000.00000017.sdmp, Offset: 04030000, based on PE: true

Associated: 00000014.00000002.2501986218.0000000004030000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000014.00000002.2504208079.0000000004079000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000014.00000002.2504943590.0000000004086000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000014.00000002.2505148754.000000000408E000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000014.00000002.2505282171.0000000004090000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000014.00000002.2505501725.0000000004097000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_4030000_Picasa3.jbxd

Similarity

API ID: CriticalCurrentSectionThread$EnterLeave
String ID:
API String ID: 637047042-0
Opcode ID: 8ff643d2d6b8a26bed8747b4b9ca120b20ab9fa53490f3631491bd0c1d12c634
Instruction ID: bc3cd63d19186460fe0210e4c0e91f6bd7dff6491b951b002e1e4f134e976bbb
Opcode Fuzzy Hash: 8ff643d2d6b8a26bed8747b4b9ca120b20ab9fa53490f3631491bd0c1d12c634
Instruction Fuzzy Hash: A421E272A00704DFD764CF59D884B5ABBE8FB89322F10476ED19AA36A0D735F941CB50

Function 033BD8F0 Relevance: 6.1, APIs: 4, Instructions: 75COMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,000000FF,00000000,00000000), ref: 033BD91E
MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,000000FF,00000000,00000000), ref: 033BD93C
MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,000000FF,?,00000000), ref: 033BD959
ExtTextOutW.GDI32(00000000,?,?,?,?,00000000,00000000,?), ref: 033BD98A

Memory Dump Source

Source File: 00000014.00000002.2494020967.00000000033B1000.00000020.00000001.01000000.00000015.sdmp, Offset: 033B0000, based on PE: true

Associated: 00000014.00000002.2493917908.00000000033B0000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000014.00000002.2497615129.00000000033F3000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000014.00000002.2498110795.0000000003400000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000014.00000002.2498410969.0000000003406000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000014.00000002.2498556459.0000000003408000.00000008.00000001.01000000.00000015.sdmpDownload File
Associated: 00000014.00000002.2498718201.000000000340A000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000014.00000002.2499166516.0000000003411000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_33b0000_Picasa3.jbxd

Similarity

API ID: ByteCharMultiWide$Text
String ID:
API String ID: 2580846266-0
Opcode ID: 0454c80aaf5d837f1be060692abf6c9b29042da2a1b9fc157a324671a59ae7e9
Instruction ID: 5cdccb770bd65c5ec5a0ed3c1bc20c6f02c99d5e24664e6483098e7d28ccb354
Opcode Fuzzy Hash: 0454c80aaf5d837f1be060692abf6c9b29042da2a1b9fc157a324671a59ae7e9
Instruction Fuzzy Hash: 41218775A00215BBD720DEA9DC85FAB77B8EF85B20F204325BA25AB6C4D570AC00C7A5

Function 0403A8B0 Relevance: 6.1, APIs: 4, Instructions: 75COMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,000000FF,00000000,00000000), ref: 0403A8DE
MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,000000FF,00000000,00000000), ref: 0403A8FC
MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,000000FF,?,00000000), ref: 0403A919
ExtTextOutW.GDI32(00000000,?,?,?,?,00000000,00000000,?), ref: 0403A94A

Memory Dump Source

Source File: 00000014.00000002.2502041842.0000000004031000.00000020.00000001.01000000.00000017.sdmp, Offset: 04030000, based on PE: true

Associated: 00000014.00000002.2501986218.0000000004030000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000014.00000002.2504208079.0000000004079000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000014.00000002.2504943590.0000000004086000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000014.00000002.2505148754.000000000408E000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000014.00000002.2505282171.0000000004090000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000014.00000002.2505501725.0000000004097000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_4030000_Picasa3.jbxd

Similarity

API ID: ByteCharMultiWide$Text
String ID:
API String ID: 2580846266-0
Opcode ID: 0198f82765949181c53a73bf0b676b2b178618bf1dffe4e301e2c3d0d8b4a3f0
Instruction ID: cadaa249b09d7188a06ac8e6e64e72ba808f810e4843ab515bb534c9b44d6a69
Opcode Fuzzy Hash: 0198f82765949181c53a73bf0b676b2b178618bf1dffe4e301e2c3d0d8b4a3f0
Instruction Fuzzy Hash: 2121A875B00219BBEB20DE99DC45FAB7BACDF85724F214325B915BB2C0C574BC0087A5

Function 033BC820 Relevance: 6.1, APIs: 4, Instructions: 70fileCOMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,000000FF,00000000,00000000), ref: 033BC852
MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,000000FF,00000000,00000000), ref: 033BC870
MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,000000FF,?,00000000), ref: 033BC88D
CreateFileW.KERNEL32(00000000,?,?,?,?,?,?), ref: 033BC8AB

Memory Dump Source

Source File: 00000014.00000002.2494020967.00000000033B1000.00000020.00000001.01000000.00000015.sdmp, Offset: 033B0000, based on PE: true

Associated: 00000014.00000002.2493917908.00000000033B0000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000014.00000002.2497615129.00000000033F3000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000014.00000002.2498110795.0000000003400000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000014.00000002.2498410969.0000000003406000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000014.00000002.2498556459.0000000003408000.00000008.00000001.01000000.00000015.sdmpDownload File
Associated: 00000014.00000002.2498718201.000000000340A000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000014.00000002.2499166516.0000000003411000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_33b0000_Picasa3.jbxd

Similarity

API ID: ByteCharMultiWide$CreateFile
String ID:
API String ID: 472006099-0
Opcode ID: e1b9bf42d8d79bdc4046e3e56e0546af2ce4a2e50189905d433969671f94c2f0
Instruction ID: daff9075ab22045de9b67afab57a44d0b4aae320923b5af14db87d7c99a82358
Opcode Fuzzy Hash: e1b9bf42d8d79bdc4046e3e56e0546af2ce4a2e50189905d433969671f94c2f0
Instruction Fuzzy Hash: 92116635700219BBD720DE65DC81FAB776DEF49B61F204325B615AF6C4D670EC0087A5

Function 040626F9 Relevance: 6.1, APIs: 4, Instructions: 70threadCOMMON

Download Yara Rule

APIs

__calloc_crt.LIBCMT ref: 04062734
CreateThread.KERNEL32(00000000,00000000,04062679,00000000,00000000,0403DAAD), ref: 04062778
GetLastError.KERNEL32(?,75722E40,0403DAAD,00000000,00000000,Function_0000D560,00000000,00000000,0000001C), ref: 04062782
__dosmaperr.LIBCMT ref: 0406279A

Memory Dump Source

Source File: 00000014.00000002.2502041842.0000000004031000.00000020.00000001.01000000.00000017.sdmp, Offset: 04030000, based on PE: true

Associated: 00000014.00000002.2501986218.0000000004030000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000014.00000002.2504208079.0000000004079000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000014.00000002.2504943590.0000000004086000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000014.00000002.2505148754.000000000408E000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000014.00000002.2505282171.0000000004090000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000014.00000002.2505501725.0000000004097000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_4030000_Picasa3.jbxd

Similarity

API ID: CreateErrorLastThread__calloc_crt__dosmaperr
String ID:
API String ID: 84609068-0
Opcode ID: 6cd349a91991092d7f2698af352b6f6ba4b756455de5bc6778457ee6e91f1914
Instruction ID: 62434e3cd73361bd3ba69fcfeda390a30da8e7d34cfe8206dae640e255633875
Opcode Fuzzy Hash: 6cd349a91991092d7f2698af352b6f6ba4b756455de5bc6778457ee6e91f1914
Instruction Fuzzy Hash: D1118F72505209AFEB11BFA4DC81CDE7BE9EF0436CB20457DF903B6190EB71B9019AA5

Function 040397E0 Relevance: 6.1, APIs: 4, Instructions: 70fileCOMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,000000FF,00000000,00000000), ref: 04039812
MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,000000FF,00000000,00000000), ref: 04039830
MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,000000FF,?,00000000), ref: 0403984D
CreateFileW.KERNEL32(00000000,?,?,?,?,?,?), ref: 0403986B

Memory Dump Source

Source File: 00000014.00000002.2502041842.0000000004031000.00000020.00000001.01000000.00000017.sdmp, Offset: 04030000, based on PE: true

Associated: 00000014.00000002.2501986218.0000000004030000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000014.00000002.2504208079.0000000004079000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000014.00000002.2504943590.0000000004086000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000014.00000002.2505148754.000000000408E000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000014.00000002.2505282171.0000000004090000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000014.00000002.2505501725.0000000004097000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_4030000_Picasa3.jbxd

Similarity

API ID: ByteCharMultiWide$CreateFile
String ID:
API String ID: 472006099-0
Opcode ID: 67d717fe69006ed562395fd7f9f8df7db1bb0d413156a069012a08bdb63c6625
Instruction ID: af2d4ea661e6f9083c2b20dcad7b3010e52865029fcae55907749fd080d3dad8
Opcode Fuzzy Hash: 67d717fe69006ed562395fd7f9f8df7db1bb0d413156a069012a08bdb63c6625
Instruction Fuzzy Hash: 18119671704219BBEB20DF69DC41FAB7B68EF89724F204229B915BB2C0D974BC0087A5

Function 033BD510 Relevance: 6.1, APIs: 4, Instructions: 69COMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,000000FF,00000000,00000000), ref: 033BD541
MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,000000FF,00000000,00000000), ref: 033BD562
MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,000000FF,00000000,00000000), ref: 033BD598
PropertySheetW.COMCTL32(00000000), ref: 033BD5A4

Memory Dump Source

Source File: 00000014.00000002.2494020967.00000000033B1000.00000020.00000001.01000000.00000015.sdmp, Offset: 033B0000, based on PE: true

Associated: 00000014.00000002.2493917908.00000000033B0000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000014.00000002.2497615129.00000000033F3000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000014.00000002.2498110795.0000000003400000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000014.00000002.2498410969.0000000003406000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000014.00000002.2498556459.0000000003408000.00000008.00000001.01000000.00000015.sdmpDownload File
Associated: 00000014.00000002.2498718201.000000000340A000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000014.00000002.2499166516.0000000003411000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_33b0000_Picasa3.jbxd

Similarity

API ID: ByteCharMultiWide$PropertySheet
String ID:
API String ID: 3439472413-0
Opcode ID: 746ad1de9fbe5802f7ba9d868ea7c37cac55360989976d67990c442e446cd05e
Instruction ID: c04d457cbaa84ae17463e978ffb6fafee6ac994a350aabd07e5051f31c9cf7b0
Opcode Fuzzy Hash: 746ad1de9fbe5802f7ba9d868ea7c37cac55360989976d67990c442e446cd05e
Instruction Fuzzy Hash: 5E118935600205BBD720DE59DCC1FAABBB8EF44724F640226BA15AF6C4D770F900C7A5

Function 033BD5C0 Relevance: 6.1, APIs: 4, Instructions: 69COMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,000000FF,00000000,00000000), ref: 033BD5F1
MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,000000FF,00000000,00000000), ref: 033BD612
MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,000000FF,00000000,00000000), ref: 033BD648
CreatePropertySheetPageW.COMCTL32(00000000), ref: 033BD654

Memory Dump Source

Source File: 00000014.00000002.2494020967.00000000033B1000.00000020.00000001.01000000.00000015.sdmp, Offset: 033B0000, based on PE: true

Associated: 00000014.00000002.2493917908.00000000033B0000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000014.00000002.2497615129.00000000033F3000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000014.00000002.2498110795.0000000003400000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000014.00000002.2498410969.0000000003406000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000014.00000002.2498556459.0000000003408000.00000008.00000001.01000000.00000015.sdmpDownload File
Associated: 00000014.00000002.2498718201.000000000340A000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000014.00000002.2499166516.0000000003411000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_33b0000_Picasa3.jbxd

Similarity

API ID: ByteCharMultiWide$CreatePagePropertySheet
String ID:
API String ID: 3622974404-0
Opcode ID: 3524c2ff60d791957fa01b6d1780c62c92808c71dd4385583808ceffa4c92f3b
Instruction ID: 74a78410289fe291ed48a1ab39a9500133de4152982c9c8041176fec2aec2c4b
Opcode Fuzzy Hash: 3524c2ff60d791957fa01b6d1780c62c92808c71dd4385583808ceffa4c92f3b
Instruction Fuzzy Hash: 70116635700205BBD720EE59DCC1FAAB7B8EF44720F640225BA19EF6C4D670F90087A5

Function 033BD840 Relevance: 6.1, APIs: 4, Instructions: 69COMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,000000FF,00000000,00000000), ref: 033BD86E
MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,000000FF,00000000,00000000), ref: 033BD88C
MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,000000FF,?,00000000), ref: 033BD8A9
TextOutW.GDI32(00000000,?,?,00000000,00000000), ref: 033BD8CE

Memory Dump Source

Source File: 00000014.00000002.2494020967.00000000033B1000.00000020.00000001.01000000.00000015.sdmp, Offset: 033B0000, based on PE: true

Associated: 00000014.00000002.2493917908.00000000033B0000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000014.00000002.2497615129.00000000033F3000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000014.00000002.2498110795.0000000003400000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000014.00000002.2498410969.0000000003406000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000014.00000002.2498556459.0000000003408000.00000008.00000001.01000000.00000015.sdmpDownload File
Associated: 00000014.00000002.2498718201.000000000340A000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000014.00000002.2499166516.0000000003411000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_33b0000_Picasa3.jbxd

Similarity

API ID: ByteCharMultiWide$Text
String ID:
API String ID: 2580846266-0
Opcode ID: 41d2f01fdfe1146311e2a5366335d27b1a3339173dbf1584706043aa0c3c1ea3
Instruction ID: fa690c9ce10785857f0aacb149a7bcdb7b1f9e723e7b69822ee1e6a46d8324a3
Opcode Fuzzy Hash: 41d2f01fdfe1146311e2a5366335d27b1a3339173dbf1584706043aa0c3c1ea3
Instruction Fuzzy Hash: E0119875A01215BBE730DE69DC85FAB7B7CDB45B31F200325BA25AF6D4C670AC0086A5

Function 033BDE60 Relevance: 6.1, APIs: 4, Instructions: 69windowCOMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,000000FF,00000000,00000000), ref: 033BDEA3
MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,000000FF,00000000,00000000), ref: 033BDEC1
MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,000000FF,?,00000000), ref: 033BDEDB
InsertMenuItemW.USER32(?,?,?,?), ref: 033BDEF4

Memory Dump Source

Source File: 00000014.00000002.2494020967.00000000033B1000.00000020.00000001.01000000.00000015.sdmp, Offset: 033B0000, based on PE: true

Associated: 00000014.00000002.2493917908.00000000033B0000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000014.00000002.2497615129.00000000033F3000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000014.00000002.2498110795.0000000003400000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000014.00000002.2498410969.0000000003406000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000014.00000002.2498556459.0000000003408000.00000008.00000001.01000000.00000015.sdmpDownload File
Associated: 00000014.00000002.2498718201.000000000340A000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000014.00000002.2499166516.0000000003411000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_33b0000_Picasa3.jbxd

Similarity

API ID: ByteCharMultiWide$InsertItemMenu
String ID:
API String ID: 2807284364-0
Opcode ID: c349357a436ace4643577d190a14db1f44962997b440851b66ae172ce6a64ac9
Instruction ID: 7ed70221b91d6750e1bfeae4faad92ebee5a1d01b9e25b054337a6f8ceb4d5fd
Opcode Fuzzy Hash: c349357a436ace4643577d190a14db1f44962997b440851b66ae172ce6a64ac9
Instruction Fuzzy Hash: 8A11963570121ABBDB20EF55DC85FAB77ADEF45760F244226BA15AF2D0C670AC00C7A0

Function 033BDCA0 Relevance: 6.1, APIs: 4, Instructions: 69windowCOMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,000000FF,00000000,00000000), ref: 033BDCE3
MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,000000FF,00000000,00000000), ref: 033BDD01
MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,000000FF,?,00000000), ref: 033BDD1B
SetMenuItemInfoW.USER32(?,?,?,?), ref: 033BDD34

Memory Dump Source

Source File: 00000014.00000002.2494020967.00000000033B1000.00000020.00000001.01000000.00000015.sdmp, Offset: 033B0000, based on PE: true

Associated: 00000014.00000002.2493917908.00000000033B0000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000014.00000002.2497615129.00000000033F3000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000014.00000002.2498110795.0000000003400000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000014.00000002.2498410969.0000000003406000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000014.00000002.2498556459.0000000003408000.00000008.00000001.01000000.00000015.sdmpDownload File
Associated: 00000014.00000002.2498718201.000000000340A000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000014.00000002.2499166516.0000000003411000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_33b0000_Picasa3.jbxd

Similarity

API ID: ByteCharMultiWide$InfoItemMenu
String ID:
API String ID: 3066823075-0
Opcode ID: f5604a6c58c21b8e8a5de5da08436787d73c4222d09b12f49ed2c25ac411c9a0
Instruction ID: 71bf3a290934e939e3c09428a65a4371336067844f833ec51951abbc4f0c1762
Opcode Fuzzy Hash: f5604a6c58c21b8e8a5de5da08436787d73c4222d09b12f49ed2c25ac411c9a0
Instruction Fuzzy Hash: 4111DA35B01219BBDB20EE55DC85FAB77B9EF45760F250225FA15AF2C0C670AC00C790

Function 0403A4D0 Relevance: 6.1, APIs: 4, Instructions: 69COMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,000000FF,00000000,00000000), ref: 0403A501
MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,000000FF,00000000,00000000), ref: 0403A522
MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,000000FF,00000000,00000000), ref: 0403A558
PropertySheetW.COMCTL32(00000000), ref: 0403A564

Memory Dump Source

Source File: 00000014.00000002.2502041842.0000000004031000.00000020.00000001.01000000.00000017.sdmp, Offset: 04030000, based on PE: true

Associated: 00000014.00000002.2501986218.0000000004030000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000014.00000002.2504208079.0000000004079000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000014.00000002.2504943590.0000000004086000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000014.00000002.2505148754.000000000408E000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000014.00000002.2505282171.0000000004090000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000014.00000002.2505501725.0000000004097000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_4030000_Picasa3.jbxd

Similarity

API ID: ByteCharMultiWide$PropertySheet
String ID:
API String ID: 3439472413-0
Opcode ID: e14dec619962a7ec43f8d0fc1d3ff7c5a7ab7bca6c437227e8fadd81f76ea0ed
Instruction ID: d8cde866c80ed079e224e6a412bef18cdfd388b213fe65f91d3f248121f39f84
Opcode Fuzzy Hash: e14dec619962a7ec43f8d0fc1d3ff7c5a7ab7bca6c437227e8fadd81f76ea0ed
Instruction Fuzzy Hash: E5119635740205BBE720EE59DC41F7ABBB8EF44721F200225BA15BB2C0D670F9008BA6

Function 0403A580 Relevance: 6.1, APIs: 4, Instructions: 69COMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,000000FF,00000000,00000000), ref: 0403A5B1
MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,000000FF,00000000,00000000), ref: 0403A5D2
MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,000000FF,00000000,00000000), ref: 0403A608
CreatePropertySheetPageW.COMCTL32(00000000), ref: 0403A614

Memory Dump Source

Source File: 00000014.00000002.2502041842.0000000004031000.00000020.00000001.01000000.00000017.sdmp, Offset: 04030000, based on PE: true

Associated: 00000014.00000002.2501986218.0000000004030000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000014.00000002.2504208079.0000000004079000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000014.00000002.2504943590.0000000004086000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000014.00000002.2505148754.000000000408E000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000014.00000002.2505282171.0000000004090000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000014.00000002.2505501725.0000000004097000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_4030000_Picasa3.jbxd

Similarity

API ID: ByteCharMultiWide$CreatePagePropertySheet
String ID:
API String ID: 3622974404-0
Opcode ID: a2411c231c37bd0d007f148c79e36eee9bb0763cea9e0b662c3caee94a63b5c4
Instruction ID: 3d4c1839430c322acff077b66019427afaf8929d98747555cfb6d6b402ee04ca
Opcode Fuzzy Hash: a2411c231c37bd0d007f148c79e36eee9bb0763cea9e0b662c3caee94a63b5c4
Instruction Fuzzy Hash: A4119635744215BBE720EE59DC41F6ABBB8EF44721F200225BA15BB2C0DA70F9009BA5

Function 0403AC60 Relevance: 6.1, APIs: 4, Instructions: 69windowCOMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,000000FF,00000000,00000000), ref: 0403ACA3
MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,000000FF,00000000,00000000), ref: 0403ACC1
MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,000000FF,?,00000000), ref: 0403ACDB
SetMenuItemInfoW.USER32(?,?,?,?), ref: 0403ACF4

Memory Dump Source

Source File: 00000014.00000002.2502041842.0000000004031000.00000020.00000001.01000000.00000017.sdmp, Offset: 04030000, based on PE: true

Associated: 00000014.00000002.2501986218.0000000004030000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000014.00000002.2504208079.0000000004079000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000014.00000002.2504943590.0000000004086000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000014.00000002.2505148754.000000000408E000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000014.00000002.2505282171.0000000004090000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000014.00000002.2505501725.0000000004097000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_4030000_Picasa3.jbxd

Similarity

API ID: ByteCharMultiWide$InfoItemMenu
String ID:
API String ID: 3066823075-0
Opcode ID: 7cd092c48562cc19669794ab0665fb6715c88bcebc815917d61cd4912f8ce8bc
Instruction ID: c5952303ea63172dcc02f60b3ef1829ade56e047a1fb9cfea396f36a6f7a8420
Opcode Fuzzy Hash: 7cd092c48562cc19669794ab0665fb6715c88bcebc815917d61cd4912f8ce8bc
Instruction Fuzzy Hash: 6511B771B01219BBEB20DF55CD05FAB7BA8EF85724F214225B515BB2C0C674BC00CB91

Function 0403AE20 Relevance: 6.1, APIs: 4, Instructions: 69windowCOMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,000000FF,00000000,00000000), ref: 0403AE63
MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,000000FF,00000000,00000000), ref: 0403AE81
MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,000000FF,?,00000000), ref: 0403AE9B
InsertMenuItemW.USER32(?,?,?,?), ref: 0403AEB4

Memory Dump Source

Source File: 00000014.00000002.2502041842.0000000004031000.00000020.00000001.01000000.00000017.sdmp, Offset: 04030000, based on PE: true

Associated: 00000014.00000002.2501986218.0000000004030000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000014.00000002.2504208079.0000000004079000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000014.00000002.2504943590.0000000004086000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000014.00000002.2505148754.000000000408E000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000014.00000002.2505282171.0000000004090000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000014.00000002.2505501725.0000000004097000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_4030000_Picasa3.jbxd

Similarity

API ID: ByteCharMultiWide$InsertItemMenu
String ID:
API String ID: 2807284364-0
Opcode ID: e494b8d658c6141cbd185f488504ddf37bb159c2176895782e836e85bbc83749
Instruction ID: 7f576476ab01f2e14fd2541e460b22e8e7b728eb7242234f2d16c0467f1eda31
Opcode Fuzzy Hash: e494b8d658c6141cbd185f488504ddf37bb159c2176895782e836e85bbc83749
Instruction Fuzzy Hash: 5C11A271B01219BBEF20DE55CC05FAB7BA8EF85724F214225B515BB2C0C674BC008AA1

Function 0403A800 Relevance: 6.1, APIs: 4, Instructions: 69COMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,000000FF,00000000,00000000), ref: 0403A82E
MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,000000FF,00000000,00000000), ref: 0403A84C
MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,000000FF,?,00000000), ref: 0403A869
TextOutW.GDI32(00000000,?,?,00000000,00000000), ref: 0403A88E

Memory Dump Source

Source File: 00000014.00000002.2502041842.0000000004031000.00000020.00000001.01000000.00000017.sdmp, Offset: 04030000, based on PE: true

Associated: 00000014.00000002.2501986218.0000000004030000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000014.00000002.2504208079.0000000004079000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000014.00000002.2504943590.0000000004086000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000014.00000002.2505148754.000000000408E000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000014.00000002.2505282171.0000000004090000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000014.00000002.2505501725.0000000004097000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_4030000_Picasa3.jbxd

Similarity

API ID: ByteCharMultiWide$Text
String ID:
API String ID: 2580846266-0
Opcode ID: 1adba39f67e31cfa0323ad4dac357d87247c3e73fdeaab8a46f091ce8ac5d803
Instruction ID: 23b83cc5876b1fb132a7947743867b5dde121240f19525be7e1b53da017eec32
Opcode Fuzzy Hash: 1adba39f67e31cfa0323ad4dac357d87247c3e73fdeaab8a46f091ce8ac5d803
Instruction Fuzzy Hash: AF119335B00215BBEB209A698C45FAB7BA8DB45B24F200325BD15BB2C0C574BD008AA5

Function 048354A0 Relevance: 6.1, APIs: 4, Instructions: 69COMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,000000FF,00000000,00000000), ref: 048354D1
MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,000000FF,00000000,00000000), ref: 048354F2
MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,000000FF,00000000,00000000), ref: 04835528
PropertySheetW.COMCTL32(00000000), ref: 04835534

Memory Dump Source

Source File: 00000014.00000002.2526268174.00000000047E1000.00000020.00000001.01000000.00000016.sdmp, Offset: 047E0000, based on PE: true

Associated: 00000014.00000002.2526187657.00000000047E0000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000014.00000002.2533437740.000000000488F000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000014.00000002.2535246598.00000000048AB000.00000004.00000001.01000000.00000016.sdmpDownload File
Associated: 00000014.00000002.2535569716.00000000048B3000.00000008.00000001.01000000.00000016.sdmpDownload File
Associated: 00000014.00000002.2535640427.00000000048B5000.00000004.00000001.01000000.00000016.sdmpDownload File
Associated: 00000014.00000002.2536317728.00000000048C0000.00000002.00000001.01000000.00000016.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_47e0000_Picasa3.jbxd

Similarity

API ID: ByteCharMultiWide$PropertySheet
String ID:
API String ID: 3439472413-0
Opcode ID: 00135ad25298bf94dbaa2ad7505d167e489d31d61c924b9c6cbe77a3a6baf2c7
Instruction ID: 2df6ad35ae3e76c9d3bf8e992bb3ccb1f4a0208927e0c420b0bf1dc9a9543b90
Opcode Fuzzy Hash: 00135ad25298bf94dbaa2ad7505d167e489d31d61c924b9c6cbe77a3a6baf2c7
Instruction Fuzzy Hash: 6C118175640219BBE720DE59DC41F6ABBA9EF44B21F200B25AA15EB2C0DA70F900C7E1

Function 04835550 Relevance: 6.1, APIs: 4, Instructions: 69COMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,000000FF,00000000,00000000), ref: 04835581
MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,000000FF,00000000,00000000), ref: 048355A2
MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,000000FF,00000000,00000000), ref: 048355D8
CreatePropertySheetPageW.COMCTL32(00000000), ref: 048355E4

Memory Dump Source

Source File: 00000014.00000002.2526268174.00000000047E1000.00000020.00000001.01000000.00000016.sdmp, Offset: 047E0000, based on PE: true

Associated: 00000014.00000002.2526187657.00000000047E0000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000014.00000002.2533437740.000000000488F000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000014.00000002.2535246598.00000000048AB000.00000004.00000001.01000000.00000016.sdmpDownload File
Associated: 00000014.00000002.2535569716.00000000048B3000.00000008.00000001.01000000.00000016.sdmpDownload File
Associated: 00000014.00000002.2535640427.00000000048B5000.00000004.00000001.01000000.00000016.sdmpDownload File
Associated: 00000014.00000002.2536317728.00000000048C0000.00000002.00000001.01000000.00000016.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_47e0000_Picasa3.jbxd

Similarity

API ID: ByteCharMultiWide$CreatePagePropertySheet
String ID:
API String ID: 3622974404-0
Opcode ID: 65a400d1b7216610903eac1b92844fc37fa026da0881de74412e592cba7ca7fe
Instruction ID: 64a27ecab9a93c1813b912211f764686ce28b81c1d71d47ca3681197e92b1dbf
Opcode Fuzzy Hash: 65a400d1b7216610903eac1b92844fc37fa026da0881de74412e592cba7ca7fe
Instruction Fuzzy Hash: 51118135600209BBE720DE69DC45F6AB7A9EF44721F200B25BA14EB2C0DA70F90087A1

Function 033BB9B0 Relevance: 6.1, APIs: 4, Instructions: 67fileCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 033BB9E7
FindNextFileW.KERNEL32(?,?), ref: 033BB9F5
WideCharToMultiByte.KERNEL32(0000FDE9,00000000,?,000000FF,?,00000104,00000000,00000000), ref: 033BBA3D
WideCharToMultiByte.KERNEL32(0000FDE9,00000000,?,000000FF,?,0000000E,00000000,00000000), ref: 033BBA62

Memory Dump Source

Source File: 00000014.00000002.2494020967.00000000033B1000.00000020.00000001.01000000.00000015.sdmp, Offset: 033B0000, based on PE: true

Associated: 00000014.00000002.2493917908.00000000033B0000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000014.00000002.2497615129.00000000033F3000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000014.00000002.2498110795.0000000003400000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000014.00000002.2498410969.0000000003406000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000014.00000002.2498556459.0000000003408000.00000008.00000001.01000000.00000015.sdmpDownload File
Associated: 00000014.00000002.2498718201.000000000340A000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000014.00000002.2499166516.0000000003411000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_33b0000_Picasa3.jbxd

Similarity

API ID: ByteCharMultiWide$FileFindNext_memset
String ID:
API String ID: 3316633952-0
Opcode ID: 06f7e741dddf2c9b03e509937ae1776fbf67447d3e3deb7c3aff326052ad2c29
Instruction ID: 34a562d1c704f0365ca9ff03bf55ff8240831e1398b761bc374a71fa91f3b600
Opcode Fuzzy Hash: 06f7e741dddf2c9b03e509937ae1776fbf67447d3e3deb7c3aff326052ad2c29
Instruction Fuzzy Hash: 2821DA726443446FE320EF54DC85F97F7D8EB88720F144619BA589B1C0D7B0A504C796

Function 033BD9B0 Relevance: 6.1, APIs: 4, Instructions: 67COMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,000000FF,00000000,00000000), ref: 033BD9DE
MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,000000FF,00000000,00000000), ref: 033BD9FC
MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,000000FF,?,00000000), ref: 033BDA19
GetTextExtentPoint32W.GDI32(00000000,00000000,00000000,?), ref: 033BDA3A

Memory Dump Source

Source File: 00000014.00000002.2494020967.00000000033B1000.00000020.00000001.01000000.00000015.sdmp, Offset: 033B0000, based on PE: true

Associated: 00000014.00000002.2493917908.00000000033B0000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000014.00000002.2497615129.00000000033F3000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000014.00000002.2498110795.0000000003400000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000014.00000002.2498410969.0000000003406000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000014.00000002.2498556459.0000000003408000.00000008.00000001.01000000.00000015.sdmpDownload File
Associated: 00000014.00000002.2498718201.000000000340A000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000014.00000002.2499166516.0000000003411000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_33b0000_Picasa3.jbxd

Similarity

API ID: ByteCharMultiWide$ExtentPoint32Text
String ID:
API String ID: 391084943-0
Opcode ID: 395b837233e90b5faeda86bedd96a50ff4035eb442d063e2eb9ba5c5fac55c80
Instruction ID: 60fd9fffb8768a784651c072d7680102db450afe90cc6fd6cc88eefc074cb6b3
Opcode Fuzzy Hash: 395b837233e90b5faeda86bedd96a50ff4035eb442d063e2eb9ba5c5fac55c80
Instruction Fuzzy Hash: 9611AB75A04215BBD730DE69DC85FAB7B78DF45B30F304325BA15AF6C4C570AC0486A5

Function 04038970 Relevance: 6.1, APIs: 4, Instructions: 67fileCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 040389A7
FindNextFileW.KERNEL32(?,?), ref: 040389B5
WideCharToMultiByte.KERNEL32(0000FDE9,00000000,?,000000FF,?,00000104,00000000,00000000), ref: 040389FD
WideCharToMultiByte.KERNEL32(0000FDE9,00000000,?,000000FF,?,0000000E,00000000,00000000), ref: 04038A22

Memory Dump Source

Source File: 00000014.00000002.2502041842.0000000004031000.00000020.00000001.01000000.00000017.sdmp, Offset: 04030000, based on PE: true

Associated: 00000014.00000002.2501986218.0000000004030000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000014.00000002.2504208079.0000000004079000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000014.00000002.2504943590.0000000004086000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000014.00000002.2505148754.000000000408E000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000014.00000002.2505282171.0000000004090000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000014.00000002.2505501725.0000000004097000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_4030000_Picasa3.jbxd

Similarity

API ID: ByteCharMultiWide$FileFindNext_memset
String ID:
API String ID: 3316633952-0
Opcode ID: 384562e6b58285b2b9c306f7e1122b3564727345b6d084fe964ec967ce620ab9
Instruction ID: 5c27d929e58504c6eec3f8b6ed0affd15f8b8c0671424ce75b438ed6fd526e1b
Opcode Fuzzy Hash: 384562e6b58285b2b9c306f7e1122b3564727345b6d084fe964ec967ce620ab9
Instruction Fuzzy Hash: 3821E4726043406BF320EE58DC46FAAB7D8EB88720F104619BA58AB1C0D7B4B904CB96

Function 0403A970 Relevance: 6.1, APIs: 4, Instructions: 67COMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,000000FF,00000000,00000000), ref: 0403A99E
MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,000000FF,00000000,00000000), ref: 0403A9BC
MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,000000FF,?,00000000), ref: 0403A9D9
GetTextExtentPoint32W.GDI32(00000000,00000000,00000000,?), ref: 0403A9FA

Memory Dump Source

Source File: 00000014.00000002.2502041842.0000000004031000.00000020.00000001.01000000.00000017.sdmp, Offset: 04030000, based on PE: true

Associated: 00000014.00000002.2501986218.0000000004030000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000014.00000002.2504208079.0000000004079000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000014.00000002.2504943590.0000000004086000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000014.00000002.2505148754.000000000408E000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000014.00000002.2505282171.0000000004090000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000014.00000002.2505501725.0000000004097000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_4030000_Picasa3.jbxd

Similarity

API ID: ByteCharMultiWide$ExtentPoint32Text
String ID:
API String ID: 391084943-0
Opcode ID: 10c6481142cefc42ea42398ab8aa7a46b78a5532f38278feb0ecfeef26d9a591
Instruction ID: 4e3314c68e1b364ba9cb03aab8d480ce6a2023c9d888228d396630994991eb41
Opcode Fuzzy Hash: 10c6481142cefc42ea42398ab8aa7a46b78a5532f38278feb0ecfeef26d9a591
Instruction Fuzzy Hash: 8B11C831B00215BBE7309AA58C46FAB7B68EB81B34F210326B9517B2C0C9747C00C6A5

Function 033BC090 Relevance: 6.1, APIs: 4, Instructions: 66registryCOMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,000000FF,00000000,00000000), ref: 033BC0C2
MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,000000FF,00000000,00000000), ref: 033BC0E0
MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,000000FF,?,00000000), ref: 033BC0FD
RegOpenKeyExW.ADVAPI32(?,00000000,?,?,?), ref: 033BC113

Memory Dump Source

Source File: 00000014.00000002.2494020967.00000000033B1000.00000020.00000001.01000000.00000015.sdmp, Offset: 033B0000, based on PE: true

Associated: 00000014.00000002.2493917908.00000000033B0000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000014.00000002.2497615129.00000000033F3000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000014.00000002.2498110795.0000000003400000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000014.00000002.2498410969.0000000003406000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000014.00000002.2498556459.0000000003408000.00000008.00000001.01000000.00000015.sdmpDownload File
Associated: 00000014.00000002.2498718201.000000000340A000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000014.00000002.2499166516.0000000003411000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_33b0000_Picasa3.jbxd

Similarity

API ID: ByteCharMultiWide$Open
String ID:
API String ID: 103789273-0
Opcode ID: f5982d63732ae4ff143445812441a845f55bf3f014cbe98773b7f7d961602fe0
Instruction ID: 2e1a97860202f433a1f0a104c93c222a8bbb17ee775ba76d651db1ad157bf6f8
Opcode Fuzzy Hash: f5982d63732ae4ff143445812441a845f55bf3f014cbe98773b7f7d961602fe0
Instruction Fuzzy Hash: B311A735B4021ABBD730EA65DC82FBB776DEF49770F200225BA15AF6C0D970EC0086A5

Function 033BDF10 Relevance: 6.1, APIs: 4, Instructions: 64windowCOMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,000000FF,00000000,00000000), ref: 033BDF3E
MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,000000FF,00000000,00000000), ref: 033BDF5C
MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,000000FF,?,00000000), ref: 033BDF79
AppendMenuW.USER32(?,?,?,00000000), ref: 033BDF8B

Memory Dump Source

Source File: 00000014.00000002.2494020967.00000000033B1000.00000020.00000001.01000000.00000015.sdmp, Offset: 033B0000, based on PE: true

Associated: 00000014.00000002.2493917908.00000000033B0000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000014.00000002.2497615129.00000000033F3000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000014.00000002.2498110795.0000000003400000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000014.00000002.2498410969.0000000003406000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000014.00000002.2498556459.0000000003408000.00000008.00000001.01000000.00000015.sdmpDownload File
Associated: 00000014.00000002.2498718201.000000000340A000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000014.00000002.2499166516.0000000003411000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_33b0000_Picasa3.jbxd

Similarity

API ID: ByteCharMultiWide$AppendMenu
String ID:
API String ID: 2558712570-0
Opcode ID: d85c64f0e516ae9751d328a7e825f97eca24826b58983d23dcdb133cf7287a0e
Instruction ID: 71f38a0abe99cf93c1349481a3125b46e49d1174c473b682430cf3c9613fbd72
Opcode Fuzzy Hash: d85c64f0e516ae9751d328a7e825f97eca24826b58983d23dcdb133cf7287a0e
Instruction Fuzzy Hash: BC11CA35704219BBD720EE65DC81FBB7778EB45770F300326BA15AF6C4C970AD008665

Function 0403AED0 Relevance: 6.1, APIs: 4, Instructions: 64windowCOMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,000000FF,00000000,00000000), ref: 0403AEFE
MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,000000FF,00000000,00000000), ref: 0403AF1C
MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,000000FF,?,00000000), ref: 0403AF39
AppendMenuW.USER32(?,?,?,00000000), ref: 0403AF4B

Memory Dump Source

Source File: 00000014.00000002.2502041842.0000000004031000.00000020.00000001.01000000.00000017.sdmp, Offset: 04030000, based on PE: true

Associated: 00000014.00000002.2501986218.0000000004030000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000014.00000002.2504208079.0000000004079000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000014.00000002.2504943590.0000000004086000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000014.00000002.2505148754.000000000408E000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000014.00000002.2505282171.0000000004090000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000014.00000002.2505501725.0000000004097000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_4030000_Picasa3.jbxd

Similarity

API ID: ByteCharMultiWide$AppendMenu
String ID:
API String ID: 2558712570-0
Opcode ID: 9f96af858bc7e4f79e1a94438d5cea136aba12bd3a5e85c0bdf5057197596178
Instruction ID: 800a99ec5cc9a56b07a3ded848dcf4120a98249b7067efde5812f58cc3b3145d
Opcode Fuzzy Hash: 9f96af858bc7e4f79e1a94438d5cea136aba12bd3a5e85c0bdf5057197596178
Instruction Fuzzy Hash: D311C675740219BFEB20DE69DC42FBB7BA8EF45734F200625B915BB2C0D970BC0096A5

Function 033BD450 Relevance: 6.1, APIs: 4, Instructions: 62COMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,000000FF,00000000,00000000), ref: 033BD47E
MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,000000FF,00000000,00000000), ref: 033BD49C
MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,000000FF,?,00000000), ref: 033BD4B9
SetDlgItemTextW.USER32(?,?,00000000), ref: 033BD4C7

Memory Dump Source

Source File: 00000014.00000002.2494020967.00000000033B1000.00000020.00000001.01000000.00000015.sdmp, Offset: 033B0000, based on PE: true

Associated: 00000014.00000002.2493917908.00000000033B0000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000014.00000002.2497615129.00000000033F3000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000014.00000002.2498110795.0000000003400000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000014.00000002.2498410969.0000000003406000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000014.00000002.2498556459.0000000003408000.00000008.00000001.01000000.00000015.sdmpDownload File
Associated: 00000014.00000002.2498718201.000000000340A000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000014.00000002.2499166516.0000000003411000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_33b0000_Picasa3.jbxd

Similarity

API ID: ByteCharMultiWide$ItemText
String ID:
API String ID: 2294292104-0
Opcode ID: abbe18aeafd3a610ee6a285132691e285ae068786ea943f0cb53a5c30b3d4405
Instruction ID: 56f76ae48680616107ff9b3af0772785bfa9d6d57bc9880cc15b8763efdce0d2
Opcode Fuzzy Hash: abbe18aeafd3a610ee6a285132691e285ae068786ea943f0cb53a5c30b3d4405
Instruction Fuzzy Hash: CC11A935700215BBD730EE69DC85FABB768EB45770F600235B615EF5C4C970A80086A5

Function 033BC970 Relevance: 6.1, APIs: 4, Instructions: 62COMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,000000FF,00000000,00000000), ref: 033BC99E
MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,000000FF,00000000,00000000), ref: 033BC9BC
MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,000000FF,?,00000000), ref: 033BC9D9
GetFileAttributesExW.KERNEL32(00000000,?,?), ref: 033BC9E7

Memory Dump Source

Source File: 00000014.00000002.2494020967.00000000033B1000.00000020.00000001.01000000.00000015.sdmp, Offset: 033B0000, based on PE: true

Associated: 00000014.00000002.2493917908.00000000033B0000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000014.00000002.2497615129.00000000033F3000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000014.00000002.2498110795.0000000003400000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000014.00000002.2498410969.0000000003406000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000014.00000002.2498556459.0000000003408000.00000008.00000001.01000000.00000015.sdmpDownload File
Associated: 00000014.00000002.2498718201.000000000340A000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000014.00000002.2499166516.0000000003411000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_33b0000_Picasa3.jbxd

Similarity

API ID: ByteCharMultiWide$AttributesFile
String ID:
API String ID: 364578359-0
Opcode ID: 205c0bc1c7e2b55cc36707ce434e639696b826046fd1dc9fe40b8fbec58e09b8
Instruction ID: 75c13db2e108ce3656a51bdcd3bf35760b57559c1ce3671b4eacccce995a634d
Opcode Fuzzy Hash: 205c0bc1c7e2b55cc36707ce434e639696b826046fd1dc9fe40b8fbec58e09b8
Instruction Fuzzy Hash: DA11E535B40219BBE730EA69DC86FAB7B6CEB45770F300225B615AF6C0C970AC0086A5

Function 033BF990 Relevance: 6.1, APIs: 4, Instructions: 62COMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,000000FF,00000000,00000000), ref: 033BF9BE
MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,000000FF,00000000,00000000), ref: 033BF9DC
MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,000000FF,?,00000000), ref: 033BF9F9
FindFirstChangeNotificationW.KERNEL32(00000000,?,?), ref: 033BFA07

Memory Dump Source

Source File: 00000014.00000002.2494020967.00000000033B1000.00000020.00000001.01000000.00000015.sdmp, Offset: 033B0000, based on PE: true

Associated: 00000014.00000002.2493917908.00000000033B0000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000014.00000002.2497615129.00000000033F3000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000014.00000002.2498110795.0000000003400000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000014.00000002.2498410969.0000000003406000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000014.00000002.2498556459.0000000003408000.00000008.00000001.01000000.00000015.sdmpDownload File
Associated: 00000014.00000002.2498718201.000000000340A000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000014.00000002.2499166516.0000000003411000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_33b0000_Picasa3.jbxd

Similarity

API ID: ByteCharMultiWide$ChangeFindFirstNotification
String ID:
API String ID: 1613830685-0
Opcode ID: 8d0c760574ae4a3bd8d5d12efe0d40277d149decd818d29b0afa558f25bba004
Instruction ID: 24297f63b3be09129ac543158db5c5982000bdbc98624e6b160e59c00dfdc134
Opcode Fuzzy Hash: 8d0c760574ae4a3bd8d5d12efe0d40277d149decd818d29b0afa558f25bba004
Instruction Fuzzy Hash: 5F11A935B00215BBE720EA65DC86FAB7768EB45770F300325B615AF6C4D970AC1086A5

Function 033BFD00 Relevance: 6.1, APIs: 4, Instructions: 62libraryCOMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,000000FF,00000000,00000000), ref: 033BFD2E
MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,000000FF,00000000,00000000), ref: 033BFD4C
MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,000000FF,?,00000000), ref: 033BFD69
LoadLibraryExW.KERNEL32(00000000,?,?), ref: 033BFD77

Memory Dump Source

Source File: 00000014.00000002.2494020967.00000000033B1000.00000020.00000001.01000000.00000015.sdmp, Offset: 033B0000, based on PE: true

Associated: 00000014.00000002.2493917908.00000000033B0000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000014.00000002.2497615129.00000000033F3000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000014.00000002.2498110795.0000000003400000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000014.00000002.2498410969.0000000003406000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000014.00000002.2498556459.0000000003408000.00000008.00000001.01000000.00000015.sdmpDownload File
Associated: 00000014.00000002.2498718201.000000000340A000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000014.00000002.2499166516.0000000003411000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_33b0000_Picasa3.jbxd

Similarity

API ID: ByteCharMultiWide$LibraryLoad
String ID:
API String ID: 2759504907-0
Opcode ID: 961467240ef762469b361974219932a4f7bb7e01d006ffb8ef44ce4ce9648c41
Instruction ID: fc39e7af12353a0f98db2a0fff11a1c02f9350eafaf680c2f81f681d71331ae1
Opcode Fuzzy Hash: 961467240ef762469b361974219932a4f7bb7e01d006ffb8ef44ce4ce9648c41
Instruction Fuzzy Hash: 8D11E935B00215BBE720EA65DC85FBB7B68EF45770F300329B615AF6C4C970A80087A4

Function 0403A410 Relevance: 6.1, APIs: 4, Instructions: 62COMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,000000FF,00000000,00000000), ref: 0403A43E
MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,000000FF,00000000,00000000), ref: 0403A45C
MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,000000FF,?,00000000), ref: 0403A479
SetDlgItemTextW.USER32(?,?,00000000), ref: 0403A487

Memory Dump Source

Source File: 00000014.00000002.2502041842.0000000004031000.00000020.00000001.01000000.00000017.sdmp, Offset: 04030000, based on PE: true

Associated: 00000014.00000002.2501986218.0000000004030000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000014.00000002.2504208079.0000000004079000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000014.00000002.2504943590.0000000004086000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000014.00000002.2505148754.000000000408E000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000014.00000002.2505282171.0000000004090000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000014.00000002.2505501725.0000000004097000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_4030000_Picasa3.jbxd

Similarity

API ID: ByteCharMultiWide$ItemText
String ID:
API String ID: 2294292104-0
Opcode ID: f869dc418589c94e2f2f35ee8249c4d19e05ef11bb21c3cfffe0feac296382cc
Instruction ID: 5a598faaabc975cadb9fa2a70c194d9ee75dad9af86b65d114c3bcd4f75070b4
Opcode Fuzzy Hash: f869dc418589c94e2f2f35ee8249c4d19e05ef11bb21c3cfffe0feac296382cc
Instruction Fuzzy Hash: F511E935B40215BBEB209A699C46FAB7BACEF45734F204235B615BB6C0D974B80086A5

Function 0403CCC0 Relevance: 6.1, APIs: 4, Instructions: 62libraryCOMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,000000FF,00000000,00000000), ref: 0403CCEE
MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,000000FF,00000000,00000000), ref: 0403CD0C
MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,000000FF,?,00000000), ref: 0403CD29
LoadLibraryExW.KERNEL32(00000000,?,?), ref: 0403CD37

Memory Dump Source

Source File: 00000014.00000002.2502041842.0000000004031000.00000020.00000001.01000000.00000017.sdmp, Offset: 04030000, based on PE: true

Associated: 00000014.00000002.2501986218.0000000004030000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000014.00000002.2504208079.0000000004079000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000014.00000002.2504943590.0000000004086000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000014.00000002.2505148754.000000000408E000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000014.00000002.2505282171.0000000004090000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000014.00000002.2505501725.0000000004097000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_4030000_Picasa3.jbxd

Similarity

API ID: ByteCharMultiWide$LibraryLoad
String ID:
API String ID: 2759504907-0
Opcode ID: 0c507e87033e75937c4642f3c9a77a5d8ce6771cf77d829f95a9d0c2dfae4740
Instruction ID: 6b5ed74e5f2be46db749869854244cde989fe6077f0148041752d52ad84ab8a3
Opcode Fuzzy Hash: 0c507e87033e75937c4642f3c9a77a5d8ce6771cf77d829f95a9d0c2dfae4740
Instruction Fuzzy Hash: EC11C631B04215BBFB209A659C45FAB7B68DB45730F200625B515BB2C0D974B90096A5

Function 04039930 Relevance: 6.1, APIs: 4, Instructions: 62COMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,000000FF,00000000,00000000), ref: 0403995E
MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,000000FF,00000000,00000000), ref: 0403997C
MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,000000FF,?,00000000), ref: 04039999
GetFileAttributesExW.KERNEL32(00000000,?,?), ref: 040399A7

Memory Dump Source

Source File: 00000014.00000002.2502041842.0000000004031000.00000020.00000001.01000000.00000017.sdmp, Offset: 04030000, based on PE: true

Associated: 00000014.00000002.2501986218.0000000004030000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000014.00000002.2504208079.0000000004079000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000014.00000002.2504943590.0000000004086000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000014.00000002.2505148754.000000000408E000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000014.00000002.2505282171.0000000004090000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000014.00000002.2505501725.0000000004097000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_4030000_Picasa3.jbxd

Similarity

API ID: ByteCharMultiWide$AttributesFile
String ID:
API String ID: 364578359-0
Opcode ID: a7a1759bd2479acea4ac030908a1e74bb8007ed97a0203ec58da9bb9603c214a
Instruction ID: b1d7adbae8c842e773f7c85b8f200dbb1dc0981f86b14d81ae443ea65b3eeadf
Opcode Fuzzy Hash: a7a1759bd2479acea4ac030908a1e74bb8007ed97a0203ec58da9bb9603c214a
Instruction Fuzzy Hash: CB11E570B04215BBEB209A698C46FAF7B68EF45B34F200336B515BB2C0D9B4BC0086A5

Function 0403C950 Relevance: 6.1, APIs: 4, Instructions: 62COMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,000000FF,00000000,00000000), ref: 0403C97E
MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,000000FF,00000000,00000000), ref: 0403C99C
MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,000000FF,?,00000000), ref: 0403C9B9
FindFirstChangeNotificationW.KERNEL32(00000000,?,?), ref: 0403C9C7

Memory Dump Source

Source File: 00000014.00000002.2502041842.0000000004031000.00000020.00000001.01000000.00000017.sdmp, Offset: 04030000, based on PE: true

Associated: 00000014.00000002.2501986218.0000000004030000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000014.00000002.2504208079.0000000004079000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000014.00000002.2504943590.0000000004086000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000014.00000002.2505148754.000000000408E000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000014.00000002.2505282171.0000000004090000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000014.00000002.2505501725.0000000004097000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_4030000_Picasa3.jbxd

Similarity

API ID: ByteCharMultiWide$ChangeFindFirstNotification
String ID:
API String ID: 1613830685-0
Opcode ID: 6e600ad47eca198624dff7d9416ff7e83ecbe135fd51fb47c879ced4267c00c4
Instruction ID: ffbe1e57ad4777f12d0ed580aa954d4cb2733a08f0ce3563e72e9110e92678dd
Opcode Fuzzy Hash: 6e600ad47eca198624dff7d9416ff7e83ecbe135fd51fb47c879ced4267c00c4
Instruction Fuzzy Hash: 3A11C235B04215BBFB209E65DC46FAB7B68EB45734F210226B615FB2C0D974BD0092A6

Function 033BDB00 Relevance: 6.1, APIs: 4, Instructions: 60COMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,000000FF,00000000,00000000), ref: 033BDB2E
MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,000000FF,00000000,00000000), ref: 033BDB4C
MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,000000FF,?,00000000), ref: 033BDB69
CreateDirectoryW.KERNEL32(00000000,?), ref: 033BDB73

Memory Dump Source

Source File: 00000014.00000002.2494020967.00000000033B1000.00000020.00000001.01000000.00000015.sdmp, Offset: 033B0000, based on PE: true

Associated: 00000014.00000002.2493917908.00000000033B0000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000014.00000002.2497615129.00000000033F3000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000014.00000002.2498110795.0000000003400000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000014.00000002.2498410969.0000000003406000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000014.00000002.2498556459.0000000003408000.00000008.00000001.01000000.00000015.sdmpDownload File
Associated: 00000014.00000002.2498718201.000000000340A000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000014.00000002.2499166516.0000000003411000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_33b0000_Picasa3.jbxd

Similarity

API ID: ByteCharMultiWide$CreateDirectory
String ID:
API String ID: 2198582921-0
Opcode ID: db9cbbd6d179e8507be3f5723de78fa4cebd3c59b47748c9912a3d1174fe1256
Instruction ID: a5a12f8405bc646e00409d06e4b1033e686c76152e59ad18fdcf7008d5f2a3a8
Opcode Fuzzy Hash: db9cbbd6d179e8507be3f5723de78fa4cebd3c59b47748c9912a3d1174fe1256
Instruction Fuzzy Hash: 9F11C835B00215BBE720EA659C86FAA7B68EB05770F700336B615AF6C0D970A90086A5

Function 033BCB70 Relevance: 6.1, APIs: 4, Instructions: 60COMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,000000FF,00000000,00000000), ref: 033BCB9E
MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,000000FF,00000000,00000000), ref: 033BCBBC
MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,000000FF,?,00000000), ref: 033BCBD9
UnregisterClassW.USER32(00000000,?), ref: 033BCBE3

Memory Dump Source

Source File: 00000014.00000002.2494020967.00000000033B1000.00000020.00000001.01000000.00000015.sdmp, Offset: 033B0000, based on PE: true

Associated: 00000014.00000002.2493917908.00000000033B0000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000014.00000002.2497615129.00000000033F3000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000014.00000002.2498110795.0000000003400000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000014.00000002.2498410969.0000000003406000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000014.00000002.2498556459.0000000003408000.00000008.00000001.01000000.00000015.sdmpDownload File
Associated: 00000014.00000002.2498718201.000000000340A000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000014.00000002.2499166516.0000000003411000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_33b0000_Picasa3.jbxd

Similarity

API ID: ByteCharMultiWide$ClassUnregister
String ID:
API String ID: 3280619191-0
Opcode ID: 0d46a75d4af51deeaec7cecccb34343c7e9ba1c8f4e0af0294da7e3775e057a6
Instruction ID: 7e40ac50bb2b77a24801c01ea40f9d758003f01ddb67dce744c289cac1b407e9
Opcode Fuzzy Hash: 0d46a75d4af51deeaec7cecccb34343c7e9ba1c8f4e0af0294da7e3775e057a6
Instruction Fuzzy Hash: 97110835B40215BBE730EA699C86FAF7B6CEF05730F300225B615AF6C0C970A80082A4

Function 033BC8D0 Relevance: 6.1, APIs: 4, Instructions: 60COMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,000000FF,00000000,00000000), ref: 033BC8FE
MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,000000FF,00000000,00000000), ref: 033BC91C
MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,000000FF,?,00000000), ref: 033BC939
SetFileAttributesW.KERNEL32(00000000,?), ref: 033BC943

Memory Dump Source

Source File: 00000014.00000002.2494020967.00000000033B1000.00000020.00000001.01000000.00000015.sdmp, Offset: 033B0000, based on PE: true

Associated: 00000014.00000002.2493917908.00000000033B0000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000014.00000002.2497615129.00000000033F3000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000014.00000002.2498110795.0000000003400000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000014.00000002.2498410969.0000000003406000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000014.00000002.2498556459.0000000003408000.00000008.00000001.01000000.00000015.sdmpDownload File
Associated: 00000014.00000002.2498718201.000000000340A000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000014.00000002.2499166516.0000000003411000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_33b0000_Picasa3.jbxd

Similarity

API ID: ByteCharMultiWide$AttributesFile
String ID:
API String ID: 364578359-0
Opcode ID: b0e08d0ee7011f0bbcc70d5a75055ac0c4004854388c7ad7d2cb0c63032c059a
Instruction ID: ac9f2b7facf6af4de7fb54b2ec013b4fb79aeee938842c7b07ad1fc2ede34a75
Opcode Fuzzy Hash: b0e08d0ee7011f0bbcc70d5a75055ac0c4004854388c7ad7d2cb0c63032c059a
Instruction Fuzzy Hash: AA110835B00215BBE730EA659C86FAA7B6CEF05730F300225B615AF6C0C970A90082A4

Function 033BCC30 Relevance: 6.1, APIs: 4, Instructions: 60COMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,000000FF,00000000,00000000), ref: 033BCC5E
MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,000000FF,00000000,00000000), ref: 033BCC7C
MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,000000FF,?,00000000), ref: 033BCC99
SetWindowTextW.USER32(?,00000000), ref: 033BCCA3

Memory Dump Source

Source File: 00000014.00000002.2494020967.00000000033B1000.00000020.00000001.01000000.00000015.sdmp, Offset: 033B0000, based on PE: true

Associated: 00000014.00000002.2493917908.00000000033B0000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000014.00000002.2497615129.00000000033F3000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000014.00000002.2498110795.0000000003400000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000014.00000002.2498410969.0000000003406000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000014.00000002.2498556459.0000000003408000.00000008.00000001.01000000.00000015.sdmpDownload File
Associated: 00000014.00000002.2498718201.000000000340A000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000014.00000002.2499166516.0000000003411000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_33b0000_Picasa3.jbxd

Similarity

API ID: ByteCharMultiWide$TextWindow
String ID:
API String ID: 850113529-0
Opcode ID: b5cfcfc6971f3089cae60ea06b4c60d98b6419bf19a81e71db2d3e0d921cf08f
Instruction ID: c11ec461ae3ac9bb635981279696df17070717d6b28c559e0a9c2ecd8b008737
Opcode Fuzzy Hash: b5cfcfc6971f3089cae60ea06b4c60d98b6419bf19a81e71db2d3e0d921cf08f
Instruction Fuzzy Hash: D511C835B40215BBD730EA699C85FAB7BACEB05B70F700236B615EF6C0C970A90097A5

Function 04039890 Relevance: 6.1, APIs: 4, Instructions: 60COMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,000000FF,00000000,00000000), ref: 040398BE
MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,000000FF,00000000,00000000), ref: 040398DC
MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,000000FF,?,00000000), ref: 040398F9
SetFileAttributesW.KERNEL32(00000000,?), ref: 04039903

Memory Dump Source

Source File: 00000014.00000002.2502041842.0000000004031000.00000020.00000001.01000000.00000017.sdmp, Offset: 04030000, based on PE: true

Associated: 00000014.00000002.2501986218.0000000004030000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000014.00000002.2504208079.0000000004079000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000014.00000002.2504943590.0000000004086000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000014.00000002.2505148754.000000000408E000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000014.00000002.2505282171.0000000004090000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000014.00000002.2505501725.0000000004097000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_4030000_Picasa3.jbxd

Similarity

API ID: ByteCharMultiWide$AttributesFile
String ID:
API String ID: 364578359-0
Opcode ID: c23c9334dfeedf4a867aa8e0db7c179f7e8ead235d8c093700fb84921ecc2092
Instruction ID: edd76a10b83c627740ff433dd5ff2693c74ae2d90696a92fefc3bc2a2dca98c0
Opcode Fuzzy Hash: c23c9334dfeedf4a867aa8e0db7c179f7e8ead235d8c093700fb84921ecc2092
Instruction Fuzzy Hash: 0B110830B04215BBEB20AB699C46FAA7B68EF45734F300235BA15BF2C0D970BD0096A5

Function 04039B30 Relevance: 6.1, APIs: 4, Instructions: 60COMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,000000FF,00000000,00000000), ref: 04039B5E
MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,000000FF,00000000,00000000), ref: 04039B7C
MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,000000FF,?,00000000), ref: 04039B99
UnregisterClassW.USER32(00000000,?), ref: 04039BA3

Memory Dump Source

Source File: 00000014.00000002.2502041842.0000000004031000.00000020.00000001.01000000.00000017.sdmp, Offset: 04030000, based on PE: true

Associated: 00000014.00000002.2501986218.0000000004030000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000014.00000002.2504208079.0000000004079000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000014.00000002.2504943590.0000000004086000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000014.00000002.2505148754.000000000408E000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000014.00000002.2505282171.0000000004090000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000014.00000002.2505501725.0000000004097000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_4030000_Picasa3.jbxd

Similarity

API ID: ByteCharMultiWide$ClassUnregister
String ID:
API String ID: 3280619191-0
Opcode ID: d9c1a854f6d1819ee7ff3dd72630f7fc85c4be03e3ddcda0f7dc9ccacc709765
Instruction ID: a6d1aa87db043acf4410f62b79e3c5798c4d3ace49e68a9e0ac3177aa35ab0eb
Opcode Fuzzy Hash: d9c1a854f6d1819ee7ff3dd72630f7fc85c4be03e3ddcda0f7dc9ccacc709765
Instruction Fuzzy Hash: EE11C871B04215BAEB20AA659C46FAA7B6CEF45734F300375B615BF2C0D974B90092A5

Function 04039BF0 Relevance: 6.1, APIs: 4, Instructions: 60COMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,000000FF,00000000,00000000), ref: 04039C1E
MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,000000FF,00000000,00000000), ref: 04039C3C
MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,000000FF,?,00000000), ref: 04039C59
SetWindowTextW.USER32(?,00000000), ref: 04039C63

Memory Dump Source

Source File: 00000014.00000002.2502041842.0000000004031000.00000020.00000001.01000000.00000017.sdmp, Offset: 04030000, based on PE: true

Associated: 00000014.00000002.2501986218.0000000004030000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000014.00000002.2504208079.0000000004079000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000014.00000002.2504943590.0000000004086000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000014.00000002.2505148754.000000000408E000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000014.00000002.2505282171.0000000004090000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000014.00000002.2505501725.0000000004097000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_4030000_Picasa3.jbxd

Similarity

API ID: ByteCharMultiWide$TextWindow
String ID:
API String ID: 850113529-0
Opcode ID: 29145344b5ad539f6862d92d5d2ea1c5d9c8ab80aab67be0a24e7b490ccd522e
Instruction ID: 07336d78545000d663d6ef761f5f8082be96df0915587633a6c2644ae263d779
Opcode Fuzzy Hash: 29145344b5ad539f6862d92d5d2ea1c5d9c8ab80aab67be0a24e7b490ccd522e
Instruction Fuzzy Hash: 30112F71B14215BBEB20AA699C41FAB7B98DF05B30F300231B515FF1C0C570B90083A5

Function 0403AAC1 Relevance: 6.1, APIs: 4, Instructions: 59COMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,000000FF,00000000,00000000), ref: 0403AAEE
MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,000000FF,00000000,00000000), ref: 0403AB0C
MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,000000FF,?,00000000), ref: 0403AB29
CreateDirectoryW.KERNEL32(00000000,?), ref: 0403AB33

Memory Dump Source

Source File: 00000014.00000002.2502041842.0000000004031000.00000020.00000001.01000000.00000017.sdmp, Offset: 04030000, based on PE: true

Associated: 00000014.00000002.2501986218.0000000004030000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000014.00000002.2504208079.0000000004079000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000014.00000002.2504943590.0000000004086000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000014.00000002.2505148754.000000000408E000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000014.00000002.2505282171.0000000004090000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000014.00000002.2505501725.0000000004097000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_4030000_Picasa3.jbxd

Similarity

API ID: ByteCharMultiWide$CreateDirectory
String ID:
API String ID: 2198582921-0
Opcode ID: 7dbafeba4aa1281a9ad3c53cb0b4a38f53d1d1c281835c05f42df6f59fa127d3
Instruction ID: aff31e567c05f862e848117dd45d717df47b40acf1d8c003c99d2782af7917d8
Opcode Fuzzy Hash: 7dbafeba4aa1281a9ad3c53cb0b4a38f53d1d1c281835c05f42df6f59fa127d3
Instruction Fuzzy Hash: 63110431B40215BAEB30AA698C46FAA7B68EF05730F300236B615BF2C0D974B90086A5

Function 033BF190 Relevance: 6.1, APIs: 4, Instructions: 58COMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,000000FF,00000000,00000000), ref: 033BF1BE
MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,000000FF,00000000,00000000), ref: 033BF1DC
MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,000000FF,?,00000000), ref: 033BF1F9
RemoveDirectoryW.KERNEL32(00000000), ref: 033BF1FF

Memory Dump Source

Source File: 00000014.00000002.2494020967.00000000033B1000.00000020.00000001.01000000.00000015.sdmp, Offset: 033B0000, based on PE: true

Associated: 00000014.00000002.2493917908.00000000033B0000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000014.00000002.2497615129.00000000033F3000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000014.00000002.2498110795.0000000003400000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000014.00000002.2498410969.0000000003406000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000014.00000002.2498556459.0000000003408000.00000008.00000001.01000000.00000015.sdmpDownload File
Associated: 00000014.00000002.2498718201.000000000340A000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000014.00000002.2499166516.0000000003411000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_33b0000_Picasa3.jbxd

Similarity

API ID: ByteCharMultiWide$DirectoryRemove
String ID:
API String ID: 1549940835-0
Opcode ID: de1c5e6a95cf747a72170586aa5bebb2d34782e62231364d1595417dc651d9af
Instruction ID: f86473ed0a044ace2f36fc0979073c8c93a230216db2ca689fb29fdabb8e8bec
Opcode Fuzzy Hash: de1c5e6a95cf747a72170586aa5bebb2d34782e62231364d1595417dc651d9af
Instruction Fuzzy Hash: 1501D635B40215BBE720E669DCC6FAA7B68EF05B70F700732B615AF5C0C970A90082A5

Function 033BB680 Relevance: 6.1, APIs: 4, Instructions: 58fileCOMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,000000FF,00000000,00000000), ref: 033BB6AE
MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,000000FF,00000000,00000000), ref: 033BB6CC
MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,000000FF,?,00000000), ref: 033BB6E9
DeleteFileW.KERNEL32(00000000), ref: 033BB6EF

Memory Dump Source

Source File: 00000014.00000002.2494020967.00000000033B1000.00000020.00000001.01000000.00000015.sdmp, Offset: 033B0000, based on PE: true

Associated: 00000014.00000002.2493917908.00000000033B0000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000014.00000002.2497615129.00000000033F3000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000014.00000002.2498110795.0000000003400000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000014.00000002.2498410969.0000000003406000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000014.00000002.2498556459.0000000003408000.00000008.00000001.01000000.00000015.sdmpDownload File
Associated: 00000014.00000002.2498718201.000000000340A000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000014.00000002.2499166516.0000000003411000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_33b0000_Picasa3.jbxd

Similarity

API ID: ByteCharMultiWide$DeleteFile
String ID:
API String ID: 3714004522-0
Opcode ID: 12cac646cc7b741b59a524272b43cf2e0f891658560cf4fb119ca5ada2c001f1
Instruction ID: 5f8d34c49f835d0e5fc9baa053bd69c1031b7c5339ed96150c7ec60c6a61b5ae
Opcode Fuzzy Hash: 12cac646cc7b741b59a524272b43cf2e0f891658560cf4fb119ca5ada2c001f1
Instruction Fuzzy Hash: B301DB35B002197BD730E6659CC6FAABB68EF05770F700231B615AF6C4DD70AC0086A5

Function 033BB5F0 Relevance: 6.1, APIs: 4, Instructions: 58COMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,000000FF,00000000,00000000), ref: 033BB61E
MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,000000FF,00000000,00000000), ref: 033BB63C
MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,000000FF,?,00000000), ref: 033BB659
GetFileAttributesW.KERNEL32(00000000), ref: 033BB65F

Memory Dump Source

Source File: 00000014.00000002.2494020967.00000000033B1000.00000020.00000001.01000000.00000015.sdmp, Offset: 033B0000, based on PE: true

Associated: 00000014.00000002.2493917908.00000000033B0000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000014.00000002.2497615129.00000000033F3000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000014.00000002.2498110795.0000000003400000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000014.00000002.2498410969.0000000003406000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000014.00000002.2498556459.0000000003408000.00000008.00000001.01000000.00000015.sdmpDownload File
Associated: 00000014.00000002.2498718201.000000000340A000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000014.00000002.2499166516.0000000003411000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_33b0000_Picasa3.jbxd

Similarity

API ID: ByteCharMultiWide$AttributesFile
String ID:
API String ID: 364578359-0
Opcode ID: 28e30ff7cf259ac9f2e1fba16667e217ce47cefa1997bd1107013f5b84305f44
Instruction ID: 801d00a4b35a8d57eea159c76151114512fd7faa0437056dd3be47f88ac6ca0a
Opcode Fuzzy Hash: 28e30ff7cf259ac9f2e1fba16667e217ce47cefa1997bd1107013f5b84305f44
Instruction Fuzzy Hash: E2019B35B40215BBEB20E6659CC6FAABB68EF05770F700235B615AF5C4DD70AC0486A5

Function 033BFBE0 Relevance: 6.1, APIs: 4, Instructions: 58COMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,000000FF,00000000,00000000), ref: 033BFC0E
MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,000000FF,00000000,00000000), ref: 033BFC2C
MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,000000FF,?,00000000), ref: 033BFC49
GetModuleHandleW.KERNEL32(00000000), ref: 033BFC4F

Memory Dump Source

Source File: 00000014.00000002.2494020967.00000000033B1000.00000020.00000001.01000000.00000015.sdmp, Offset: 033B0000, based on PE: true

Associated: 00000014.00000002.2493917908.00000000033B0000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000014.00000002.2497615129.00000000033F3000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000014.00000002.2498110795.0000000003400000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000014.00000002.2498410969.0000000003406000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000014.00000002.2498556459.0000000003408000.00000008.00000001.01000000.00000015.sdmpDownload File
Associated: 00000014.00000002.2498718201.000000000340A000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000014.00000002.2499166516.0000000003411000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_33b0000_Picasa3.jbxd

Similarity

API ID: ByteCharMultiWide$HandleModule
String ID:
API String ID: 546208114-0
Opcode ID: cbb1d2dbe7599613617a045d55cc473d2326ee1967226e00fcd5e6e3df3cb886
Instruction ID: c923982814131710b94f2a9b40ea833459905df1ae988022bf30e58b191d313d
Opcode Fuzzy Hash: cbb1d2dbe7599613617a045d55cc473d2326ee1967226e00fcd5e6e3df3cb886
Instruction Fuzzy Hash: 3B01D635B40215BBE720E6699CC6FAA7B68EF05B70F300231BA15AF5C4C970A90082A5

Function 033BFC70 Relevance: 6.1, APIs: 4, Instructions: 58libraryCOMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,000000FF,00000000,00000000), ref: 033BFC9E
MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,000000FF,00000000,00000000), ref: 033BFCBC
MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,000000FF,?,00000000), ref: 033BFCD9
LoadLibraryW.KERNEL32(00000000), ref: 033BFCDF

Memory Dump Source

Source File: 00000014.00000002.2494020967.00000000033B1000.00000020.00000001.01000000.00000015.sdmp, Offset: 033B0000, based on PE: true

Associated: 00000014.00000002.2493917908.00000000033B0000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000014.00000002.2497615129.00000000033F3000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000014.00000002.2498110795.0000000003400000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000014.00000002.2498410969.0000000003406000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000014.00000002.2498556459.0000000003408000.00000008.00000001.01000000.00000015.sdmpDownload File
Associated: 00000014.00000002.2498718201.000000000340A000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000014.00000002.2499166516.0000000003411000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_33b0000_Picasa3.jbxd

Similarity

API ID: ByteCharMultiWide$LibraryLoad
String ID:
API String ID: 2759504907-0
Opcode ID: 2f630ad2e8e62a67fd54e494f6da76399ec6d4097355128edb6a1565573ac253
Instruction ID: 68f47385d8f3cc911d477ce39fe86acb462c4a2bcc28eeaa4426c6477c32ccc0
Opcode Fuzzy Hash: 2f630ad2e8e62a67fd54e494f6da76399ec6d4097355128edb6a1565573ac253
Instruction Fuzzy Hash: 8C01DB35B402157BD720E6699CC5FAA7B68DF05770F300335BA15AF5C4C970A80086A5

Function 04038640 Relevance: 6.1, APIs: 4, Instructions: 58fileCOMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,000000FF,00000000,00000000), ref: 0403866E
MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,000000FF,00000000,00000000), ref: 0403868C
MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,000000FF,?,00000000), ref: 040386A9
DeleteFileW.KERNEL32(00000000), ref: 040386AF

Memory Dump Source

Source File: 00000014.00000002.2502041842.0000000004031000.00000020.00000001.01000000.00000017.sdmp, Offset: 04030000, based on PE: true

Associated: 00000014.00000002.2501986218.0000000004030000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000014.00000002.2504208079.0000000004079000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000014.00000002.2504943590.0000000004086000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000014.00000002.2505148754.000000000408E000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000014.00000002.2505282171.0000000004090000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000014.00000002.2505501725.0000000004097000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_4030000_Picasa3.jbxd

Similarity

API ID: ByteCharMultiWide$DeleteFile
String ID:
API String ID: 3714004522-0
Opcode ID: fd6f7caaffa50aa91fc5b6d3c7ae965a592a393c2e8aacbd01dcf64dbaffa248
Instruction ID: a929fbc20b4345e977f40cac7909d16eaa52aa5aff69f8e581f0fd94719139d6
Opcode Fuzzy Hash: fd6f7caaffa50aa91fc5b6d3c7ae965a592a393c2e8aacbd01dcf64dbaffa248
Instruction Fuzzy Hash: AA01D631B40215BAEB20AA799C46FAE7BA8EF05B34F300775B615BF1C0D974B80492A5

Function 0403C150 Relevance: 6.1, APIs: 4, Instructions: 58COMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,000000FF,00000000,00000000), ref: 0403C17E
MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,000000FF,00000000,00000000), ref: 0403C19C
MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,000000FF,?,00000000), ref: 0403C1B9
RemoveDirectoryW.KERNEL32(00000000), ref: 0403C1BF

Memory Dump Source

Source File: 00000014.00000002.2502041842.0000000004031000.00000020.00000001.01000000.00000017.sdmp, Offset: 04030000, based on PE: true

Associated: 00000014.00000002.2501986218.0000000004030000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000014.00000002.2504208079.0000000004079000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000014.00000002.2504943590.0000000004086000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000014.00000002.2505148754.000000000408E000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000014.00000002.2505282171.0000000004090000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000014.00000002.2505501725.0000000004097000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_4030000_Picasa3.jbxd

Similarity

API ID: ByteCharMultiWide$DirectoryRemove
String ID:
API String ID: 1549940835-0
Opcode ID: 8ed2da795082be83324bf684e536d8185e26e528344583d54a52f97b372c6c96
Instruction ID: 085d10f594f451f31439cc1df1fef7499e8db0c85a27d3e30f8817c25113d79d
Opcode Fuzzy Hash: 8ed2da795082be83324bf684e536d8185e26e528344583d54a52f97b372c6c96
Instruction Fuzzy Hash: 1201DB31B44215BAFB30AA659C45FAB7B58DF45734F300235B615FF1C0D964BC0096A5

Function 0403CC30 Relevance: 6.1, APIs: 4, Instructions: 58libraryCOMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,000000FF,00000000,00000000), ref: 0403CC5E
MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,000000FF,00000000,00000000), ref: 0403CC7C
MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,000000FF,?,00000000), ref: 0403CC99
LoadLibraryW.KERNEL32(00000000), ref: 0403CC9F

Memory Dump Source

Source File: 00000014.00000002.2502041842.0000000004031000.00000020.00000001.01000000.00000017.sdmp, Offset: 04030000, based on PE: true

Associated: 00000014.00000002.2501986218.0000000004030000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000014.00000002.2504208079.0000000004079000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000014.00000002.2504943590.0000000004086000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000014.00000002.2505148754.000000000408E000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000014.00000002.2505282171.0000000004090000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000014.00000002.2505501725.0000000004097000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_4030000_Picasa3.jbxd

Similarity

API ID: ByteCharMultiWide$LibraryLoad
String ID:
API String ID: 2759504907-0
Opcode ID: 2bf7f5046a655a2a7f891771fd97a9f31b4c0fab14d8badda992d6f1445cccdd
Instruction ID: 7b26855f5b5aefc1d6e2ea354ee70853ac3377037abbd0c602993e55111af699
Opcode Fuzzy Hash: 2bf7f5046a655a2a7f891771fd97a9f31b4c0fab14d8badda992d6f1445cccdd
Instruction Fuzzy Hash: BF01DB31B14215BAF720AA659C46FAB7B58DF05B34F300336F615FF1C0D974B80092A5

Function 0403CBA0 Relevance: 6.1, APIs: 4, Instructions: 58COMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,000000FF,00000000,00000000), ref: 0403CBCE
MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,000000FF,00000000,00000000), ref: 0403CBEC
MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,000000FF,?,00000000), ref: 0403CC09
GetModuleHandleW.KERNEL32(00000000), ref: 0403CC0F

Memory Dump Source

Source File: 00000014.00000002.2502041842.0000000004031000.00000020.00000001.01000000.00000017.sdmp, Offset: 04030000, based on PE: true

Associated: 00000014.00000002.2501986218.0000000004030000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000014.00000002.2504208079.0000000004079000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000014.00000002.2504943590.0000000004086000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000014.00000002.2505148754.000000000408E000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000014.00000002.2505282171.0000000004090000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000014.00000002.2505501725.0000000004097000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_4030000_Picasa3.jbxd

Similarity

API ID: ByteCharMultiWide$HandleModule
String ID:
API String ID: 546208114-0
Opcode ID: 7fb50f49b6f39eb187f1d1c02844daeb26c1699388a36e1f6412c9301605bdf7
Instruction ID: 25cdc411515f7adf09301ab2a774bf803e58e7a876ebc6ca7fb5392f3c7431be
Opcode Fuzzy Hash: 7fb50f49b6f39eb187f1d1c02844daeb26c1699388a36e1f6412c9301605bdf7
Instruction Fuzzy Hash: 9B01D631B54215BAFB20AA699C46FAA7B68DF05B34F300635B616FF2C0D964B80092A5

Function 040385B1 Relevance: 6.1, APIs: 4, Instructions: 57COMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,000000FF,00000000,00000000), ref: 040385DE
MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,000000FF,00000000,00000000), ref: 040385FC
MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,000000FF,?,00000000), ref: 04038619
GetFileAttributesW.KERNEL32(00000000), ref: 0403861F

Memory Dump Source

Source File: 00000014.00000002.2502041842.0000000004031000.00000020.00000001.01000000.00000017.sdmp, Offset: 04030000, based on PE: true

Associated: 00000014.00000002.2501986218.0000000004030000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000014.00000002.2504208079.0000000004079000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000014.00000002.2504943590.0000000004086000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000014.00000002.2505148754.000000000408E000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000014.00000002.2505282171.0000000004090000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000014.00000002.2505501725.0000000004097000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_4030000_Picasa3.jbxd

Similarity

API ID: ByteCharMultiWide$AttributesFile
String ID:
API String ID: 364578359-0
Opcode ID: bcb81b6622422f39be547437e6457b2fb3f4958d0a67ca46106ec3031ecabd17
Instruction ID: 98eee49592b808f99c7b7f21e098b51f689a9039b703dd63c83f2c104b10346e
Opcode Fuzzy Hash: bcb81b6622422f39be547437e6457b2fb3f4958d0a67ca46106ec3031ecabd17
Instruction Fuzzy Hash: 4D01D631B44215BAEB20AA659C46FAA7BA8EF05734F300675B615FF1C0D964B90092A6

Function 04833581 Relevance: 6.1, APIs: 4, Instructions: 57COMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,000000FF,00000000,00000000), ref: 048335AE
MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,000000FF,00000000,00000000), ref: 048335CC
MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,000000FF,?,00000000), ref: 048335E9
GetFileAttributesW.KERNEL32(00000000), ref: 048335EF

Memory Dump Source

Source File: 00000014.00000002.2526268174.00000000047E1000.00000020.00000001.01000000.00000016.sdmp, Offset: 047E0000, based on PE: true

Associated: 00000014.00000002.2526187657.00000000047E0000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000014.00000002.2533437740.000000000488F000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000014.00000002.2535246598.00000000048AB000.00000004.00000001.01000000.00000016.sdmpDownload File
Associated: 00000014.00000002.2535569716.00000000048B3000.00000008.00000001.01000000.00000016.sdmpDownload File
Associated: 00000014.00000002.2535640427.00000000048B5000.00000004.00000001.01000000.00000016.sdmpDownload File
Associated: 00000014.00000002.2536317728.00000000048C0000.00000002.00000001.01000000.00000016.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_47e0000_Picasa3.jbxd

Similarity

API ID: ByteCharMultiWide$AttributesFile
String ID:
API String ID: 364578359-0
Opcode ID: 726211901c58432d52d2b28b848c417febb49b9bff3514d6c8a72a14fd0387d8
Instruction ID: bb5a1cca88ca3d94caaca52360b5892859fe1ac36b6ef95c64f420efe103b983
Opcode Fuzzy Hash: 726211901c58432d52d2b28b848c417febb49b9bff3514d6c8a72a14fd0387d8
Instruction Fuzzy Hash: 4601D631B44219B7E730AA699C46FAA7BA4EF05B24F300B35B615EB1C0D960B8009295

Function 033B2F50 Relevance: 6.1, APIs: 4, Instructions: 54COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?,00000000,00000000,?,033B3961,?,?,?,?,?,?,00000000), ref: 033B2F59

Part of subcall function 033B8890: lstrcmpiA.KERNEL32(?,?), ref: 033B88AE

LeaveCriticalSection.KERNEL32(?,?,?,?,?,?,?,00000000), ref: 033B2F74
LeaveCriticalSection.KERNEL32(?,?,?,?,?,?,?,00000000), ref: 033B2F92

Memory Dump Source

Source File: 00000014.00000002.2494020967.00000000033B1000.00000020.00000001.01000000.00000015.sdmp, Offset: 033B0000, based on PE: true

Associated: 00000014.00000002.2493917908.00000000033B0000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000014.00000002.2497615129.00000000033F3000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000014.00000002.2498110795.0000000003400000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000014.00000002.2498410969.0000000003406000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000014.00000002.2498556459.0000000003408000.00000008.00000001.01000000.00000015.sdmpDownload File
Associated: 00000014.00000002.2498718201.000000000340A000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000014.00000002.2499166516.0000000003411000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_33b0000_Picasa3.jbxd

Similarity

API ID: CriticalSection$Leave$Enterlstrcmpi
String ID:
API String ID: 431788158-0
Opcode ID: 0fb501b3ac2c7c2addbc95d78ff2923f1b6984628ca88a443e0ab22313936c1d
Instruction ID: e6e96c3af352ea1db5b4d6b85eaed627049bf0006f44ea1758b42826a0ca464e
Opcode Fuzzy Hash: 0fb501b3ac2c7c2addbc95d78ff2923f1b6984628ca88a443e0ab22313936c1d
Instruction Fuzzy Hash: 53F06276600211ABD620DAA8ECC4B96F3BCEB44775F118A16F711D7544C770E81187A0

Function 033EA74A Relevance: 6.0, APIs: 4, Instructions: 48COMMONLIBRARYCODE

Download Yara Rule

APIs

__cftof_l.LIBCMT ref: 033EA76E

Part of subcall function 033EA599: __fltout2.LIBCMT ref: 033EA5C3

__cftog_l.LIBCMT ref: 033EA794
__cftoe_l.LIBCMT ref: 033EA7C6

Memory Dump Source

Source File: 00000014.00000002.2494020967.00000000033B1000.00000020.00000001.01000000.00000015.sdmp, Offset: 033B0000, based on PE: true

Associated: 00000014.00000002.2493917908.00000000033B0000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000014.00000002.2497615129.00000000033F3000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000014.00000002.2498110795.0000000003400000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000014.00000002.2498410969.0000000003406000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000014.00000002.2498556459.0000000003408000.00000008.00000001.01000000.00000015.sdmpDownload File
Associated: 00000014.00000002.2498718201.000000000340A000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000014.00000002.2499166516.0000000003411000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_33b0000_Picasa3.jbxd

Similarity

API ID: __cftoe_l__cftof_l__cftog_l__fltout2
String ID:
API String ID: 3016257755-0
Opcode ID: 7ea3a893bf3bd11cad7cd0372379ff1f7e327c259811a7a92178e9d3a0fb71f7
Instruction ID: fe108975d34ad95f6169d7e5f56206362964c96faf347781c37b70d1a93c36ee
Opcode Fuzzy Hash: 7ea3a893bf3bd11cad7cd0372379ff1f7e327c259811a7a92178e9d3a0fb71f7
Instruction Fuzzy Hash: 5C01457640025ABBCF129EC8CC91CEE3F76BB1C251B598815FA68581B0D236C9B1BB81

Function 04070C5D Relevance: 6.0, APIs: 4, Instructions: 48COMMONLIBRARYCODE

Download Yara Rule

APIs

__cftof_l.LIBCMT ref: 04070C81

Part of subcall function 04070AAC: __fltout2.LIBCMT ref: 04070AD6

__cftog_l.LIBCMT ref: 04070CA7
__cftoe_l.LIBCMT ref: 04070CD9

Memory Dump Source

Source File: 00000014.00000002.2502041842.0000000004031000.00000020.00000001.01000000.00000017.sdmp, Offset: 04030000, based on PE: true

Associated: 00000014.00000002.2501986218.0000000004030000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000014.00000002.2504208079.0000000004079000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000014.00000002.2504943590.0000000004086000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000014.00000002.2505148754.000000000408E000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000014.00000002.2505282171.0000000004090000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000014.00000002.2505501725.0000000004097000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_4030000_Picasa3.jbxd

Similarity

API ID: __cftoe_l__cftof_l__cftog_l__fltout2
String ID:
API String ID: 3016257755-0
Opcode ID: 7ea3a893bf3bd11cad7cd0372379ff1f7e327c259811a7a92178e9d3a0fb71f7
Instruction ID: f7ca8aa6c99ae5806ecfb164d9a71b5fb7491bc0bfb55f16a7ca0273ea24c87a
Opcode Fuzzy Hash: 7ea3a893bf3bd11cad7cd0372379ff1f7e327c259811a7a92178e9d3a0fb71f7
Instruction Fuzzy Hash: 4A01807291114EBBDF165F84CD41CEE3F63BB08358F088614FA1868130D336E5B1AB8A

Function 04884534 Relevance: 6.0, APIs: 4, Instructions: 48COMMONLIBRARYCODE

Download Yara Rule

APIs

__cftof_l.LIBCMT ref: 04884558

Part of subcall function 04884383: __fltout2.LIBCMT ref: 048843AD

__cftog_l.LIBCMT ref: 0488457E
__cftoe_l.LIBCMT ref: 048845B0

Memory Dump Source

Source File: 00000014.00000002.2526268174.00000000047E1000.00000020.00000001.01000000.00000016.sdmp, Offset: 047E0000, based on PE: true

Associated: 00000014.00000002.2526187657.00000000047E0000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000014.00000002.2533437740.000000000488F000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000014.00000002.2535246598.00000000048AB000.00000004.00000001.01000000.00000016.sdmpDownload File
Associated: 00000014.00000002.2535569716.00000000048B3000.00000008.00000001.01000000.00000016.sdmpDownload File
Associated: 00000014.00000002.2535640427.00000000048B5000.00000004.00000001.01000000.00000016.sdmpDownload File
Associated: 00000014.00000002.2536317728.00000000048C0000.00000002.00000001.01000000.00000016.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_47e0000_Picasa3.jbxd

Similarity

API ID: __cftoe_l__cftof_l__cftog_l__fltout2
String ID:
API String ID: 3016257755-0
Opcode ID: 7ea3a893bf3bd11cad7cd0372379ff1f7e327c259811a7a92178e9d3a0fb71f7
Instruction ID: b1bf28540d0c3f61133250016cd6fa0c4e82336cc3a8c0c98db1dec13fa3105f
Opcode Fuzzy Hash: 7ea3a893bf3bd11cad7cd0372379ff1f7e327c259811a7a92178e9d3a0fb71f7
Instruction Fuzzy Hash: 4301427300014EBBCF166E88DC05CEE3F66BB08758B448A19FE1894130E736E671AB81

Function 033E2010 Relevance: 6.0, APIs: 4, Instructions: 47COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 033E06D5: __amsg_exit.LIBCMT ref: 033E06E3

__amsg_exit.LIBCMT ref: 033E203C
__lock.LIBCMT ref: 033E204C
InterlockedDecrement.KERNEL32(?), ref: 033E2069
InterlockedIncrement.KERNEL32(04991548), ref: 033E2094

Memory Dump Source

Source File: 00000014.00000002.2494020967.00000000033B1000.00000020.00000001.01000000.00000015.sdmp, Offset: 033B0000, based on PE: true

Associated: 00000014.00000002.2493917908.00000000033B0000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000014.00000002.2497615129.00000000033F3000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000014.00000002.2498110795.0000000003400000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000014.00000002.2498410969.0000000003406000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000014.00000002.2498556459.0000000003408000.00000008.00000001.01000000.00000015.sdmpDownload File
Associated: 00000014.00000002.2498718201.000000000340A000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000014.00000002.2499166516.0000000003411000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_33b0000_Picasa3.jbxd

Similarity

API ID: Interlocked__amsg_exit$DecrementIncrement__lock
String ID:
API String ID: 4129207761-0
Opcode ID: 30fcb33d4e7de830324b7f385d16bdf9625ac06a558a3503d49c16102b25c6e1
Instruction ID: 789cdfcf7f17ce7713157a5e962e0688cac4ea484326f1fa239d7591a237bc04
Opcode Fuzzy Hash: 30fcb33d4e7de830324b7f385d16bdf9625ac06a558a3503d49c16102b25c6e1
Instruction Fuzzy Hash: 64015E36E01732ABD625FB6598C475AB7A8BB04722F084509D810BB2C4CB389D41CBD5

Function 033E065E Relevance: 6.0, APIs: 4, Instructions: 45threadCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,00000000,033DF4AB,033E1BF6,00000001,033E03BD,?,00000000,?,?,?,033DC7F4,033E04CF,?,033DC7F4,?), ref: 033E0660

Part of subcall function 033E0517: TlsGetValue.KERNEL32(00000000,033E0673,?,00000000,033DF4AB,033E1BF6,00000001,033E03BD,?,00000000,?,?,?,033DC7F4,033E04CF), ref: 033E051E
Part of subcall function 033E0517: TlsSetValue.KERNEL32(00000000,00000000,033DF4AB,033E1BF6,00000001,033E03BD,?,00000000,?,?,?,033DC7F4,033E04CF,?,033DC7F4,?), ref: 033E053F

__calloc_crt.LIBCMT ref: 033E0682

Part of subcall function 033E2DFB: __calloc_impl.LIBCMT ref: 033E2E09
Part of subcall function 033E2DFB: Sleep.KERNEL32(00000000,?,033DC7F4,?), ref: 033E2E20

Part of subcall function 033E0485: TlsGetValue.KERNEL32(?,033E0AC9,033DC963,033DC7F4,?,033DC7F4,?), ref: 033E0492
Part of subcall function 033E0485: TlsGetValue.KERNEL32(00000009,?,033DC7F4,?), ref: 033E04A9

Part of subcall function 033E059F: GetModuleHandleA.KERNEL32(KERNEL32.DLL,033FDBF8,0000000C,033E06B0,00000000,00000000,?,00000000,033DF4AB,033E1BF6,00000001,033E03BD,?,00000000), ref: 033E05B0
Part of subcall function 033E059F: GetProcAddress.KERNEL32(?,EncodePointer), ref: 033E05E4
Part of subcall function 033E059F: GetProcAddress.KERNEL32(?,DecodePointer), ref: 033E05F4
Part of subcall function 033E059F: InterlockedIncrement.KERNEL32(034004A8), ref: 033E0616
Part of subcall function 033E059F: __lock.LIBCMT ref: 033E061E
Part of subcall function 033E059F: ___addlocaleref.LIBCMT ref: 033E063D

GetCurrentThreadId.KERNEL32 ref: 033E06B2
SetLastError.KERNEL32(00000000,?,00000000,033DF4AB,033E1BF6,00000001,033E03BD,?,00000000,?,?,?,033DC7F4,033E04CF,?,033DC7F4), ref: 033E06CA

Memory Dump Source

Source File: 00000014.00000002.2494020967.00000000033B1000.00000020.00000001.01000000.00000015.sdmp, Offset: 033B0000, based on PE: true

Associated: 00000014.00000002.2493917908.00000000033B0000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000014.00000002.2497615129.00000000033F3000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000014.00000002.2498110795.0000000003400000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000014.00000002.2498410969.0000000003406000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000014.00000002.2498556459.0000000003408000.00000008.00000001.01000000.00000015.sdmpDownload File
Associated: 00000014.00000002.2498718201.000000000340A000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000014.00000002.2499166516.0000000003411000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_33b0000_Picasa3.jbxd

Similarity

API ID: Value$AddressErrorLastProc$CurrentHandleIncrementInterlockedModuleSleepThread___addlocaleref__calloc_crt__calloc_impl__lock
String ID:
API String ID: 1081334783-0
Opcode ID: 85f068974cb306d5abcf31bdefffaa2fd961d9e7dc508151cce8366cc7d9822c
Instruction ID: ba9f43b116c942e15bb76c31dde547892c4ccf568c7a02edc7915b4801c367d4
Opcode Fuzzy Hash: 85f068974cb306d5abcf31bdefffaa2fd961d9e7dc508151cce8366cc7d9822c
Instruction Fuzzy Hash: A3F0A43A905732AFD73A7B75ACC8B5A6A98EF80770B140119F455AA1D4CE71C40287A4

Function 040647B5 Relevance: 6.0, APIs: 4, Instructions: 45threadCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(00000000,00000000,040636ED,04064E08,00000001,04064514,00000000,00000000,00000000,?,?,?,04064626), ref: 040647B7

Part of subcall function 0406466E: TlsGetValue.KERNEL32(00000000,040647CA,?,?,?,04064626), ref: 04064675
Part of subcall function 0406466E: TlsSetValue.KERNEL32(00000000,?,?,04064626), ref: 04064696

__calloc_crt.LIBCMT ref: 040647D9

Part of subcall function 04064B92: __calloc_impl.LIBCMT ref: 04064BA0
Part of subcall function 04064B92: Sleep.KERNEL32(00000000,00000000,?,00000000), ref: 04064BB7

Part of subcall function 040645DC: TlsGetValue.KERNEL32(00000000,04066D4A,04061974,?,00000001,040351EC,00000001), ref: 040645E9
Part of subcall function 040645DC: TlsGetValue.KERNEL32(0000000B), ref: 04064600

Part of subcall function 040646F6: GetModuleHandleA.KERNEL32(KERNEL32.DLL,04083A00,0000000C,04064807,00000000,00000000,?,?,?,04064626), ref: 04064707
Part of subcall function 040646F6: GetProcAddress.KERNEL32(?,EncodePointer), ref: 0406473B
Part of subcall function 040646F6: GetProcAddress.KERNEL32(?,DecodePointer), ref: 0406474B
Part of subcall function 040646F6: InterlockedIncrement.KERNEL32(040867F0), ref: 0406476D
Part of subcall function 040646F6: __lock.LIBCMT ref: 04064775
Part of subcall function 040646F6: ___addlocaleref.LIBCMT ref: 04064794

GetCurrentThreadId.KERNEL32 ref: 04064809
SetLastError.KERNEL32(00000000,?,?,?,04064626), ref: 04064821

Memory Dump Source

Source File: 00000014.00000002.2502041842.0000000004031000.00000020.00000001.01000000.00000017.sdmp, Offset: 04030000, based on PE: true

Associated: 00000014.00000002.2501986218.0000000004030000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000014.00000002.2504208079.0000000004079000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000014.00000002.2504943590.0000000004086000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000014.00000002.2505148754.000000000408E000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000014.00000002.2505282171.0000000004090000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000014.00000002.2505501725.0000000004097000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_4030000_Picasa3.jbxd

Similarity

API ID: Value$AddressErrorLastProc$CurrentHandleIncrementInterlockedModuleSleepThread___addlocaleref__calloc_crt__calloc_impl__lock
String ID:
API String ID: 1081334783-0
Opcode ID: 28d963dc5a80dc0b52dbbb5a3d5f8d61a1313ecbdb48ea79b969e52d413b2ec4
Instruction ID: 31b092995950e4f5ef6bcbb3d1a3d8ed7998fea24010a53ccca6e03cf8a1c45b
Opcode Fuzzy Hash: 28d963dc5a80dc0b52dbbb5a3d5f8d61a1313ecbdb48ea79b969e52d413b2ec4
Instruction Fuzzy Hash: 1DF0F4329016226EE6323E747C04A9E3B94DF42674B110629FA4BBA1A0CE2DAC4186D9

Function 033DE18E Relevance: 6.0, APIs: 4, Instructions: 43threadCOMMON

Download Yara Rule

APIs

Part of subcall function 033E0517: TlsGetValue.KERNEL32(00000000,033E0673,?,00000000,033DF4AB,033E1BF6,00000001,033E03BD,?,00000000,?,?,?,033DC7F4,033E04CF), ref: 033E051E
Part of subcall function 033E0517: TlsSetValue.KERNEL32(00000000,00000000,033DF4AB,033E1BF6,00000001,033E03BD,?,00000000,?,?,?,033DC7F4,033E04CF,?,033DC7F4,?), ref: 033E053F

Part of subcall function 033E04FC: TlsGetValue.KERNEL32(?,033DE1AB,00000000,?,?), ref: 033E0506

GetLastError.KERNEL32(00000000,?,00000000,?,?), ref: 033DE1C3
ExitThread.KERNEL32 ref: 033DE1CA
GetCurrentThreadId.KERNEL32 ref: 033DE1D0
__freefls@4.LIBCMT ref: 033DE1F1

Memory Dump Source

Source File: 00000014.00000002.2494020967.00000000033B1000.00000020.00000001.01000000.00000015.sdmp, Offset: 033B0000, based on PE: true

Associated: 00000014.00000002.2493917908.00000000033B0000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000014.00000002.2497615129.00000000033F3000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000014.00000002.2498110795.0000000003400000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000014.00000002.2498410969.0000000003406000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000014.00000002.2498556459.0000000003408000.00000008.00000001.01000000.00000015.sdmpDownload File
Associated: 00000014.00000002.2498718201.000000000340A000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000014.00000002.2499166516.0000000003411000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_33b0000_Picasa3.jbxd

Similarity

API ID: Value$Thread$CurrentErrorExitLast__freefls@4
String ID:
API String ID: 3657912857-0
Opcode ID: d3ef7a760e1bf2349f33ecf8abc0cad1880c64f5b1098d0a12c2e71231ba9091
Instruction ID: 5c70f8241489042b2082d80857716b74d4f1cb7d9f184ea8357dd6bd56823b12
Opcode Fuzzy Hash: d3ef7a760e1bf2349f33ecf8abc0cad1880c64f5b1098d0a12c2e71231ba9091
Instruction Fuzzy Hash: 1501B179900712AFDB08FBA1D9C895EBBB9EF04304F108458E9548F295D774C946CB92

Function 0406266D Relevance: 6.0, APIs: 4, Instructions: 43threadCOMMON

Download Yara Rule

APIs

Part of subcall function 0406466E: TlsGetValue.KERNEL32(00000000,040647CA,?,?,?,04064626), ref: 04064675
Part of subcall function 0406466E: TlsSetValue.KERNEL32(00000000,?,?,04064626), ref: 04064696

Part of subcall function 04064653: TlsGetValue.KERNEL32(?,0406268A,00000000,?,?), ref: 0406465D

GetLastError.KERNEL32(00000000,?,00000000,?,?), ref: 040626A2
ExitThread.KERNEL32 ref: 040626A9
GetCurrentThreadId.KERNEL32 ref: 040626AF
__freefls@4.LIBCMT ref: 040626D0

Memory Dump Source

Source File: 00000014.00000002.2502041842.0000000004031000.00000020.00000001.01000000.00000017.sdmp, Offset: 04030000, based on PE: true

Associated: 00000014.00000002.2501986218.0000000004030000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000014.00000002.2504208079.0000000004079000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000014.00000002.2504943590.0000000004086000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000014.00000002.2505148754.000000000408E000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000014.00000002.2505282171.0000000004090000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000014.00000002.2505501725.0000000004097000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_4030000_Picasa3.jbxd

Similarity

API ID: Value$Thread$CurrentErrorExitLast__freefls@4
String ID:
API String ID: 3657912857-0
Opcode ID: 1e86a684a0459517dd008406c675f858371f96c1c0d54aaae10be0f1fa5014c8
Instruction ID: 4a287b14dfc8671e55089f2b3d527e5c088439a101cbee5ec73d0adfc8132018
Opcode Fuzzy Hash: 1e86a684a0459517dd008406c675f858371f96c1c0d54aaae10be0f1fa5014c8
Instruction Fuzzy Hash: 83014F71901241AFEB04BFB0D9089DE7BA5EF4424DB1184A8B917B7220DB38F882DF57

Function 033C0040 Relevance: 6.0, APIs: 4, Instructions: 41COMMON

Download Yara Rule

APIs

CreateEventA.KERNEL32(00000000,00000001,00000000,00000000), ref: 033C0065
InterlockedExchange.KERNEL32(0340F188,00000000), ref: 033C008C
InitializeCriticalSection.KERNEL32(0340F1A8), ref: 033C00A3
CreateEventA.KERNEL32(00000000,00000000,00000000,00000000), ref: 033C00DB

Memory Dump Source

Source File: 00000014.00000002.2494020967.00000000033B1000.00000020.00000001.01000000.00000015.sdmp, Offset: 033B0000, based on PE: true

Associated: 00000014.00000002.2493917908.00000000033B0000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000014.00000002.2497615129.00000000033F3000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000014.00000002.2498110795.0000000003400000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000014.00000002.2498410969.0000000003406000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000014.00000002.2498556459.0000000003408000.00000008.00000001.01000000.00000015.sdmpDownload File
Associated: 00000014.00000002.2498718201.000000000340A000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000014.00000002.2499166516.0000000003411000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_33b0000_Picasa3.jbxd

Similarity

API ID: CreateEvent$CriticalExchangeInitializeInterlockedSection
String ID:
API String ID: 2986729424-0
Opcode ID: d16a0249b2f4ec9eeb333eb07300f207226112bcd69d611d3f458e873d0be4b2
Instruction ID: f0682fb05739805aa37367e55fc8327c5308c5aeedd7155295ce340747fccf52
Opcode Fuzzy Hash: d16a0249b2f4ec9eeb333eb07300f207226112bcd69d611d3f458e873d0be4b2
Instruction Fuzzy Hash: 210197B0B15205AEE320EF29EBC59557AE8F30D35CBD0013FE509AE249C3750C4D8B90

Function 04044750 Relevance: 6.0, APIs: 4, Instructions: 41COMMON

Download Yara Rule

APIs

CreateEventA.KERNEL32(00000000,00000001,00000000,00000000), ref: 04044775
InterlockedExchange.KERNEL32(04094100,00000000), ref: 0404479C
InitializeCriticalSection.KERNEL32(04094120), ref: 040447B3
CreateEventA.KERNEL32(00000000,00000000,00000000,00000000), ref: 040447EB

Memory Dump Source

Source File: 00000014.00000002.2502041842.0000000004031000.00000020.00000001.01000000.00000017.sdmp, Offset: 04030000, based on PE: true

Associated: 00000014.00000002.2501986218.0000000004030000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000014.00000002.2504208079.0000000004079000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000014.00000002.2504943590.0000000004086000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000014.00000002.2505148754.000000000408E000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000014.00000002.2505282171.0000000004090000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000014.00000002.2505501725.0000000004097000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_4030000_Picasa3.jbxd

Similarity

API ID: CreateEvent$CriticalExchangeInitializeInterlockedSection
String ID:
API String ID: 2986729424-0
Opcode ID: c27aad6f78301ac101c7e626912c44a348e73497e7be435f6951836150bc4c3f
Instruction ID: 0f13ff6612fdc731dd7c1ba859b7509d706e56f2dc56bdfb26169e3ac58451af
Opcode Fuzzy Hash: c27aad6f78301ac101c7e626912c44a348e73497e7be435f6951836150bc4c3f
Instruction Fuzzy Hash: 6A01A9F180C224AEE7108F5AB8C59527FA8F3E9348B41407EA118B7211DB7C1C868FA1

Function 04827540 Relevance: 6.0, APIs: 4, Instructions: 34fileCOMMON

Download Yara Rule

APIs

SetFilePointer.KERNEL32(?,00000000,00000000,00000000,?,04827A54,?,04827F24,?,?,?,?,0000000A), ref: 04827570
GetLastError.KERNEL32(?,04827F24,?,?,?,?,0000000A), ref: 0482757B
SetEndOfFile.KERNEL32(?,?,04827A54,?,04827F24,?,?,?,?,0000000A), ref: 04827585
GetLastError.KERNEL32(?,04827F24,?,?,?,?,0000000A), ref: 0482758F

Memory Dump Source

Source File: 00000014.00000002.2526268174.00000000047E1000.00000020.00000001.01000000.00000016.sdmp, Offset: 047E0000, based on PE: true

Associated: 00000014.00000002.2526187657.00000000047E0000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000014.00000002.2533437740.000000000488F000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000014.00000002.2535246598.00000000048AB000.00000004.00000001.01000000.00000016.sdmpDownload File
Associated: 00000014.00000002.2535569716.00000000048B3000.00000008.00000001.01000000.00000016.sdmpDownload File
Associated: 00000014.00000002.2535640427.00000000048B5000.00000004.00000001.01000000.00000016.sdmpDownload File
Associated: 00000014.00000002.2536317728.00000000048C0000.00000002.00000001.01000000.00000016.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_47e0000_Picasa3.jbxd

Similarity

API ID: ErrorFileLast$Pointer
String ID:
API String ID: 1697706070-0
Opcode ID: 4075841620801e9915fb6a2e361d8302c1c2f16cc9c14c5b343f54214a170285
Instruction ID: 63c5f4123221ac860220ae327f6b97b35e7dea2592e9c928601f761e0f52e8bd
Opcode Fuzzy Hash: 4075841620801e9915fb6a2e361d8302c1c2f16cc9c14c5b343f54214a170285
Instruction Fuzzy Hash: 8DF0BD707007129BE7208A7ADB89F16F7D5BB08715F504E1CE26AC6681D734F8808614

Function 040359F0 Relevance: 6.0, APIs: 4, Instructions: 30windowCOMMON

Download Yara Rule

APIs

IsWindow.USER32(00000000), ref: 04035A0C
IsWindowVisible.USER32(00000000), ref: 04035A1C
PostMessageA.USER32(00000000,00000010,00000000,00000000), ref: 04035A32
PostMessageA.USER32(00000000,00000010,00000000,00000000), ref: 04035A40

Memory Dump Source

Source File: 00000014.00000002.2502041842.0000000004031000.00000020.00000001.01000000.00000017.sdmp, Offset: 04030000, based on PE: true

Associated: 00000014.00000002.2501986218.0000000004030000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000014.00000002.2504208079.0000000004079000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000014.00000002.2504943590.0000000004086000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000014.00000002.2505148754.000000000408E000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000014.00000002.2505282171.0000000004090000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000014.00000002.2505501725.0000000004097000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_4030000_Picasa3.jbxd

Similarity

API ID: MessagePostWindow$Visible
String ID:
API String ID: 2246049238-0
Opcode ID: 1447598474303d7d3e8ff607172d294fea3cb464418b4c97652240b8fae5a542
Instruction ID: 496859552db43af6c0d313d85e31fc83589c9171376637fe32ba3c49ac37fbc2
Opcode Fuzzy Hash: 1447598474303d7d3e8ff607172d294fea3cb464418b4c97652240b8fae5a542
Instruction Fuzzy Hash: E0F098F0A41600BAFF619EE1AD88B623BECE705B45F044868B500FA1E1DBACEC40D625

Function 033D9390 Relevance: 5.5, APIs: 1, Strings: 2, Instructions: 233COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 033D9462

Strings

KYMC, xrefs: 033D93F7
KYMC, xrefs: 033D9550

Memory Dump Source

Source File: 00000014.00000002.2494020967.00000000033B1000.00000020.00000001.01000000.00000015.sdmp, Offset: 033B0000, based on PE: true

Associated: 00000014.00000002.2493917908.00000000033B0000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000014.00000002.2497615129.00000000033F3000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000014.00000002.2498110795.0000000003400000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000014.00000002.2498410969.0000000003406000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000014.00000002.2498556459.0000000003408000.00000008.00000001.01000000.00000015.sdmpDownload File
Associated: 00000014.00000002.2498718201.000000000340A000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000014.00000002.2499166516.0000000003411000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_33b0000_Picasa3.jbxd

Similarity

API ID: _memset
String ID: KYMC$KYMC
API String ID: 2102423945-3985403719
Opcode ID: 6b1ad85de0cf9e736fa7ef52f4140353eefd267fa746d3c7d9a8ba87bd471cf8
Instruction ID: 59d4919a9e4fcbb8c297f395fd66ca5dbb4d3c27542209c87be611d87bebbb11
Opcode Fuzzy Hash: 6b1ad85de0cf9e736fa7ef52f4140353eefd267fa746d3c7d9a8ba87bd471cf8
Instruction Fuzzy Hash: 588191B6A00341ABD714DF28E8C0B6BB7A9FF88314F08456DF9499B381DB35E914CB95

Function 04060380 Relevance: 5.5, APIs: 1, Strings: 2, Instructions: 233COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 04060452

Strings

KYMC, xrefs: 040603E7
KYMC, xrefs: 04060540

Memory Dump Source

Source File: 00000014.00000002.2502041842.0000000004031000.00000020.00000001.01000000.00000017.sdmp, Offset: 04030000, based on PE: true

Associated: 00000014.00000002.2501986218.0000000004030000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000014.00000002.2504208079.0000000004079000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000014.00000002.2504943590.0000000004086000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000014.00000002.2505148754.000000000408E000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000014.00000002.2505282171.0000000004090000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000014.00000002.2505501725.0000000004097000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_4030000_Picasa3.jbxd

Similarity

API ID: _memset
String ID: KYMC$KYMC
API String ID: 2102423945-3985403719
Opcode ID: b8cee48ed8a90b3509547e96e4c8566056e13c0ce83c60656992873d57078218
Instruction ID: 34836f0bb23f4c1fd1b65b9d6be6e84e9da0a79eb6e38161135fa045845f1a5e
Opcode Fuzzy Hash: b8cee48ed8a90b3509547e96e4c8566056e13c0ce83c60656992873d57078218
Instruction Fuzzy Hash: B281A3B16002059FD714EF18D880AABB7E9FF88318F04452DFD4AA7241E775F914CBA6

Function 0481D690 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 136COMMON

Download Yara Rule

Strings

:%d, xrefs: 0481D7BD, 0481D7FA
https://, xrefs: 0481D775

Memory Dump Source

Source File: 00000014.00000002.2526268174.00000000047E1000.00000020.00000001.01000000.00000016.sdmp, Offset: 047E0000, based on PE: true

Associated: 00000014.00000002.2526187657.00000000047E0000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000014.00000002.2533437740.000000000488F000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000014.00000002.2535246598.00000000048AB000.00000004.00000001.01000000.00000016.sdmpDownload File
Associated: 00000014.00000002.2535569716.00000000048B3000.00000008.00000001.01000000.00000016.sdmpDownload File
Associated: 00000014.00000002.2535640427.00000000048B5000.00000004.00000001.01000000.00000016.sdmpDownload File
Associated: 00000014.00000002.2536317728.00000000048C0000.00000002.00000001.01000000.00000016.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_47e0000_Picasa3.jbxd

Similarity

API ID: Interlocked$DecrementIncrement
String ID: :%d$https://
API String ID: 2172605799-4007839252
Opcode ID: 684398f018235fa965e6eb172946cc8aa68508d871c808f0b0477f03e1426b0f
Instruction ID: 00196f396fecff8f87cd78880af88545ae0d0fe2053ab93a26f1934403377f2f
Opcode Fuzzy Hash: 684398f018235fa965e6eb172946cc8aa68508d871c808f0b0477f03e1426b0f
Instruction Fuzzy Hash: 8351B0312183558FD721DF28C8447ABB7E8BF85708F444E1AE884D7220D774BA09CBA2

Function 040378C0 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 132COMMON

Download Yara Rule

APIs

GetSystemMetrics.USER32(00000011), ref: 04037902
GetSystemMetrics.USER32(00000010), ref: 04037919

Strings

(, xrefs: 04037989

Memory Dump Source

Source File: 00000014.00000002.2502041842.0000000004031000.00000020.00000001.01000000.00000017.sdmp, Offset: 04030000, based on PE: true

Associated: 00000014.00000002.2501986218.0000000004030000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000014.00000002.2504208079.0000000004079000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000014.00000002.2504943590.0000000004086000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000014.00000002.2505148754.000000000408E000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000014.00000002.2505282171.0000000004090000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000014.00000002.2505501725.0000000004097000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_4030000_Picasa3.jbxd

Similarity

API ID: MetricsSystem
String ID: (
API String ID: 4116985748-3887548279
Opcode ID: c6f3569065681849dd31f2ba75b22129f542703952d3a0fe4f8e6dff0ae74b65
Instruction ID: 1b317b9e1f1b8e13d6db700d17d703e0a92fa100793aa8d7ed3eac4fb336a025
Opcode Fuzzy Hash: c6f3569065681849dd31f2ba75b22129f542703952d3a0fe4f8e6dff0ae74b65
Instruction Fuzzy Hash: E8414DB06047458FCB14DF69C58092AFBE9AF84319F44CA2EE589E7351EBB4F805CB42

Function 0481A570 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 107COMMON

Download Yara Rule

APIs

Part of subcall function 047E3430: InterlockedDecrement.KERNEL32(00000000), ref: 047E3442
Part of subcall function 047E3430: InterlockedIncrement.KERNEL32(00000000), ref: 047E345E

InterlockedIncrement.KERNEL32(00000000), ref: 0481A659

Strings

.google.com, xrefs: 0481A67D
.google., xrefs: 0481A5E3

Memory Dump Source

Source File: 00000014.00000002.2526268174.00000000047E1000.00000020.00000001.01000000.00000016.sdmp, Offset: 047E0000, based on PE: true

Associated: 00000014.00000002.2526187657.00000000047E0000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000014.00000002.2533437740.000000000488F000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000014.00000002.2535246598.00000000048AB000.00000004.00000001.01000000.00000016.sdmpDownload File
Associated: 00000014.00000002.2535569716.00000000048B3000.00000008.00000001.01000000.00000016.sdmpDownload File
Associated: 00000014.00000002.2535640427.00000000048B5000.00000004.00000001.01000000.00000016.sdmpDownload File
Associated: 00000014.00000002.2536317728.00000000048C0000.00000002.00000001.01000000.00000016.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_47e0000_Picasa3.jbxd

Similarity

API ID: Interlocked$Increment$Decrement
String ID: .google.$.google.com
API String ID: 4289621856-3325920050
Opcode ID: aef157a3a82fcfa07e6bb9d5ea68dfda211c6c82734ef2d97ceb1721e5f59c04
Instruction ID: 032b42b684994fe35610e239b3996bdd83d5c41a0c42b6f65319ce9133bcc47a
Opcode Fuzzy Hash: aef157a3a82fcfa07e6bb9d5ea68dfda211c6c82734ef2d97ceb1721e5f59c04
Instruction Fuzzy Hash: 0331B1712183414BD715EF68C8545EEB3D5AF85354F800F2AE056D72A1DB78F5488692

Function 033B39E0 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 104stringCOMMON

Download Yara Rule

APIs

Part of subcall function 033B3810: lstrlenA.KERNEL32(?,00000000,?,?,00000000,?,?,?,?,?,?,?,?,033B3A0E,?,00000000), ref: 033B3843
Part of subcall function 033B3810: CharNextA.USER32(?,?,00000000,?,?,00000000,?,?,?,?,?,?,?,?,033B3A0E), ref: 033B389B
Part of subcall function 033B3810: CharNextA.USER32(?,?,00000000,?,?,00000000,?,?,?,?,?,?,?,?,033B3A0E), ref: 033B38A7
Part of subcall function 033B3810: CharNextA.USER32(?,?,?,?,00000000,?,?,00000000), ref: 033B38C2
Part of subcall function 033B3810: CoTaskMemFree.OLE32(?,?,00000000,?,?,00000000,?,?,?,?,?,?,?,?,033B3A0E), ref: 033B38E2

lstrcmpiA.KERNEL32(00000000), ref: 033B3A5D
CoTaskMemFree.OLE32(033B2987,?,00000000), ref: 033B3AD7

Strings

{, xrefs: 033B3A93

Memory Dump Source

Source File: 00000014.00000002.2494020967.00000000033B1000.00000020.00000001.01000000.00000015.sdmp, Offset: 033B0000, based on PE: true

Associated: 00000014.00000002.2493917908.00000000033B0000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000014.00000002.2497615129.00000000033F3000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000014.00000002.2498110795.0000000003400000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000014.00000002.2498410969.0000000003406000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000014.00000002.2498556459.0000000003408000.00000008.00000001.01000000.00000015.sdmpDownload File
Associated: 00000014.00000002.2498718201.000000000340A000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000014.00000002.2499166516.0000000003411000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_33b0000_Picasa3.jbxd

Similarity

API ID: CharNext$FreeTask$lstrcmpilstrlen
String ID: {
API String ID: 695951202-366298937
Opcode ID: 6d5e5b08e8528d82a0cc84a9596d261c931e05b90ac5ac0b3b5ca63707b05b1e
Instruction ID: 4930815c8dae94201845c016f4227ff21ccadd46caf958d9daf8b7c6551fbe1f
Opcode Fuzzy Hash: 6d5e5b08e8528d82a0cc84a9596d261c931e05b90ac5ac0b3b5ca63707b05b1e
Instruction Fuzzy Hash: 1731A47EB043559BD311EA18DCC0BEBB7FDAFC4720F24481DE6899B640EA74D90487A2

Function 040336C0 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 101COMMON

Download Yara Rule

APIs

Part of subcall function 04033C60: InterlockedIncrement.KERNEL32(00000000), ref: 04033CB8
Part of subcall function 04033C60: InterlockedIncrement.KERNEL32(00000000), ref: 04033D28
Part of subcall function 04033C60: InterlockedIncrement.KERNEL32(00000000), ref: 04033D73

InterlockedIncrement.KERNEL32(00000000), ref: 0403373A
InterlockedIncrement.KERNEL32(?), ref: 040337AC

Strings

ru, xrefs: 0403373A, 040337AC

Memory Dump Source

Source File: 00000014.00000002.2502041842.0000000004031000.00000020.00000001.01000000.00000017.sdmp, Offset: 04030000, based on PE: true

Associated: 00000014.00000002.2501986218.0000000004030000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000014.00000002.2504208079.0000000004079000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000014.00000002.2504943590.0000000004086000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000014.00000002.2505148754.000000000408E000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000014.00000002.2505282171.0000000004090000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000014.00000002.2505501725.0000000004097000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_4030000_Picasa3.jbxd

Similarity

API ID: IncrementInterlocked
String ID: ru
API String ID: 3508698243-1355688448
Opcode ID: bffcf82be2cf776c63e709485e875fce827b076d0e482665eeeb21c9ba19cbe4
Instruction ID: 03b1884e96c59b573ad20ffa645b2f44fd77e6fb82fb80807dad5a58cbd3487d
Opcode Fuzzy Hash: bffcf82be2cf776c63e709485e875fce827b076d0e482665eeeb21c9ba19cbe4
Instruction Fuzzy Hash: 4131A1B11043028FE720AF15C8C0BAA7BD9AF8535AF10483CE981BB251CB74B9458B91

Function 04042D70 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 98COMMON

Download Yara Rule

APIs

InterlockedDecrement.KERNEL32(?), ref: 04042E11
InterlockedIncrement.KERNEL32(?), ref: 04042E29

Strings

ru, xrefs: 04042E29

Memory Dump Source

Source File: 00000014.00000002.2502041842.0000000004031000.00000020.00000001.01000000.00000017.sdmp, Offset: 04030000, based on PE: true

Associated: 00000014.00000002.2501986218.0000000004030000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000014.00000002.2504208079.0000000004079000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000014.00000002.2504943590.0000000004086000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000014.00000002.2505148754.000000000408E000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000014.00000002.2505282171.0000000004090000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000014.00000002.2505501725.0000000004097000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_4030000_Picasa3.jbxd

Similarity

API ID: Interlocked$DecrementIncrement
String ID: ru
API String ID: 2172605799-1355688448
Opcode ID: 7f45456deac0a2177fbb4b553f7fa0164463723fb09815ac056334e939ab39b7
Instruction ID: 4e533d67f6a1082858038e579ed6258f646cbf176a71328aa0023539ce4caea8
Opcode Fuzzy Hash: 7f45456deac0a2177fbb4b553f7fa0164463723fb09815ac056334e939ab39b7
Instruction Fuzzy Hash: 6031CEF27042419BD720DE58D880AAA37E5FBC1344F1908BDF116FB282DB39BD468756

Function 04033E10 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 96COMMON

Download Yara Rule

APIs

InterlockedIncrement.KERNEL32(00000000), ref: 04033E68
InterlockedIncrement.KERNEL32(00000000), ref: 04033ED8

Strings

ru, xrefs: 04033E68, 04033ED8

Memory Dump Source

Source File: 00000014.00000002.2502041842.0000000004031000.00000020.00000001.01000000.00000017.sdmp, Offset: 04030000, based on PE: true

Associated: 00000014.00000002.2501986218.0000000004030000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000014.00000002.2504208079.0000000004079000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000014.00000002.2504943590.0000000004086000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000014.00000002.2505148754.000000000408E000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000014.00000002.2505282171.0000000004090000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000014.00000002.2505501725.0000000004097000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_4030000_Picasa3.jbxd

Similarity

API ID: IncrementInterlocked
String ID: ru
API String ID: 3508698243-1355688448
Opcode ID: 12b21bed7a5af2d0678da1a1c042ff0c5a3ea5aaadb1b584213522915ef2c1ec
Instruction ID: b23fb13c9f10f30a5deb550b7b33064e9d8d2c68dd14c121823d62381738e274
Opcode Fuzzy Hash: 12b21bed7a5af2d0678da1a1c042ff0c5a3ea5aaadb1b584213522915ef2c1ec
Instruction Fuzzy Hash: 5331E4728043628FD7519F15D4807AABFE9EF8474AF088469ED41BF246CB34B949CBD1

Function 04042D96 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 84COMMON

Download Yara Rule

APIs

InterlockedDecrement.KERNEL32(?), ref: 04042E11
InterlockedIncrement.KERNEL32(?), ref: 04042E29

Strings

ru, xrefs: 04042E29

Memory Dump Source

Source File: 00000014.00000002.2502041842.0000000004031000.00000020.00000001.01000000.00000017.sdmp, Offset: 04030000, based on PE: true

Associated: 00000014.00000002.2501986218.0000000004030000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000014.00000002.2504208079.0000000004079000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000014.00000002.2504943590.0000000004086000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000014.00000002.2505148754.000000000408E000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000014.00000002.2505282171.0000000004090000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000014.00000002.2505501725.0000000004097000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_4030000_Picasa3.jbxd

Similarity

API ID: Interlocked$DecrementIncrement
String ID: ru
API String ID: 2172605799-1355688448
Opcode ID: 60b4b721a64ed0943e349937917073e96a190b85101b7640348f3ff6d14d0136
Instruction ID: 78f376db7882cfa21d8d8d5f18fa38c980ce3d846b4e08f5e2521e313e016cdf
Opcode Fuzzy Hash: 60b4b721a64ed0943e349937917073e96a190b85101b7640348f3ff6d14d0136
Instruction Fuzzy Hash: 9721CEF26042419BD720DF54D8D0AA937E1FBC1348F1908BDE156AB282DB3ABD468B56

Function 0482F480 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 77COMMON

Download Yara Rule

APIs

Part of subcall function 04832DE0: EnterCriticalSection.KERNEL32(048BB878,052650A0,00000000,?,?,00000000,?,?,?,?), ref: 04832E19
Part of subcall function 04832DE0: InterlockedIncrement.KERNEL32(00000000), ref: 04832E8F
Part of subcall function 04832DE0: InterlockedIncrement.KERNEL32(00000000), ref: 04832EAC

Part of subcall function 047E3430: InterlockedDecrement.KERNEL32(00000000), ref: 047E3442
Part of subcall function 047E3430: InterlockedIncrement.KERNEL32(00000000), ref: 047E345E

InterlockedIncrement.KERNEL32(00000000), ref: 0482F4FD

Strings

ytApp::InfoTitle, xrefs: 0482F4C7
Info, xrefs: 0482F4CC

Memory Dump Source

Source File: 00000014.00000002.2526268174.00000000047E1000.00000020.00000001.01000000.00000016.sdmp, Offset: 047E0000, based on PE: true

Associated: 00000014.00000002.2526187657.00000000047E0000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000014.00000002.2533437740.000000000488F000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000014.00000002.2535246598.00000000048AB000.00000004.00000001.01000000.00000016.sdmpDownload File
Associated: 00000014.00000002.2535569716.00000000048B3000.00000008.00000001.01000000.00000016.sdmpDownload File
Associated: 00000014.00000002.2535640427.00000000048B5000.00000004.00000001.01000000.00000016.sdmpDownload File
Associated: 00000014.00000002.2536317728.00000000048C0000.00000002.00000001.01000000.00000016.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_47e0000_Picasa3.jbxd

Similarity

API ID: Interlocked$Increment$CriticalDecrementEnterSection
String ID: Info$ytApp::InfoTitle
API String ID: 1498674674-1881070251
Opcode ID: 8204d3d202d55b2b24a24cc1ae22d8ccb894abffa2a73d0f225a39f4debf01da
Instruction ID: d62113200282007c72e2d3a23e99b7e6102f57981abab8771e2f8fec4cf95c36
Opcode Fuzzy Hash: 8204d3d202d55b2b24a24cc1ae22d8ccb894abffa2a73d0f225a39f4debf01da
Instruction Fuzzy Hash: DC21C4715043624BD7219F28EA04AAB77E4EF81709F080F29FA81E7240D768F949E7D2

Function 0483C4F0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 74COMMON

Download Yara Rule

APIs

InterlockedIncrement.KERNEL32(?), ref: 0483C534
InterlockedIncrement.KERNEL32(00000027), ref: 0483C571

Strings

My Pictures, xrefs: 0483C579

Memory Dump Source

Source File: 00000014.00000002.2526268174.00000000047E1000.00000020.00000001.01000000.00000016.sdmp, Offset: 047E0000, based on PE: true

Associated: 00000014.00000002.2526187657.00000000047E0000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000014.00000002.2533437740.000000000488F000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000014.00000002.2535246598.00000000048AB000.00000004.00000001.01000000.00000016.sdmpDownload File
Associated: 00000014.00000002.2535569716.00000000048B3000.00000008.00000001.01000000.00000016.sdmpDownload File
Associated: 00000014.00000002.2535640427.00000000048B5000.00000004.00000001.01000000.00000016.sdmpDownload File
Associated: 00000014.00000002.2536317728.00000000048C0000.00000002.00000001.01000000.00000016.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_47e0000_Picasa3.jbxd

Similarity

API ID: IncrementInterlocked
String ID: My Pictures
API String ID: 3508698243-3990772490
Opcode ID: 6e2fe4b2fbdac9db0044e759227a4f1be7568706127b63a4e6e05007cf86200e
Instruction ID: 79bb9cc0dded43956d70274a3fffdcd4b6caf3633c3cf825321d8af2ca39bd84
Opcode Fuzzy Hash: 6e2fe4b2fbdac9db0044e759227a4f1be7568706127b63a4e6e05007cf86200e
Instruction Fuzzy Hash: C121AEB36083408FE725DF28D8857AA77E4BF85305F444E68E546D7251EB78F9088792

Function 0483C5F0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 74COMMON

Download Yara Rule

APIs

InterlockedIncrement.KERNEL32(?), ref: 0483C634
InterlockedIncrement.KERNEL32(0000000D), ref: 0483C671

Strings

My Music, xrefs: 0483C679

Memory Dump Source

Source File: 00000014.00000002.2526268174.00000000047E1000.00000020.00000001.01000000.00000016.sdmp, Offset: 047E0000, based on PE: true

Associated: 00000014.00000002.2526187657.00000000047E0000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000014.00000002.2533437740.000000000488F000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000014.00000002.2535246598.00000000048AB000.00000004.00000001.01000000.00000016.sdmpDownload File
Associated: 00000014.00000002.2535569716.00000000048B3000.00000008.00000001.01000000.00000016.sdmpDownload File
Associated: 00000014.00000002.2535640427.00000000048B5000.00000004.00000001.01000000.00000016.sdmpDownload File
Associated: 00000014.00000002.2536317728.00000000048C0000.00000002.00000001.01000000.00000016.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_47e0000_Picasa3.jbxd

Similarity

API ID: IncrementInterlocked
String ID: My Music
API String ID: 3508698243-1666671304
Opcode ID: c587391d15d653850519ff24ab871617687cf1eb31b687398daf866c663dd841
Instruction ID: 2c20a0f4f812ee6281558403b1758ec703b10a376eda07bb586101976e768121
Opcode Fuzzy Hash: c587391d15d653850519ff24ab871617687cf1eb31b687398daf866c663dd841
Instruction Fuzzy Hash: BD21E0B26083408FE715DF28D8897AA77E4AF45305F445E6CE446D7291E779B808C7D2

Function 04031BA0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 73COMMON

Download Yara Rule

APIs

InterlockedIncrement.KERNEL32(?), ref: 04031BCA
InterlockedIncrement.KERNEL32(00000000), ref: 04031C1C

Strings

ru, xrefs: 04031BA9

Memory Dump Source

Source File: 00000014.00000002.2502041842.0000000004031000.00000020.00000001.01000000.00000017.sdmp, Offset: 04030000, based on PE: true

Associated: 00000014.00000002.2501986218.0000000004030000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000014.00000002.2504208079.0000000004079000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000014.00000002.2504943590.0000000004086000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000014.00000002.2505148754.000000000408E000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000014.00000002.2505282171.0000000004090000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000014.00000002.2505501725.0000000004097000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_4030000_Picasa3.jbxd

Similarity

API ID: IncrementInterlocked
String ID: ru
API String ID: 3508698243-1355688448
Opcode ID: bbb951a2b16f2711dff1c466f4279195bc399d60260976cf1e934874314e7a40
Instruction ID: c70a37bb83e7037f10d66dc1843a7f62631fb2bd0dc3d5b127bbccd37b9aa62e
Opcode Fuzzy Hash: bbb951a2b16f2711dff1c466f4279195bc399d60260976cf1e934874314e7a40
Instruction Fuzzy Hash: 5F21A1715143118FD710DF14D9406AABBE9AF89B46F088869E894BF244D774FA09CBD2

Function 04041380 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 70COMMON

Download Yara Rule

APIs

InterlockedDecrement.KERNEL32(?), ref: 040413E8
InterlockedIncrement.KERNEL32(?), ref: 04041404

Strings

`ruru, xrefs: 040413E8

Memory Dump Source

Source File: 00000014.00000002.2502041842.0000000004031000.00000020.00000001.01000000.00000017.sdmp, Offset: 04030000, based on PE: true

Associated: 00000014.00000002.2501986218.0000000004030000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000014.00000002.2504208079.0000000004079000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000014.00000002.2504943590.0000000004086000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000014.00000002.2505148754.000000000408E000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000014.00000002.2505282171.0000000004090000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000014.00000002.2505501725.0000000004097000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_4030000_Picasa3.jbxd

Similarity

API ID: Interlocked$DecrementIncrement
String ID: `ruru
API String ID: 2172605799-999165909
Opcode ID: 112b0a80d602b5f4a3efedb2388d240223238bd70e01adce86eefac1d1260e92
Instruction ID: 2e9cd26ae40e4ee63e49f30920c65eb200394891ee12d39caa60434ef4fdd9c7
Opcode Fuzzy Hash: 112b0a80d602b5f4a3efedb2388d240223238bd70e01adce86eefac1d1260e92
Instruction Fuzzy Hash: 9E11B1F26152155BE750DE18D808B6F73E4EFC1311F00893AF491EF641EB38F9819652

Function 0483C400 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 67COMMON

Download Yara Rule

APIs

InterlockedIncrement.KERNEL32(?), ref: 0483C444
InterlockedIncrement.KERNEL32(00000005), ref: 0483C47E

Strings

Personal, xrefs: 0483C486

Memory Dump Source

Source File: 00000014.00000002.2526268174.00000000047E1000.00000020.00000001.01000000.00000016.sdmp, Offset: 047E0000, based on PE: true

Associated: 00000014.00000002.2526187657.00000000047E0000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000014.00000002.2533437740.000000000488F000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000014.00000002.2535246598.00000000048AB000.00000004.00000001.01000000.00000016.sdmpDownload File
Associated: 00000014.00000002.2535569716.00000000048B3000.00000008.00000001.01000000.00000016.sdmpDownload File
Associated: 00000014.00000002.2535640427.00000000048B5000.00000004.00000001.01000000.00000016.sdmpDownload File
Associated: 00000014.00000002.2536317728.00000000048C0000.00000002.00000001.01000000.00000016.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_47e0000_Picasa3.jbxd

Similarity

API ID: IncrementInterlocked
String ID: Personal
API String ID: 3508698243-150736850
Opcode ID: 4d1397b505bda77595b2da3fe819b8762f4a2699bdd32f4f8f7b3751ede56fbb
Instruction ID: 0aa2ecc3b6447b9a68ac86a278924682f43e7d0b5312d7117aa18ea102b16ac8
Opcode Fuzzy Hash: 4d1397b505bda77595b2da3fe819b8762f4a2699bdd32f4f8f7b3751ede56fbb
Instruction Fuzzy Hash: 6B21BB722043448FE725CB28D991BBA7BE1AF81305F448E68E586DB298D738B804C792

Function 04031940 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 60COMMON

Download Yara Rule

APIs

InterlockedIncrement.KERNEL32(?), ref: 04031973
InterlockedIncrement.KERNEL32(?), ref: 040319AC

Part of subcall function 04031000: InterlockedDecrement.KERNEL32(00000000), ref: 04031012
Part of subcall function 04031000: InterlockedIncrement.KERNEL32(00000000), ref: 0403102E

Strings

ru, xrefs: 04031944

Memory Dump Source

Source File: 00000014.00000002.2502041842.0000000004031000.00000020.00000001.01000000.00000017.sdmp, Offset: 04030000, based on PE: true

Associated: 00000014.00000002.2501986218.0000000004030000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000014.00000002.2504208079.0000000004079000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000014.00000002.2504943590.0000000004086000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000014.00000002.2505148754.000000000408E000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000014.00000002.2505282171.0000000004090000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000014.00000002.2505501725.0000000004097000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_4030000_Picasa3.jbxd

Similarity

API ID: Interlocked$Increment$Decrement
String ID: ru
API String ID: 4289621856-1355688448
Opcode ID: b847ae6da327b784d06f34747e21c5dc97bf9e07faa5e113d2bce806844b26a4
Instruction ID: bcbb693974337c51c3f508c853799f2fd48f3bdd3626011c655268989c63e5dc
Opcode Fuzzy Hash: b847ae6da327b784d06f34747e21c5dc97bf9e07faa5e113d2bce806844b26a4
Instruction Fuzzy Hash: 1911BF316006118FD720EF29D48076ABBE9AF8970AF44496DE4C9EB644C738F8198BA1

Function 0403CF80 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 59COMMON

Download Yara Rule

APIs

InterlockedDecrement.KERNEL32(?), ref: 0403CFCC
InterlockedIncrement.KERNEL32(?), ref: 0403CFE8

Part of subcall function 0403D230: InterlockedDecrement.KERNEL32(?), ref: 0403D279
Part of subcall function 0403D230: InterlockedIncrement.KERNEL32(?), ref: 0403D291
Part of subcall function 0403D230: InterlockedDecrement.KERNEL32(?), ref: 0403D2CE
Part of subcall function 0403D230: InterlockedIncrement.KERNEL32(?), ref: 0403D2E6

Strings

`ruru, xrefs: 0403CFCC

Memory Dump Source

Source File: 00000014.00000002.2502041842.0000000004031000.00000020.00000001.01000000.00000017.sdmp, Offset: 04030000, based on PE: true

Associated: 00000014.00000002.2501986218.0000000004030000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000014.00000002.2504208079.0000000004079000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000014.00000002.2504943590.0000000004086000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000014.00000002.2505148754.000000000408E000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000014.00000002.2505282171.0000000004090000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000014.00000002.2505501725.0000000004097000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_4030000_Picasa3.jbxd

Similarity

API ID: Interlocked$DecrementIncrement
String ID: `ruru
API String ID: 2172605799-999165909
Opcode ID: cbbfee68e36c0d605161dad1642ab05f986a71e6450244e731d14d1b2a3f282e
Instruction ID: 5ebfd6632f9ad707ae0773c70b15e2fca9ad1abdda5d0c08e3900d77cdf3a0b2
Opcode Fuzzy Hash: cbbfee68e36c0d605161dad1642ab05f986a71e6450244e731d14d1b2a3f282e
Instruction Fuzzy Hash: 5811E0F75002525FF7205F14E89476ABFA8EF41716F248528F842BB241E739BA11A791

Function 0403D340 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 55COMMON

Download Yara Rule

APIs

InterlockedDecrement.KERNEL32(?), ref: 0403D379
InterlockedIncrement.KERNEL32(?), ref: 0403D390

Strings

ru, xrefs: 0403D390

Memory Dump Source

Source File: 00000014.00000002.2502041842.0000000004031000.00000020.00000001.01000000.00000017.sdmp, Offset: 04030000, based on PE: true

Associated: 00000014.00000002.2501986218.0000000004030000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000014.00000002.2504208079.0000000004079000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000014.00000002.2504943590.0000000004086000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000014.00000002.2505148754.000000000408E000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000014.00000002.2505282171.0000000004090000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000014.00000002.2505501725.0000000004097000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_4030000_Picasa3.jbxd

Similarity

API ID: Interlocked$DecrementIncrement
String ID: ru
API String ID: 2172605799-1355688448
Opcode ID: 22d5adb676334e3b10f186590c8c6f3cd26eb786ad0d22360803c9217d5a8c5c
Instruction ID: a93c15ac38c4067ef8902dbb02b17c9cd351fb7ea8dce73c5fe44ee0695ef1be
Opcode Fuzzy Hash: 22d5adb676334e3b10f186590c8c6f3cd26eb786ad0d22360803c9217d5a8c5c
Instruction Fuzzy Hash: 9F11A1B2A002525FE7209E14D884BAEBF9DEF41316F154425E881BB255E72CBA149791

Function 04033F50 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 54COMMON

Download Yara Rule

APIs

InterlockedDecrement.KERNEL32(?), ref: 04033F85
InterlockedIncrement.KERNEL32(?), ref: 04033F9D

Strings

ru, xrefs: 04033F9D

Memory Dump Source

Source File: 00000014.00000002.2502041842.0000000004031000.00000020.00000001.01000000.00000017.sdmp, Offset: 04030000, based on PE: true

Associated: 00000014.00000002.2501986218.0000000004030000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000014.00000002.2504208079.0000000004079000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000014.00000002.2504943590.0000000004086000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000014.00000002.2505148754.000000000408E000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000014.00000002.2505282171.0000000004090000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000014.00000002.2505501725.0000000004097000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_4030000_Picasa3.jbxd

Similarity

API ID: Interlocked$DecrementIncrement
String ID: ru
API String ID: 2172605799-1355688448
Opcode ID: 37c626c99e8cec8bb487c76f3ab67f6c75aa0628898068e9752f10bb9c5f09c8
Instruction ID: 4c4c79e2dcc7bfa5d0427a40573d67c59ac1877d9d6878ffb82193e0cbb072e4
Opcode Fuzzy Hash: 37c626c99e8cec8bb487c76f3ab67f6c75aa0628898068e9752f10bb9c5f09c8
Instruction Fuzzy Hash: EB0100B39002524FE7209E14DC8477EFFADEF02316F500925FD02AB150E738BA05AB91

Function 040412C0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 52COMMONLIBRARYCODE

Download Yara Rule

APIs

__vsnprintf_c.LIBCMT ref: 040412ED

Part of subcall function 040630D7: __vsnprintf_helper.LIBCMT ref: 040630EE

InterlockedIncrement.KERNEL32(?), ref: 04041337

Strings

ru, xrefs: 04041337

Memory Dump Source

Source File: 00000014.00000002.2502041842.0000000004031000.00000020.00000001.01000000.00000017.sdmp, Offset: 04030000, based on PE: true

Associated: 00000014.00000002.2501986218.0000000004030000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000014.00000002.2504208079.0000000004079000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000014.00000002.2504943590.0000000004086000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000014.00000002.2505148754.000000000408E000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000014.00000002.2505282171.0000000004090000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000014.00000002.2505501725.0000000004097000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_4030000_Picasa3.jbxd

Similarity

API ID: IncrementInterlocked__vsnprintf_c__vsnprintf_helper
String ID: ru
API String ID: 2874577754-1355688448
Opcode ID: 6a979b99afc7a9461aacd159549cb1f6cce207b5023f33a8af49238445df066a
Instruction ID: daf0271d68f2d0ef59d0070f3de74a3232c9313bb7a9c748151fee55c2da8c3f
Opcode Fuzzy Hash: 6a979b99afc7a9461aacd159549cb1f6cce207b5023f33a8af49238445df066a
Instruction Fuzzy Hash: E41182B22043419BE760DF20C4457EF77D5AFC8349F044C39E2D6AA540DBB8A88487A2

Function 033B1230 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 49memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 033B9790: MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,000000FF,00000000,00000000,?,?,00000000,?,033B66F2,?), ref: 033B97BF
Part of subcall function 033B9790: MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,000000FF,-00000004,00000000,?,00000000,00000000,?,?,00000000,?,033B66F2,?), ref: 033B97EC

SysFreeString.OLEAUT32(00000000), ref: 033B1284
SysAllocString.OLEAUT32(?), ref: 033B1293

Strings

`cu, xrefs: 033B1284

Memory Dump Source

Source File: 00000014.00000002.2494020967.00000000033B1000.00000020.00000001.01000000.00000015.sdmp, Offset: 033B0000, based on PE: true

Associated: 00000014.00000002.2493917908.00000000033B0000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000014.00000002.2497615129.00000000033F3000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000014.00000002.2498110795.0000000003400000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000014.00000002.2498410969.0000000003406000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000014.00000002.2498556459.0000000003408000.00000008.00000001.01000000.00000015.sdmpDownload File
Associated: 00000014.00000002.2498718201.000000000340A000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000014.00000002.2499166516.0000000003411000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_33b0000_Picasa3.jbxd

Similarity

API ID: ByteCharMultiStringWide$AllocFree
String ID: `cu
API String ID: 447844807-4120539311
Opcode ID: 0cc9e8f075142aa470d529a7b65053666d961b14ced99628a8fdc8d069c2e664
Instruction ID: a71e3d72be20ffae2715e6e495aec701829e592e28b168683444e7b63e9e1b16
Opcode Fuzzy Hash: 0cc9e8f075142aa470d529a7b65053666d961b14ced99628a8fdc8d069c2e664
Instruction Fuzzy Hash: 9701D43AA002115BC710DA7ACCD9B87B7ACEF85370F188529FA44DF284CB31D800C6A0

Function 0487259D Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 41COMMONLIBRARYCODE

Download Yara Rule

APIs

_strlen.LIBCMT ref: 048725A5

Strings

I, xrefs: 048725DA
minsize, xrefs: 048725A3

Memory Dump Source

Source File: 00000014.00000002.2526268174.00000000047E1000.00000020.00000001.01000000.00000016.sdmp, Offset: 047E0000, based on PE: true

Associated: 00000014.00000002.2526187657.00000000047E0000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000014.00000002.2533437740.000000000488F000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000014.00000002.2535246598.00000000048AB000.00000004.00000001.01000000.00000016.sdmpDownload File
Associated: 00000014.00000002.2535569716.00000000048B3000.00000008.00000001.01000000.00000016.sdmpDownload File
Associated: 00000014.00000002.2535640427.00000000048B5000.00000004.00000001.01000000.00000016.sdmpDownload File
Associated: 00000014.00000002.2536317728.00000000048C0000.00000002.00000001.01000000.00000016.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_47e0000_Picasa3.jbxd

Similarity

API ID: _strlen
String ID: I$minsize
API String ID: 4218353326-3692596403
Opcode ID: b5064b06f67165edf720b06c6d5e6ea689afa8835003341013f826279d79d5b6
Instruction ID: 6efd9e3471a592b13c7d19da19fd6c898a1aeda39bdcfb9063294acc8461b607
Opcode Fuzzy Hash: b5064b06f67165edf720b06c6d5e6ea689afa8835003341013f826279d79d5b6
Instruction Fuzzy Hash: ABF0AFB1C00109ABDF106FA98C118AEBBB9FF44328F10472BF824E6180E674E551DBA6

Function 0403DB90 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 40threadCOMMON

Download Yara Rule

APIs

InterlockedCompareExchange.KERNEL32(?,00000000,00000000), ref: 0403DB9B
SetThreadPriority.KERNEL32(?), ref: 0403DBF2

Strings

0Mru, xrefs: 0403DB9B

Memory Dump Source

Source File: 00000014.00000002.2502041842.0000000004031000.00000020.00000001.01000000.00000017.sdmp, Offset: 04030000, based on PE: true

Associated: 00000014.00000002.2501986218.0000000004030000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000014.00000002.2504208079.0000000004079000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000014.00000002.2504943590.0000000004086000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000014.00000002.2505148754.000000000408E000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000014.00000002.2505282171.0000000004090000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000014.00000002.2505501725.0000000004097000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_4030000_Picasa3.jbxd

Similarity

API ID: CompareExchangeInterlockedPriorityThread
String ID: 0Mru
API String ID: 315362132-2487986153
Opcode ID: 82c7524fb70305225d97200944954f30445f49568e9ce80ccbfe9d7089918467
Instruction ID: 917a626884e36fbe1614e3a63a6dc095626ac4bf14a984e0f9370d459a1ca0d4
Opcode Fuzzy Hash: 82c7524fb70305225d97200944954f30445f49568e9ce80ccbfe9d7089918467
Instruction Fuzzy Hash: B0018BB1A15710DBD7A4DF25D804B9BBBECAF40712F0049ADA451E7280E730F844C791

Function 04802690 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 36COMMON

Download Yara Rule

APIs

GetSysColor.USER32(0000000F), ref: 048026EC
CreateSolidBrush.GDI32(00000000), ref: 048026F3

Strings

PrintsPrefs, xrefs: 048026B3

Memory Dump Source

Source File: 00000014.00000002.2526268174.00000000047E1000.00000020.00000001.01000000.00000016.sdmp, Offset: 047E0000, based on PE: true

Associated: 00000014.00000002.2526187657.00000000047E0000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000014.00000002.2533437740.000000000488F000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000014.00000002.2535246598.00000000048AB000.00000004.00000001.01000000.00000016.sdmpDownload File
Associated: 00000014.00000002.2535569716.00000000048B3000.00000008.00000001.01000000.00000016.sdmpDownload File
Associated: 00000014.00000002.2535640427.00000000048B5000.00000004.00000001.01000000.00000016.sdmpDownload File
Associated: 00000014.00000002.2536317728.00000000048C0000.00000002.00000001.01000000.00000016.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_47e0000_Picasa3.jbxd

Similarity

API ID: BrushColorCreateSolid
String ID: PrintsPrefs
API String ID: 2798526982-203912700
Opcode ID: 89cdb78ecc4c8f12fc9d461966dfdc02f85acc872957036f0ea2b038ae6b54c6
Instruction ID: 1b0c70c7e21e281a6530cd20f99c2b494759b2635eff342c878b298bed604b93
Opcode Fuzzy Hash: 89cdb78ecc4c8f12fc9d461966dfdc02f85acc872957036f0ea2b038ae6b54c6
Instruction Fuzzy Hash: F5019CB1505B418FD320DF6A9580446FBF4FF696007949E2ED5DA87B02C374B948CF65

Function 04031000 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 29COMMONLIBRARYCODE

Download Yara Rule

APIs

InterlockedDecrement.KERNEL32(00000000), ref: 04031012
InterlockedIncrement.KERNEL32(00000000), ref: 0403102E

Strings

`ruru, xrefs: 04031012

Memory Dump Source

Source File: 00000014.00000002.2502041842.0000000004031000.00000020.00000001.01000000.00000017.sdmp, Offset: 04030000, based on PE: true

Associated: 00000014.00000002.2501986218.0000000004030000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000014.00000002.2504208079.0000000004079000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000014.00000002.2504943590.0000000004086000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000014.00000002.2505148754.000000000408E000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000014.00000002.2505282171.0000000004090000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000014.00000002.2505501725.0000000004097000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_4030000_Picasa3.jbxd

Similarity

API ID: Interlocked$DecrementIncrement
String ID: `ruru
API String ID: 2172605799-999165909
Opcode ID: 858e2b9636786826866dd2e78aa9837278578a666b8e1b17ebfb61406fde1eb9
Instruction ID: 4877af9b7470f6d68f56868e6c13c187a688f3adc5cc9cd1097c7e427aad2b8b
Opcode Fuzzy Hash: 858e2b9636786826866dd2e78aa9837278578a666b8e1b17ebfb61406fde1eb9
Instruction Fuzzy Hash: DDF0E5B14001F207F7712F15D4A077F3F9EAF06302F240831E591BD045EB6CA8415A95

Function 04031550 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 25COMMON

Download Yara Rule

APIs

InterlockedCompareExchange.KERNEL32(?,00000000,00000000), ref: 0403155D
InterlockedExchange.KERNEL32(?,00000001), ref: 04031577

Strings

0Mru, xrefs: 0403155D

Memory Dump Source

Source File: 00000014.00000002.2502041842.0000000004031000.00000020.00000001.01000000.00000017.sdmp, Offset: 04030000, based on PE: true

Associated: 00000014.00000002.2501986218.0000000004030000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000014.00000002.2504208079.0000000004079000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000014.00000002.2504943590.0000000004086000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000014.00000002.2505148754.000000000408E000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000014.00000002.2505282171.0000000004090000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000014.00000002.2505501725.0000000004097000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_4030000_Picasa3.jbxd

Similarity

API ID: ExchangeInterlocked$Compare
String ID: 0Mru
API String ID: 3167933728-2487986153
Opcode ID: dc9f55dfcfdd0588a543d50779ea8960e4f48fb7bcdfa2a7a5c79e15cf9dc0d3
Instruction ID: 53c349c40ba7ef7997cdc02d37d882ecd907aa8ffce74e00b378201ec01be0ee
Opcode Fuzzy Hash: dc9f55dfcfdd0588a543d50779ea8960e4f48fb7bcdfa2a7a5c79e15cf9dc0d3
Instruction Fuzzy Hash: 35E012353401109BE610DF15DC49FAAB7A9EBC9B51F118018F345AB2D0C7A5E802CBD1

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may move onto systems, possibly those on disconnected or air-gapped networks, by copying malware to removable media and taking advantage of Autorun features when the media is inserted into a system and executes. In the case of Lateral Movement, this may occur through modification of executable files stored on removable media or by copying malware and renaming it to look like a legitimate file to trick users into executing it on a separate system. In the case of Initial Access, this may occur through manual manipulation of the media, modification of systems used to initially format the media, or modification to the media's firmware itself.
Tactics:	Initial Access, Lateral Movement
Data Sources:	Drive: Drive Creation, File: File Access, File: File Creation, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.
Tactics:	Execution
Data Sources:	Application Log: Application Log Content, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may create or modify Windows services to repeatedly execute malicious payloads as part of persistence. When Windows boots up, it starts programs or applications called services that perform background system functions.Windows service configuration information, including the file path to the service's executable or recovery programs/commands, is stored in the Windows Registry.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Driver: Driver Load, File: File Metadata, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Creation, Service: Service Creation, Service: Service Modification, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. Windows uses access tokens to determine the ownership of a running process. A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the process. When this occurs, the process also takes on the security context associated with the new token.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Active Directory: Active Directory Object Modification, Command: Command Execution, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, User Account: User Account Metadata
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to hide configuration information within Registry keys, remove information as part of cleaning up, or as part of other techniques to aid in persistence and execution.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse rundll32.exe to proxy execution of malicious code. Using rundll32.exe, vice executing directly (i.e. Shared Modules ), may avoid triggering security tools that may not monitor execution of the rundll32.exe process because of allowlists or false positives from normal operations. Rundll32.exe is commonly associated with executing DLL payloads (ex: `rundll32.exe {DLLname, DLLfunction}` ).
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to gather information about attached peripheral devices and components connected to a computer system.Peripheral devices could include auxiliary resources that support a variety of functionalities such as keyboards, printers, cameras, smart card readers, or removable storage. The information may be used to enhance their awareness of the system and network environment or may be used for further actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 563299efce875400a8d9b44b96597c8e-sample (1).zip

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

Cryptography

Phishing

Compliance

Spreading

Software Vulnerabilities

Networking

Spam, unwanted Advertisements and Ransom Demands

DDoS

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Program Files (x86)\Google\Picasa3\MovieThumb.exe

C:\Program Files (x86)\Google\Picasa3\Picasa3.exe

C:\Program Files (x86)\Google\Picasa3\Picasa3i18n.dll

C:\Program Files (x86)\Google\Picasa3\PicasaPhotoViewer.exe

C:\Program Files (x86)\Google\Picasa3\buttons\core-lh2.pbz

C:\Program Files (x86)\Google\Picasa3\buttons\geotag.pbz

C:\Program Files (x86)\Google\Picasa3\cdautorun\Download Picasa.url

C:\Program Files (x86)\Google\Picasa3\cdautorun\Picasa CD Slideshow.app\Contents\Frameworks\GoogleBreakpad.framework\GoogleBreakpad

C:\Program Files (x86)\Google\Picasa3\cdautorun\Picasa CD Slideshow.app\Contents\Frameworks\GoogleBreakpad.framework\Resources

C:\Program Files (x86)\Google\Picasa3\cdautorun\Picasa CD Slideshow.app\Contents\Frameworks\GoogleBreakpad.framework\Versions\A\GoogleBreakpad

C:\Program Files (x86)\Google\Picasa3\cdautorun\Picasa CD Slideshow.app\Contents\Frameworks\GoogleBreakpad.framework\Versions\A\Resources\Info.plist

C:\Program Files (x86)\Google\Picasa3\cdautorun\Picasa CD Slideshow.app\Contents\Frameworks\GoogleBreakpad.framework\Versions\A\Resources\Inspector

C:\Program Files (x86)\Google\Picasa3\cdautorun\Picasa CD Slideshow.app\Contents\Frameworks\GoogleBreakpad.framework\Versions\A\Resources\Reporter.app\Contents\Info.plist

C:\Program Files (x86)\Google\Picasa3\cdautorun\Picasa CD Slideshow.app\Contents\Frameworks\GoogleBreakpad.framework\Versions\A\Resources\Reporter.app\Contents\MacOS\Reporter

Windows Analysis Report
563299efce875400a8d9b44b96597c8e-sample (1).zip

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre